Industrial firewall protection method, device, industrial firewall and medium

Abstract

The present application relates to a method, apparatus, industrial firewall, and medium for industrial firewall protection, and relates to the field of industrial firewalls. The method includes, upon receiving a request message, determining whether the request message exists in a preset access control list. If not, determining the importance level of the request message, and based on the importance level, determining whether the request message allows access to target data, where the target data is the data to be accessed by the request message, and adding the request message and the corresponding determination result to the preset access control list. The present application enables the industrial firewall to automatically add request messages.

Description

Technical Field

[0001] The present application relates to the field of industrial firewalls, and in particular to a method, device, industrial firewall, and medium for industrial firewall protection. Background Art

[0002] An industrial firewall is a product that separates other networks from the industrial control network, so that other networks can only access the industrial control network if they obtain an access permit, thereby achieving the effect of protecting the industrial control network.

[0003] Currently, devices on other networks obtain the data they need by sending requests to devices on the industrial control network. Because these requests may contain information that could attack public networks, industrial firewalls must inspect these requests. Industrial firewalls typically check these requests by matching them against the requests in an access control list (ACL). If a match fails in the ACL, meaning the request does not exist in the ACL, the firewall determines the access status of the request as either deny (Cisco ACL) or allow (Huawei ACL). For example, if the Huawei ACL requires a deny status for the request, security personnel must manually add the request to the ACL and indicate the deny status. This prevents the request from subsequently entering the industrial control network and potentially causing an attack, or from entering other networks and potentially leaking information. Currently, industrial firewalls cannot automatically add requests that are not in the ACL. Summary of the Invention

[0004] In order to enable an industrial firewall to automatically add request information that is not in an access control list, the present application provides an industrial firewall protection method, device, industrial firewall and medium.

[0005] In a first aspect, the present application provides an industrial firewall protection method, which adopts the following technical solutions:

[0006] A method for industrial firewall protection, comprising:

[0007] When receiving the request information, determining whether the request information is in the preset access control list;

[0008] If not, determining the importance level of the requested information;

[0009] Based on the importance level, determining whether the request information allows acquisition of target data, where the target data is data to be acquired by the request information;

[0010] The request information and the corresponding judgment result are added to the preset access control list.

[0011] By adopting the above technical solution, when a request message is received, it indicates that the current industrial firewall needs to determine whether the request message can pass. The preset access control list is a pre-set permission list, which includes multiple request messages that can pass through the industrial firewall and multiple request messages that cannot pass through the industrial firewall. It is determined whether the request message exists in the preset access control list, thereby achieving the effect of determining whether the request message can be recognized by the industrial firewall. When it exists in the preset access control list, it indicates that the industrial firewall can identify whether the request message can pass. When it does not exist in the preset access control list, it indicates that the industrial firewall cannot identify whether the request message can pass. Therefore, the importance level of the request message can be determined, and then whether the request message is allowed to obtain the target data according to the importance level can be determined, wherein the target data is the data that the request message needs to obtain, so that the request message and the corresponding judgment result can be added to the preset access control list later, so that when the request message is received again in the future, the industrial firewall can determine whether the request message can pass according to the preset access control list, thereby achieving the effect of the industrial firewall being able to automatically add the request information.

[0012] In another possible implementation, the request information includes a destination IP address and a destination port number; and determining the importance level of the request information includes:

[0013] Determine the job level information of the user corresponding to the destination IP address;

[0014] Determine the address level of the destination IP address based on the post level information;

[0015] Determine the process information of the destination port number on the device corresponding to the destination IP address, wherein the process information corresponds to a preset port level;

[0016] The importance level of the request information is obtained by summing the address level and the preset port level.

[0017] By adopting the above technical solution, the request information includes the destination IP address and the destination port number. The destination IP address is used to clarify that the target data to be obtained by the current request information specifically belongs to the device information. Each port number has corresponding process information, and the destination port number is used to clarify that the target data is the data of the process information corresponding to the target port. The position level information of the user corresponding to the destination IP address in the request information is used to determine the address level corresponding to the destination IP address based on the position level information, and to determine the process information of the destination port number on the device corresponding to the destination IP address. The process information corresponds to a preset port level, so that the address level and the preset port level can be summed to obtain the importance level of the request information, thereby achieving the effect of determining the importance level of the request information.

[0018] In another possible implementation, the request information includes a source IP address, and determining whether the request information allows acquisition of target data based on the importance level includes:

[0019] Determine whether the source IP address exists in the preset access control list;

[0020] If so, determining the historical request information corresponding to the source IP address and determining the historical importance level corresponding to the historical request information, wherein the historical request information is the request information corresponding to the source IP address in the preset access control list;

[0021] Determine the historical request information corresponding to the highest historical importance level as the target historical request information;

[0022] If the highest historical importance level is not less than the importance level, and the target history request information allows acquisition of the target history target data, then it is determined that the request information allows acquisition of the target data, and the target history target data is the target data required to be acquired by the target history request information;

[0023] If the highest history importance level is less than the importance level, and the target history request information allows obtaining the target history target data, it is determined that the request information denies obtaining the target data.

[0024] By adopting the above technical solution, the request information includes the source IP address, and it is determined whether the source IP address exists in the preset access control list, so as to determine whether the device corresponding to the source IP address has request information in the history. When it exists, it means that there is request information corresponding to the source IP address in the history. Therefore, the historical request information corresponding to the source IP address can be determined, and the historical importance level corresponding to the historical request information can be determined, so that it can be subsequently determined whether the request information is allowed to access the target process based on the historical importance level and the importance level. The higher the importance level corresponding to the request information, the higher the importance of the data that the request information can obtain. Since the number of historical request information corresponding to the source IP address in the preset control list may be more than one, the historical request information corresponding to the highest historical importance level can be determined as the target historical request information. When the highest historical importance level is not less than the importance level, and the highest historical request information allows the acquisition of the target historical target data, it means that the source IP address is allowed to obtain target data greater than the current importance level in history. Therefore, it can be determined that the request information allows the acquisition of the target data. If the highest historical importance level is lower than the importance level, and the highest historical request allows access to the target data, this indicates that the source IP address has historically only been able to access data of lower importance, while the current request has a higher importance level. Therefore, it can be determined that the request denies access to the target data. This effectively determines whether a request allows access to the target data based on the importance level.

