Industrial control firewall performance test evaluation method, device, equipment and storage medium

Abstract

The present invention provides an industrial control firewall performance test and evaluation method, device, equipment and storage medium, the method comprising: determining an industrial control business stage corresponding to the industrial control firewall state; determining a business expected result corresponding to the industrial control business stage; and performing industrial control firewall performance test and evaluation in stages for the industrial control protocols involved according to the industrial control business stage and the business expected result corresponding to the industrial control business stage. The present invention combines the business characteristics of the industrial control firewall performance test and evaluation, and performs industrial control firewall performance test and evaluation in stages for the industrial control protocols involved according to the industrial control business stage corresponding to the industrial control firewall and the business expected result corresponding to the industrial control business stage, so that the performance of the industrial control firewall can be evaluated more effectively and targetedly, thereby making up for the shortcomings of the evaluation means of the traditional application-level firewall.

Description

Technical Field

[0001] The present invention relates to the field of network communication technology, and in particular to an industrial control firewall performance test and evaluation method, device, equipment and storage medium. Background Art

[0002] With the development of the Internet in depth and breadth, traditional firewalls have begun to be replaced by industrial control firewalls in the border access control of the industrial control field.

[0003] The industrial control field has strict business requirements for throughput and latency. Therefore, in the test and evaluation of industrial control firewalls, the performance of the equipment is one of the most important evaluation items. Traditional Internet application-level firewalls already have mature performance evaluation test methods. However, compared with traditional Internet application-level firewalls, there are many differences in the business of industrial control firewalls. Therefore, it is impossible to continue to use the performance evaluation test methods of traditional Internet application-level firewalls. Summary of the invention

[0004] In view of the problems in the prior art, the embodiments of the present invention provide an industrial control firewall performance test and evaluation method, device, equipment and storage medium.

[0005] Specifically, the embodiment of the present invention provides the following technical solutions:

[0006] In a first aspect, an embodiment of the present invention provides a method for testing and evaluating the performance of an industrial control firewall.

[0007] Determine the industrial control business stage corresponding to the industrial control firewall status;

[0008] Determine the expected business results corresponding to the industrial control business stage;

[0009] According to the industrial control business stage and the expected business results corresponding to the industrial control business stage, the industrial control firewall performance test and evaluation are carried out in stages for the industrial control protocols involved.

[0010] Furthermore, the industrial control business stage corresponding to the industrial control firewall state includes: one or more of an unstarted industrial control stage, a learning stage, a log stage, and a protection stage;

[0011] Among them, the non-industrial control stage refers to: the stage where the industrial control firewall is not turned on; the learning stage refers to: the industrial control firewall is in a preparation state, learning the industrial control in the network to determine the industrial control strategy that needs to be issued; the log stage refers to: the industrial control firewall is in a pre-application state, releasing traffic, recording logs for all traffic, and issuing alarms for illegal traffic; the protection stage refers to: the industrial control firewall is in use, recording logs for all traffic, and blocking all illegal traffic.

[0012] Further, the expected business results corresponding to the industrial control business stage are determined, including one or more of the following:

[0013] A. Determine the expected business results corresponding to the unstarted industrial control stage, including:

[0014] A1: For industrial control throughput services, the expected service results include: normal transmission without packet loss, complete industrial control log records without loss, and normal security policy functions;

[0015] A2: For new industrial control services, the expected results include: taking the minimum load function code of the industrial control protocol object involved as the benchmark data, testing the maximum capacity of new industrial control connections per second, testing no packet loss, no parsing log loss, and recording the maximum new capacity;

[0016] A3: For industrial control concurrent services, the expected results include: using the minimum load function code of the industrial control protocol object involved as the benchmark data, constructing the test protocol long connection object, request and response, respectively establishing the maximum concurrent connection capacity of the test equipment, testing without packet loss, parsing logs without loss, and recording the maximum concurrent connection capacity;

[0017] B. Determine the expected business results corresponding to the learning stage, including:

[0018] B1: For industrial control throughput services, the expected service results include: industrial control services pass normally without packet loss, industrial control service latency meets requirements, rule learning is complete without loss, and industrial control log records are complete without loss;

[0019] B2: For new industrial control services, the expected results include: taking the minimum load function code of the industrial control protocol object involved as the benchmark data, testing the maximum capacity of new industrial control connections per second, testing no packet loss, no loss of parsed logs, and recording the maximum new capacity;

[0020] B3: For industrial control concurrent services, the expected results include: using the minimum load function code of the industrial control protocol object involved as the benchmark data, constructing the test protocol long connection object, request and response, respectively establishing the maximum concurrent connection capacity of the test equipment, testing without packet loss, parsing logs without loss, and recording the maximum concurrent connection capacity;

[0021] C. Determining the expected business results corresponding to the log stage includes:

[0022] C1: For industrial control throughput services, the expected service results include: the industrial control services pass normally without packet loss, the industrial control service latency meets the requirements, and the industrial control log records are complete without loss, including normal industrial control traffic and illegal industrial control traffic;

[0023] C2: For new industrial control services, the expected results include: taking the minimum load function code of the industrial control protocol object involved as the benchmark data, testing the maximum capacity of new industrial control connections per second, testing no packet loss, no loss of parsed logs, and recording the maximum new capacity;

[0024] C3: For industrial control concurrent services, the expected results include: using the minimum load function code of the industrial control protocol object involved as the benchmark data, constructing the test protocol long connection object, request and response, respectively establishing the maximum concurrent connection capacity of the test equipment, testing without packet loss, parsing logs without loss, and recording the maximum concurrent connection capacity;

[0025] D. Determine the expected business results corresponding to the protection stage, including:

[0026] D1: For industrial control throughput services, the expected service results include: industrial control services are passed normally without packet loss, industrial control services meet latency requirements, industrial control illegal services cannot pass, and industrial control log records are complete without loss, including normal industrial control traffic and illegal industrial control traffic;

[0027] D2: For new industrial control services, the expected results include: taking the minimum load function code of the industrial control protocol object involved as the benchmark data, testing the maximum capacity of new industrial control connections per second, testing no packet loss, no loss of parsed logs, and recording the maximum new capacity;

[0028] D3: For industrial control concurrent services, the expected results include: using the minimum load function code of the industrial control protocol object involved as the benchmark data, constructing the test protocol long connection object, request and response, respectively establishing the maximum concurrent connection capacity of the test equipment, testing without packet loss, parsing logs without loss, and recording the maximum concurrent connection capacity.

