Method and system for realizing multiple management ports of industrial control firewall by kernel protocol stack

Abstract

The invention discloses a method and a system for realizing multiple management ports of an industrial control firewall through a kernel protocol stack, and relates to the technical field of industrial control security. The method comprises the following steps: creating a plurality of virtual TAP ports for communication between an FW data plane and an FW kernel protocol stack; the FW data plane creates a gateway ARP proxy of the TAP port to proxy an ARP request of an external management port visitor; the FW data plane receives access traffic of an external management port visitor to the FW data plane, and the access traffic is imported into an FW kernel protocol stack through a TAP port; and the FW data plane receives the response flow of the FW kernel protocol stack through the TAP port, and sends the response flow to the external management port visitor. According to the method and the device, the problem that management ports cannot be managed by equipment without hardware management ports is solved, a management method of multiple management ports can be realized, and the multiple management ports can support access of different network segments.

Description

Technical Field

[0001] The present invention relates to the field of industrial control security technology, and in particular to a method for realizing multiple management ports of an industrial control firewall using a kernel protocol stack. Background Art

[0002] In recent years, many relevant laws, regulations and industry standards such as the "Regulations on the Security Protection of Critical Information Infrastructure" have been promulgated, strengthening the state's regulatory requirements for industrial enterprise security compliance. Among the many industrial control security-related products, industrial control firewalls, as the first door to protect the security of industrial control environments, have also achieved rapid growth driven by both policy compliance and market demand.

[0003] Currently, industrial control firewalls generally implement data plane traffic forwarding based on the DPDK forwarding framework, but there are various ways to implement the management port. Some hardware has an independent management port for out-of-band management, and some manufacturers have developed their own user-mode protocol stack to implement management.

[0004] This patent will provide a method for implementing device management using the kernel protocol stack, namely through TUN / TAP virtual network card technology. Summary of the invention

[0005] The present invention provides a method for realizing multiple management ports of an industrial control firewall by using a kernel protocol stack, comprising:

[0006] Create multiple virtual TAP ports for communication between the FW data plane and the FW kernel protocol stack, and configure the kernel default gateway for the FW kernel protocol stack;

[0007] The FW data plane creates a gateway ARP proxy for the TAP port to proxy external ARP requests.

[0008] The FW data plane receives access traffic from external management port visitors to the FW data plane, and imports the access traffic into the FW kernel protocol stack through the TAP port;

[0009] The FW data plane receives the response traffic from the FW kernel protocol stack through the TAP port and sends the response traffic to the external management port access.

[0010] In the method for implementing multiple management ports of an industrial control firewall using a kernel protocol stack as described above, creating a TAP port includes creating a main TAP port and a TAP sub-interface.

[0011] The above-mentioned method for realizing multiple management ports of an industrial control firewall with a kernel protocol stack, wherein the FW data plane receives access traffic from an external management port visitor and imports the access traffic into the FW kernel protocol stack through the TAP port, specifically includes the following sub-steps:

[0012] ARP request initiated by the management port visitor;

[0013] After receiving the ARP request, the FW data plane responds to the ARP request on behalf of the TAP interface and sends the response message out from the service port accordingly.

[0014] After receiving the ARP response, the management port visitor initiates an SSH request to the FW data plane;

[0015] After receiving the SSH request, the FW data plane sends the request to the kernel through the TUN / TAP port.

[0016] As described above, a method for implementing multiple management ports of an industrial control firewall using a kernel protocol stack is described, wherein the FW data plane proxies external ARP requests to the firewall and proxies kernel gateway ARP requests.

[0017] As described above, a kernel protocol stack implements a method for implementing multiple management ports of an industrial control firewall, wherein the FW data plane proxies external ARP requests, specifically, the FW data plane replies to ARP requests for accessing the FW data plane.

[0018] As described above, a kernel protocol stack implements a method for multiple management ports of an industrial control firewall, wherein the FW data plane parses the response traffic from the FW kernel protocol stack, queries the data plane static routing table and policy routing table according to the destination IP address, and sends the response traffic out from the determined service port according to the routing table.