[0025] In another possible implementation, the determining whether the source IP address exists in the preset access control list further includes:

[0026] If not, obtaining the target data;

[0027] Generate data to be output based on the target data and preset label information;

[0028] Outputting the data to be output based on a preset transmission channel, where the preset transmission channel is a transmission channel corresponding to the target data;

[0029] Determine whether a feedback signal corresponding to the preset tag information is received within a first preset time;

[0030] The request information and the judgment result are added to the preset access control list.

[0031] By adopting the above technical solution, when the source IP address does not exist in the preset access control list, it means that the current industrial firewall cannot determine whether the currently received request information is allowed to obtain the target data based on the request information in the preset access control list. When the industrial firewall allows the request information to enter the industrial control network to obtain the target data, it may cause an attack on the industrial control network. Therefore, when the industrial firewall cannot determine whether the current request information is safe, the industrial firewall can obtain the target data based on the request information and generate the output data based on the target data and preset tag information, wherein the preset tag information is pre-set tag information and the preset tag information corresponds to a feedback signal, and output the output data according to a preset transmission channel, wherein the preset transmission channel is a pre-set internal transmission channel, and the device corresponding to the source IP address of the output data can receive the output data through the preset transmission channel, indicating that the network information corresponding to the source IP address can pass through the industrial firewall. The preset tag information is used to control the device to send a feedback signal when a device receives the output data. Therefore, by determining whether the feedback signal corresponding to the preset tag information is received within a first preset time, the request information and the judgment result are added to the preset access control list, thereby achieving the effect of the industrial firewall being able to automatically add the request information.

[0032] In another possible implementation, the method further includes:

[0033] If the request information allows the acquisition of the target data and the importance level is greater than the preset importance level, when it is detected that the request information acquires the target data for the first time, the acquisition time is recorded;

[0034] If the acquisition time reaches a second preset time, the request information to acquire the target data is rejected, and the request information is output.

[0035] By adopting the above technical solution, the preset importance level is the importance level set in advance, which is used to judge whether the importance level is a higher importance level. When the request information allows the acquisition of target data, and the importance level of the request information is greater than the preset importance level, it means that the importance of the target data to be accessed by the current request information is higher, that is, there may be a risk of information leakage in the industrial control network. Therefore, the acquisition time of the request information can be recorded. The second preset time is the preset time set in advance, which is used to judge whether the current acquisition time is longer. When the acquisition time reaches the second preset time, it means that the device that sends the request information is likely to cause harm to the industrial control network, that is, the request information can be rejected to obtain the target data, and the request information can be output, thereby making the protection performance of the industrial firewall better.

[0036] In another possible implementation, there is at least one piece of historical request information corresponding to the source IP address, and the method further includes:

[0037] Determining whether there is an association relationship between the target data and the historical target data corresponding to each piece of historical request information;

[0038] Acquire the total number of associated historical target data with associated relationships and the number of obtainable data, where the obtainable data is the associated historical target data that is allowed to be obtained from the associated historical target data;

[0039] determining a target ratio based on the quantity and the total quantity;

[0040] Determining whether the target ratio reaches a preset ratio;

[0041] The request information and the judgment result are added to the preset access control list.

[0042] By adopting the above technical solution, in the preset access control list, the number of historical request information corresponding to the source IP address may be at least one, and it is determined whether there is an association relationship between the target data and the historical target data corresponding to each historical request information. The retrievable data is the associated historical target data that is allowed to be retrieved in the associated historical target data. The total number of associated historical target data with an association relationship and the number of retrievable data are obtained, and the target ratio is determined based on the number and the total number, so as to facilitate the subsequent judgment of whether the request information is allowed to retrieve the target data based on the target ratio. The preset ratio is a ratio set in advance, which serves as a standard for judging whether the current target ratio meets the standard. When the target ratio reaches the preset ratio, it means that most of the historical request information corresponding to the source IP address in the historical records can retrieve their respective corresponding target data, so it can be determined that the current request information is allowed to retrieve the target data. When the target ratio does not reach the preset ratio, it means that most of the historical request information corresponding to the source IP address in the historical records refuses to retrieve their respective corresponding target data, so it can be determined that the current request information refuses to retrieve the target data. That is, the request information and the judgment result can be added to the preset access control list. When the request information is used again to obtain the target data, the industrial firewall can determine whether the current request information can obtain the target data based on the preset access control list. This achieves the effect of the industrial firewall automatically adding request information.

[0043] In another possible implementation, the determining of the historical importance level corresponding to the historical request information further includes:

[0044] Based on the historical request information, determine the historical MAC address corresponding to the source IP address;

[0045] Obtain the MAC address of the requested information;

[0046] Determine whether the MAC address is the same as the historical MAC address;

[0047] If they are not the same, it is determined that the source IP address is a modified IP address, and it is determined that the request information refuses to obtain the target data.

[0048] By adopting the above technical solution, the historical MAC address corresponding to the source IP address is determined according to the historical request information, and the MAC address of the current request information is obtained, so as to facilitate the subsequent judgment of whether the MAC address is the same as the historical MAC address, and then judge whether the current source IP address is the modified source IP address. When they are not the same, it means that the current source IP address is the modified IP address, then it is determined that the source IP address belongs to the modified IP address, and it is determined that the request information refuses to obtain the target data, so that the industrial firewall can identify whether the source IP address is the real IP address, thereby improving the protection capability of the industrial firewall.

[0049] In a second aspect, the present application provides an industrial firewall protection device, which adopts the following technical solution:

[0050] An industrial firewall protection device, comprising:

[0051] A first judgment module is used to judge whether the request information exists in a preset access control list when receiving the request information;

[0052] a first determining module, configured to determine the importance level of the requested information when the information does not exist;

[0053] A second judgment module is used to judge whether the request information allows acquisition of target data based on the importance level, where the target data is data to be acquired by the request information;

[0054] The first adding module is used to add the request information and the corresponding judgment result to the preset access control list.

