A system and method for information security access point control

Abstract

The present invention discloses a system and method for information security access point control, which relates to the field of intelligent network information security. The system includes a black and white list module, an access control module, a session control module and a log module. The black and white list module is used to create a white list and a black list of IP addresses, and based on the source IP address or the destination IP address in the data packet controlled by the access point, the data packet is released or blocked. The filtering policy control; the access control module is used to create an access control list for recording five-tuples, and based on the five-tuple of the data packet controlled by the access point, the data packet is released or blocked. The filtering policy control; the session control module is used to create a session control list for recording five-tuples. The present invention ensures the legitimacy of the direct data flow between the in-vehicle network and the out-of-vehicle network, and can also prevent the intrusion of illegal data flows outside the domain, while also ensuring that the legal data flow can flow in and out quickly.

Description

Technical Field

[0001] The present invention relates to the field of intelligent network information security, and in particular to a system and method for controlling information security access points. Background Art

[0002] For the information security of vehicle intelligent networking, its purpose is to ensure the legitimacy of the direct data flow between the in-vehicle network and the external network, prevent the intrusion of illegal data flow from outside the domain, and also ensure that the legal data flow can flow in and out quickly, thereby realizing information security access control.

[0003] In the actual operation process, smart vehicles are often threatened by illegal behaviors such as intrusion of illegal data streams from outside the domain, DDOS attacks, illegal port scanning, etc., but there is currently a lack of effective prevention measures for these illegal behaviors. Summary of the invention

[0004] In view of the defects existing in the prior art, the purpose of the present invention is to provide a system and method for information security access point control, which ensures the legitimacy of the direct data flow between the in-vehicle network and the external network, prevents the intrusion of illegal data flows from outside the domain, and also ensures that legal data flows can flow in and out quickly.

[0005] To achieve the above objectives, the present invention provides a system for information security access point control, comprising:

[0006] Black and white list module, which is used to create whitelist and blacklist of IP addresses, and implement filtering policy control of data packets based on the source IP address or destination IP address in the data packets controlled by the access point;

[0007] An access control module, which is used to create an access control list for recording five-tuples, and implement a filtering policy control of releasing or blocking data packets based on the five-tuples of the data packets controlled by the access point;

[0008] A session control module, which is used to create a session control list for recording five-tuples, and based on the five-tuple of the data packet controlled by the access point, release the data packet when the five-tuple of the data packet is not in the session control list, and when the five-tuple of the data packet is in the session control list, implement the release or blocking filtering policy control of the data packet based on the number of currently connected sessions;

[0009] A log module, which is used to record the filtering process of data packets controlled by the access point, and to record the information generated during the access point control process;

[0010] Wherein, the black and white list module, the access control module and the session control module filter the data packets in sequence.

[0011] Based on the above technical solutions,

[0012] Based on the access control requirements, create a whitelist and a blacklist of IP addresses to obtain a blacklist and whitelist module, create an access control list to obtain an access control module, create a session control list to obtain a session control module, and create a log module at the same time to generate an XML configuration file;

[0013] The generated XML configuration file is parsed based on the parsing tool to generate a configuration file database that can be run on the T-BOX side, and the configuration file database is encrypted and protected by the encryption algorithm integrated in the parsing tool. The configuration file database includes the filtering strategies of the blacklist and whitelist module, the access control module and the session control module.

[0014] Based on the above technical solutions,

[0015] Obtain and parse the data packets for access point control from the external network. The parsed data packets are filtered and detected by the blacklist and whitelist module, access control module and session control module in turn.

[0016] The blacklist and whitelist module, access control module and session control module obtain filtering strategies from a configuration file database.

[0017] On the basis of the above technical solution, the filtering strategies of the blacklist and whitelist module, the access control module and the session control module can be updated in real time according to the demand, and the updated filtering strategies are written into the configuration file database.

[0018] Based on the above technical solutions,

[0019] When the source IP address or destination IP address in a data packet controlled by an access point exists in the whitelist, the blacklist and whitelist module will allow the data packet to pass;

[0020] When the source IP address or destination IP address in a data packet controlled by an access point exists in the blacklist, the blacklist and whitelist module blocks the data packet.

[0021] Based on the above technical solutions,

[0022] When the five-tuple of the data packet controlled by the access point does not exist in the access control list, the access control module blocks the data packet;

[0023] When the five-tuple of the data packet controlled by the access point exists in the access control list, if the set action is blocking, the access control module blocks the data packet; if the set action is releasing, the access control module releases the data packet.

