Industrial control network architecture and control method

Abstract

The invention relates to an industrial control network architecture, and belongs to the technical field of vehicle manufacturing. Comprising a foreground network, a background network, a physical firewall and an SDN controller. Wherein the foreground network comprises an access layer and a convergence layer, and the access layer is connected with the service terminal through a port and is connected with the convergence layer through a TRUNK link; the convergence layer is provided with a distributed gateway and is used for receiving the service data of the TRUNK link from the access layer, performing packaging processing according to a VLAN identifier, mapping the VLAN identifier of the service data into a VXLAN identifier and forwarding the service data to a background network; and the SDN controller is in communication connection with a convergence layer of the background network and the foreground network, and is used for generating a virtual firewall based on the physical firewall, and performing access limitation and flow filtering on service data between the foreground network and the background network through the virtual firewall so as to perform isolation protection on the service data. According to the invention, the security, flexibility and expandability of the industrial control network can be improved.

Description

Technical Field

[0001] This application relates to the field of vehicle manufacturing technology, and in particular to an industrial control network architecture and control method. Background Technology

[0002] Currently, with the rapid development of industry and intelligent manufacturing, industrial control systems are evolving towards high automation, intelligence, and networking. Under the lean intelligent manufacturing model, factory production needs to simultaneously meet the requirements of high flexibility, high efficiency, and high intelligence to achieve rapid response to market demands and effective control of production costs. Therefore, the industrial control network architecture must be able to support the collaborative operation of various types of intelligent devices and possess good scalability and security.

[0003] However, existing industrial control network architectures generally still adopt traditional layered designs, relying solely on VLANs (Virtual Local Area Networks) for logical isolation, which cannot support cross-subnet and cross-plant service mapping and unified management. Furthermore, traditional firewalls can only provide physical boundary protection and cannot control the interaction between different service networks, easily leading to cross-service interference and security risks. Summary of the Invention

[0004] Therefore, it is necessary to provide an industrial control network architecture and control method to address the aforementioned technical issues.

[0005] Firstly, an industrial control network architecture is provided, including a front-end network, a back-end network, a physical firewall, and an SDN controller; wherein, The front-end network includes an access layer and an aggregation layer. The access layer connects to service terminals through ports and is connected to the aggregation layer through TRUNK links. The aggregation layer is equipped with a distributed gateway, which is used to receive service data from the TRUNK link of the access layer, map the VLAN identifier of the service data to the VXLAN identifier based on the pre-configured VLAN and VXLAN mapping table, perform encapsulation processing according to the VXLAN identifier, and forward it to the backend network. The SDN controller is communicatively connected to the aggregation layer of the backend network and the frontend network. It is used to generate a virtual firewall based on the physical firewall and to restrict access and filter traffic for business data between the frontend network and the backend network through the virtual firewall, so as to isolate and protect the business data.

[0006] As an optional implementation, the architecture includes at least one front-end network and one back-end network. The back-end network includes back-end business modules corresponding to each front-end network. The virtual firewall establishes an independent access control instance for each front-end network to restrict each front-end network to access only its corresponding back-end business module.

[0007] As an optional implementation, the port side of the aggregation layer is pre-configured with a broadcast storm suppression mechanism.

[0008] As an optional implementation, the broadcast storm suppression mechanism includes: Set a broadcast message rate threshold on the aggregation layer port side; When the broadcast message rate exceeds the threshold, the excess messages are discarded, and based on the VLAN to VXLAN mapping, the forwarding range of the broadcast messages is restricted to the broadcast domain corresponding to the same VXLAN identifier.

[0009] As an optional implementation, the front-end network includes a production front-end, the access layer of which is connected to the production equipment via a port for collecting production business data generated by the production equipment; The aggregation layer of the production front end is used to forward the production service data packets collected by the access layer port to the back-end network through the TRUNK link.

[0010] As an optional implementation, the front-end network includes an industrial control front-end, the access layer of which is connected to industrial control equipment through a port for collecting industrial control command data issued by the industrial control equipment; The aggregation layer of the industrial control front end is used to classify and forward industrial control command data and other business data. By establishing a VLAN priority-based queue in the aggregation layer, industrial control command data is preferentially forwarded to the back-end control server, while other business data is placed in a low-priority forwarding queue.

