A security gateway based on industrial internet

Abstract

The application relates to the technical field of security gateways, and particularly discloses a security gateway based on an industrial internet, which comprises a network division module, an iteration module and a path selection module.The network division module divides the industrial internet into a security subnetwork, obtains the number of routers in the security subnetwork and the number of target networks, and initializes a routing table based on the target networks connected by the routers.The iteration module screens out direct connection routers, pre-sets a routing period, and updates a local routing table based on the received routing table.The path selection module marks a start network and an end network, screens out a selected network and a selected router, and selects a next-hop router based on the routing table corresponding to the selected router.The application selects a suitable network path under the premise of ensuring the completeness of data packets by screening the routing lines of the data packets, shortens the length of the network path, reduces the behavior of the security gateway in deep detection and analysis of network flow, and improves the network communication efficiency.

Description

Technical Field

[0001] This invention relates to the field of security gateway technology, and more specifically to a security gateway based on the Industrial Internet. Background Technology

[0002] A gateway, also known as an internetwork connector or protocol converter, acts as a network segment checkpoint. Hosts in different network segments cannot communicate directly and must pass through a gateway to access each other. Gateways interconnect different network segments at the transport layer. Therefore, hosts within the same network segment do not need a gateway to communicate with each other; a gateway is only required when hosts in different network segments need to communicate with each other. The transport layer is essentially the exit point of a network segment, receiving data from the application layer and potentially slicing the data. Then, routers at the network layer determine the next transmission path.

[0003] The primary function of a security gateway is to authorize data packets based on their source address, destination address, port number, and network protocol. Only authorized packets can pass through the gateway, which filters out unauthorized packets and either intercepts or discards them. Therefore, a security gateway primarily serves a protective function, preventing insecure elements from spreading into the internal network. It functions as a firewall, but with far greater capabilities, and the two can be combined.

[0004] In existing technologies, security gateways need to perform deep inspection and analysis of large amounts of network traffic, such as packet filtering in firewall functions and signature matching in intrusion detection systems. This consumes significant computing resources and time, leading to delays in network data transmission. Properly planning the network topology is crucial to minimizing the number of hops (the number of network devices a data packet passes through from source to destination). Excessive hops increase the risk of data packet transmission delays and loss, and also increase the time it takes for the security gateway to process data packets. However, existing network topologies are interconnected, and arbitrarily changing them would consume substantial human and material resources. Therefore, a method is needed to filter data packet routing paths, selecting appropriate network paths while ensuring data packet integrity, shortening network path lengths, thereby reducing the need for deep inspection and analysis of network traffic by the security gateway and improving network communication efficiency. Summary of the Invention

[0005] The purpose of this invention is to provide a security gateway based on the Industrial Internet to solve the above-mentioned technical problems.

[0006] The objective of this invention can be achieved through the following technical solutions:

[0007] A security gateway based on the Industrial Internet includes:

[0008] Network partitioning module: Divides the industrial internet into several security subnets. The network protocol of each security subnet is different from that of adjacent security subnets. Obtain the number of routers N and the number of destination networks M in each security subnet. The destination network refers to the network in the security subnet that is connected by routers. Initialize a routing table based on the destination network. The routing table includes distance and next hop. The distance refers to the number of routers that the data packet passes through when transmitting between destination networks. The next hop refers to the next router that the data packet will reach.

[0009] Iteration module: If the routers are connected to the same destination network, they are directly connected routers. A routing cycle is preset. After each routing cycle, the current routing table is sent to the directly connected router. The directly connected router updates its local routing table based on the received routing table. The above operation is repeated until the routing tables in the secure subnet are all updated.

[0010] Path selection module: The destination network where the data packet originates and the destination network are located is designated as the origin network and the destination network, respectively. The destination network where the current data packet is located is designated as the routing network, and the router connected to the routing network is designated as the routing router. The next hop router is selected based on the routing table corresponding to the routing router. The above operation is repeated until the data packet reaches the destination network.