[0024] Based on the above technical solutions,

[0025] When the five-tuple of the data packet controlled by the access point does not exist in the session control list, the session control module releases the data packet;

[0026] When the quintuple of the data packet controlled by the access point exists in the session control list, if the number of currently connected sessions does not exceed the session threshold, the session control module releases the data packet; if the number of currently connected sessions exceeds the session threshold, when the policy switch is high, the session control module blocks the data packet; when the policy switch is low, the session control module releases the data packet.

[0027] Based on the above technical solutions,

[0028] Based on the set session policy, detect the newly established sessions controlled by the access point, and record the status of each connection session starting from the first connection session. When it is detected that the session connection is established, record the number of current connection sessions.

[0029] After the session connection is established, the blacklist and whitelist module, the access control module and the session control module no longer filter the subsequent data packets from the same session.

[0030] Based on the above technical solution, for the established connection session:

[0031] If, within the set time, either party in the session sends a session end packet or a session reset packet, the number of currently connected sessions recorded will be reduced by one;

[0032] If within the set time, neither party in the session sends a session end data packet, and no data packet is sent, the current session is determined to have timed out, the current session is ended, and the number of recorded current connection sessions is reduced by one.

[0033] The present invention provides a method for controlling information security access points, which is implemented based on the above-mentioned system and specifically includes the following steps:

[0034] S1: Get the source IP address of the data packet and go to S2;

[0035] S2: Determine whether the source IP address of the data packet exists in the whitelist. If so, go to S9; if not, go to S3.

[0036] S3: Determine whether the source IP address of the data packet exists in the blacklist. If yes, go to S4; if not, go to S5.

[0037] S4: Block the data packet and end;

[0038] S5: Determine whether the source IP address of the data packet exists in the access control list. If so, go to S6; if not, go to S4.

[0039] S6: Determine whether the source IP address of the data packet exists in the session control list. If so, go to S7; if not, go to S9;

[0040] S7: Determine whether the number of currently connected sessions exceeds the session threshold. If not, go to S9; if yes, go to S8;

[0041] S8: Determine the strategy switch. When the strategy switch is high, go to S4. When the strategy switch is low, go to S9.

[0042] S9: Release the data packet.

[0043] Compared with the prior art, the advantages of the present invention are: by correspondingly designing black and white list modules, access control modules and session control modules, a filtering strategy for access point control is implemented, secure transmission of information inside / outside the vehicle is achieved, the security of inside / outside communication is ensured, the legitimacy of the direct data flow between the inside-vehicle network and the outside-vehicle network is ensured, and the intrusion of illegal data flows from outside the domain can be prevented, while also ensuring that legitimate data flows can flow in and out quickly. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0045] Figure 1 A schematic diagram of the structure of a system for controlling information security access points in an embodiment of the present invention;

[0046] Figure 2 The present invention is a flowchart of a method for controlling information security access points in an embodiment of the present invention. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments.

[0048] See also Figure 1As shown, an embodiment of the present invention provides a system for information security access point control, which detects factors such as the source end, the destination end, and the number of connections in response to the characteristics of attacks such as intrusion of illegal data flows from outside the domain, DDOS attacks (distributed denial of service attacks), and illegal port scanning, and accordingly designs a blacklist and whitelist module, an access control module, and a session control module to implement a filtering strategy for access point control and ensure access security. The system for information security access point control in an embodiment of the present invention includes a blacklist and whitelist module, an access control module, a session control module, and a log module.

[0049] The black and white list module is used to create a white list and a black list of IP addresses, and implement the filtering policy control of releasing or blocking the data packet based on the source IP address or the destination IP address in the data packet controlled by the access point; the access control module is used to create an access control list for recording five-tuples, and implement the filtering policy control of releasing or blocking the data packet based on the five-tuple of the data packet controlled by the access point; the session control module is used to create a session control list for recording five-tuples, and based on the five-tuple of the data packet controlled by the access point, when the five-tuple of the data packet is not in the session control list, the data packet is released, and when the five-tuple of the data packet is in the session control list, the filtering policy control of the data packet is implemented based on the number of currently connected sessions; the log module is used to record the filtering process of the data packet controlled by the access point, and record the information generated during the access point control process; the black and white list module, the access control module and the session control module filter the data packet in turn.