[0029] Furthermore, according to the industrial control business stage and the expected business results corresponding to the industrial control business stage, the industrial control firewall performance test and evaluation are carried out in stages for the industrial control protocols involved, including:

[0030] For the industrial control protocol involved, determine a performance evaluation traffic model corresponding to the industrial control protocol;

[0031] In the learning phase, a performance test is performed based on the performance evaluation traffic model, and no packet loss is confirmed during the performance test, and it is determined that the traffic reaches the limit value of no packet loss. After the test is completed, the number of industrial control logs and the number of industrial control rules are recorded, and it is determined whether the number of logs and the number of rules are accurate; and the industrial control service delay is recorded, and the actual delay is determined based on the test delay and the industrial control service delay;

[0032] In the log phase, a performance test is performed based on the performance evaluation traffic model, and no packet loss is confirmed during the performance test, and it is determined that the traffic reaches the limit value of no packet loss. After the test is completed, the number of industrial control logs, normal logs and violation logs are recorded, and it is determined whether the number of logs is accurate; and the industrial control service delay is recorded, and the actual delay is determined based on the test delay and the industrial control service delay;

[0033] In the protection stage, a performance test is performed based on the performance evaluation traffic model, and traffic packets are confirmed during the performance test, and it is determined that the traffic reaches the limit value of normal packets. After the test is completed, the number of industrial control logs, normal logs and violation logs are recorded, and it is determined whether the number of logs is accurate; and the industrial control business delay is recorded, and the actual delay is determined based on the test delay and the industrial control business delay.

[0034] Furthermore, for the industrial control protocol involved, a performance evaluation traffic model corresponding to the industrial control protocol is determined, including:

[0035] If the industrial control protocol involved is IEC104, the content of the performance evaluation traffic model corresponding to the industrial control protocol is determined to include: TCP / UDP typical operation codes in one connection; Layer 2 protocol, sequential traversal protocol operation codes; source destination IP or source destination MAC changes;

[0036] The performance evaluation traffic model corresponds to a first preset ratio of normal and legal packets in the learning phase; and corresponds to a second preset ratio of normal and legal packets + a third preset ratio of illegal packets in the logging phase and the protection phase.

[0037] In a second aspect, an embodiment of the present invention further provides an industrial control firewall performance test and evaluation device, comprising:

[0038] A first determination module is used to determine the industrial control business stage corresponding to the industrial control firewall state;

[0039] A second determination module is used to determine the expected business result corresponding to the industrial control business stage;

[0040] The test and evaluation module is used to perform industrial control firewall performance test and evaluation in stages according to the industrial control business stage and the expected business results corresponding to the industrial control business stage, targeting the industrial control protocols involved.

[0041] Furthermore, the industrial control business stage corresponding to the industrial control firewall includes: one or more of an unstarted industrial control stage, a learning stage, a log stage, and a protection stage;

[0042] Among them, the non-industrial control stage refers to: the stage where the industrial control firewall is not turned on; the learning stage refers to: the industrial control firewall is in a preparation state, learning the industrial control in the network to determine the industrial control strategy that needs to be issued; the log stage refers to: the industrial control firewall is in a pre-application state, releasing traffic, recording logs for all traffic, and issuing alarms for illegal traffic; the protection stage refers to: the industrial control firewall is in use, recording logs for all traffic, and blocking all illegal traffic.

[0043] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the industrial control firewall performance test and evaluation method as described in the first aspect are implemented.

[0044] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the industrial control firewall performance test and evaluation method as described in the first aspect.

[0045] In a fifth aspect, an embodiment of the present invention further provides a computer program product, the computer program product comprising a computer program, which, when executed by a processor, implements the steps of the industrial control firewall performance test and evaluation method as described in the first aspect.

[0046] It can be seen from the above technical scheme that the industrial control firewall performance test and evaluation method, device, equipment and storage medium provided in the embodiment of the present invention first determine the industrial control business stage corresponding to the industrial control firewall status, then determine the expected business results corresponding to the industrial control business stage, and then according to the industrial control business stage and the expected business results corresponding to the industrial control business stage, for the industrial control protocol involved, the industrial control firewall performance test and evaluation are performed in stages. It can be seen that the embodiment of the present invention combines the business characteristics of the industrial control firewall performance test and evaluation, according to the industrial control business stage corresponding to the industrial control firewall and the expected business results corresponding to the industrial control business stage, for the industrial control protocol involved, the industrial control firewall performance test and evaluation are performed in stages, so that the performance of the industrial control firewall can be evaluated more effectively and targetedly, thereby making up for the shortcomings of the evaluation means of traditional application-level firewalls. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0048] Figure 1 A flowchart of a method for testing and evaluating the performance of an industrial control firewall provided by an embodiment of the present invention;

[0049] Figure 2 A schematic diagram of the main use phases of the business core process of the industrial control firewall provided by an embodiment of the present invention;

[0050] Figure 3 A schematic diagram of the structure of an industrial control firewall performance test and evaluation device provided by an embodiment of the present invention;

[0051] Figure 4 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0053] The industrial control field has strict business requirements for throughput and latency. Therefore, in the test and evaluation of industrial control firewalls, the performance of the equipment is one of the most important evaluation items. Traditional Internet application-level firewalls already have mature performance evaluation test methods, such as: 1. 21KB throughput; 2. New application layer; 3. Connection concurrency; 4. 2544 standard. However, compared with traditional Internet application-level firewalls, the business of industrial control firewalls has many differences, so it is impossible to continue to use the performance evaluation test methods of traditional Internet application-level firewalls.