[0011] As a further aspect of the present invention: in the path selection module, the method for selecting the next-hop router based on the routing table corresponding to the routing router includes:

[0012] Obtain the distance L corresponding to the destination network in the routing table of the routing router, obtain the number I of data packets received by the routing router within a preset time, and calculate the overall processing degree K of the routing router using the formula:

[0013] ;

[0014] Where D represents the number of destination networks connected to the routing router, B represents the bandwidth of the routing router, λ represents the preset processing coefficient, and L i S represents the distance to the destination network of the i-th data packet. i The number of bytes in the i-th data packet is represented by the number of routing routers. The routers are then sorted in ascending order of their overall processing power, and the first router in the sorted sequence is designated as the next hop router.

[0015] As a further aspect of the present invention: in the iterative module, the transmission time of data packets transmitted within the security subnet is obtained, and the routing period is made greater than the maximum value of the transmission time.

[0016] As a further aspect of the present invention: in the iterative module, the method for the directly connected router to update its local routing table based on the received routing table includes:

[0017] The received routing table is recorded as the reference routing table, the destination network that exists in the reference routing table but does not exist in the local routing table is recorded as the new network, and the corresponding information of the new network is added to the local routing table;

[0018] The destination network that exists in both the reference routing table and the local routing table is denoted as an existing network. The distance L1 of the existing network in the reference routing table and the distance L2 in the local routing table are obtained. The distance corresponding to the existing network in the local routing table is updated to the smaller value between distance L1 and distance L2.

[0019] As a further aspect of the present invention, it includes:

[0020] If the originating network and the destination network are in the same security subnet, then the next-hop router with the shortest distance to the destination network in the routing table is directly selected for transmission.

[0021] As a further aspect of the present invention: in the iterative module, a minimum waiting time is set. When the router update is completed, the minimum waiting time is entered, and the update stops when the router is in the minimum waiting time.

[0022] As a further aspect of the present invention: in the path selection module, the gateway's interception rate LJ for data packets is obtained. When the interception rate LJ is higher than 80%, subsequent operations are stopped, and staff are prompted to troubleshoot the problem.

[0023] As a further aspect of the present invention: if there are decision routers with the same overall processing power, the decision router that receives fewer data packets within a preset time period is placed in a higher sorting position.

[0024] The beneficial effects of this invention are as follows: First, to simplify operations, the entire industrial internet is divided into several secure subnets according to network protocols. This reduces the number of times data packets are converted when transmitted between different network protocols. At the same time, it can further reduce the amount of operation when processing subsequent destination networks. The routing table of the destination network connected by the router is initialized to obtain the optimal network path. Although the network path here will be affected by the router bandwidth and the number of data packets, the path selection of subsequent data packets can still be initially determined based on the routing table, thereby reducing the processing workload of subsequent steps.

[0025] The purpose of continuously updating the router is to obtain the shortest path distance. Although bandwidth, processing power and other factors will be considered when selecting a path later, updating the routing table first at this point helps to simplify the process. When the routing table stops being updated, it will contain the minimum number of routers required to reach the destination network.

[0026] Then, the destination network of the data packet is denoted as the routing network, and the router connected to the routing network is denoted as the routing router. The next-hop router is selected based on the routing table of the routing router. Essentially, this selection is based on the routing router's overall processing efficiency K. According to the formula, the more data packets a router processes per unit time, the higher its overall processing efficiency. However, the size of the data packets also needs to be considered; larger data packets are processed more slowly. Therefore, both are directly proportional to the overall processing efficiency K. The router's bandwidth represents its data packet processing capacity. When the number and size of data packets are equal, the larger the bandwidth, the smaller the overall processing efficiency K. Therefore, the overall processing efficiency K represents the router's "busyness," so routers with lower busyness are prioritized. In summary, this invention uses a method to filter the routing path of data packets, selecting a suitable network path while ensuring data packet integrity, shortening network path length, reducing the need for deep inspection and analysis of network traffic by security gateways, and improving network communication efficiency. Attached Figure Description

[0027] The invention will now be further described with reference to the accompanying drawings.