[0050] The filtering strategy of access point control is completed in the production environment and updated with the system update. Based on the access control requirements, the whitelist and blacklist of IP addresses are created to obtain the blacklist and whitelist module, the access control list is created to obtain the access control module, the session control list is created to obtain the session control module, and the log module is created at the same time to generate an XML (Extensible Markup Language) configuration file. That is, the vehicle terminal business developer fills in the XML configuration file according to the actual situation. The XML configuration file includes the blacklist and whitelist module, the access control module, the session control module and the log module.

[0051] The generated XML configuration file is parsed based on the parsing tool to generate a configuration file database that can be run on the T-BOX (telematics processor) side. The configuration file database is encrypted and protected by the encryption algorithm integrated in the parsing tool (which can be an AES symmetric key algorithm). The configuration file database includes filtering policies for the black and white list module, access control module, and session control module.

[0052] The data packets used for access point control are obtained from the external network and parsed. The parsed data packets are filtered and detected by the black and white list module, access control module and session control module in turn; the black and white list module, access control module and session control module obtain filtering strategies from the configuration file database.

[0053] In the present invention, the use of the parsing tool is as follows:

[0054] . / nts_ethfw_parse_conf_tool -pi nts_ethfw.xml -o nts_ethfw.conf

[0055] Among them, nts_ethfw_parse_conf_tool indicates the parsing tool, and nts_ethfw.conf indicates the configuration file database.

[0056] Access point control related functions obtain and parse data packets for access point control from the external network. The parsed data packets are filtered and tested by the blacklist and whitelist modules, access control modules, and session control modules in turn. The results of the filtering test will be returned to the kernel state, which will block or release the data packets. Various messages generated by the access point control related functions during operation, including various warnings, errors, etc., will be recorded by the log module.

[0057] In the embodiment of the present invention, the filtering strategies of the blacklist and whitelist module, the access control module and the session control module can be updated in real time according to the demand, and the updated filtering strategies are written into the configuration file database. The real-time effectiveness of the security strategy is guaranteed through the strategy update configuration mechanism.

[0058] The dynamic update strategy is to transmit the filtering policy that needs to be updated to the dynamic update policy process by the caller's own application process through inter-process communication. The dynamic policy update process then sends the security policy to the local socket. The access point control-related program will receive and load the deployment security policy from the local socket during operation. In order to ensure that it takes effect after restart, the access point control-related program will update the new policy filtering strategy into the configuration file database. After all processing is completed, the processing result will be returned to the dynamic update policy process. The dynamic policy update process obtains the updated result and returns it to the caller's own application process.

[0059] In the embodiment of the present invention, when the source IP address or the destination IP address in the data packet controlled by the access point exists in the white list, the black and white list module releases the data packet;

[0060] When the source IP address or destination IP address in a data packet controlled by an access point exists in the blacklist, the blacklist and whitelist module blocks the data packet.

[0061] That is, when an IP address or domain name is set as a whitelist, if the source IP address (or destination IP address) of all packets controlled by the access point is the same as the IP address or domain name corresponding to the whitelist, the packet is said to hit the whitelist policy, and the packet hitting the whitelist policy will be released. When the access point control related program is running, the specific whitelist policy obtains the IP information in the whitelist through the domain name conversion IP structure type structure, and obtains the domain name information in the whitelist through the domain name conversion IP structure type structure.

[0062] Similar to whitelist filtering detection, when an IP address or domain name is set as a blacklist, if the source IP address (or destination IP address) of all packets controlled by the access point is the same as the IP address or domain name corresponding to the blacklist, the packet is said to hit the blacklist policy, and the packet hitting the blacklist policy will be blocked. When the access point control-related program is running, the specific whitelist policy obtains the IP information in the blacklist by converting the domain name to the IP structure type structure, and obtains the domain name information in the blacklist by converting the domain name to the IP structure type structure.

[0063] It should be noted that when comparing domain name information, it is converted into corresponding IP information for comparison. First, the hash value corresponding to the domain name is obtained through the nts_efw_domain_ip_key_t structure, and then the IP information corresponding to the hash value is found through the nts_efw_domain_to_ip_value_t structure, that is, the IP corresponding to the domain name. Finally, the found IP is used for filtering and detection.

[0064] In the embodiment of the present invention,

[0065] When the five-tuple of the data packet controlled by the access point does not exist in the access control list, the access control module blocks the data packet;

[0066] When the five-tuple of the data packet controlled by the access point exists in the access control list, if the set action is blocking, the access control module blocks the data packet; if the set action is releasing, the access control module releases the data packet.