[0054] For example, for the business of industrial control firewalls, compared with traditional Internet application-level firewalls, there are the following differences: the traffic model is completely different; the model of the traditional evaluation method is inconsistent with the industrial control field; the protocol content is brand new; the traditional evaluation method does not consider the special application of the industrial control protocol scenario. The industrial control protocol is the main traffic, and the industrial control wall often occupies a large amount of resources when processing this business; there are business-level delay requirements; the traditional evaluation model does not consider the application-level delay, but only considers the network IP packet delay; the application function scenarios are different; the traditional evaluation method does not consider the diversity of application modes of industrial control firewalls. In response to this problem, the present invention proposes a special performance test evaluation method for industrial control firewalls. The industrial control firewall performance test evaluation method provided by the present invention will be described in detail through specific embodiments.

[0055] Figure 1 The flowchart of the industrial control firewall performance test and evaluation method provided by the embodiment of the present invention is shown. Figure 1 As shown, the industrial control firewall performance test and evaluation method provided by the embodiment of the present invention specifically includes the following steps:

[0056] Step 101: Determine the industrial control service stage corresponding to the industrial control firewall state;

[0057] In this step, the business characteristics of the industrial control firewall performance test and evaluation are combined to divide the industrial control business stages corresponding to the industrial control firewall into a learning stage, a logging stage, and a protection stage. Among them, the learning stage: corresponds to the preparation stage, starting to learn the industrial control in the network to determine the industrial control strategy that needs to be issued; the logging stage: corresponds to the pre-application state, traffic is released, logs are recorded for all traffic, and alarms are issued for illegal traffic; the protection stage: corresponds to the final use state, logs are recorded for all traffic, and all illegal traffic is blocked. Step 102: Determine the expected business results corresponding to the industrial control business stage;

[0058] In this step, the focus of the industrial control firewall performance test evaluation is on the industrial control performance test result standard. In this embodiment, the business focus results include: industrial control is not turned on: the same as the traditional application-level firewall results, no packet loss, accurate logs, and normal security policy functions; learning stage: industrial control business passes normally without packet loss, industrial control business latency meets the requirements, industrial control business is issued and responded in time, rule learning is complete without loss, and industrial control log records are complete without loss; log stage: industrial control business passes normally without packet loss, industrial control business latency meets the requirements, industrial control business is issued and responded in time, industrial control log records are complete without loss, including normal industrial control traffic and illegal industrial control traffic; protection stage: industrial control business passes normally without packet loss, industrial control business latency meets the requirements, industrial control business is issued and responded in time, illegal industrial control business cannot pass, and industrial control log records are complete without loss, including normal industrial control traffic and illegal industrial control traffic.

[0059] It can be seen that the detailed focus of the industrial control firewall business results is on delay, logging capability, learning capability and blocking capability. Delay includes: the delay from business initiation to response; logging capability includes: normal industrial control log, illegal industrial control log; learning capability includes: learning integrity, learning rule capacity; blocking capability includes: for example, normal traffic 99% + illegal traffic 1%, normal can pass, illegal traffic is blocked.

[0060] Step 103: According to the industrial control business stage and the expected business results corresponding to the industrial control business stage, the industrial control firewall performance test and evaluation are performed in stages for the industrial control protocols involved.

[0061] In this step, a general industrial control firewall-specific performance evaluation method is provided in combination with the business characteristics of the industrial control firewall performance test and evaluation. This embodiment performs staged testing and evaluation according to the industrial control business stage, so that the performance of the industrial control firewall can be evaluated more effectively and specifically, thereby making up for the shortcomings of the evaluation methods of traditional application-level firewalls.

[0062] It can be seen from the above technical scheme that the industrial control firewall performance test and evaluation method provided by the embodiment of the present invention first determines the industrial control business stage corresponding to the industrial control firewall state, then determines the expected business result corresponding to the industrial control business stage, and then according to the industrial control business stage and the expected business result corresponding to the industrial control business stage, for the industrial control protocol involved, the industrial control firewall performance test and evaluation are performed in stages. It can be seen that the embodiment of the present invention combines the business characteristics of the industrial control firewall performance test and evaluation, according to the industrial control business stage corresponding to the industrial control firewall and the expected business result corresponding to the industrial control business stage, for the industrial control protocol involved, the industrial control firewall performance test and evaluation are performed in stages, so that the performance of the industrial control firewall can be evaluated more effectively and targetedly, thereby making up for the shortcomings of the evaluation means of traditional application-level firewalls.

[0063] Further, based on the content of the above embodiment, in this embodiment, the industrial control business stage corresponding to the industrial control firewall includes: one or more of the unstarted industrial control stage, the learning stage, the log stage and the protection stage;

[0064] Among them, the non-industrial control stage refers to: the stage where the industrial control firewall is not turned on; the learning stage refers to: the industrial control firewall is in a preparation state, learning the industrial control in the network to determine the industrial control strategy that needs to be issued; the log stage refers to: the industrial control firewall is in a pre-application state, releasing traffic, recording logs for all traffic, and issuing alarms for illegal traffic; the protection stage refers to: the industrial control firewall is in use, recording logs for all traffic, and blocking all illegal traffic.