[0028] Figure 1 This is a schematic diagram of the structure of a security gateway based on the Industrial Internet according to the present invention. Figure 2 Here is the topology of the destination network and routers, where netM represents the Mth destination network and RN represents the Nth router. Figure 3 For the Figure 2 The routing table updated by the first router in the middle. Figure 4 For the Figure 2 The initial routing table of the first router in the middle. Detailed Implementation

[0029] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0030] Please see Figure 1 As shown, the present invention is a security gateway based on the Industrial Internet, comprising:

[0031] Network partitioning module: Divides the industrial internet into several security subnets. The network protocol of each security subnet is different from that of adjacent security subnets. Obtain the number of routers N and the number of destination networks M in each security subnet. The destination network refers to the network in the security subnet that is connected by routers. Initialize a routing table based on the destination network. The routing table includes distance and next hop. The distance refers to the number of routers that the data packet passes through when transmitting between destination networks. The next hop refers to the next router that the data packet will reach.

[0032] Iteration module: If the routers are connected to the same destination network, they are directly connected routers. A routing cycle is preset. After each routing cycle, the current routing table is sent to the directly connected router. The directly connected router updates its local routing table based on the received routing table. The above operation is repeated until the routing tables in the secure subnet are all updated.

[0033] Path selection module: The destination network where the data packet originates and the destination network are located is designated as the origin network and the destination network, respectively. The destination network where the current data packet is located is designated as the routing network, and the router connected to the routing network is designated as the routing router. The next hop router is selected based on the routing table corresponding to the routing router. The above operation is repeated until the data packet reaches the destination network.

[0034] It should be noted that in the industrial internet environment, in order to achieve more efficient, convenient and secure operation and management, it is first necessary to divide the industrial internet into several security subnets.

[0035] Dividing the network according to network protocols has several important implications. Firstly, in actual network data transmission, data packets often need to be transmitted between various network protocols. Each conversion between different protocols involves a series of complex operations and processing steps, which not only consumes significant system resources but may also introduce potential errors and security vulnerabilities. By dividing the Industrial Internet into secure subnets according to network protocols, the number of conversions required when data packets are transmitted between different network protocols can be significantly reduced.

[0036] On the other hand, this partitioning method can further reduce the amount of operation when processing subsequent destination networks. When the data packet arrives at the destination network, since the subnet has been partitioned according to the network protocol, the system can more accurately identify and locate the position and characteristics of the destination network, thereby avoiding large-scale search and matching operations in complex network topologies.

[0037] At the same time, for destination networks connected via routers, their routing tables also need to be initialized. The routing table records path information between nodes in the network and is crucial for the correct transmission of data packets. The purpose of initializing the routing table is to obtain the optimal network path.

[0038] Router bandwidth is a crucial resource for network transmission, directly determining the data transmission speed. If a router has limited bandwidth, the amount of data transmitted on the links it connects to will be restricted, leading to data transmission delays or even congestion. The number of data packets also significantly impacts the network path. Too many data packets can cause network congestion, increasing transmission times and even resulting in packet loss. Therefore, both factors must be carefully considered during routing table initialization to select the most suitable path for the current network conditions.

[0039] Although network paths can be affected by these factors, the routing table can still be used to preliminarily determine the path selection for subsequent data packets. By properly configuring and optimizing the routing table, the system can select a relatively optimal transmission path for each data packet based on the real-time network status and packet characteristics. For example, when the router bandwidth on a certain link is low or the number of data packets is large, the system can avoid sending data packets to that link and instead choose other links with sufficient bandwidth and lower load for transmission. This not only improves data transmission efficiency and reduces data transmission latency but also effectively avoids network congestion. Furthermore, by preliminarily determining the path selection of data packets, it can provide important reference for subsequent data processing steps, thereby further reducing the processing workload of subsequent steps and improving the overall operational efficiency and performance of the industrial internet system.

[0040] The core purpose of updating routers is to accurately determine the shortest path distance. In a network, data needs to be transmitted accurately from source to destination, and routers, as key nodes in the network, are responsible for guiding data forwarding based on routing table information. Finding the shortest path from source to destination is crucial for efficient data transmission. Although subsequent stages in the actual path selection process require comprehensive consideration of many key issues such as bandwidth and processing capacity, bandwidth determines the speed and efficiency of data transmission on the link. If the bandwidth of a link is too narrow, even a short path distance may lead to data transmission delays or even congestion. Processing capacity reflects the amount of data a router can process per unit of time; excessive processing capacity may overload the router, thus affecting normal data forwarding. However, prioritizing routing table updates in the initial stage is of paramount importance, as it simplifies the entire network communication process.