[0019] The present invention also provides a system for realizing multiple management ports of an industrial control firewall by using a kernel protocol stack, comprising: a FW data plane, a FW kernel protocol stack and an external management port visitor, wherein:

[0020] FW kernel protocol stack configures kernel gateway;

[0021] The external management port accessor sends an ARP request to the FW data plane;

[0022] Multiple virtual TAP ports are created between the FW data plane and the FW kernel protocol stack. The FW data plane creates a gateway ARP proxy for the TAP port to proxy external ARP requests. The FW data plane receives access traffic from external management port visitors to the FW data plane, and imports the access traffic into the FW kernel protocol stack through the TAP port. The FW data plane receives the response traffic from the FW kernel protocol stack through the TAP port, and sends the response traffic to the external management port visitor.

[0023] As described above, a kernel protocol stack implements a system with multiple management ports of an industrial control firewall, wherein the FW data plane proxies external ARP requests to the firewall and proxies kernel gateway ARP requests.

[0024] The present invention also provides a computer storage medium, characterized in that it comprises: at least one memory and at least one processor;

[0025] The memory is used to store one or more program instructions;

[0026] The processor is used to run one or more program instructions to execute any of the above-mentioned methods for implementing multiple management ports of an industrial control firewall using a kernel protocol stack.

[0027] The beneficial effects achieved by the present invention are as follows: the present invention solves the problem that a device without a hardware management port cannot perform management of the management port, can implement a multiple management port management method, and multiple management ports can support access to different network segments. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0029] Figure 1 This is a flow chart of a method for implementing multiple management ports of an industrial control firewall using a kernel protocol stack provided in Embodiment 1 of the present application;

[0030] Figure 2 It is a kernel protocol stack that implements the thread execution graph of multiple management ports of industrial control firewalls;

[0031] Figure 3 This is an example diagram of how the industrial control firewall kernel protocol stack implements multiple management ports. DETAILED DESCRIPTION

[0032] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0033] Embodiment 1

[0034] like Figure 1 and Figure 2 As shown, the first embodiment of the present invention provides a method for implementing multiple management ports of an industrial control firewall using a kernel protocol stack, including:

[0035] Step 110: Create multiple virtual TAP ports for communication between the FW data plane and the FW kernel protocol stack;

[0036] Take the industrial control firewall system using the DPDK forwarding framework as an example. Figure 3This is an example of how the industrial control firewall kernel protocol stack implements multiple management ports. Assumptions:

[0037] (1) The firewall's ETH1, ETH2, and ETH3 ports are enabled as management ports, and their IP addresses are 192.168.10.5, 192.168.20.5, and 192.168.30.5, respectively;

[0038] (2) The firewall data plane routing configuration is shown in Table 1 below:

[0039] Table 1 Firewall data plane routing configuration table

[0040] Destination Address Subnet Mask Outbound interface Next hop 17.17.17.5 24 ETH3 192.168.30.2

[0041] (3) Administrator visitor PC-17.17.17.10 accesses the firewall management port 192.168.20.5 through the SSH protocol.

[0042] Creating a TAP port includes creating a main TAP port and a TAP sub-interface. Specifically, the firewall creates three virtual ports, tap0, tap0:1, and tap0:2, with IP addresses of 192.168.10.5, 192.168.20.5, and 192.168.30.5, respectively. Tap0 is the main TAP port, and tap0:1 and tap0:2 are TAP sub-interfaces.

[0043] Step 120: The FW data plane creates a gateway ARP proxy for the TAP port to proxy external ARP requests.

[0044] Specifically, the FW data plane creates a gateway ARP proxy for the TAP port to proxy external ARP requests, that is, the FW data plane replies to the ARP request for accessing the management port.

[0045] The FW data plane receives access traffic from external management port visitors to the FW data plane and imports the access traffic into the FW kernel protocol stack through the TAP port. The specific steps include the following:

[0046] Step 121: ARP request initiated by the management port visitor;

[0047] In the above example, the management port visitor PC-17.17.17.10 initiates an ARP request to the firewall management port 192.168.20.5 from the firewall ETH3 side.

[0048] Step 122: After receiving the ARP request, the FW data plane responds to the ARP request on behalf of the TAP interface and sends the response message out from the service port accordingly.

[0049] Step 123: After receiving the ARP response, the management port visitor initiates an SSH request to the FW data plane.

[0050] Step 124: After receiving the SSH request, the FW data plane sends the request to the kernel through the TUN / TAP port.