[0055] By adopting the above technical solution, when a request message is received, it indicates that the current industrial firewall needs to determine whether the request message can pass. The preset access control list is a pre-set permission list, which includes multiple request messages that can pass through the industrial firewall and multiple request messages that cannot pass through the industrial firewall. The first judgment module determines whether the request message exists in the preset access control list, thereby achieving the effect of determining whether the request message can be recognized by the industrial firewall. When it exists in the preset access control list, it indicates that the industrial firewall can identify whether the request message can pass. When it does not exist in the preset access control list, it indicates that the industrial firewall cannot identify whether the request message can pass. Therefore, the importance level of the request message can be determined by the first determination module, so that the second judgment module determines whether the request message allows the acquisition of target data based on the importance level, wherein the target data is the data that the request message needs to acquire, so that the subsequent first adding module can add the request message and the corresponding judgment result to the preset access control list, so that when the request message is received again in the future, the industrial firewall can determine whether the request message can pass according to the preset access control list, thereby achieving the effect of the industrial firewall being able to automatically add the request message.

[0056] In another possible implementation, when determining the importance level of the request information, the first determining module is specifically configured to:

[0057] Determine the job level information of the user corresponding to the destination IP address;

[0058] Determine the address level of the destination IP address based on the post level information;

[0059] Determine the process information of the destination port number on the device corresponding to the destination IP address, wherein the process information corresponds to a preset port level;

[0060] The importance level of the request information is obtained by summing the address level and the preset port level.

[0061] In another possible implementation, the second determination module determines, based on the importance level, whether the request information allows acquisition of the target data, specifically for:

[0062] Determine whether the source IP address exists in the preset access control list;

[0063] If so, determining the historical request information corresponding to the source IP address and determining the historical importance level corresponding to the historical request information, wherein the historical request information is the request information corresponding to the source IP address in the preset access control list;

[0064] Determine the historical request information corresponding to the highest historical importance level as the target historical request information;

[0065] If the highest historical importance level is not less than the importance level, and the target history request information allows acquisition of the target history target data, then it is determined that the request information allows acquisition of the target data, and the target history target data is the target data required to be acquired by the target history request information;

[0066] If the highest history importance level is less than the importance level, and the target history request information allows obtaining the target history target data, it is determined that the request information denies obtaining the target data.

[0067] In another possible implementation, the apparatus further includes:

[0068] A first acquisition module, configured to acquire the target data when the target data does not exist;

[0069] A generating module, configured to generate data to be output based on the target data and preset label information;

[0070] a first output module, configured to output the data to be output based on a preset transmission channel, where the preset transmission channel is a transmission channel corresponding to the target data;

[0071] A third judgment module is used to judge whether a feedback signal corresponding to the preset tag information is received within a first preset time;

[0072] The second adding module is used to add the request information and the judgment result to the preset access control list.

[0073] In another possible implementation, the apparatus further includes:

[0074] a recording module, configured to, when the request information allows acquisition of the target data and the importance level is greater than a preset importance level, record an acquisition time if it is detected that the request information acquires the target data for the first time;

[0075] The second output module is configured to reject the request information to obtain the target data and output the request information when the acquisition time reaches a second preset time.

[0076] In another possible implementation, the apparatus further includes:

[0077] A fourth judgment module is used to judge whether there is an association relationship between the target data and the historical target data corresponding to each historical request information;

[0078] a second acquisition module, configured to acquire the total number of associated historical target data with associated relationships and the number of obtainable data, wherein the obtainable data is the associated historical target data that is allowed to be obtained from the associated historical target data;

[0079] a third determining module, configured to determine a target ratio based on the quantity and the total quantity;

[0080] A fifth judgment module is used to judge whether the target ratio reaches a preset ratio;

[0081] The third adding module is used to add the request information and the judgment result to the preset access control list.

[0082] In another possible implementation, the apparatus further includes:

[0083] A third determining module is used to determine a historical MAC address corresponding to the source IP address based on the historical request information;

[0084] A third acquisition module is used to obtain the MAC address of the request information;

[0085] A sixth determination module, configured to determine whether the MAC address is the same as the historical MAC address;

[0086] The fourth determining module is used to determine that the source IP address belongs to a modified IP address when they are not the same, and to determine that the request information refuses to obtain the target data.

[0087] In a third aspect, the present application provides an industrial firewall that adopts the following technical solutions:

[0088] An industrial firewall, comprising:

[0089] at least one processor;

[0090] Memory;

[0091] At least one application, wherein the at least one application is stored in a memory and configured to be executed by at least one processor, and the at least one application is configured to: execute an industrial firewall protection method shown in any possible implementation of the first aspect.

[0092] In a fourth aspect, the present application provides a computer-readable storage medium, which adopts the following technical solution:

[0093] A computer-readable storage medium, when the computer program is executed in a computer, causes the computer to execute the industrial firewall protection method described in any one of the first aspects.

[0094] In summary, this application includes at least one of the following beneficial technical effects:

[0095] 1. When a request message is received, it indicates that the current industrial firewall needs to determine whether the request message can pass. The preset access control list is a pre-set permission list, which includes multiple request messages that can pass through the industrial firewall and multiple request messages that cannot pass through the industrial firewall. It is determined whether the request message exists in the preset access control list, thereby achieving the effect of determining whether the request message can be recognized by the industrial firewall. If it exists in the preset access control list, it indicates that the industrial firewall can identify whether the request message can pass. If it does not exist in the preset access control list, it indicates that the industrial firewall cannot identify whether the request message can pass. Therefore, the importance level of the request message can be determined, and then, based on the importance level, it is determined whether the request message is allowed to obtain the target data, wherein the target data is the data that the request message needs to obtain. This enables the request message and the corresponding judgment result to be subsequently added to the preset access control list, so that when the request message is received again in the future, the industrial firewall can determine whether the request message can pass according to the preset access control list, thereby achieving the effect of the industrial firewall being able to automatically add the request message;

[0096] 2. When the source IP address does not exist in the preset access control list, the current industrial firewall cannot determine whether the currently received request information is allowed to access the target data based on the request information in the preset access control list. If the industrial firewall allows the request information to enter the industrial control network and obtain the target data, it may pose an attack to the industrial control network. Therefore, if the firewall cannot determine whether the current request information is safe, it can obtain the target data based on the request information and generate the output data based on the target data and preset tag information. The preset tag information is pre-set tag information and corresponds to a feedback signal. The output data is then output through a preset transmission channel. The preset transmission channel is a pre-set internal transmission channel. If the device corresponding to the source IP address of the output data can receive the output data through the preset transmission channel, it means that the network information corresponding to the source IP address can pass through the industrial firewall. The preset tag information is used to control the device to send a feedback signal when a device receives the output data. Therefore, by determining whether the feedback signal corresponding to the preset tag information is received within a first preset time, the request information and the judgment result are added to the preset access control list, thereby achieving the effect of the industrial firewall automatically adding the request information. BRIEF DESCRIPTION OF THE DRAWINGS

[0097] Figure 1 It is a flowchart of an industrial firewall protection method in an embodiment of the present application.