[0011] As an optional implementation, the front-end network includes an OA front-end, whose access layer connects to office equipment via ports to collect office data generated by the office equipment; The aggregation layer of the OA front end is used to forward data packets of the office VLAN to the office server in the back-end network based on the matching rules of the VLAN identifier, and to prohibit the data packets from accessing the production server and industrial control server in the back-end network.

[0012] As an optional implementation, the architecture also includes a video surveillance network, which includes an access layer and an aggregation layer. The access layer of the video surveillance network connects to video surveillance devices through ports for collecting surveillance video data. The aggregation layer of the video surveillance network is also used to locally filter out surveillance video data that does not conform to preset access rules based on access control lists, and forward the filtered surveillance video data to the video server of the backend network.

[0013] As an optional implementation, the distributed gateway of the aggregation layer is further configured to parse the source MAC address or VLAN identifier of the service data when receiving service data from the access layer, so as to determine the network partition to which the service data belongs; The distributed gateway is further configured to perform forwarding and control operations corresponding to each of the network partitions; wherein, Business data belonging to the production front-end network partition is forwarded to the manufacturing execution module of the back-end network; Forward business data belonging to the industrial control front-end network partition to the control server of the back-end network; Business data belonging to the OA front-end network partition is only allowed to be forwarded to the office server in the back-end network, and access to the production server and industrial control server is prohibited. The service data belonging to the video surveillance network partition is filtered locally based on the access control list to remove surveillance video data that does not meet the preset access rules, and then the filtered surveillance video data is forwarded to the video server of the backend network through the TRUNK link.

[0014] As an optional implementation, the backend network also includes a log recording module for storing the access time, source address, and destination address of business data passing through the physical firewall or virtual firewall.

[0015] As an optional implementation, the SDN controller is specifically used for: Periodically scan the management interface of the aggregation layer devices to detect the identifiers of newly added front-end networks; If an unregistered foreground network identifier is detected, a virtual firewall is generated; Bind the virtual firewall to the identifier of the newly added front-end network; Based on the type of the newly added front-end network, a preset security control template is invoked to generate access control rules and distribute them to the virtual firewall; Activate the virtual firewall and register it to the control domain to achieve security protection and management of the newly added front-end network.

[0016] In a second aspect, an industrial control network control method is provided, the method being applied to an industrial control network architecture as described in any one of the first aspects, the method comprising: The aggregation layer device management interface is periodically scanned. When an aggregation layer device corresponding to an unregistered front-end network is detected, the front-end network is identified as a newly added front-end network. If the aggregation layer device supports the SDN protocol, a control connection is established with the aggregation layer of the newly added front-end network through the SDN controller; Based on the control connection, the newly added aggregation layer is connected to the SDN control domain to access the newly added front-end network.

[0017] This application provides an industrial control network architecture, including a front-end network, a back-end network, a physical firewall, and an SDN controller. The front-end network includes an access layer and an aggregation layer. The access layer connects to service terminals via ports and to the aggregation layer via trunk links. The aggregation layer is equipped with a distributed gateway for forwarding service data from the trunk links of the access layer to the back-end network, mapping the VLAN identifier of the service data to a VXLAN identifier. The SDN controller is communicatively connected to the aggregation layers of the back-end network and the front-end network, and is used to generate a virtual firewall based on the physical firewall, and to isolate and protect service data between different front-end networks and between the front-end network and the back-end network through the virtual firewall.

[0018] The technical solutions provided by the embodiments of this application bring at least the following beneficial effects: The industrial control network architecture of this application realizes unified management of terminal access through the layered design of the access layer and the aggregation layer, avoiding interference caused by direct interconnection of different services. By setting up distributed gateways in the aggregation layer and performing VLAN to VXLAN (Virtual Extensible Local Area Network) mapping, cross-network segment data forwarding and logical isolation are realized. By generating virtual firewalls based on physical firewalls through the SDN (Software Defined Network) controller, access control and security protection are performed on data between different front-end networks and between the front-end network and the back-end network. This solves the problem of lack of unified management and security isolation mechanism for multi-service networks in existing industrial control networks, and improves system security and scalability.

[0019] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a schematic diagram of an industrial control network architecture provided in an embodiment of this application; Figure 2 This is a schematic diagram illustrating an example of an industrial control network architecture provided in this application. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0023] The following will describe in detail an industrial control network architecture provided in the embodiments of this application, with reference to specific implementation methods. Figure 1 This is a schematic diagram of an industrial control network architecture provided in an embodiment of this application, such as... Figure 1 As shown, it includes a front-end network 110, a back-end network 120, a physical firewall 130, and an SDN controller 140. Among them, The front-end network 110 includes an access layer 1101 and an aggregation layer 1102. The access layer 1101 connects to the service terminal through a port and connects to the aggregation layer 1102 through a TRUNK link.