[0065] In this embodiment, see Figure 2 ,The performance of industrial control should be combined with the business and various ,performance results should be considered from the expected results of the business. Figure 2 It is the main use stage of the core business process of the industrial control firewall, including: before industrial control, learning stage, log stage and protection stage; among which:

[0066] Industrial control is not enabled: corresponds to the status under the traditional application-level firewall;

[0067] Learning phase: corresponds to the preparation phase, starting to learn the industrial control in the network to determine the industrial control strategy that needs to be issued;

[0068] Logging stage: pre-application state, traffic is released, all traffic is logged, and alarms are issued for illegal traffic;

[0069] Protection stage: final use state, all traffic is logged and all illegal traffic is blocked.

[0070] It can be seen that in this embodiment, the industrial control business stages corresponding to the industrial control firewall are given, including the learning stage, the log stage and the protection stage. Accordingly, this embodiment performs performance test and evaluation of the industrial control firewall in stages according to the industrial control business stages corresponding to the industrial control firewall and the expected business results corresponding to the industrial control business stages. The performance of the industrial control firewall can be evaluated in a targeted manner, thereby making up for the shortcomings of the evaluation methods of traditional application-level firewalls.

[0071] Further, based on the content of the above embodiment, in this embodiment, determining the expected business result corresponding to the industrial control business stage includes one or more of the following (referring to one or more of A, B, and C, or one or more of A1, A2, A3, B1, B2, B3, C1, C2, C3, D1, D2, and D3):

[0072] A. Determine the expected business results corresponding to the unstarted industrial control stage, including:

[0073] For industrial control throughput services, the expected service results include: normal transmission without packet loss, complete industrial control log records without loss, and normal security policy functions;

[0074] For new industrial control services, the expected results include: taking the minimum load function code of the industrial control protocol object involved as the benchmark data, testing the maximum capacity of new industrial control connections per second, testing no packet loss, no loss of parsed logs, and recording the maximum new capacity;

[0075] For industrial control concurrent services, the expected results include: using the minimum load function code of the industrial control protocol object involved as the benchmark data, constructing the test protocol long connection object, request and response, respectively establishing the maximum concurrent connection capacity of the test equipment, testing without packet loss, parsing logs without loss, and recording the maximum concurrent connection capacity;

[0076] B. Determine the expected business results corresponding to the learning stage, including:

[0077] For industrial control throughput services, the expected service results include: industrial control services pass normally without packet loss, industrial control service latency meets requirements, rule learning is complete without loss, and industrial control log records are complete without loss;

[0078] For new industrial control services, the expected results include: taking the minimum load function code of the industrial control protocol object involved as the benchmark data, testing the maximum capacity of new industrial control connections per second, testing no packet loss, no loss of parsed logs, and recording the maximum new capacity;

[0079] For industrial control concurrent services, the expected results include: using the minimum load function code of the industrial control protocol object involved as the benchmark data, constructing the test protocol long connection object, request and response, respectively establishing the maximum concurrent connection capacity of the test equipment, testing without packet loss, parsing logs without loss, and recording the maximum concurrent connection capacity;

[0080] C. Determining the expected business results corresponding to the log stage includes:

[0081] For industrial control throughput services, the expected service results include: the industrial control services pass normally without packet loss, the industrial control services latency meets the requirements, and the industrial control log records are complete without loss, including normal industrial control traffic and illegal industrial control traffic;

[0082] For new industrial control services, the expected results include: taking the minimum load function code of the industrial control protocol object involved as the benchmark data, testing the maximum capacity of new industrial control connections per second, testing no packet loss, no loss of parsed logs, and recording the maximum new capacity;

[0083] For industrial control concurrent services, the expected results include: using the minimum load function code of the industrial control protocol object involved as the benchmark data, constructing the test protocol long connection object, request and response, respectively establishing the maximum concurrent connection capacity of the test equipment, testing without packet loss, parsing logs without loss, and recording the maximum concurrent connection capacity;

[0084] D. Determine the expected business results corresponding to the protection stage, including:

[0085] For industrial control throughput services, the expected service results include: industrial control services pass normally without packet loss, industrial control services meet latency requirements, industrial control illegal services cannot pass, and industrial control log records are complete without loss, including normal industrial control traffic and illegal industrial control traffic;

[0086] For new industrial control services, the expected results include: taking the minimum load function code of the industrial control protocol object involved as the benchmark data, testing the maximum capacity of new industrial control connections per second, testing no packet loss, no loss of parsed logs, and recording the maximum new capacity;

[0087] For industrial control concurrent services, the expected business results include: using the minimum load function code of the industrial control protocol object involved as the benchmark data, constructing the test protocol long connection object, request and response, respectively establishing the maximum concurrent connection capacity of the test equipment, testing without packet loss, parsing logs without loss, and recording the maximum concurrent connection capacity at the same time.

[0088] It is understandable that the focus of the industrial control firewall performance test evaluation is on the industrial control performance test result standard. In this embodiment, for the industrial control throughput service, the service focus results include:

[0089] Before industrial control: The results are the same as those of traditional application-level firewalls, with no packet loss, accurate logs, and normal security policy functions.

[0090] Learning stage: Industrial control services are passed normally without packet loss, industrial control service latency meets requirements, industrial control services are issued and responded to in a timely manner, rule learning is complete without loss, and industrial control log records are complete without loss;

[0091] Log stage: Industrial control services are transmitted normally without packet loss, the latency of industrial control services meets the requirements, industrial control services are issued and responded to in a timely manner, and industrial control log records are complete without loss, including normal industrial control traffic and illegal industrial control traffic;

[0092] Protection stage: Industrial control services pass normally without packet loss, industrial control service latency meets requirements, industrial control services are issued and responded to in a timely manner, illegal industrial control services cannot pass, and industrial control log records are complete without loss, including normal industrial control traffic and illegal industrial control traffic.