[0041] When updating the routing table, the router continuously collects link-state information from the network, such as link connectivity, latency, and bandwidth, based on various routing protocols and algorithms. Through complex calculations and comparisons, it determines the optimal path to each destination. During this process, the routing table reflects changes in the network topology and dynamic adjustments to the link states in real time. As updates continue, the information in the routing table becomes increasingly accurate and complete, gradually approaching the optimal routing state.

[0042] When the routing table stops being updated, the information stored in it becomes highly specific, recording the minimum number of routers required to reach the destination network. This means that, under the current network conditions, data transmission following the paths recorded in the routing table can minimize the number of routers the data passes through while ensuring path connectivity. This reduces latency and packet loss during data transmission, improving efficiency and reliability.

[0043] Selecting the next-hop router based on the routing table of the routing router is essentially based on the overall processing power K of the routing router. The overall processing power K is a comprehensive indicator that reflects the router's processing capability. It not only considers the number of data packets the router can process per unit time, but also fully considers the impact of data packet size on processing speed.

[0044] From a formulaic perspective, the more data packets a router processes per unit of time, the higher its overall processing efficiency K. A router that can process more data packets in the same amount of time obviously has stronger processing capabilities. However, the size of the data packets is also a key factor determining the overall processing efficiency K. In real-world network environments, data packet sizes vary, and larger data packets often require more processing resources and time. Therefore, data packet size is taken into account when calculating the overall processing efficiency K. Specifically, the larger the data packet, the slower the router processes it, which naturally has a negative impact on the overall processing efficiency K.

[0045] Meanwhile, a router's bandwidth, as a crucial indicator of its data packet processing capability, also plays a significant role in calculating the overall processing power K. Bandwidth represents the amount of data a router can transmit per unit of time, and it is a vital component of a router's processing capacity. However, it's important to note that when the number and size of data packets are equal, a router with higher bandwidth will actually have a lower overall processing power K.

[0046] This analysis shows that the overall processing power K is actually a comprehensive indicator of a router's "busyness." It considers not only the router's processing speed but also the impact of factors such as packet size and bandwidth on its processing capabilities. Therefore, when selecting the next-hop router, priority should be given to routers with lower overall processing power K, i.e., lower "busyness." This selection strategy helps balance the network load, avoiding processing delays or packet loss caused by some routers being overloaded, thus ensuring more efficient and stable data transmission across the entire network.

[0047] exist Figure 2 The topology of the destination network and routers only contains a part, not the complete topology. Its purpose is to explain the initialization and updating of the routing table. In actual process, the topology is drawn according to the actual network structure, which will not be elaborated on in this invention.

[0048] In another preferred embodiment of the present invention, the method for selecting the next-hop router based on the routing table corresponding to the routing router includes:

[0049] Obtain the distance L corresponding to the destination network in the routing table of the routing router, obtain the number I of data packets received by the routing router within a preset time, and calculate the overall processing degree K of the routing router using the formula:

[0050] ;

[0051] Where D represents the number of destination networks connected to the routing router, B represents the bandwidth of the routing router, λ represents the preset processing coefficient, and L i S represents the distance to the destination network of the i-th data packet. i The number of bytes in the i-th data packet is represented by the number of routing routers. The routers are then sorted in ascending order of their overall processing power, and the first router in the sorted sequence is designated as the next hop router.

[0052] It's worth noting that the more data packets a router processes per unit of time, the higher its overall processing efficiency (K). A router that can process more data packets in the same amount of time obviously has stronger processing capabilities. However, the size of the data packets is also a key factor determining the overall processing efficiency (K). In real-world network environments, data packet sizes vary, and larger packets often require more processing resources and time. Therefore, packet size is taken into account when calculating the overall processing efficiency (K). Specifically, the larger the data packet, the slower the router processes it, which naturally has a negative impact on the overall processing efficiency (K).

[0053] Meanwhile, a router's bandwidth, as a crucial indicator of its data packet processing capability, also plays a significant role in calculating the overall processing power K. Bandwidth represents the amount of data a router can transmit per unit of time, and it is a vital component of a router's processing capacity. However, it's important to note that when the number and size of data packets are equal, a router with higher bandwidth will actually have a lower overall processing power K.

