Execution method and device of industrial security gateway, gateway and storage medium

Abstract

The invention discloses an industrial security gateway execution method and device, a gateway and a storage medium, and the method comprises the steps: determining a routing mode corresponding to a network data packet according to the routing information corresponding to the destination address of the network data packet after the network data packet is received; if the routing mode corresponding to the network data packet is to send the network data packet to a local machine, processing the network data packet through an IPSec VPN technology and a local security alliance; and if the routing mode corresponding to the network data packet is routing forwarding, processing the network data packet according to a pre-established industrial control protocol connection state table and an industrial control protocol deep filtering rule. According to the technical scheme, the legality of the industrial control instruction can be strictly guaranteed, and the timeliness requirement of the industrial control instruction is met.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an execution method, device, gateway and storage medium of an industrial security gateway. Background Art

[0002] With the popularization of computer technology, industrial control systems have gradually become digitalized, and digital computers have begun to be used to replace traditional controllers to achieve a higher level of automation and intelligence. Industrial control systems are usually distributed in different geographical locations. With the help of Virtual Private Network (VPN), encryption and tunneling technology can be used to ensure the confidentiality and integrity of data transmission to prevent unauthorized access and data leakage. However, when the VPN identity credentials are leaked, the VPN can ensure the secure transmission of industrial control instructions, but cannot guarantee their legitimacy. Therefore, it is necessary to impose legal constraints on all industrial control instructions sent to industrial sites.

[0003] In the prior art, when the legality constraints are imposed on industrial control instructions, the industrial security gateway can respond to the security policy configured by the user. However, the existing security policy only includes the source IP address, destination IP address, source port, destination port and processing action, and does not include constraints on the application layer fields of the data packet, which cannot meet the requirements of industrial control security for strict review of industrial control instructions. Another method is to first send the data from the kernel state to the industrial control protocol engine in the user state when parsing the data packet for industrial control protocol, and then send the parsing result to the kernel after parsing and comparing with the policy. However, when the network traffic is large, the performance overhead of context switching is large in this implementation method. Since industrial control instructions are more sensitive to timeliness, this method may not meet the requirements of industrial control scenarios. Summary of the invention

[0004] The present invention provides an execution method, device, gateway and storage medium of an industrial security gateway, which can strictly ensure the legality of industrial control instructions and meet the timeliness requirements of industrial control instructions.

[0005] According to one aspect of the present invention, a method for executing an industrial security gateway is provided, the method comprising:

[0006] After receiving the network data packet, determining the routing mode corresponding to the network data packet according to the routing information corresponding to the destination address of the network data packet;

[0007] If the routing mode corresponding to the network data packet is to send it to the local machine, the network data packet is processed by VPN technology based on Internet Protocol Security (IPSec) and a local security association;

[0008] If the routing mode corresponding to the network data packet is routing forwarding, the network data packet is processed according to a pre-established industrial control protocol connection status table and an industrial control protocol deep filtering rule.

[0009] Optionally, the network data packet is processed by IPSec VPN technology and a local security association, including:

[0010] Determine whether the network data packet is a tunnel encrypted message encapsulated by IPSec VPN;

[0011] If yes, matching the network data packet through the local security alliance and processing the network data packet according to the matching result;

[0012] If not, the network data packet is sent to the local computer.

[0013] Optionally, matching the network data packet through a local security alliance, and processing the network data packet according to the matching result, includes:

[0014] By means of a local security association, judging whether the network data packet is a data packet transmitted by the IPSec VPN tunnel of the gateway according to the attribute information corresponding to the network data packet;

[0015] If yes, decrypt the network data packet according to the tunnel encryption algorithm negotiated in the local security association, re-enter the decrypted data packet into the network protocol stack, and then return to perform the operation of determining the routing mode corresponding to the network data packet;

[0016] If not, the network data packet is discarded.