[0024] In implementation, the hierarchical structure of the access layer and aggregation layer enables unified access and zone management of terminals. The TRUNK link is used to carry data from multiple VLANs (Virtual Local Area Networks) between the access layer and aggregation layer, enabling parallel transmission of multiple services. For example, production terminals, industrial control equipment, and office terminals are connected to different ports of the access layer switch, and a gigabit Ethernet link is used as the TRUNK link between the access layer and aggregation layer, supporting simultaneous transmission of data from multiple VLANs.

[0025] The aggregation layer 1102 is equipped with a distributed gateway, which is used to map the VLAN identifier of the service data from the TRUNK link of the access layer 1101 to the VXLAN identifier based on the pre-configured VLAN and VXLAN mapping table, perform encapsulation processing according to the VXLAN identifier, and forward it to the backend network 120.

[0026] In implementation, the distributed gateway (not shown in the diagram) can complete the VLAN to VXLAN (Virtual Extensible Local Area Network) mapping at the aggregation layer 1102. Specifically, after receiving a data frame containing service data, the distributed gateway first reads the VLAN identifier (e.g., XXX.XXVLANTag) from a preset field in the data frame. Then, the distributed gateway looks up the VXLAN identifier corresponding to the VLAN identifier according to the pre-configured VLAN-VXLAN mapping table. Through this mapping, service data can still maintain logical isolation when transmitted across networks. For example, the pre-configured VLAN-VXLAN mapping table in the distributed gateway. When the aggregation layer 1102 receives an Ethernet frame from an office terminal with a VLAN identifier of 100, the distributed gateway queries the mapping table to determine the corresponding VXLAN identifier as 5001, then encapsulates and processes it into a new packet according to the VXLAN identifier and forwards it to the backend network 120.

[0027] SDN controller 140 is communicatively connected to aggregation layer 1102 of backend network 120 and frontend network 110. It is used to generate a virtual firewall based on physical firewall 130, and to restrict access and filter traffic of business data between frontend network and backend network through virtual firewall, so as to isolate and protect business data.

[0028] In implementation, the SDN (Software Defined Network) controller centrally manages network devices and can dynamically configure virtual firewalls through policy distribution, thereby achieving fine-grained logical isolation on top of physical firewalls. Virtual firewalls can define access control rules based on source IP, destination IP, and port number to ensure security boundaries between different network zones. For example, the SDN controller and aggregation layer switches can establish a control channel through Open Flow Protocol (ODP). Access control rules can be set in the virtual firewall, such as allowing data from the industrial control system's front-end to access the back-end industrial control server while blocking access to the back-end office database, thus achieving security protection against cross-domain access.

[0029] As an optional implementation, the SDN controller 140 is also used to periodically scan the management interface of the aggregation layer device to detect the identifier of a newly added front-end network; If an unregistered foreground network identifier is detected, a virtual firewall is generated; Bind the virtual firewall to the identifier of the newly added front-end network; Based on the type of the newly added front-end network, a preset security control template is invoked to generate access control rules and distribute them to the virtual firewall; Activate the virtual firewall and register it to the control domain to achieve security protection and management of the newly added front-end network.