[0098] Figure 2 It is a structural diagram of an industrial firewall protection device in an embodiment of the present application.

[0099] Figure 3 This is a structural diagram of an industrial firewall in an embodiment of the present application. DETAILED DESCRIPTION

[0100] The following is combined with Figure 1-3 This application is described in further detail.

[0101] After reading this specification, those skilled in the art may make non-creative modifications to this embodiment as needed, but such modifications are protected by patent law as long as they fall within the scope of the claims of this application.

[0102] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0103] In this document, the term "and / or" simply describes a relationship between related objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " in this document, unless otherwise specified, generally indicates an "or" relationship between the related objects.

[0104] The embodiments of the present application are described in further detail below with reference to the accompanying drawings.

[0105] The embodiment of the present application provides a method for industrial firewall protection, which is executed by the industrial firewall, such as Figure 1 As shown, the method includes: step S101, step S102, step S103 and step S104, wherein,

[0106] Step S101: When a request message is received, it is determined whether the request message exists in a preset access control list.

[0107] In the embodiment of the present application, when a request message is received, it indicates that the current industrial firewall needs to determine whether the request message can pass. The preset access control list is a pre-set permission list, which includes multiple request messages that can pass through the industrial firewall and multiple request messages that cannot pass through the industrial firewall. It is determined whether the request message exists in the preset access control list, thereby achieving the effect of determining whether the request message can be recognized by the industrial firewall. Assume that the received request message is request message A.

[0108] Step S102: If not, determine the importance level of the requested information.

[0109] In the embodiment of the present application, if the request information does not exist in the preset access control list, it means that the industrial firewall cannot identify whether the request information can pass through. Therefore, the importance level of the request information can be determined, so that it can be judged whether the request information allows the acquisition of the target data based on the importance level. Taking step S101 as an example, the request information is request information A, and the preset access control list includes request information B, request information C, and request information D. If request information A does not exist in the preset access control list, the importance level of request information A can be determined, so that it can be judged whether request information A allows the acquisition of the target data based on the importance level.

[0110] In an embodiment of the present application, when it exists in the preset access control list, it means that the industrial firewall can identify whether the request information can pass. Assuming that the request information currently received is request information B, request information B exists in the preset access control list, and request information B can obtain the target data, it can be determined that the received request information B is allowed to obtain the target data.

[0111] Step S103: Based on the importance level, it is determined whether the request information allows acquisition of the target data.

[0112] The target data is the data that needs to be obtained by requesting information.

[0113] For the embodiment of the present application, the target data is the data that the request information needs to obtain. Assuming that the target data that the request information A needs to obtain is data A, based on the importance level of the request information A, it is determined whether the request information A is allowed to obtain data A, so that the request information A and the corresponding judgment result can be added to the preset access control list later.

[0114] Step S104: Add the request information and the corresponding judgment result to a preset access control list.

[0115] For the embodiment of the present application, the judgment results include allowing access to the target data and refusing access to the target data. The request information and the corresponding judgment results are added to the preset access control list so that when the request information is received again in the future, the industrial firewall can judge whether the request information can pass according to the preset access control list, thereby achieving the effect that the industrial firewall can automatically add the request information.

[0116] In a possible implementation of the embodiment of the present application, step S102, when determining the importance level of the requested information, specifically includes step S1021 (not shown in the figure), step S1022 (not shown in the figure), step S1023 (not shown in the figure), and step S1024 (not shown in the figure), wherein:

[0117] Step S1021, determine the position level information of the user corresponding to the destination IP address.

[0118] For the embodiment of the present application, the request information includes a destination IP address and a destination port number. The destination IP address is used to clarify that the target data to be obtained by the current request information specifically belongs to the device information. Each port number has corresponding process information. The destination port number is used to clarify that the target data is the data of the process information corresponding to the target port. The job level information of the user corresponding to the destination IP address in the request information is judged and used so as to determine the address level corresponding to the destination IP address based on the job level information. Assume that the device corresponding to the destination IP address in the currently received request information A is device A, the user using device A is user A, and the job level information of user A is p1. The higher the p level is at work, the higher the corresponding job level is.

[0119] Step S1022: determine the address level of the destination IP address based on the level information.

[0120] For the embodiment of the present application, taking step S1021 as an example, if the post level information is p1, it can be determined that the address level of the destination IP address is level 1.

[0121] Step S1023: Determine the process information of the destination port number on the device corresponding to the destination IP address.

[0122] The process information corresponds to a preset port level.

[0123] In this embodiment of the present application, process information corresponds to a preset port level. The process information of the device corresponding to the destination port number is determined, so that the importance level of the request information can be determined based on the preset port level corresponding to the destination port number. Assume that the process information corresponding to the destination port number is process A, and the preset port level corresponding to process A is level 1.

[0124] Step S1024: sum the address level and the preset port level to obtain the importance level of the request information.

[0125] In the embodiment of the present application, taking steps S1022 and S1023 as an example, the port level is preset to level 1, the address level is preset to level 1, and the address level and the preset port level are summed to obtain the importance level of the request information as level 2. This achieves the effect of determining the importance level of the request information A.

[0126] In a possible implementation of the embodiment of the present application, step S103, when determining whether the request information allows acquisition of target data based on the importance level, specifically includes step S1031 (not shown in the figure), step S1032 (not shown in the figure), step S1033 (not shown in the figure), step S1034 (not shown in the figure), and step S1035 (not shown in the figure), wherein:

[0127] Step S1031: determine whether the source IP address exists in the preset access control list.

[0128] In this embodiment of the present application, the request information includes a source IP address. A determination is made as to whether the source IP address is in the preset access control list, thereby determining whether the device corresponding to the source IP address has a request information in the history. Assuming that the source IP address of request information A is address A, a determination is made as to whether address A is in the preset access control list, thereby determining whether a request information from address A has been received in the history.

[0129] Step S1032: If it exists, determine the historical request information corresponding to the source IP address, and determine the historical importance level corresponding to the historical request information.

[0130] The historical request information is the request information corresponding to the source IP address in the preset access control list.