[0017] Optionally, the network data packet is processed according to a pre-established industrial control protocol connection status table and an industrial control protocol deep filtering rule, including:

[0018] In the industrial control protocol connection status table, query whether there is connection information corresponding to the network data packet;

[0019] If so, the network data packet is processed according to the pre-established industrial control protocol deep filtering rules;

[0020] If not, query whether there is rule information corresponding to the network data packet in the industrial control rule list pre-configured by the user;

[0021] If so, the network data packet is processed according to the pre-established industrial control protocol deep filtering rules;

[0022] If not, the network data packet is discarded.

[0023] Optionally, the network data packet is processed according to a pre-established industrial control protocol deep filtering rule, including:

[0024] According to the industrial control protocol, the application layer data of the network data packet is parsed to obtain the data packet parsing result;

[0025] Compare the data packet analysis results with the industrial control rules pre-configured by the user one by one to determine whether the network data packet matches the industrial control protocol deep filtering rules;

[0026] If yes, matching the network data packet through the local security alliance and processing the network data packet according to the matching result;

[0027] If not, the network data packet is discarded.

[0028] Optionally, matching the network data packet through a local security alliance, and processing the network data packet according to the matching result, includes:

[0029] Determining whether the quintuple of the network data packet matches a protection subnet in a local security association;

[0030] If yes, encrypt and encapsulate the network data packet according to the tunnel encryption algorithm negotiated in the local security association, and then forward the encrypted and encapsulated network data packet;

[0031] If not, the network data packet is directly forwarded.

[0032] According to another aspect of the present invention, there is provided an execution device of an industrial security gateway, the device comprising:

[0033] A data packet receiving module, configured to determine, after receiving a network data packet, a routing mode corresponding to the network data packet according to routing information corresponding to a destination address of the network data packet;

[0034] The local sending module is used to process the network data packet through the virtual private network IPSec VPN technology based on the network data transmission security protocol and the local security alliance if the routing mode corresponding to the network data packet is to send it to the local machine;

[0035] The routing forwarding module is used to process the network data packet according to a pre-established industrial control protocol connection status table and an industrial control protocol deep filtering rule if the routing mode corresponding to the network data packet is routing forwarding.

[0036] According to another aspect of the present invention, an industrial security gateway is provided, the industrial security gateway comprising:

[0037] at least one processor; and

[0038] a memory communicatively connected to the at least one processor; wherein,

[0039] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the execution method of the industrial security gateway described in any embodiment of the present invention.

[0040] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the execution method of the industrial security gateway described in any embodiment of the present invention when executed.

[0041] The technical solution provided by the embodiment of the present invention determines the routing mode corresponding to the network data packet according to the routing information corresponding to the destination address of the network data packet after receiving the network data packet. If the routing mode corresponding to the network data packet is to send to the local machine, the network data packet is processed by IPSec VPN technology and local security alliance. If the routing mode corresponding to the network data packet is routing forwarding, the technical means for processing the network data packet is based on the pre-established industrial control protocol connection state table and the industrial control protocol deep filtering rules. The industrial control protocol deep filtering can be deeply combined with the virtual private network. While the industrial control instructions rely on identity authentication and data encryption technology for secure transmission, the legality of the industrial control instructions is strictly guaranteed, and various security threats that the industrial control system may face are eliminated to the maximum extent. Secondly, the execution method provided by the present embodiment can be directly applied to the routing forwarding of the local area network inside the gateway, which is relatively flexible and universal, and does not require repeated policy configuration. The industrial control protocol deep filtering security policy will only generate context switching overhead when it is sent to the kernel. When the data packet is deeply filtered, there is no additional performance overhead, thereby meeting the timeliness requirements of the industrial control instructions.

[0042] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0044] Figure 1a is a flowchart of an execution method of an industrial security gateway provided according to an embodiment of the present invention;

[0045] Figure 1b is a schematic diagram of a system structure corresponding to an industrial security gateway provided according to an embodiment of the present invention;

[0046] Figure 2 is a flowchart of another execution method of an industrial security gateway provided according to an embodiment of the present invention;

[0047] Figure 3 is a structural schematic diagram of an execution device of an industrial security gateway provided according to an embodiment of the present invention;

[0048] Figure 4 It is a structural diagram of an industrial security gateway that implements the execution method of the industrial security gateway according to an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0050] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0051] Figure 1a The flowchart of an execution method of an industrial security gateway provided by an embodiment of the present invention is applicable to the case where the industrial security gateway constrains the legality of industrial control instructions. The method can be executed by the execution device of the industrial security gateway. The execution device of the industrial security gateway can be implemented in the form of hardware and / or software. The execution device of the industrial security gateway can be configured in the industrial security gateway. Figure 1a As shown, the method includes:

[0052] Step 110: After receiving the network data packet, determine the routing mode corresponding to the network data packet according to the routing information corresponding to the destination address of the network data packet.