[0093] For new industrial control services and concurrent industrial control services, the service focus results are shown in Table 1 below:

[0094] Table 1

[0095]

[0096]

[0097] It can be seen that in this embodiment, in combination with specific businesses, the expected business results corresponding to the learning stage, the log stage and the protection stage are given respectively. Accordingly, according to the industrial control business stage corresponding to the industrial control firewall and the expected business results corresponding to the industrial control business stage, the performance test and evaluation of the industrial control firewall can be carried out in stages, so that the performance of the industrial control firewall can be evaluated in a targeted manner, thereby making up for the shortcomings of the evaluation methods of traditional application-level firewalls.

[0098] Further, based on the content of the above embodiment, in this embodiment, according to the industrial control business stage and the expected business results corresponding to the industrial control business stage, the industrial control firewall performance test and evaluation are performed in stages for the industrial control protocols involved, including:

[0099] For the industrial control protocol involved, determine a performance evaluation traffic model corresponding to the industrial control protocol;

[0100] In the learning phase, a performance test is performed based on the performance evaluation traffic model, and no packet loss is confirmed during the performance test, and it is determined that the traffic reaches the limit value of no packet loss. After the test is completed, the number of industrial control logs and the number of industrial control rules are recorded, and it is determined whether the number of logs and the number of rules are accurate; and the industrial control service delay is recorded, and the actual delay is determined based on the test delay and the industrial control service delay;

[0101] In the log phase, a performance test is performed based on the performance evaluation traffic model, and no packet loss is confirmed during the performance test, and it is determined that the traffic reaches the limit value of no packet loss. After the test is completed, the number of industrial control logs, normal logs and violation logs are recorded, and it is determined whether the number of logs is accurate; and the industrial control service delay is recorded, and the actual delay is determined based on the test delay and the industrial control service delay;

[0102] In the protection stage, a performance test is performed based on the performance evaluation traffic model, and traffic packets are confirmed during the performance test, and it is determined that the traffic reaches the limit value of normal packets. After the test is completed, the number of industrial control logs, normal logs and violation logs are recorded, and it is determined whether the number of logs is accurate; and the industrial control business delay is recorded, and the actual delay is determined based on the test delay and the industrial control business delay.

[0103] In this embodiment, for different industrial control service stages and corresponding service expected results, the industrial control firewall performance test and evaluation are carried out in stages for the industrial control protocols involved. The following is an explanation from the learning stage, the log stage and the protection stage respectively.

[0104] Learning stage:

[0105] Assuming that the specific industrial control protocol involved is IEC104 (IEC refers to International Electrotechnical Commission), the performance evaluation traffic model includes: TCP / UDP (TCP refers to Transfer Control Protocol; UDP refers to User Datagram Protocol) typical operation codes in one connection, and the total connection size is about 20KB, layer 2 protocol, sequential traversal protocol operation codes, 100% normal and legal packets, source and destination IP (Internet Protocol) or source and destination MAC (Media Access Control) changes. Based on the performance evaluation traffic model, a performance test is performed, and during the performance test, a packet loss confirmation is performed, and at the same time, it is determined that the traffic reaches the limit value of no packet loss. After the test is completed, the number of industrial control logs and the number of industrial control rules are recorded, and it is determined whether the number of logs and the number of rules are accurate; at the same time, the industrial control service delay is recorded, and the actual delay is determined based on the test delay and the industrial control service delay; the actual delay = test delay - the delay of the tester itself (service level, such as syn, ack delay).

[0106] Logging stage:

[0107] Assuming that the specific industrial control protocol involved is IEC104, the performance evaluation traffic model includes: TCP / UDP typical operation codes in one connection, and the total connection size is about 20KB, layer 2 protocol, sequential traversal protocol operation codes, 99% normal legal packets + 1% illegal packets, source destination IP or source destination MAC changes. Perform performance testing based on the performance evaluation traffic model, and confirm that there is no packet loss during the performance test. At the same time, determine that the traffic reaches the limit value without packet loss. After the test is completed, record the number of industrial control logs, normal logs and illegal logs, and determine whether the number of logs is accurate; and record the industrial control service delay, and determine the actual delay based on the test delay and the industrial control service delay. Actual delay = test delay - delay of the tester itself (service level, such as syn, delay between acks).

[0108] Protection stage:

[0109] Assuming that the specific industrial control protocol involved is IEC104, the content of the performance evaluation traffic model includes: TCP / UDP typical operation codes in one connection, and the total connection size is about 20KB, layer 2 protocol, sequential traversal protocol operation codes, 99% normal legal packets + 1% illegal packets, source destination IP or source destination MAC changes. Based on the performance evaluation traffic model, a performance test is performed, and the traffic packet is confirmed during the performance test, and the traffic reaches the limit value of the normal packet. After the test is completed, the number of industrial control logs, normal logs and illegal logs are recorded, and it is determined whether the number of logs is accurate; and the industrial control service delay is recorded, and the actual delay is determined based on the test delay and the industrial control service delay. The actual delay = test delay-tester's own delay (service level, such as syn, ack delay).

[0110] In this embodiment, there is a quantity constraint on the industrial control rules. For example, for the above test, the effective evaluation is tested under typical rule quantities such as 0 rules, 1 rule, and 5000 rules.

[0111] In this embodiment, it should be noted that the detailed focus of the industrial control firewall service results is on delay, logging capability, learning capability and blocking capability. The delay includes: the delay from service initiation to response; the logging capability includes: normal industrial control log, illegal industrial control log; the learning capability includes: learning integrity, the capacity of learning rules; the blocking capability includes: normal traffic 99% + illegal traffic 1%, normal can pass, illegal traffic is blocked.