[0051] Return to see Figure 1 , step 130, the FW data plane receives access traffic from the external management port visitor to the FW data plane, and imports the access traffic into the FW kernel protocol stack through the TAP port;

[0052] Specifically, the FW data plane in the FW data plane imports the access traffic to the FW data plane into the FW kernel protocol stack through the TUN / TAP port. The FW data plane acts as a proxy for the kernel gateway and responds to the FW kernel protocol stack's ARP request to the gateway.

[0053] The FW data plane imports access traffic into the FW kernel protocol stack through the TAP port, which includes the following sub-steps:

[0054] Step 131, the FW kernel protocol stack finds that the visitor and the local management port IP are not in the same network segment, and sends an ARP broadcast to obtain the gateway's MAC address.

[0055] In the above example, the firewall data plane will respond to the gateway ARP request of the tap port.

[0056] Step 132: After receiving the ARP response from the gateway, the FW kernel protocol stack sends an SSH response message through the tap port.

[0057] Return to see Figure 1 , step 140, the FW data plane receives the response traffic of the FW kernel protocol stack through the TAP port, and sends the response traffic to the external management port visitor.

[0058] Specifically, the FW data plane parses the response traffic (SSH response message) coming out of the FW kernel protocol stack, checks the data plane routing table, policy routing table, etc., and sends the response traffic out from the determined service port (ETH3) according to the routing table.

[0059] Embodiment 2

[0060] Embodiment 2 of the present invention provides a system for implementing multiple management ports of an industrial control firewall using a kernel protocol stack, including: a FW data plane, a FW kernel protocol stack, and an external management port visitor, wherein:

[0061] The FW kernel protocol stack configures the kernel gateway to receive access traffic from the FW data plane. When there is no MAC address of the management port visitor, the FW kernel protocol stack sends an ARP request to the kernel gateway, and the FW data plane proxies the kernel gateway ARP request.

[0062] The external management port accessor sends an ARP request to the FW data plane;

[0063] Multiple virtual TAP ports are created between the FW data plane and the FW kernel protocol stack. The FW data plane creates a gateway ARP proxy for the TAP port to proxy external ARP requests. The FW data plane receives access traffic from external management port visitors to the FW data plane, and imports the access traffic into the FW kernel protocol stack through the TAP port. The FW data plane receives the response traffic from the FW kernel protocol stack through the TAP port, and sends the response traffic to the external management port visitor.

[0064] The creation of a TAP port includes the creation of a main TAP port and a TAP sub-interface.

[0065] The FW data plane proxies external ARP requests and the kernel's gateway ARP requests. The FW data plane proxies external ARP requests, specifically, the FW data plane replies to ARP requests that access the FW data plane.

[0066] The FW data plane receives access traffic from external management port visitors, and imports the access traffic into the FW kernel protocol stack through the TAP port, including: ARP request initiated by management port visitors; after receiving the ARP request, the FW data plane responds to the ARP request on behalf of the TAP interface, and sends the response message from the corresponding service port; after receiving the ARP response, the management port visitor initiates an SSH request to the FW data plane; after receiving the SSH request, the FW data plane sends the request to the kernel through the TUN / TAP port. The FW data plane parses the response traffic from the FW kernel protocol stack, queries the data plane static routing table, policy routing table, etc. according to the destination IP address, and sends the response traffic from the determined service port (ETH3) according to the routing table.

[0067] Corresponding to the above embodiment, an embodiment of the present invention provides a computer storage medium, including: at least one memory and at least one processor;

[0068] The memory is used to store one or more program instructions;

[0069] The processor is used to run one or more program instructions to execute a method for realizing multiple management ports of an industrial control firewall using a kernel protocol stack.

[0070] Corresponding to the above embodiments, an embodiment of the present invention provides a computer-readable storage medium, which contains one or more program instructions, and the one or more program instructions are used by a processor to execute a method for implementing multiple management ports of an industrial control firewall using a kernel protocol stack.

[0071] The embodiment disclosed in the present invention provides a computer-readable storage medium, in which computer program instructions are stored. When the computer program instructions are executed on a computer, the computer executes the above-mentioned method of implementing multiple management ports of an industrial control firewall using a kernel protocol stack.

[0072] In the embodiment of the present invention, the processor may be an integrated circuit chip having the ability to process signals. The processor may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0073] The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present invention can be directly embodied as a hardware decoding processor for execution, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The processor reads the information in the storage medium and completes the steps of the above method in combination with its hardware.

[0074] The storage medium may be a memory, which may be, for example, a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memory.

[0075] Among them, the non-volatile memory can be a read-only memory (ROM), a programmable ROM (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory.