[0067] The quintuple includes the source IP address, source port, destination IP address, destination port, and packet protocol.

[0068] Access control is the filtering of the five-tuple of source IP address, source port, destination IP address, destination port and data packet protocol to control network traffic penetration through access points and establish session links.

[0069] When setting an access policy, the data packets passing through the access point control are checked. Only the data packets that hit the access policy are allowed to pass, otherwise the data packets will be blocked. The source IP supports the domain name form, and the destination IP supports the domain name form. When the access point control related program is running, the five-tuple information in the policy is obtained through the nts_efw_acl_value_t structure; if the source IP is in the domain name form, the nts_efw_acl_sdomain_value_t structure is used; if the destination IP is in the domain name form, the nts_efw_acl_ddomain_value_t structure is used.

[0070] In the embodiment of the present invention,

[0071] When the five-tuple of the data packet controlled by the access point does not exist in the session control list, the session control module releases the data packet;

[0072] When the quintuple of the data packet controlled by the access point exists in the session control list, if the number of currently connected sessions does not exceed the session threshold, the session control module releases the data packet; if the number of currently connected sessions exceeds the session threshold, when the policy switch is high, the session control module blocks the data packet; when the policy switch is low, the session control module releases the data packet.

[0073] Session control is based on the limit on the total number of connection sessions, which is a security measure for device resource consumption. It supports source-based session connection limit, destination-based session connection limit, and multi-element strategy-based session connection limit. Through the protection of session policies, it blocks DDOS attacks and protects the normal operation of the system.

[0074] When setting a session policy, the newly created sessions controlled by the access point are checked, and the number of active sessions matching the source IP address, source port, destination IP address, destination port and protocol in the session policy (the policy configured in the XML configuration file, the session connection number threshold information corresponding to the five-tuple is obtained through the nts_efw_session_value_t structure when the access point control related program is running) is counted. If the threshold is exceeded, subsequent session establishment is not allowed. The specific session statistics and timeout mechanism are described as follows:

[0075] 1. Based on the set session policy, detect the newly established sessions controlled by the access point, and record the status of each connection session starting from the first connection session. When it is detected that the session connection is established, record the number of current connection sessions;

[0076] 2. After the session connection is established, the blacklist and whitelist module, access control module and session control module will no longer filter the subsequent data packets from the same session, thereby improving the efficiency of sending and receiving data packets and reducing the delay time of data packet processing;

[0077] 3. For a connected session:

[0078] If within the set time (the default is 10 minutes), either party of the session sends a session end packet or a session reset packet, the number of currently connected sessions recorded will be reduced by one;

[0079] If within the set time, neither party in the session sends a session end data packet, and no data packet is sent, the current session is determined to have timed out, the current session is ended, and the number of recorded current connection sessions is reduced by one.

[0080] In the present invention, the opening or closing of the session statistics and timeout mechanism functions can be configured in the XML configuration file, and when the access point control related program is running, the plv_session_level element in the nts_efw_policy_level_value_t structure is used to query whether the function is opened.

[0081] In an embodiment of the present invention, the log module mainly includes a log audit function and a log backup function, which is used to record information about access point control related programs during the startup and initialization phase, data packet filtering, and access point control related program exit phase, and is also used to record audit information about debugging functions during the development phase.

[0082] The log module configures related parameters through the XML configuration file mentioned in the static configuration strategy. The configured parameters are called through the nts_efw_log_value_t structure when the access point control related program is running. They mainly include the path of the log file (structure element lv_path), the number of log file backups (structure element lv_num), the size of the log file backup (structure element lv_size) and the level of log module recording (structure element lv_level). The log module can record 8 different levels of information, and different recording levels can be set according to different needs. It has the following levels:

[0083] EMERG: indicates the highest level of business log, used to record illegal messages

[0084] ALERT: indicates recording serious warning information

[0085] CRIT: indicates recording of serious program error information

[0086] ERROR: indicates recording program exception information

[0087] WARNING: indicates recording business warning information

[0088] NOTICE: indicates recording of prompt information

[0089] INFO: indicates recording normal output information

[0090] DEBUG: means recording debugging information

[0091] In the present invention, the record format of the log file is date time hostname level logname[pid]:log messag.

[0092] To export log files, use the command adb pull logpath to export logs. logpath is the storage path of logs in TBOX. This path is consistent with the path ( / log / nts_ethfw.log) in the log module properties in the configuration file.

[0093] Furthermore, the system for information security access point control of the present invention also provides a port scanning defense function.