[0030] In implementation, within an industrial control network architecture, to achieve automatic security protection when new front-end network accesses, the SDN controller can periodically scan the management interfaces of aggregation layer devices to detect newly added front-end network identifiers (such as VLAN IDs or VXLAN IDs) in real time. The period can be configured based on the scale of the industrial control network and the real-time requirements of the services. For example, in scenarios sensitive to changes in access status, the SDN controller can set the scan period to 5 seconds to quickly detect new front-end network identifiers. In scenarios with relatively stable services and minimal network topology changes, the scan period can be set to 30 or 60 seconds to reduce the load on the control plane. When a front-end network identifier is detected as not registered in the current control domain, the controller automatically triggers the generation of a virtual firewall. The generated virtual firewall is bound to the identifier of the newly added front-end network, ensuring that the firewall only monitors and protects the data traffic of that specific front-end network. Subsequently, the SDN controller can automatically generate access control rules based on the type of the new network (e.g., production front-end network, industrial control front-end network, OA front-end network, or video surveillance network) by calling the corresponding security control template from a pre-set security control template library and distributing them to the corresponding virtual firewall instance. Finally, the SDN controller can activate the virtual firewall instance and register it with the control domain, completing synchronization with the physical firewall. This enables newly added front-end networks to immediately possess access control and security protection functions, achieving protection upon access. In actual deployment, security control templates can be pre-defined by the administrator in the SDN controller to apply a consistent security policy structure to different types of front-end networks. Differences between different templates typically lie in the matching conditions of access control rules, allowed / disallowed service ports, rate limiting parameters, and cross-security domain access restrictions. For example: (1) The business traffic of the production front-end network is mainly directed towards the manufacturing execution system and the production data acquisition module. The production front-end network security control template may include: Allowed destination IP ranges, such as the IP address range of the background manufacturing execution module; Permitted business port numbers, such as TCP port 000A, 000B or other production data reporting ports; Destinations that are blocked from access include backend industrial control servers and OA servers.

[0031] (2) The industrial control front-end network is mainly based on control commands, and has high requirements for low latency and high priority of commands. Therefore, the industrial control front-end network security control template may include: Permitted traffic types, such as data streams that conform to the characteristics of industrial control protocols; Priority settings: Set industrial control messages to a high-priority queue; Destinations that are blocked from access, such as OA servers and video servers; Abnormal behavior rules, such as rules that block access triggered by continuous unauthorized access or overdue packets.

[0032] (3) The OA front-end network belongs to ordinary office traffic, and the security control template for the OA front-end network may include: Allowed access targets, such as mail servers and file servers; Prohibited destination addresses, such as production servers, MES servers, and industrial control controllers; Domain filtering, such as allowing access only to internal corporate domains; Rate limiting, such as limiting large upload volumes and blocking P2P ports, etc.

[0033] (4) The video surveillance front-end network is primarily based on video streams. The security control template for the video surveillance front-end network may include: Permitted targets, such as servers and storage devices responsible for video management in the backend network; Matching rules, such as allowing only video streams from the addresses of registered cameras; Destinations that are prohibited from access include production servers, industrial control servers, and OA servers; Bandwidth management, such as setting a fixed bandwidth limit for video streams, can prevent excessive use of link resources.

[0034] After applying the security control template, the SDN controller will automatically generate access control rules based on the template content and distribute the rules to the corresponding virtual firewall instances, thereby achieving differentiated security protection for different front-end networks and ensuring that any new front-end network access can obtain full access control capabilities.

[0035] As an optional implementation, the port side of the aggregation layer 1102 is pre-configured with a broadcast storm suppression mechanism.

[0036] In practice, broadcast storms are caused by the unrestricted spread of broadcast messages within a local area network (LAN), leading to link congestion and network performance degradation. By setting suppression mechanisms on the aggregation layer port side, the rate of broadcast messages can be limited, thereby preventing network paralysis. For example, broadcast storm control parameters can be configured on each uplink port of the aggregation layer switch, such as setting the bandwidth occupied by broadcast messages to no more than 5% of the total bandwidth, and automatically discarding messages exceeding this threshold.

[0037] As an optional implementation, the broadcast storm suppression mechanism includes: Set the broadcast message rate threshold on the aggregation layer 1102 port side.

[0038] When the broadcast message rate exceeds the threshold, the excess messages are discarded, and based on the VLAN to VXLAN mapping, the forwarding range of the broadcast messages is restricted to the broadcast domain corresponding to the same VXLAN identifier.

[0039] In implementation, dropping packets using thresholds can prevent localized broadcast flooding. Combined with VLAN-to-VXLAN mapping, broadcast packets can be confined to designated virtual networks, preventing cross-network propagation. For example, setting a broadcast packet rate threshold of 1000 frames per second on an aggregation layer port will discard excess packets when the broadcast rate exceeds this value. Simultaneously, VXLAN tunneling technology ensures that broadcast packets are only allowed to propagate within the same VXLAN identifier.

[0040] Optionally, different broadcast message rate thresholds can be configured according to the service characteristics of different front-end networks to meet the differentiated requirements of various types of networks for broadcast domain size, real-time performance, and fault tolerance.