[0053] In a specific embodiment, Figure 1b is a schematic diagram of the system structure corresponding to the industrial security gateway, such as Figure 1b As shown, the industrial security gateway may include an IPSec VPN tunnel policy module, an IPSec VPN tunnel negotiation module, an IPSec VPN security alliance module, an industrial control protocol security policy module, an industrial control protocol connection status module, and an industrial control protocol deep filtering module.

[0054] Among them, the IPSec VPN tunnel policy module, IPSec VPN tunnel negotiation module and industrial control protocol security policy module are deployed in the user state of the industrial security gateway; the IPSec VPN security alliance module, industrial control protocol connection status module and industrial control protocol deep filtering module are deployed in the kernel state of the industrial security gateway.

[0055] The IPSec VPN tunnel policy module is used to provide users with a tunnel policy configuration interface and send the user-configured tunnel policy to the tunnel negotiation module. Specifically, users can configure tunnel authentication mode, protection subnet, IKE (Internet Key Exchange) algorithm proposal, IPSec algorithm proposal, DPD (Dead Peer Detection) and other parameters through the IPSec VPN tunnel policy module.

[0056] The IPSec VPN tunnel negotiation module is used to receive all tunnel policies configured by users, negotiate and establish IKE SA (Internet Key Exchange Security Association) and IPSec SA (Security Association), and then send the negotiated tunnel encryption algorithm and tunnel policy to the kernel.

[0057] The IPSec VPN security association module is used to compare the received data packet with the IKE SA. If a match is found, the data packet is decrypted using the encryption algorithm, transmission mode, and encapsulation method determined by the IPSec SA negotiation, and re-enters the network stack. The IPSec VPN security association module is also used to compare the sent data packet with the IPSec SA. If a match is found, the data packet is encrypted and encapsulated using the encryption algorithm, transmission mode, and encapsulation method determined by the IPSec SA negotiation.

[0058] The industrial control protocol security policy module is used to provide users with a configuration interface for industrial control policies, send the five-tuple information in the industrial control policies to the industrial control protocol connection status module, and send the application layer constraint fields related to the industrial control protocol to the industrial control protocol deep filtering module.

[0059] The industrial control protocol connection status module is used to receive the industrial control policies issued by the user state, manage and maintain the connection status table, and perform preliminary filtering of data packets through quintuple information.

[0060] The industrial control protocol deep filtering module is used to receive the industrial control policy issued by the user state, parse the application layer data of the data packet according to the industrial control protocol, and then match the protocol field with the industrial control policy to achieve deep filtering of the data packet.

[0061] Step 120: If the routing mode corresponding to the network data packet is to send it to the local computer, the network data packet is processed by using IPSec VPN technology and a local security association.

[0062] In this embodiment, optionally, if the routing mode corresponding to the network data packet is to send it to the local device, the network data packet can be processed according to the above-mentioned IPSec VPN tunnel policy module, IPSec VPN tunnel negotiation module and IPSec VPN security association module.

[0063] Step 130: If the routing mode corresponding to the network data packet is routing forwarding, the network data packet is processed according to a pre-established industrial control protocol connection status table and an industrial control protocol deep filtering rule.

[0064] In this embodiment, optionally, if the routing mode corresponding to the network data packet is routing forwarding, the network data packet can be processed according to the above-mentioned industrial control protocol connection status module, industrial control protocol deep filtering module, IPSec VPN security alliance module and industrial control protocol security policy module.