[0131] For the embodiment of the present application, when it exists, it indicates that there is a request information corresponding to the source IP address in the history. Therefore, the historical request information corresponding to the source IP address can be determined, and the historical importance level corresponding to the historical request information can be determined, so that it can be judged whether the request information is allowed to access the target process based on the historical importance level and the importance level. Taking step S1031 as an example, the preset access control list includes request information B and request information C for address A. The importance level corresponding to request information B is level 1, and the importance level corresponding to request level C is level 5.

[0132] Step S1033 : Determine the historical request information corresponding to the highest historical importance level as the target historical request information.

[0133] In this embodiment of the present application, the higher the importance level of the request information, the more important the data that the request information can obtain. Since there may be more than one historical request information corresponding to the source IP address in the preset control list, the historical request information corresponding to the highest historical importance level can be determined as the target historical request information. Taking step S1032 as an example, the target historical request information is request information C.

[0134] Step S1034: If the highest historical importance level is not less than the importance level, and the target history request information allows obtaining the target history target data, it is determined that the request information allows obtaining the target data.

[0135] The target history target data is the target data that needs to be obtained by the target history request information.

[0136] For the embodiment of the present application, when the highest historical importance level is not less than the importance level, and the highest historical request information allows the acquisition of the target historical target data, it means that the source IP address has historically allowed the acquisition of target data greater than the current importance level, so it can be determined that the request information allows the acquisition of the target data. Taking step S1032 as an example, the highest historical importance level is level 5, and request information C allows the acquisition of the target data corresponding to request information C, and the importance level of request information A is level 2. The highest historical importance level is not less than the importance level, that is, the A address corresponding to request information A can obtain data with an importance level of 5, then request information A with an importance level of 2 is also allowed to obtain the target data, thereby achieving the effect of determining that the current request information can allow the acquisition of the target data.

[0137] Step S1035 : If the highest historical importance level is less than the importance level, and the target history request information allows obtaining the target history target data, then it is determined that the request information denies obtaining the target data.

[0138] In this embodiment of the present application, assuming that the highest historical importance level is level 1, and the importance level of request information A is level 2, that is, the highest importance level ever accessed by source IP address A corresponding to request information A in the address history is level 1, and since the current importance level of request information A is level 2, which is higher than the highest historical importance level, it can be determined that request information A refuses to obtain the target data. This achieves the effect of determining that request information A cannot obtain the target data.

[0139] In a possible implementation of the embodiment of the present application, step S1031 further includes step S105 (not shown in the figure), step S106 (not shown in the figure), step S107 (not shown in the figure), step S108 (not shown in the figure), and step S109 (not shown in the figure), wherein:

[0140] Step S105: If the target data does not exist, obtain the target data.

[0141] For the embodiment of the present application, when the source IP address does not exist in the preset access control list, it means that the current industrial firewall cannot determine whether the currently received request information is allowed to obtain the target data based on the request information in the preset access control list. When the industrial firewall releases the request information, allowing the request information to enter the industrial control network to obtain the target data, it may cause an attack on the industrial control network. Therefore, when the industrial firewall cannot determine whether the current request information is safe, the industrial firewall can obtain the target data based on the request information. Assuming that the target data to be obtained by request information A is data A, in order to prevent request information A from entering the industrial control network, the industrial firewall can obtain data A in the industrial control network so that data A can be output later, and then determine whether request information A is allowed to pass through the industrial firewall and obtain data A.

[0142] Step S106: Generate data to be output based on the target data and preset label information.

[0143] In the embodiment of the present application, the preset tag information is pre-set tag information, and the preset tag information corresponds to a feedback signal. The output data is generated based on the target data and the preset tag information, so that it is possible to subsequently determine whether the current request information allows the acquisition of the target data based on the output data. Assume that the feedback signal corresponding to the tag information is "I have received it."

[0144] Step S107: outputting the data to be output based on the preset transmission channel.

[0145] The preset transmission channel is the transmission channel corresponding to the target data.

[0146] For the embodiment of the present application, the preset transmission channel is an internal transmission channel set in advance, and the device corresponding to the source IP address of the data to be output can be received through the preset transmission channel, indicating that the network information corresponding to the source IP address can pass through the industrial firewall. The preset tag information is used to control the device to send a feedback signal when a device receives the data to be output. Therefore, the data to be transmitted is output according to the preset transmission channel, so as to facilitate the subsequent judgment of whether the request information A allows the acquisition of data A. Assuming that the preset transmission channel corresponding to data A is channel 1, if the device can receive the data output by channel 1, it means that the device is a device that allows the acquisition of data. Therefore, the data to be output A generated according to data A and the preset tag information is output through channel 1, and it can be judged whether the request information A allows the acquisition of data A.

[0147] Step S108 , determining whether a feedback signal corresponding to the preset tag information is received within a first preset time.

[0148] In this embodiment of the present application, the first preset time is a time set in advance. Assuming that the first preset time is 10 seconds, taking step S106 as an example, assuming that a "I have received" signal is received within 10 seconds, it means that request information A allows acquisition of target data A. If the "I have received" signal is not received within 10 seconds, it means that request information A refuses to acquire data A.

[0149] Step S109: Add the request information and the judgment result to the preset access control list.

[0150] For the embodiment of the present application, the request information and the judgment result are added to the preset access control list, thereby achieving the effect that the industrial firewall can automatically add the request information. Assuming that the judgment result is that a feedback signal is received, indicating that the device of the source IP address corresponding to the current request information A obtains data A, it can be determined that the request information A allows the acquisition of the target data A, that is, the request information A and the permission to obtain data A can be added to the preset access control list. If the judgment result is that no feedback signal is received, indicating that the device of the source IP address corresponding to the current request information A does not obtain data A, it can be determined that the request information A refuses to obtain the target data A, and the request information A and the refusal to obtain data A can be added to the preset access control list. This makes it easier to quickly determine whether the request information A allows the acquisition of data A when the request information A is received again in the future, thereby achieving the effect that the industrial firewall can automatically add the request information.

[0151] In a possible implementation of the embodiment of the present application, step S104 further includes step S110 (not shown in the figure) and step S111 (not shown in the figure), wherein:

[0152] Step S110: If the request information allows the target data to be obtained, and the importance level is greater than the preset importance level, then when it is detected that the request information obtains the target data for the first time, the acquisition time is recorded.