[0041] For example, production equipment in the production front-end network can periodically report status information. The broadcast message rate threshold can be set to 800 frames per second; broadcasts exceeding this threshold will be automatically discarded. Industrial control front-end networks have high real-time requirements, and some industrial control protocols may generate sudden broadcasts. Therefore, the broadcast message rate threshold can be set to 1500 frames per second to avoid accidental discarding due to excessively low rates. Discarding is only performed when an abnormal broadcast storm occurs, and the broadcast domain range is limited by VLAN-to-VXLAN mapping. OA front-end networks generate a lot of broadcasts, so a moderate threshold can be appropriately set to balance office stability and risk mitigation capabilities, such as 1200 frames per second. When the threshold is exceeded, it will be considered abnormal broadcast behavior and additional broadcasts will be discarded to prevent OA front-end network broadcasts from consuming excessive link resources and to avoid spreading to other business networks. Video surveillance front-end networks mainly consist of point-to-point video streams, with very few broadcasts. Therefore, the threshold can be set lower to quickly detect abnormal devices or illegal probing behavior, such as 500 frames per second.

[0042] As an optional implementation method, Figure 2 A schematic diagram illustrating an example of an industrial control network architecture provided in this application embodiment, such as... Figure 2 As shown, the front-end network 110 includes a production front-end. The access layer of the production front-end connects to the production equipment through ports to collect production business data generated by the production equipment.

[0043] The aggregation layer at the production front end is used to forward production business data packets collected by the access layer ports to the back-end network 120 via the TRUNK link.

[0044] In implementation, data from production equipment is collected at the access layer and forwarded uniformly at the aggregation layer, ensuring real-time reporting and centralized management of production data. For example, production terminals such as industrial robots and sensors are connected to the access layer switches via gigabit Ethernet ports. The aggregation layer tags packets with VLANs via trunk links and encapsulates them with VXLAN before transmitting them to the backend network 120.

[0045] As an optional implementation method, such as Figure 2 As shown, the front-end network 110 includes an industrial control front-end. The access layer of the industrial control front-end connects to the industrial control equipment through ports and is used to collect industrial control command data issued by the industrial control equipment.

[0046] The aggregation layer of the industrial control front end is used to classify and forward industrial control command data and other business data.

[0047] In implementation, the instruction data generated by industrial control equipment has high real-time requirements and needs to be isolated from office or video data to prevent interference. For example, PLCs (Programmable Logic Controllers) are connected through access layer switches, and the aggregation layer sets a high-priority forwarding policy for industrial control VLANs, sending industrial control packets directly to the back-end control server, while office data is forwarded with normal priority.

[0048] As an optional implementation method, such as Figure 2 As shown, the front-end network 110 includes an OA front-end. The access layer of the OA front-end connects to office equipment through ports to collect office data generated by the office equipment.

[0049] The aggregation layer of the OA front end is used to forward data packets of the office VLAN to the office server in the back-end network based on the matching rules of the VLAN identifier, and to prohibit the data packets from accessing the production server and industrial control server in the back-end network.

[0050] In implementation, office data need not be mixed with industrial control or production data. VLANs can be used to separate office and industrial control data to ensure they do not interfere with each other. For example, the office VLAN can be pre-configured with VLAN 30. When the aggregation layer receives service data, it parses the VLAN ID. When it detects VLAN 30, it forwards the data packet to the backend office server. Another example: PC terminals and printers are connected through an access layer switch and assigned to VLAN 100. The aggregation layer forwards data from VLAN 100 separately to the backend office server, without entering the industrial control VLAN.

[0051] As an optional implementation method, such as Figure 2As shown, the architecture also includes a video surveillance network, which comprises an access layer and an aggregation layer. The access layer of the video surveillance network connects to video surveillance devices through ports for collecting surveillance video data.

[0052] The aggregation layer 1102 of the video surveillance network forwards the surveillance video data to the backend network 120 through the TRUNK link, and removes surveillance video data that does not conform to the preset access rules based on the access control list in the aggregation layer 1102.

[0053] In implementation, video surveillance data consumes a large amount of bandwidth, which may affect industrial control services if left unrestricted. ACL (Access Control List) control can be used to filter out abnormal or unauthorized video data. For example, after cameras are connected to the access layer, they are uniformly assigned to VLAN 200. The aggregation layer sets ACLs on the uplink ports to only allow data from legitimate camera IP address ranges to be forwarded to the backend video server, while other packets are discarded.