[0065] In this embodiment, in the kernel processing path of IPSec VPN tunnel data packet forwarding, in addition to the common check of data packet connection status, an additional deep check of each field of the industrial control protocol of the data packet application layer is added. According to the field characteristics of different industrial control protocols, a security policy with perfect constraints is defined. After the user-configured policy is sent to the kernel, it is managed and maintained by the corresponding industrial control protocol filtering submodule. After the data packet connection status check is completed, it is sent to the corresponding industrial control module for analysis and comparison with the security policy, thereby realizing the combination of virtual private network and industrial control protocol deep filtering.

[0066] The technical solution provided by the embodiment of the present invention determines the routing mode corresponding to the network data packet according to the routing information corresponding to the destination address of the network data packet after receiving the network data packet. If the routing mode corresponding to the network data packet is to send to the local machine, the network data packet is processed by IPSec VPN technology and local security alliance. If the routing mode corresponding to the network data packet is routing forwarding, the technical means for processing the network data packet is based on the pre-established industrial control protocol connection state table and the industrial control protocol deep filtering rules. The industrial control protocol deep filtering can be deeply combined with the virtual private network. While the industrial control instructions rely on identity authentication and data encryption technology for secure transmission, the legality of the industrial control instructions is strictly guaranteed, and various security threats that the industrial control system may face are eliminated to the maximum extent. Secondly, the execution method provided by the present embodiment can be directly applied to the routing forwarding of the local area network inside the gateway, which is relatively flexible and universal, and does not require repeated policy configuration. The industrial control protocol deep filtering security policy will only generate context switching overhead when it is sent to the kernel. When the data packet is deeply filtered, there is no additional performance overhead, thereby meeting the timeliness requirements of the industrial control instructions.

[0067] Figure 2 A flowchart of another method for executing an industrial security gateway provided by an embodiment of the present invention is shown in FIG. Figure 2 As shown, the method includes:

[0068] Step 201: Receive a network data packet.

[0069] Step 202, after receiving the network data packet, determine whether the routing mode corresponding to the network data packet is routing forwarding according to the routing information corresponding to the destination address of the network data packet, if so, execute step 203, if not, execute step 211.

[0070] Step 203 , query whether there is connection information corresponding to the network data packet in the industrial control protocol connection status table, if so, execute step 204 , if not, execute step 205 .

[0071] In this embodiment, specifically, the network data packet can be first queried and compared in the industrial control protocol connection status table. If the connection information corresponding to the network data packet exists, the subsequent processing process is performed. If not, the query and comparison is continued in the industrial control rule list configured by the user. If it matches, the subsequent processing process is performed. If it does not match, the data packet is discarded.

[0072] In this embodiment, if the connection information corresponding to the network data packet exists in the industrial control protocol connection status table, the network data packet is processed according to the pre-established industrial control protocol deep filtering rule.

[0073] Step 204: parse the application layer data of the network data packet according to the industrial control protocol to obtain a data packet parsing result.

[0074] Step 205 , query whether there is rule information corresponding to the network data packet in the industrial control rule list pre-configured by the user, if so, execute step 204 , if not, execute step 208 .

[0075] In this embodiment, if the rule information corresponding to the network data packet exists in the industrial control rule list pre-configured by the user, the network data packet is processed according to the pre-established industrial control protocol deep filtering rule.

[0076] Step 206, compare the data packet analysis results with the industrial control rules pre-configured by the user one by one to determine whether the network data packet matches the industrial control protocol deep filtering rules. If so, execute step 207, if not, execute step 208.

[0077] In this embodiment, specifically, in the industrial control protocol deep filtering module, according to the field characteristics of different industrial control protocols, the module has multiple sub-modules corresponding to different industrial control protocols, and the industrial control rules configured by the user can be distributed to different sub-modules according to the protocol for management.

[0078] After the network data packet passes the connection status filter, it will be sent to the corresponding industrial control filtering sub-module according to the protocol type. In the sub-module, the application layer data of the data packet is parsed according to the protocol, and the configured industrial control rules are compared with the parsed field values ​​one by one. If all match, the data packet will be released, otherwise the data packet will be discarded.

[0079] In this embodiment, if the network data packet matches the industrial control protocol deep filtering rule, the quintuple of the network data packet can be matched through the local security alliance, and the network data packet can be processed according to the matching result.