[0153] In this embodiment of the present application, the preset importance level is a pre-set importance level, which serves as a criterion for determining whether the importance level is high. Assuming the preset importance level is 5, when the request information allows access to the target data, and the importance level of the request information is greater than 5, it indicates that the target data to be accessed by the current request information is of high importance, indicating that there may be a risk of information leakage in the industrial control network. Therefore, the time the request information is obtained can be recorded so that it can be subsequently determined whether a risk of information leakage has occurred based on the acquisition time. Assume that the acquisition time is 10 minutes.

[0154] Step S111: If the acquisition time reaches the second preset time, the request information to obtain the target data is rejected, and the request information is output.

[0155] For the embodiment of the present application, the second preset time is a preset time set in advance, which is used as a standard to determine whether the current acquisition time is long. Assuming that the second preset time is 10 minutes, taking step S110 as an example, the acquisition time reaches the second preset time, which means that the device that sends the request information is likely to cause harm to the industrial control network. That is, the request information can be rejected to obtain the target data, and the request information can be output so that network management personnel can promptly view the request information with permission changes, thereby making the protection performance of the industrial firewall better.

[0156] A possible implementation of the embodiment of the present application further includes step S112 (not shown in the figure), step S113 (not shown in the figure), step S114 (not shown in the figure), step S115 (not shown in the figure), and step S116 (not shown in the figure), wherein step S112 may be performed before step S104, wherein,

[0157] Step S112: determine whether there is an association relationship between the target data and the historical target data corresponding to each piece of historical request information.

[0158] For an embodiment of the present application, in the preset access control list, the number of historical request information corresponding to the source IP address may be at least one, and it is determined whether there is an association relationship between the target data and the historical target data corresponding to each historical request information, so as to subsequently determine the total number of request information with an association relationship and the number of request information that are allowed to obtain data.

[0159] Assume that the source IP address of request information A is address A. In the preset access control list, the request information corresponding to address A are request information B, request information C, request information D, and request information E. The corresponding target data are data B, data C, data D, and data E. Determine whether there is an association relationship between data A and data B, data C, data D, and data E respectively.

[0160] Step S113: Acquire the total number of associated historical target data with associated relationships and the number of obtainable data.

[0161] The obtainable data refers to the associated historical target data that is allowed to be obtained from the associated historical target data.

[0162] In this embodiment of the present application, the retrievable data refers to the associated historical target data that is allowed to be retrieved. The total number of associated historical target data with an associated relationship and the number of retrievable data are obtained, so that it can be subsequently determined whether the current request information allows the target data to be retrieved based on the total number and the number. Taking step S112 as an example, assume that data A has an associated relationship with data B, data C, data D, and data E respectively. The total number is 4. Assuming that data B, data C, and data D can each be retrieved by their corresponding request information, the number of retrievable data is 3.

[0163] Step S114: determining a target ratio based on the quantity and the total quantity.

[0164] In the embodiment of the present application, taking step S113 as an example, the quantity 3 can be divided by the total quantity 4 to obtain a target ratio of 75%, so that it can be determined whether the current request information A is allowed to obtain data A based on 75%.

[0165] Step S115 , determining whether the target ratio reaches a preset ratio.

[0166] For the embodiment of the present application, the preset ratio is a ratio set in advance, which serves as a standard for judging whether the current target ratio meets the standard. When the target ratio reaches the preset ratio, it means that most of the historical request information corresponding to the source IP address in the historical records can obtain their respective corresponding target data, so it can be determined that the current request information allows the acquisition of the target data. When the target ratio does not reach the preset ratio, it means that most of the historical request information corresponding to the source IP address in the historical records refuses to obtain their respective corresponding target data, so it can be determined that the current request information refuses to obtain the target data.

[0167] Taking step S114 as an example, assuming the preset ratio is 70%, and the currently calculated target ratio is 75%, which meets the preset ratio, this indicates that address A in request information A is likely to allow access to the target data among the many request information corresponding to it in the past. Therefore, it can be determined that request information A allows access to data A.

[0168] Step S116: Add the request information and the judgment result to the preset access control list.

[0169] For the embodiment of the present application, the judgment result includes the target ratio reaching the preset ratio, indicating that the current request information allows the acquisition of the target data, and the target ratio does not reach the preset ratio, indicating that the current request information refuses to acquire the target data. The request information and the corresponding judgment result are added to the preset access control list, so that when the request information is received again in the future, the industrial firewall can determine whether the request information can pass according to the preset access control list, thereby achieving the effect that the industrial firewall can automatically add the request information. Taking step S115 as an example, if the target ratio reaches the preset ratio, it means that the request information A allows the acquisition of data A, then the request information A allows the acquisition of data A and the request information A can be added to the preset access control list, so that when the request information A is received again in the future, the industrial firewall can determine that the request information A allows the acquisition of data A according to the preset access control list, thereby achieving the effect that the industrial firewall can automatically add the request information A.

[0170] In a possible implementation of the embodiment of the present application, step S1032 further includes step S117 (not shown in the figure), step S118 (not shown in the figure), step S119 (not shown in the figure), and step S120 (not shown in the figure), wherein:

[0171] Step S117: Determine the historical MAC address corresponding to the source IP address based on the historical request information.

[0172] In the embodiments of the present application, many hackers currently attack industrial control networks and may encapsulate their own IP addresses to transform them into IP addresses that can be recognized by industrial firewalls, thereby passing through the industrial firewall and entering the industrial control network. The MAC address is the gateway address of the device corresponding to the IP address and is a geographically located address. Based on historical request information, the historical MAC address corresponding to the A address is determined to be the A1 address, so that the A1 address can be used to determine whether the current A address is the modified address.

[0173] Step S118: Obtain the MAC address of the request information.

[0174] For the embodiment of the present application, the MAC address of the request information A is obtained so as to facilitate the subsequent determination of whether the MAC address is the same as the historical MAC address. Assume that the MAC address of the request information A is A2 address.

[0175] Step S119: Determine whether the MAC address is the same as the historical MAC address.

[0176] In the embodiment of the present application, if the MAC address is the same as the historical MAC address, it means that the A address in the current request information A is the same as the historical A address and has not been modified. If the MAC address is different from the historical MAC address, it means that the A address in the current request information A may not actually be A address, but B address. The hacker has used some means to modify B address to A address to disrupt the identification result of the industrial firewall.

[0177] Step S120: If they are not the same, it is determined that the source IP address is a modified IP address, and the request information is determined to refuse to obtain the target data.