[0112] It can be seen that this embodiment provides a general industrial control firewall dedicated performance evaluation method. This embodiment performs phased testing and evaluation according to the industrial control business stage. The test content includes business-level latency, industrial control log validity evaluation, and industrial control rule quantity factors, thereby making the evaluation process more effective, that is, the performance of the industrial control firewall can be evaluated more effectively and specifically, making up for the shortcomings of the evaluation methods of traditional application-level firewalls.

[0113] Further, based on the content of the above embodiment, in this embodiment, for the industrial control protocol involved, a performance evaluation traffic model corresponding to the industrial control protocol is determined, including:

[0114] If the industrial control protocol involved is IEC104, the content of the performance evaluation traffic model corresponding to the industrial control protocol is determined to include: TCP / UDP typical operation codes in one connection; Layer 2 protocol, sequential traversal protocol operation codes; source destination IP or source destination MAC changes;

[0115] The performance evaluation traffic model corresponds to a first preset ratio of normal and legal packets in the learning phase; and corresponds to a second preset ratio of normal and legal packets + a third preset ratio of illegal packets in the logging phase and the protection phase.

[0116] In this embodiment, the first preset ratio is generally 100% or a ratio close to 100%, such as 100%, 99.99%, etc.; the second preset ratio is generally 97-99%, such as 97%, 98%, 98.99%, 99%, etc.; the third preset ratio is generally 1%-3%, such as 3%, 2%, 1.01%, 1%, etc. It should be noted that the sum of the second preset ratio and the third preset ratio is 100%.

[0117] In this embodiment, it should be noted that the industrial control protocol needs to be evaluated specifically, so each test needs to be specifically evaluated for one industrial control protocol. For example, for the IEC dedicated to the power industry, the traffic model is constructed for the IEC traffic, and for TCP and UDP, typical function code combinations are selected in one connection. For Layer 2 messages, typical functions are covered by traversal tests. It can be understood that normal industrial control traffic is used for learning to verify the performance during learning; illegal industrial control traffic is used to test the blocking performance in protection mode.

[0118] Figure 3 The schematic diagram of the structure of the industrial control firewall performance test and evaluation device provided by the embodiment of the present invention is shown. Figure 3 As shown, the industrial control firewall performance test and evaluation device provided in this embodiment is applied to a client, and includes: a first determination module 21, a second determination module 22 and a test and evaluation module 23, wherein:

[0119] A first determination module 21, used to determine the industrial control service stage corresponding to the industrial control firewall state;

[0120] A second determination module 22, used to determine the expected business result corresponding to the industrial control business stage;

[0121] The test evaluation module 23 is used to perform industrial control firewall performance test evaluation in stages according to the industrial control business stage and the expected business results corresponding to the industrial control business stage and for the industrial control protocols involved.

[0122] Further, based on the content of the above embodiment, in this embodiment, the industrial control business stage corresponding to the industrial control firewall includes: one or more of the unstarted industrial control stage, the learning stage, the log stage and the protection stage;

[0123] Among them, the non-industrial control stage refers to: the stage where the industrial control firewall is not turned on; the learning stage refers to: the industrial control firewall is in a preparation state, learning the industrial control in the network to determine the industrial control strategy that needs to be issued; the log stage refers to: the industrial control firewall is in a pre-application state, releasing traffic, recording logs for all traffic, and issuing alarms for illegal traffic; the protection stage refers to: the industrial control firewall is in use, recording logs for all traffic, and blocking all illegal traffic.

[0124] Further, based on the content of the above embodiment, in this embodiment, the second determining module 22 is specifically used for:

[0125] Determining the expected business results corresponding to the learning stage includes: the industrial control business passes normally without packet loss, the industrial control business delay meets the requirements, the rule learning is complete without loss, and the industrial control log record is complete without loss;

[0126] Determine the expected business results corresponding to the log stage, including: the industrial control business passes normally without packet loss, the industrial control business delay meets the requirements, and the industrial control log records are complete without loss, including normal industrial control traffic and illegal industrial control traffic;

[0127] Determine the expected business results corresponding to the protection stage, including: industrial control business passes normally without packet loss, industrial control business latency meets requirements, illegal industrial control business cannot pass, industrial control log records are complete without loss, including normal industrial control traffic and illegal industrial control traffic.

[0128] Further, based on the content of the above embodiment, in this embodiment, the test evaluation module 23 is specifically used for:

[0129] For the industrial control protocol involved, determine a performance evaluation traffic model corresponding to the industrial control protocol;

[0130] In the learning phase, a performance test is performed based on the performance evaluation traffic model, and no packet loss is confirmed during the performance test, and it is determined that the traffic reaches the limit value of no packet loss. After the test is completed, the number of industrial control logs and the number of industrial control rules are recorded, and it is determined whether the number of logs and the number of rules are accurate; and the industrial control service delay is recorded, and the actual delay is determined based on the test delay and the industrial control service delay;

[0131] In the log phase, a performance test is performed based on the performance evaluation traffic model, and no packet loss is confirmed during the performance test, and it is determined that the traffic reaches the limit value of no packet loss. After the test is completed, the number of industrial control logs, normal logs and violation logs are recorded, and it is determined whether the number of logs is accurate; and the industrial control service delay is recorded, and the actual delay is determined based on the test delay and the industrial control service delay;

[0132] In the protection stage, a performance test is performed based on the performance evaluation traffic model, and traffic packets are confirmed during the performance test, and it is determined that the traffic reaches the limit value of normal packets. After the test is completed, the number of industrial control logs, normal logs and violation logs are recorded, and it is determined whether the number of logs is accurate; and the industrial control business delay is recorded, and the actual delay is determined based on the test delay and the industrial control business delay.