[0094] Port scanning defense is to defend against port scanning behavior (using SYN packets to detect ports) to prevent a large number of service ports from being exposed to attackers. Port scanning is to obtain information about the target system, including operating system information and port information providing services. After obtaining this information, attackers can carry out targeted attacks based on this information. Access point control can prevent attackers from detecting attempts, thereby preventing attackers from obtaining important information about protected networks and network resources.

[0095] When a source IP address sends IP packets containing TCP (Transmission Control Protocol) SYN segments to 16 different ports at the same destination IP address within a specified time interval, a port scan is performed, and the access point control related program marks it as a port scan attack. Access point control detects and discards scan packets after the 16th port that meet the port scan attack criteria. The specific processing flow is as follows:

[0096] The access point control-related program performs port scanning defense on the received data packets. If the number of ports detected from the same IP address reaches the set upper limit (configured in the XML configuration file, the default port upper limit is 16, and the nv_syn element in the nts_efw_nids_value_t structure is used to obtain the port number threshold when the access point control-related program is running) within the set time (configured in the XML configuration file, the access point control-related program is running) All data packets from the IP address are blocked; within the blocking time (the default value is 10 minutes), all data packets from the IP address will also be blocked. If the blocking time is exceeded, the access point control-related program will re-perform port scanning detection on the data packets from the IP address.

[0097] The port scan defense function can be enabled or disabled in the XML configuration file. When the access point control-related program is running, the plv_nids_level element in the nts_efw_policy_level_value_t structure is used to query whether the function is enabled.

[0098] In the present invention, access point control is used as an important network security component in the car. It is a security barrier set up in the car and is used for access control of the network security domain. Its purpose is to ensure the legitimacy of the direct data flow between the in-car network and the external network, prevent the intrusion of illegal data flows outside the domain, and also ensure that the legal data flow can flow in and out quickly. The access point control performs secure access control on the data flow flowing through it. Only data that complies with the security policy of the access point control can pass. Data that does not comply with the policy will be rejected and recorded. By deploying the access point control security module, the secure transmission of information inside / outside the car is realized, and the security of communication inside / outside the car is guaranteed.

[0099] See also Figure 2 As shown, a method for controlling information security access points provided by an embodiment of the present invention is implemented based on the above-mentioned system, and the method specifically includes the following steps:

[0100] S1: Get the source IP address of the data packet and go to S2;

[0101] S2: Determine whether the source IP address of the data packet exists in the whitelist. If so, go to S9; if not, go to S3.

[0102] S3: Determine whether the source IP address of the data packet exists in the blacklist. If yes, go to S4; if not, go to S5.

[0103] S4: Block the data packet and end;

[0104] S5: Determine whether the source IP address of the data packet exists in the access control list. If so, go to S6; if not, go to S4.

[0105] S6: Determine whether the source IP address of the data packet exists in the session control list. If so, go to S7; if not, go to S9;

[0106] S7: Determine whether the number of currently connected sessions exceeds the session threshold. If not, go to S9; if yes, go to S8;

[0107] S8: Determine the strategy switch. When the strategy switch is high, go to S4. When the strategy switch is low, go to S9.

[0108] S9: Release the data packet.

[0109] When the access point control related program is started and enters the data packet filtering state, it will not only perform security filtering on the data packets received by the terminal, but also on the data packets sent by the terminal. When the network card receives an Ethernet data packet, the data packet will be stored in the set kernel rule queue in sequence, and the access point control related program will take out the data packet from the kernel rule queue in sequence; when the terminal application sends the Ethernet data packet to the kernel send cache queue, the access point control related program will take out the data packet from the kernel rule queue in sequence, and both the received and sent packets will perform the above filtering process in sequence according to the set security policy.

[0110] The above description is only a specific implementation of the present application, so that those skilled in the art can understand or implement the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest range consistent with the principles and novel features applied for herein.