[0178] For the embodiment of the present application, taking step S118 as an example, the MAC address is A2 address, and the historical MAC address is A1 address, indicating that they are different, that is, in the request information A, the A address may be a modified address, so it can be determined that the A address is a modified address, and the request information A is rejected to obtain data A.

[0179] The above embodiment introduces an industrial firewall protection method from the perspective of method flow. The following embodiment introduces an industrial firewall protection device 20 from the perspective of a virtual module or virtual unit. Please refer to the following embodiment for details.

[0180] The embodiment of the present application provides an industrial firewall protection device 20, such as Figure 2 As shown, the industrial firewall protection device 20 may specifically include:

[0181] The first judgment module 201 is used to judge whether the request information exists in the preset access control list when receiving the request information;

[0182] A first determining module 202, configured to determine the importance level of the requested information when the information does not exist;

[0183] The second judgment module 203 is used to judge whether the request information allows the acquisition of target data based on the importance level, and the target data is the data to be acquired by the request information;

[0184] The first adding module 204 is configured to add the request information and the corresponding judgment result to a preset access control list.

[0185] By adopting the above technical solution, when a request message is received, it indicates that the current industrial firewall needs to determine whether the request message can pass. The preset access control list is a permission list set in advance, which includes multiple request messages that can pass through the industrial firewall and multiple request messages that cannot pass through the industrial firewall. The first judgment module 201 determines whether the request message exists in the preset access control list, thereby achieving the effect of determining whether the request message can be recognized by the industrial firewall. When it exists in the preset access control list, it indicates that the industrial firewall can identify whether the request message can pass. When it does not exist in the preset access control list, it indicates that the industrial firewall can identify whether the request message can pass. The industrial firewall cannot identify whether the request information can pass, so the importance level of the request information can be determined by the first determination module 202, so that the second judgment module 203 can judge whether the request information is allowed to obtain the target data based on the importance level, wherein the target data is the data that the request information needs to obtain, so that the subsequent first adding module 204 can add the request information and the corresponding judgment result to the preset access control list, so that when the request information is received again in the future, the industrial firewall can determine whether the request information can pass according to the preset access control list, thereby achieving the effect that the industrial firewall can automatically add the request information.

[0186] In one possible implementation of the embodiment of the present application, the first determining module 202, when determining the importance level of the request information, is specifically configured to:

[0187] Determine the job level information of the user corresponding to the destination IP address;

[0188] Determine the address level of the destination IP address based on the post level information;

[0189] Determine the process information of the destination port number on the device corresponding to the destination IP address, and the process information corresponds to a preset port level;

[0190] The importance level of the request information is obtained by summing the address level and the preset port level.

[0191] In one possible implementation of the embodiment of the present application, the second determination module 203 determines whether the request information allows acquisition of target data based on the importance level, specifically for:

[0192] Determine whether the source IP address exists in the preset access control list;

[0193] If it exists, determine the historical request information corresponding to the source IP address and determine the historical importance level corresponding to the historical request information. The historical request information is the request information corresponding to the source IP address in the preset access control list.

[0194] Determine the historical request information corresponding to the highest historical importance level as the target historical request information;

[0195] If the highest historical importance level is not less than the importance level, and the target history request information allows obtaining the target history target data, then it is determined that the request information allows obtaining the target data, and the target history target data is the target data required to be obtained by the target history request information;

[0196] If the highest historical importance level is less than the importance level, and the target history request information allows obtaining the target history target data, it is determined that the request information denies obtaining the target data.

[0197] In a possible implementation of the embodiment of the present application, the apparatus 20 further includes:

[0198] A first acquisition module, configured to acquire target data when the target data does not exist;

[0199] A generation module is used to generate data to be output based on target data and preset label information;

[0200] A first output module, configured to output the data to be output based on a preset transmission channel, where the preset transmission channel is a transmission channel corresponding to the target data;

[0201] A third judgment module is used to judge whether a feedback signal corresponding to the preset tag information is received within a first preset time;

[0202] The second adding module is used to add the request information and the judgment result to the preset access control list.

[0203] In a possible implementation of the embodiment of the present application, the apparatus 20 further includes:

[0204] a recording module, configured to, when the request information allows acquisition of target data and the importance level is greater than a preset importance level, record an acquisition time if it is detected that the request information acquires the target data for the first time;

[0205] The second output module is used to reject the request information to obtain the target data and output the request information when the acquisition time reaches a second preset time.

[0206] In a possible implementation of the embodiment of the present application, the apparatus 20 further includes:

[0207] A fourth judgment module is used to judge whether there is an association relationship between the target data and the historical target data corresponding to each historical request information;

[0208] A second acquisition module is used to acquire the total number of associated historical target data with an associated relationship and the number of obtainable data, where the obtainable data is the associated historical target data that is allowed to be obtained;

[0209] A third determination module is used to determine a target ratio based on the quantity and the total quantity;

[0210] A fifth judgment module is used to judge whether the target ratio reaches a preset ratio;

[0211] The third adding module is used to add the request information and the judgment result to the preset access control list.

[0212] In a possible implementation of the embodiment of the present application, the apparatus 20 further includes:

[0213] A third determining module is used to determine a historical MAC address corresponding to the source IP address based on historical request information;

[0214] The third acquisition module is used to obtain the MAC address of the request information;

[0215] A sixth judgment module, used to judge whether the MAC address is the same as the historical MAC address;

[0216] The fourth determining module is used to determine that the source IP address belongs to the modified IP address when they are not the same, and to determine that the request information refuses to obtain the target data.

[0217] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-mentioned industrial firewall protection device 20 can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0218] The embodiment of the present application provides an industrial firewall, such as Figure 3 As shown, Figure 3 The illustrated industrial firewall 30 includes a processor 301 and a memory 303. The processor 301 and the memory 303 are connected, for example, via a bus 302. Optionally, the industrial firewall 30 may also include a transceiver 304. It should be noted that in practice, the number of transceivers 304 is not limited to one, and the structure of the industrial firewall 30 does not constitute a limitation on the embodiments of this application.

[0219] Processor 301 can be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 301 can also be a combination that implements computing functions, such as a combination including at least one microprocessor, a combination of a DSP and a microprocessor, etc.

[0220] Bus 302 may include a path for transmitting information between the above components. Bus 302 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. Bus 302 may be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, Figure 3 Only one thick line is used in the diagram, but it does not mean that there is only one bus or one type of bus.