[0133] Further, based on the content of the above embodiment, in this embodiment, for the industrial control protocol involved, a performance evaluation traffic model corresponding to the industrial control protocol is determined, including:

[0134] If the industrial control protocol involved is IEC104, the content of the performance evaluation traffic model corresponding to the industrial control protocol is determined to include: TCP / UDP typical operation codes in one connection; Layer 2 protocol, sequential traversal protocol operation codes; source destination IP or source destination MAC changes;

[0135] The performance evaluation traffic model corresponds to a first preset ratio of normal and legal packets in the learning phase; and corresponds to a second preset ratio of normal and legal packets + a third preset ratio of illegal packets in the logging phase and the protection phase.

[0136] Since the industrial control firewall performance test and evaluation device provided in the embodiment of the present invention can be used to execute the industrial control firewall performance test and evaluation method described in the above embodiment, its working principle and beneficial effects are similar, so they will not be described in detail here. For specific contents, please refer to the introduction of the above embodiment.

[0137] In this embodiment, it should be noted that the various modules in the device of the embodiment of the present invention can be integrated into one or deployed separately. The above modules can be combined into one module or further divided into multiple sub-modules.

[0138] Based on the same inventive concept, another embodiment of the present invention provides an electronic device, see Figure 4 , the electronic device specifically includes the following contents: a processor 301, a memory 302, a communication interface 303 and a communication bus 304;

[0139] The processor 301, the memory 302, and the communication interface 303 communicate with each other via the communication bus 304;

[0140] The processor 301 is used to call the computer program in the memory 302. When the processor executes the computer program, all steps of the above-mentioned industrial control firewall performance test and evaluation method are implemented. For example, when the processor executes the computer program, the following process is implemented: determining the industrial control business stage corresponding to the industrial control firewall status; determining the expected business result corresponding to the industrial control business stage; according to the industrial control business stage and the expected business result corresponding to the industrial control business stage, the industrial control firewall performance test and evaluation are performed in stages for the industrial control protocols involved.

[0141] It can be understood that the detailed functions and extended functions that can be executed by the computer program can refer to the description of the above embodiments.

[0142] Based on the same inventive concept, another embodiment of the present invention provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, all steps of the above-mentioned industrial control firewall performance test and evaluation method are implemented. For example, when the processor executes the computer program, the following process is implemented: determining the industrial control business stage corresponding to the industrial control firewall status; determining the expected business result corresponding to the industrial control business stage; according to the industrial control business stage and the expected business result corresponding to the industrial control business stage, the industrial control firewall performance test and evaluation are performed in stages for the industrial control protocols involved.

[0143] It can be understood that the detailed functions and extended functions that can be executed by the computer program can refer to the description of the above embodiments.

[0144] Based on the same inventive concept, another embodiment of the present invention provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements all the steps of the above-mentioned industrial control firewall performance test and evaluation method. For example, when the processor executes the computer program, it implements the following process: determining the industrial control business stage corresponding to the industrial control firewall status; determining the expected business result corresponding to the industrial control business stage; according to the industrial control business stage and the expected business result corresponding to the industrial control business stage, for the industrial control protocol involved, performing industrial control firewall performance test and evaluation in stages.

[0145] It can be understood that the detailed functions and extended functions that can be executed by the computer program can refer to the description of the above embodiments.

[0146] In addition, the logic instructions in the above-mentioned memory can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0147] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the embodiments of the present invention. Those of ordinary skill in the art may understand and implement them without creative effort.

[0148] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, or of course by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the industrial control firewall performance test and evaluation method described in each embodiment or some parts of the embodiment.

[0149] In addition, in the present invention, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0150] In addition, in the present invention, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0151] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for testing and evaluating the performance of an industrial control firewall, characterized in that: include: Determine an industrial control business stage corresponding to the industrial control firewall state, wherein the industrial control business stage corresponding to the industrial control firewall state includes: one or more of an unstarted industrial control stage, a learning stage, a log stage, and a protection stage; Among them, the non-industrial control stage refers to: the stage where the industrial control firewall is not turned on; the learning stage refers to: the industrial control firewall is in a preparation state, learning the industrial control in the network to determine the industrial control strategy that needs to be issued; the log stage refers to: the industrial control firewall is in a pre-application state, releasing traffic, recording logs for all traffic, and alarming for illegal traffic; the protection stage refers to: the industrial control firewall is in use, recording logs for all traffic, and blocking all illegal traffic; Determine the expected business results corresponding to the industrial control business stage; According to the industrial control business stage and the expected business results corresponding to the industrial control business stage, the industrial control firewall performance test and evaluation are carried out in stages for the industrial control protocols involved, wherein the expected business results corresponding to the industrial control business stage are determined, including one or more of the following: A. Determine the expected business results corresponding to the unstarted industrial control stage, including: For industrial control throughput services, the expected service results include: normal transmission without packet loss, complete industrial control log records without loss, and normal security policy functions; For new industrial control services, the expected results include: taking the minimum load function code of the industrial control protocol object involved as the benchmark data, testing the maximum capacity of new industrial control connections per second, testing no packet loss, no loss of parsed logs, and recording the maximum new capacity; For industrial control concurrent services, the expected results include: using the minimum load function code of the industrial control protocol object involved as the benchmark data, constructing the test protocol long connection object, request and response, respectively establishing the maximum concurrent connection capacity of the test equipment, testing without packet loss, parsing logs without loss, and recording the maximum concurrent connection capacity; B. Determine the expected business results corresponding to the learning stage, including: For industrial control throughput services, the expected service results include: industrial control services pass normally without packet loss, industrial control service latency meets requirements, rule learning is complete without loss, and industrial control log records are complete without loss; For new industrial control services, the expected results include: taking the minimum load function code of the industrial control protocol object involved as the benchmark data, testing the maximum capacity of new industrial control connections per second, testing no packet loss, no loss of parsed logs, and recording the maximum new capacity; For industrial control concurrent services, the expected results include: using the minimum load function code of the industrial control protocol object involved as the benchmark data, constructing the test protocol long connection object, request and response, respectively establishing the maximum concurrent connection capacity of the test equipment, testing without packet loss, parsing logs without loss, and recording the maximum concurrent connection capacity; C. Determining the expected business results corresponding to the log stage includes: For industrial control throughput services, the expected service results include: the industrial control services pass normally without packet loss, the industrial control services latency meets the requirements, and the industrial control log records are complete without loss, including normal industrial control traffic and illegal industrial control traffic; For new industrial control services, the expected results include: taking the minimum load function code of the industrial control protocol object involved as the benchmark data, testing the maximum capacity of new industrial control connections per second, testing no packet loss, no loss of parsed logs, and recording the maximum new capacity; For industrial control concurrent services, the expected results include: using the minimum load function code of the industrial control protocol object involved as the benchmark data, constructing the test protocol long connection object, request and response, respectively establishing the maximum concurrent connection capacity of the test equipment, testing without packet loss, parsing logs without loss, and recording the maximum concurrent connection capacity; D. Determine the expected business results corresponding to the protection stage, including: For industrial control throughput services, the expected service results include: industrial control services pass normally without packet loss, industrial control services meet latency requirements, industrial control illegal services cannot pass, and industrial control log records are complete without loss, including normal industrial control traffic and illegal industrial control traffic; For new industrial control services, the expected results include: taking the minimum load function code of the industrial control protocol object involved as the benchmark data, testing the maximum capacity of new industrial control connections per second, testing no packet loss, no loss of parsed logs, and recording the maximum new capacity; For industrial control concurrent services, the expected business results include: using the minimum load function code of the industrial control protocol object involved as the benchmark data, constructing the test protocol long connection object, request and response, respectively establishing the maximum concurrent connection capacity of the test equipment, testing without packet loss, parsing logs without loss, and recording the maximum concurrent connection capacity at the same time.