[0111] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems) and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the process in the flowchart. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

Claims

1. A system for information security access point control, characterized in that: include: Black and white list module, which is used to create whitelist and blacklist of IP addresses, and implement filtering policy control of data packets based on the source IP address or destination IP address in the data packets controlled by the access point; An access control module, which is used to create an access control list for recording five-tuples, and implement a filtering policy control of releasing or blocking data packets based on the five-tuples of the data packets controlled by the access point; A session control module, which is used to create a session control list for recording five-tuples, and based on the five-tuple of the data packet controlled by the access point, release the data packet when the five-tuple of the data packet is not in the session control list, and when the five-tuple of the data packet is in the session control list, implement the release or blocking filtering policy control of the data packet based on the number of currently connected sessions; A log module, which is used to record the filtering process of data packets controlled by the access point, and to record the information generated during the access point control process; Wherein, the black and white list module, access control module and session control module filter the data packets in sequence; Based on the access control requirements, create a whitelist and a blacklist of IP addresses to obtain a blacklist and whitelist module, create an access control list to obtain an access control module, create a session control list to obtain a session control module, and create a log module at the same time to generate an XML configuration file; The generated XML configuration file is parsed based on the parsing tool to generate a configuration file database that can be run on the T-BOX side, and the configuration file database is encrypted and protected by the encryption algorithm integrated in the parsing tool. The configuration file database includes the filtering strategies of the blacklist and whitelist module, the access control module and the session control module; When the five-tuple of the data packet controlled by the access point does not exist in the session control list, the session control module releases the data packet; When the five-tuple of the data packet controlled by the access point exists in the session control list, if the number of currently connected sessions does not exceed the session threshold, the session control module releases the data packet; if the number of currently connected sessions exceeds the session threshold, when the policy switch is high, the session control module blocks the data packet; when the policy switch is low, the session control module releases the data packet; The system also provides a port scan defense function. The port scan defense function is that if the number of ports detected from the same IP address reaches a set upper limit within a set time, all data packets from the IP address will be blocked. During the blocking time, all data packets from the IP address will be blocked. If the blocking time exceeds, the data packets from the IP address will be re-port scanned. The port scanning defense function can be enabled or disabled in the XML configuration file.

2. A system for information security access point control as claimed in claim 1, characterized in that: Obtain and parse the data packets for access point control from the external network. The parsed data packets are filtered and detected by the blacklist and whitelist module, access control module and session control module in turn. The blacklist and whitelist module, access control module and session control module obtain filtering strategies from a configuration file database.

3. A system for information security access point control as claimed in claim 2, characterized in that: The filtering strategies of the blacklist and whitelist module, the access control module and the session control module can be updated in real time according to the requirements, and the updated filtering strategies are written into the configuration file database.

4. A system for information security access point control as claimed in claim 1, characterized in that: When the source IP address or destination IP address in a data packet controlled by an access point exists in the whitelist, the blacklist and whitelist module will release the data packet; When the source IP address or destination IP address in a data packet controlled by an access point exists in the blacklist, the blacklist and whitelist module blocks the data packet.

5. A system for information security access point control as claimed in claim 1, characterized in that: When the five-tuple of the data packet controlled by the access point does not exist in the access control list, the access control module blocks the data packet; When the five-tuple of the data packet controlled by the access point exists in the access control list, if the set action is blocking, the access control module blocks the data packet, and if the set action is releasing, the access control module releases the data packet.

6. A system for information security access point control as claimed in claim 1, characterized in that: Based on the set session policy, detect the newly established sessions controlled by the access point, and record the status of each connection session starting from the first connection session. When it is detected that the session connection is established, record the number of current connection sessions. After the session connection is established, the blacklist and whitelist module, the access control module and the session control module no longer filter the subsequent data packets from the same session.

7. A system for information security access point control as claimed in claim 6, characterized in that: For an established connected session: If, within the set time, either party of the session sends a session end packet or a session reset packet, the number of currently connected sessions recorded will be reduced by one; If within the set time, neither party in the session sends a session end data packet, and no data packet is sent, the current session is determined to have timed out, the current session is ended, and the number of recorded current connection sessions is reduced by one.

8. A method for controlling information security access points, implemented based on the system according to any one of claims 1 to 7, characterized in that: The specific steps include: S1: Get the source IP address of the data packet and go to S2; S2: Determine whether the source IP address of the data packet exists in the whitelist. If so, go to S9; if not, go to S3; S3: Determine whether the source IP address of the data packet exists in the blacklist. If so, go to S4; if not, go to S5. S4: Block the data packet and end; S5: Determine whether the source IP address of the data packet exists in the access control list. If so, go to S6; if not, go to S4. S6: Determine whether the source IP address of the data packet exists in the session control list. If so, go to S7; if not, go to S9; S7: Determine whether the number of currently connected sessions exceeds the session threshold. If not, go to S9; if yes, go to S8; S8: Determine the strategy switch. When the strategy switch is high, go to S4. When the strategy switch is low, go to S9. S9: Release the data packet.

Images