[0221] The memory 303 may be a ROM (Read Only Memory) or other type of static storage device that can store static information and instructions, a RAM (Random Access Memory) or other type of dynamic storage device that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0222] The memory 303 is used to store application code for executing the solution of the present application, and the execution is controlled by the processor 301. The processor 301 is used to execute the application code stored in the memory 303 to implement the content shown in the above method embodiment.

[0223] Industrial firewalls include, but are not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), and in-vehicle terminals (such as in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Servers are also possible. Figure 3 The industrial firewall shown is merely an example and should not limit the functions and scope of use of the embodiments of the present application.

[0224] An embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon. When the computer-readable storage medium is run on a computer, the computer can execute the corresponding contents of the aforementioned method embodiment. Compared with the related art, in the embodiment of the present application, when a request message is received, it indicates that the current industrial firewall needs to determine whether the request message can pass. The preset access control list is a pre-set permission list, which includes multiple request messages that can pass through the industrial firewall and multiple request messages that cannot pass through the industrial firewall. It is determined whether the request message exists in the preset access control list, thereby achieving the effect of determining whether the request message can be recognized by the industrial firewall. When it exists in the preset access control list, it indicates that the industrial firewall can identify whether the request message can pass. When it does not exist in the preset access control list, it indicates that the industrial firewall cannot identify whether the request message can pass. Therefore, the importance level of the request message can be determined, and then whether the request message is allowed to obtain the target data can be determined according to the importance level, wherein the target data is the data that the request message needs to obtain, so that the request information and the corresponding judgment result can be added to the preset access control list later, so that when the request message is received again in the future, the industrial firewall can determine whether the request message can pass according to the preset access control list, thereby achieving the effect that the industrial firewall can automatically add the request information.

[0225] It should be understood that although the steps in the flowcharts of the accompanying drawings are shown in sequence as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the flowcharts of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0226] The above are only some of the implementation methods of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for industrial firewall protection, characterized in that: include: When receiving a request message, determining whether the request message is in a preset access control list, wherein the request message includes a source IP address; If not, determining the importance level of the requested information; Determine whether the source IP address exists in the preset access control list; If so, determining the historical request information corresponding to the source IP address and determining the historical importance level corresponding to the historical request information, wherein the historical request information is the request information corresponding to the source IP address in the preset access control list; Determine the historical request information corresponding to the highest historical importance level as the target historical request information; If the highest historical importance level is not less than the importance level, and the target history request information allows acquisition of the target history target data, then it is determined that the request information allows acquisition of the target data, and the target history target data is the target data required to be acquired by the target history request information; If the highest historical importance level is less than the importance level, and the target history request information allows obtaining the target historical target data, then determining that the request information denies obtaining the target data; the target data is the data required to be obtained by the request information; If not, obtaining the target data; Generate data to be output based on the target data and preset label information; Outputting the data to be output based on a preset transmission channel, where the preset transmission channel is a transmission channel corresponding to the target data; Determine whether a feedback signal corresponding to the preset tag information is received within a first preset time; The request information and the corresponding judgment result are added to the preset access control list.

2. The method for industrial firewall protection according to claim 1, characterized in that: The request information includes the destination IP address and the destination port number; Determining the importance level of the request information includes: Determine the job level information of the user corresponding to the destination IP address; Determine the address level of the destination IP address based on the post level information; Determine the process information of the destination port number on the device corresponding to the destination IP address, wherein the process information corresponds to a preset port level; The importance level of the request information is obtained by summing the address level and the preset port level.

3. The method for industrial firewall protection according to claim 1, characterized in that: The method further comprises: If the request information allows the acquisition of the target data and the importance level is greater than the preset importance level, when it is detected that the request information acquires the target data for the first time, the acquisition time is recorded; If the acquisition time reaches a second preset time, the request information to acquire the target data is rejected, and the request information is output.

4. The method for industrial firewall protection according to claim 1, characterized in that: There is at least one piece of historical request information corresponding to the source IP address, and the method further includes: Determining whether there is an association relationship between the target data and the historical target data corresponding to each piece of historical request information; Acquire the total number of associated historical target data with associated relationships and the number of obtainable data, where the obtainable data is the associated historical target data that is allowed to be obtained from the associated historical target data; determining a target ratio based on the quantity and the total quantity; Determining whether the target ratio reaches a preset ratio; The request information and the judgment result are added to the preset access control list.

5. The industrial firewall protection method according to claim 1, characterized in that: The determining of the historical importance level corresponding to the historical request information further includes: Based on the historical request information, determine the historical MAC address corresponding to the source IP address; Obtain the MAC address of the requested information; Determine whether the MAC address is the same as the historical MAC address; If they are not the same, it is determined that the source IP address is a modified IP address, and it is determined that the request information refuses to obtain the target data.

6. An industrial firewall protection device, characterized in that: include: A first judgment module is used to determine whether the request information is in a preset access control list when receiving the request information, wherein the request information includes a source IP address; a first determining module, configured to determine the importance level of the requested information when the information does not exist; The second judgment module is used to judge whether the source IP address exists in the preset access control list; If it exists, then determine the historical request information corresponding to the source IP address, and determine the historical importance level corresponding to the historical request information, the historical request information is the request information corresponding to the source IP address in the preset access control list; determine the historical request information corresponding to the highest historical importance level as the target historical request information; if the highest historical importance level is not less than the importance level, and the target historical request information allows the acquisition of the target historical target data, then determine that the request information allows the acquisition of the target data, and the target historical target data is the target data that the target historical request information needs to acquire; if the highest historical importance level is less than the importance level, and the target historical request information allows the acquisition of the target historical target data, then determine that the request information refuses to acquire the target data; the target data is the data that the request information needs to acquire; If not, obtaining the target data; Generate data to be output based on the target data and preset label information; Outputting the data to be output based on a preset transmission channel, where the preset transmission channel is a transmission channel corresponding to the target data; Determine whether a feedback signal corresponding to the preset tag information is received within a first preset time; The first adding module is used to add the request information and the corresponding judgment result to the preset access control list.

7. An industrial firewall, characterized in that: It includes: at least one processor; Memory; At least one application, wherein the at least one application is stored in the memory and configured to be executed by the at least one processor, and the at least one application is configured to: execute the industrial firewall protection method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed in a computer, the computer is caused to execute the industrial firewall protection method according to any one of claims 1 to 5.

Images