2. The industrial control firewall performance test and evaluation method according to claim 1 is characterized in that: According to the industrial control business stage and the expected business results corresponding to the industrial control business stage, the industrial control firewall performance test and evaluation are carried out in stages for the industrial control protocols involved, including: For the industrial control protocol involved, determine a performance evaluation traffic model corresponding to the industrial control protocol; In the learning phase, a performance test is performed based on the performance evaluation traffic model, and no packet loss is confirmed during the performance test, and it is determined that the traffic reaches the limit value of no packet loss. After the test is completed, the number of industrial control logs and the number of industrial control rules are recorded, and it is determined whether the number of logs and the number of rules are accurate; and the industrial control service delay is recorded, and the actual delay is determined based on the test delay and the industrial control service delay; In the log phase, a performance test is performed based on the performance evaluation traffic model, and no packet loss is confirmed during the performance test, and it is determined that the traffic reaches the limit value of no packet loss. After the test is completed, the number of industrial control logs, normal logs and violation logs are recorded, and it is determined whether the number of logs is accurate; and the industrial control service delay is recorded, and the actual delay is determined based on the test delay and the industrial control service delay; In the protection stage, a performance test is performed based on the performance evaluation traffic model, and traffic packets are confirmed during the performance test, and it is determined that the traffic reaches the limit value of normal packets. After the test is completed, the number of industrial control logs, normal logs and violation logs are recorded, and it is determined whether the number of logs is accurate; and the industrial control business delay is recorded, and the actual delay is determined based on the test delay and the industrial control business delay.

3. The industrial control firewall performance test and evaluation method according to claim 2 is characterized in that: For the industrial control protocol involved, determine a performance evaluation traffic model corresponding to the industrial control protocol, including: If the industrial control protocol involved is IEC104, the content of the performance evaluation traffic model corresponding to the industrial control protocol is determined to include: TCP / UDP typical operation codes in one connection; Layer 2 protocol, sequential traversal protocol operation codes; source destination IP or source destination MAC changes; The performance evaluation traffic model corresponds to a first preset ratio of normal and legal packets in the learning phase; and corresponds to a second preset ratio of normal and legal packets + a third preset ratio of illegal packets in the logging phase and the protection phase.

4. An industrial control firewall performance test and evaluation device, characterized in that: The device is used to implement the industrial control firewall performance test and evaluation method according to any one of claims 1 to 3, and the device includes: A first determination module is used to determine an industrial control business stage corresponding to the industrial control firewall state, wherein the industrial control business stage corresponding to the industrial control firewall state includes: one or more of an unstarted industrial control stage, a learning stage, a log stage, and a protection stage; Among them, the non-industrial control stage refers to: the stage where the industrial control firewall is not turned on; the learning stage refers to: the industrial control firewall is in a preparation state, learning the industrial control in the network to determine the industrial control strategy that needs to be issued; the log stage refers to: the industrial control firewall is in a pre-application state, releasing traffic, recording logs for all traffic, and alarming for illegal traffic; the protection stage refers to: the industrial control firewall is in use, recording logs for all traffic, and blocking all illegal traffic; A second determination module is used to determine the expected business result corresponding to the industrial control business stage; The test and evaluation module is used to perform industrial control firewall performance test and evaluation in stages according to the industrial control business stage and the expected business results corresponding to the industrial control business stage, targeting the industrial control protocols involved.

5. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the industrial control firewall performance testing and evaluation method as described in any one of claims 1 to 3 are implemented.

6. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the industrial control firewall performance test and evaluation method as claimed in any one of claims 1 to 3 are implemented.

7. A computer program product, the computer program product comprising a computer program, characterized in that: When the computer program is executed by a processor, the steps of the industrial control firewall performance test and evaluation method as claimed in any one of claims 1 to 3 are implemented.

Images