[0076] The volatile memory may be a random access memory (RAM) which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDRSDRAM), enhanced synchronous DRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM bus DRAM (DRRAM).

[0077] The storage media described in the embodiments of the present invention are intended to include, but are not limited to, these and any other suitable types of memory.

[0078] Those skilled in the art will appreciate that in one or more of the above examples, the functions described in the present invention can be implemented using a combination of hardware and software. When software is used, the corresponding functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any media that facilitates the transmission of computer programs from one place to another. Storage media can be any available media that can be accessed by general or special-purpose computers.

[0079] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for realizing multiple management ports of industrial control firewall by using kernel protocol stack, characterized in that: include: Create multiple virtual TAP ports for communication between the FW data plane and the FW kernel protocol stack; The FW data plane creates a gateway ARP proxy for the TAP port, which acts as a proxy for ARP requests from external management port visitors. The FW data plane receives access traffic from external management port visitors to the FW data plane, and imports the access traffic into the FW kernel protocol stack through the TAP port; The FW data plane receives the response traffic from the FW kernel protocol stack through the TAP port and sends the response traffic to the external management port access.

2. The method for implementing multiple management ports of an industrial control firewall using a kernel protocol stack as claimed in claim 1, characterized in that: Creating a TAP port includes creating a main TAP port and a TAP sub-interface.

3. The method for realizing multiple management ports of industrial control firewall by using a kernel protocol stack as claimed in claim 1, characterized in that: The FW data plane proxies the ARP requests of external management port visitors to the firewall, and the gateway ARP requests of the proxy kernel.

4. A method for implementing multiple management ports of an industrial control firewall using a kernel protocol stack as claimed in claim 3, characterized in that: The FW data plane receives access traffic from external management port visitors and imports the access traffic into the FW kernel protocol stack through the TAP port. The specific steps include the following: ARP request initiated by the management port visitor; After receiving the ARP request, the FW data plane responds to the ARP request on behalf of the TAP interface and sends the response message out from the service port accordingly. After receiving the ARP response, the management port visitor initiates an SSH request to the FW data plane; After receiving the SSH request, the FW data plane sends the request to the kernel through the TUN / TAP port.

5. The method for realizing multiple management ports of industrial control firewall by using a kernel protocol stack as claimed in claim 4, characterized in that: The FW data plane proxies the ARP requests of external management port visitors to the firewall, as well as the gateway ARP requests of the proxy kernel. Specifically, the FW data plane replies to the ARP requests for accessing the firewall.

6. A method for implementing multiple management ports of an industrial control firewall using a kernel protocol stack as claimed in claim 5, characterized in that: Configure the kernel default gateway for the FW kernel protocol stack. When there is no MAC address of the management port visitor, the FW kernel protocol stack will send an ARP request to the kernel default gateway. The FW data plane will proxy the kernel gateway ARP request.

7. A method for implementing multiple management ports of an industrial control firewall using a kernel protocol stack as claimed in claim 4, characterized in that: The FW data plane parses the response traffic from the FW kernel protocol stack, queries the data plane static routing table according to the destination IP address, and sends the response traffic out from the determined service port according to the routing table.

8. A system for realizing multiple management ports of industrial control firewalls using a kernel protocol stack, characterized in that: include: FW data plane, FW kernel protocol stack, and external management port access, including: FW kernel protocol stack configures kernel default gateway; The external management port accessor sends an ARP request to the FW data plane; Multiple virtual TAP ports are created between the FW data plane and the FW kernel protocol stack. The FW data plane creates a gateway ARP proxy for the TAP port to proxy external ARP requests. The FW data plane receives access traffic from external management port visitors to the FW data plane, and imports the access traffic into the FW kernel protocol stack through the TAP port. The FW data plane receives the response traffic from the FW kernel protocol stack through the TAP port, and sends the response traffic to the external management port visitor.

9. A system for realizing multiple management ports of industrial control firewalls using a kernel protocol stack as claimed in claim 8, characterized in that: The FW data plane proxies external ARP requests to the firewall and the kernel's gateway ARP requests.

10. A computer storage medium, characterized in that: include: at least one memory and at least one processor; The memory is used to store one or more program instructions; A processor is used to run one or more program instructions to execute a method for implementing multiple management ports of an industrial control firewall using a kernel protocol stack as described in any one of claims 1 to 8.

Images