[0054] This analysis shows that the overall processing power K is actually a comprehensive indicator reflecting the router's "busyness." It not only considers the router's processing speed but also fully takes into account the impact of factors such as packet size and bandwidth on the router's processing capabilities.

[0055] In another preferred embodiment of the present invention, the transmission time of data packets transmitted within the security subnet is obtained, and the routing period is made greater than the maximum value of the transmission time.

[0056] Understandably, if the routing period is less than or equal to the maximum transmission time, the routing table may be updated multiple times during packet transmission, causing packets to frequently need to reselect paths, thus increasing transmission latency and the risk of packet loss. Setting the routing period to a value greater than the maximum transmission time ensures that the routing table remains stable during packet transmission, allowing packets to be transmitted smoothly along the predetermined path, thereby improving transmission efficiency and reliability.

[0057] In another preferred embodiment of the present invention, the method for a directly connected router to update its local routing table based on the received routing table includes:

[0058] The received routing table is recorded as the reference routing table, the destination network that exists in the reference routing table but does not exist in the local routing table is recorded as the new network, and the corresponding information of the new network is added to the local routing table;

[0059] The destination network that exists in both the reference routing table and the local routing table is denoted as an existing network. The distance L1 of the existing network in the reference routing table and the distance L2 in the local routing table are obtained. The distance corresponding to the existing network in the local routing table is updated to the smaller value between distance L1 and distance L2.

[0060] It's important to note that during routing table management and optimization, the local routing table needs to be updated and improved. First, for destination networks that exist in the reference routing table but not in the local routing table, these destination networks should be added to the local routing table. This is because the reference routing table may contain new network information or better path selections, which are crucial for the correct operation of the local network and efficient data transmission. By adding these missing destination networks to the local routing table, it ensures that the local network can recognize and correctly handle these new destination networks, preventing situations where data cannot reach its destination.

[0061] Secondly, for existing networks that exist in both the reference routing table and the local routing table, compare the distance values ​​of these networks in the reference and local routing tables. Here, "distance" typically refers to the number of hops from the local network to the destination network, or other metrics that measure path quality. This comparison is necessary because the reference routing table may offer shorter, more efficient path choices. After the comparison, update the distance in the local routing table to the smaller of the two values. The significance of this operation is that the shortest path is always chosen for data transmission. A shorter path means fewer intermediate nodes during transmission, thus reducing transmission latency, packet loss, and other risks, and improving the efficiency and reliability of data transmission. Information from the reference routing table can be used to optimize the local routing table, making it better adaptable to changes in the network environment and providing users with higher-quality network services.

[0062] In another preferred embodiment of the present invention, it includes:

[0063] If the originating network and the destination network are in the same security subnet, then the next-hop router with the shortest distance to the destination network in the routing table is directly selected for transmission.

[0064] It should be noted that when the originating network and the destination network are in the same security subnet, in order to simplify the operation process, the next-hop router with the shortest distance to the destination network in the routing table is selected for transmission.

[0065] In another preferred embodiment of the present invention, a minimum waiting time is set. When the router update is completed, the minimum waiting time is entered. When the router is in the minimum waiting time, the update stops.

[0066] Understandably, setting a minimum wait time aims to prevent routers from frequently updating their routing tables within a short period, thereby reducing potential network fluctuations or data transmission interruptions caused by frequent updates. By forcing the router to enter a quiet period after an update, the current state of the routing table can be ensured to remain stable for a certain time, allowing data packets to be transmitted smoothly along the predetermined path and avoiding data packet loss or delays caused by frequent changes in the routing table.

[0067] In addition, setting the minimum wait time provides the router with the necessary buffer time to process pending packets or tasks that may accumulate during the update process, thereby further improving the overall performance and reliability of the network.

[0068] In another preferred embodiment of the present invention, the gateway's interception rate LJ of data packets is obtained. When the interception rate LJ is higher than 80%, subsequent operations are stopped, and staff are prompted to troubleshoot the problem.