[0080] Step 207 , determine whether the quintuple of the network data packet matches the protection subnet in the local security association, if so, execute step 209 , if not, execute step 210 .

[0081] Step 208: discard the network data packet.

[0082] Step 209: Encrypt and encapsulate the network data packet according to the tunnel encryption algorithm negotiated in the local security association.

[0083] In this embodiment, if the quintuple of the network data packet matches the protected subnet in the local security association, it means that the network data packet needs to be transmitted through the IPSec VPN secure tunnel, so the network data packet can be encrypted and encapsulated according to the algorithm, protocol type and transmission mode negotiated in the local security association.

[0084] Step 210: forward the network data packet.

[0085] In this embodiment, if the quintuple of the network data packet matches the protected subnet in the local security alliance, the network data packet is encrypted and encapsulated according to the tunnel encryption algorithm negotiated in the local security alliance, and then the encrypted and encapsulated network data packet is forwarded; if it does not match, the network data packet is directly forwarded.

[0086] Step 211, determine whether the network data packet is a tunnel encrypted message encapsulated by IPSec VPN, if so, execute step 212, if not, execute step 214.

[0087] In this step, specifically, it can be determined whether it is a tunnel encryption message encapsulated by IPSecVPN according to the protocol type of the network data packet.

[0088] In this embodiment, if the network data packet is a tunnel encrypted message encapsulated by IPSec VPN, the network data packet can be matched through the local security association, and the network data packet can be processed according to the matching result.

[0089] Step 212: through the local security association, according to the attribute information corresponding to the network data packet, determine whether the network data packet is a data packet transmitted by the IPSec VPN tunnel of this gateway; if so, execute step 213, and then return to execute the operation of determining the routing method corresponding to the network data packet; if not, execute step 208.

[0090] In this step, specifically, it can be determined whether the network data packet is a data packet transmitted by the IPSec VPN tunnel of the gateway according to the IP address, protocol type, etc. corresponding to the network data packet.

[0091] Step 213: decrypt the network data packet according to the tunnel encryption algorithm negotiated in the local security association, and re-enter the decrypted data packet into the network protocol stack.

[0092] Step 214: Send the network data packet to the local computer.

[0093] The technical solution provided by the embodiment of the present invention, after receiving a network data packet, if the routing mode is routing forwarding, then query whether there is connection information corresponding to the network data packet, if so, parse the application layer data of the network data packet, and compare the data packet parsing result with the industrial control rules pre-configured by the user one by one to determine whether the network data packet matches the industrial control protocol deep filtering rule, if so, determine whether the five-tuple of the network data packet matches the protection subnet in the local security alliance, if so, encrypt and encapsulate the network data packet according to the tunnel encryption algorithm negotiated in the local security alliance, and forward the encrypted and encapsulated network data packet; if the routing mode is to send to the local machine, then determine whether the network data packet is a tunnel encrypted message encapsulated by IPSec VPN, if so, determine whether the network data packet is a data packet transmitted by the IPSecVPN tunnel of this gateway, if so, decrypt the network data packet according to the tunnel encryption algorithm negotiated in the local security alliance, and re-enter the decrypted data packet into the network protocol stack. The technical means can strictly ensure the legality of the industrial control instructions and meet the timeliness requirements of the industrial control instructions.

[0094] Figure 3 A schematic diagram of the structure of an execution device of an industrial security gateway provided by an embodiment of the present invention, wherein the device is applied to an industrial security gateway, such as Figure 3 As shown, the device includes: a data packet receiving module 310, a local sending module 320 and a routing forwarding module 330.

[0095] The data packet receiving module 310 is used to determine the routing mode corresponding to the network data packet according to the routing information corresponding to the destination address of the network data packet after receiving the network data packet;

[0096] The local sending module 320 is used to process the network data packet through the virtual private network IPSec VPN technology based on the network data transmission security protocol and the local security alliance if the routing mode corresponding to the network data packet is to send it to the local device;

[0097] The routing forwarding module 330 is used to process the network data packet according to the pre-established industrial control protocol connection status table and the industrial control protocol deep filtering rules if the routing mode corresponding to the network data packet is routing forwarding.

[0098] The technical solution provided by the embodiment of the present invention determines the routing mode corresponding to the network data packet according to the routing information corresponding to the destination address of the network data packet after receiving the network data packet. If the routing mode corresponding to the network data packet is to send to the local machine, the network data packet is processed by IPSec VPN technology and local security alliance. If the routing mode corresponding to the network data packet is routing forwarding, the technical means for processing the network data packet is based on the pre-established industrial control protocol connection state table and the industrial control protocol deep filtering rules. The industrial control protocol deep filtering can be deeply combined with the virtual private network. While the industrial control instructions rely on identity authentication and data encryption technology for secure transmission, the legality of the industrial control instructions is strictly guaranteed, and various security threats that the industrial control system may face are eliminated to the maximum extent. Secondly, the execution method provided by the present embodiment can be directly applied to the routing forwarding of the local area network inside the gateway, which is relatively flexible and universal, and does not require repeated policy configuration. The industrial control protocol deep filtering security policy will only generate context switching overhead when it is sent to the kernel. When the data packet is deeply filtered, there is no additional performance overhead, thereby meeting the timeliness requirements of the industrial control instructions.

[0099] Based on the above embodiment, the local sending module 320 includes:

[0100] The encrypted message judgment unit is used to judge whether the network data packet is a tunnel encrypted message encapsulated by IPSec VPN; if so, match the network data packet through the local security association and process the network data packet according to the matching result; if not, send the network data packet to the local machine;

[0101] The security association matching unit is used to determine whether the network data packet is a data packet transmitted by the IPSec VPN tunnel of this gateway according to the attribute information corresponding to the network data packet through the local security association; if so, decrypt the network data packet according to the tunnel encryption algorithm negotiated in the local security association, re-enter the decrypted data packet into the network protocol stack, and then return to execute the operation of determining the routing method corresponding to the network data packet; if not, discard the network data packet.

[0102] The routing and forwarding module 330 includes:

[0103] A connection information query unit, used to query whether there is connection information corresponding to the network data packet in the industrial control protocol connection status table; if so, process the network data packet according to the pre-established industrial control protocol deep filtering rule; if not, query whether there is rule information corresponding to the network data packet in the industrial control rule list pre-configured by the user; if so, process the network data packet according to the pre-established industrial control protocol deep filtering rule; if not, discard the network data packet;

[0104] The application layer parsing unit is used to parse the application layer data of the network data packet according to the industrial control protocol to obtain the data packet parsing result; compare the data packet parsing result with the industrial control rules pre-configured by the user one by one to determine whether the network data packet matches the industrial control protocol deep filtering rule; if so, match the network data packet through the local security alliance and process the network data packet according to the matching result; if not, discard the network data packet;

[0105] A data packet forwarding unit is used to determine whether the quintuple of the network data packet matches the protected subnet in the local security alliance; if so, encrypt and encapsulate the network data packet according to the tunnel encryption algorithm negotiated in the local security alliance, and then forward the encrypted and encapsulated network data packet; if not, directly forward the network data packet.

[0106] The above device can execute the methods provided by all the above embodiments of the present invention, and has the corresponding functional modules and beneficial effects of executing the above methods. For technical details not fully described in the embodiments of the present invention, please refer to the methods provided by all the above embodiments of the present invention.

[0107] Figure 4 A schematic diagram of the structure of an industrial security gateway 10 that can be used to implement an embodiment of the present invention is shown.

[0108] like Figure 4 As shown, the industrial security gateway 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In RAM 13, various programs and data required for the operation of the industrial security gateway 10 can also be stored. The processor 11, ROM 12 and RAM 13 are connected to each other via a bus 14. The input / output (I / O) interface 15 is also connected to the bus 14.

[0109] Multiple components in the industrial security gateway 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the industrial security gateway 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0110] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as the execution method of the industrial security gateway.

[0111] In some embodiments, the execution method of the industrial security gateway may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the industrial security gateway 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the execution method of the industrial security gateway described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the execution method of the industrial security gateway in any other appropriate manner (e.g., by means of firmware).