[0069] It's worth noting that when the interception rate (LJ) exceeds 80%, it indicates that the gateway is frequently intercepting a large number of data packets. This could signify serious abnormal traffic, malicious attacks, or configuration errors within the network. In this situation, the system should immediately cease further operations to avoid exacerbating the network load or leading to more serious security incidents. Simultaneously, the system will issue clear troubleshooting prompts to staff, reminding them to intervene as soon as possible and analyze the reasons for the high interception rate.

[0070] In a preferred embodiment, if there are decision routers with the same overall processing power, the decision router that receives fewer data packets within a preset time period is ranked higher.

[0071] It is worth noting that this sorting mechanism based on the number of data packets received within a preset time period has a certain degree of dynamic adaptability. Since network traffic and router load change constantly over time, by periodically updating the statistical results and reordering, it can be ensured that the path selection strategy always remains consistent with the current network state, thereby improving the overall efficiency and reliability of the network.

[0072] The foregoing has provided a detailed description of one embodiment of the present invention, but this description is merely a preferred embodiment and should not be construed as limiting the scope of the invention. All equivalent variations and modifications made within the scope of the claims of this invention should still fall within the patent coverage of this invention.

Claims

1. A security gateway based on the Industrial Internet, characterized in that, include: Network partitioning module: Divides the industrial internet into several security subnets. The network protocol of each security subnet is different from that of adjacent security subnets. It obtains the routers and destination networks in each security subnet. The destination network refers to the network in the security subnet that is connected by routers. It initializes a routing table based on the destination network. The routing table contains distance and next hop. The distance refers to the number of routers that the data packet passes through in the transmission between destination networks. The next hop refers to the next router that the data packet will reach. Iteration module: If the routers are connected to the same destination network, they are directly connected routers. The routing period is preset and the transmission time of data packets transmitted within the secure subnet is obtained, so that the routing period is greater than the maximum value of the transmission time. After each routing cycle, the current routing table is sent to the directly connected router. The directly connected router updates its local routing table based on the received routing table. The above operation is repeated until all routing tables in the secure subnet are updated. Path selection module: The destination network where the data packet originates and terminates is located is designated as the origin network and destination network, respectively. The destination network where the current data packet is located is designated as the routing network, and the router connected to the routing network is designated as the routing router. The method for selecting the next-hop router based on the routing table corresponding to the routing router includes: Obtain the distance L corresponding to the destination network in the routing table of the routing router, obtain the number I of data packets received by the routing router within a preset time, and calculate the overall processing degree K of the routing router using the formula: ； Where D represents the number of destination networks connected to the routing router, B represents the bandwidth of the routing router, λ represents the preset processing coefficient, and L i S represents the distance to the destination network of the i-th data packet. i The number of bytes in the i-th data packet is represented by the number of routing routers. The routing routers are sorted in ascending order of their overall processing power. The router at the top of the sort is set as the next hop router. If there are routing routers with the same overall processing power, the routing router that receives fewer data packets within a preset time is placed at the top of the sort. The above method is repeated until the data packet reaches the destination network.

2. A security gateway based on the Industrial Internet according to claim 1, characterized in that, In the iterative module, the method for the directly connected router to update its local routing table based on the received routing table includes: The received routing table is recorded as the reference routing table, the destination network that exists in the reference routing table but does not exist in the local routing table is recorded as the new network, and the corresponding information of the new network is added to the local routing table; The destination network that exists in both the reference routing table and the local routing table is denoted as an existing network. The distance L1 of the existing network in the reference routing table and the distance L2 in the local routing table are obtained. The distance corresponding to the existing network in the local routing table is updated to the smaller value between distance L1 and distance L2.

3. A security gateway based on the Industrial Internet according to claim 1, characterized in that, include: If the originating network and the destination network are in the same security subnet, then the next-hop router with the shortest distance to the destination network in the routing table is directly selected for transmission.

4. A security gateway based on the Industrial Internet according to claim 1, characterized in that, In the iterative module, a minimum waiting time is set. When the router update is completed, the minimum waiting time is entered. When the router is in the minimum waiting time, the update stops.

5. A security gateway based on the Industrial Internet according to claim 1, characterized in that, In the path selection module, the gateway's packet interception rate LJ is obtained. When the interception rate LJ is higher than 80%, subsequent operations are stopped, and staff are prompted to troubleshoot the problem.

Images