[0112] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0113] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0114] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0115] To provide interaction with a user, the systems and techniques described herein may be implemented on an industrial security gateway having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to a user; and a keyboard and a pointing device (e.g., a mouse or trackball), through which a user may provide input to the industrial security gateway. Other types of devices may also be used to provide interaction with a user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0116] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0117] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0118] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0119] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. An execution method of an industrial security gateway, characterized in that: The method comprises: After receiving the network data packet, determining the routing mode corresponding to the network data packet according to the routing information corresponding to the destination address of the network data packet; If the routing mode corresponding to the network data packet is to send it to the local machine, the network data packet is processed by using the virtual private network IPSec VPN technology based on the network data transmission security protocol and the local security alliance; If the routing mode corresponding to the network data packet is routing forwarding, the network data packet is processed according to a pre-established industrial control protocol connection status table and an industrial control protocol deep filtering rule.

2. The method according to claim 1, characterized in that The network data packets are processed through IPSec VPN technology and local security alliance, including: Determine whether the network data packet is a tunnel encrypted message encapsulated by IPSec VPN; If yes, matching the network data packet through the local security alliance and processing the network data packet according to the matching result; If not, the network data packet is sent to the local computer.

3. The method according to claim 2, characterized in that Matching the network data packet through a local security alliance and processing the network data packet according to the matching result includes: By means of a local security association, judging whether the network data packet is a data packet transmitted by the IPSec VPN tunnel of the gateway according to the attribute information corresponding to the network data packet; If yes, decrypt the network data packet according to the tunnel encryption algorithm negotiated in the local security association, re-enter the decrypted data packet into the network protocol stack, and then return to perform the operation of determining the routing mode corresponding to the network data packet; If not, the network data packet is discarded.

4. The method according to claim 1, characterized in that: According to the pre-established industrial control protocol connection status table and the industrial control protocol deep filtering rules, the network data packet is processed, including: In the industrial control protocol connection status table, query whether there is connection information corresponding to the network data packet; If so, the network data packet is processed according to the pre-established industrial control protocol deep filtering rules; If not, query whether there is rule information corresponding to the network data packet in the industrial control rule list pre-configured by the user; If so, the network data packet is processed according to the pre-established industrial control protocol deep filtering rules; If not, the network data packet is discarded.

5. The method according to claim 4, characterized in that Process the network data packet according to the pre-established industrial control protocol deep filtering rules, including: According to the industrial control protocol, the application layer data of the network data packet is parsed to obtain the data packet parsing result; Compare the data packet analysis results with the industrial control rules pre-configured by the user one by one to determine whether the network data packet matches the industrial control protocol deep filtering rules; If yes, matching the network data packet through the local security alliance and processing the network data packet according to the matching result; If not, the network data packet is discarded.

6. The method according to claim 5, characterized in that Matching the network data packet through a local security alliance and processing the network data packet according to the matching result includes: Determining whether the quintuple of the network data packet matches a protection subnet in a local security association; If yes, encrypt and encapsulate the network data packet according to the tunnel encryption algorithm negotiated in the local security association, and then forward the encrypted and encapsulated network data packet; If not, the network data packet is directly forwarded.

7. An execution device of an industrial security gateway, characterized in that: The device comprises: A data packet receiving module, configured to determine, after receiving a network data packet, a routing mode corresponding to the network data packet according to routing information corresponding to a destination address of the network data packet; The local sending module is used to process the network data packet through the virtual private network IPSec VPN technology based on the network data transmission security protocol and the local security alliance if the routing mode corresponding to the network data packet is to send it to the local machine; The routing forwarding module is used to process the network data packet according to a pre-established industrial control protocol connection status table and an industrial control protocol deep filtering rule if the routing mode corresponding to the network data packet is routing forwarding.

8. An industrial security gateway, characterized in that: The industrial security gateway comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the execution method of the industrial security gateway described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the execution method of the industrial security gateway according to any one of claims 1 to 6 when executed.

10. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the execution method of the industrial security gateway according to any one of claims 1 to 6.

Images