[0054] As an optional implementation, the distributed gateway of the aggregation layer 1102 is also used to parse the source MAC address or VLAN identifier of the service data when receiving service data from the access layer 1101, so as to determine the network partition to which the service data belongs.

[0055] The distributed gateway is also used to perform forwarding and control operations corresponding to each network partition; among which, Business data belonging to the production front-end network partition is forwarded to the manufacturing execution module of the back-end network; Forward business data belonging to the industrial control front-end network partition to the control server of the back-end network; Business data belonging to the OA front-end network partition is only allowed to be forwarded to the office server in the back-end network, and access to the production server and industrial control server is prohibited. The business data belonging to the video surveillance network partition is filtered locally based on the access control list to remove surveillance video data that does not meet the preset access rules, and then the filtered surveillance video data is forwarded to the video server of the backend network through the TRUNK link.

[0056] In implementation, the distributed gateway can parse the source MAC address or VLAN identifier of the data frame when receiving service data from the access layer, thereby determining the network partition to which the service data belongs. Specifically, the aggregation layer can be pre-configured with a partition identification table to store the mapping relationship between MAC address prefixes or VLAN IDs and corresponding front-end network partitions. This identification table can be configured by the network administrator during the deployment phase and can be dynamically updated according to changes in network devices. After determining the network partition, the distributed gateway can execute forwarding and access control operations corresponding to the partition type according to the pre-configured partition forwarding rules. For service data in the production front-end network partition, the distributed gateway forwards the data packet to the manufacturing execution system (such as the MES system) in the back-end network based on the target IP address or service port number. For service data in the industrial control front-end network partition, the distributed gateway prioritizes real-time performance and forwards the data directly to the back-end control server to meet the low-latency response requirements of industrial control commands. For service data in the OA front-end network partition, the distributed gateway only allows it to access the back-end office server and prohibits it from accessing the back-end production server and industrial control server based on the access control table to prevent data cross-interference between the office network and the production network. For example, taking a smart manufacturing workshop as an example, the network includes three front-end network partitions: production, industrial control, and OA, as well as a video surveillance network partition. The aggregation layer is deployed with a distributed gateway supporting SDN. When data packets uploaded from the access layer enter the aggregation layer, the gateway first parses the data, identifying the source MAC address and VLAN ID. For example, the VLAN ID for the production front-end is VLAN 10, for the industrial control front-end it is VLAN 20, and for the OA front-end it is VLAN 30. After receiving service data from VLAN 10, the distributed gateway encapsulates the data packet using VXLAN and forwards it to the back-end MES server. When industrial control command data from VLAN 20 is detected, the distributed gateway can forward it to the back-end control server with high priority, ensuring that the industrial control command response delay does not exceed a preset response value (e.g., 10ms). For office data from VLAN 30, the distributed gateway can, according to ACL rules, only allow it to access the back-end OA email and file server ports. If it detects that the office data is attempting to access the control server, it automatically discards the packet. For service data in video surveillance network partitions, the distributed gateway first filters the surveillance video stream locally based on the access control list, removing illegal or abnormal data packets that do not conform to preset access rules. Then, it forwards the filtered video traffic to the backend video server via a TRUNK link. Through this identification and partition forwarding, the distributed gateway can achieve network-level service partition identification, differentiated execution, and access path control, thereby achieving logical isolation of multiple services within the same physical network architecture and improving the overall network security and manageability.For example, in a video surveillance network with VLAN 40, the distributed gateway first performs ACL matching to remove abnormal video streams originating from unregistered camera devices. Then, it forwards legitimate video data to the backend video storage and monitoring management server via a TRUNK link. Using the solution provided in this application, the distributed gateway can automatically identify network partitions and perform differentiated processing when data enters the aggregation layer. This achieves secure isolation and intelligent forwarding of multiple service partitions without manual configuration, effectively reducing the risk of mutual interference between different services and improving the overall system response speed and security management level.

[0057] As an optional implementation, the backend network 120 also includes a logging module for storing the access time, source address, and destination address of business data passing through the physical firewall 130 or the virtual firewall.

[0058] In implementation, logging enables security incident tracing and prevents malicious access from going undetected. For example, a backend log server can run the Syslog system to generate records for all data packets passing through the firewall, saving information such as source IP, destination IP, and timestamps for subsequent auditing.

[0059] As an optional implementation, the SDN controller 140 is also configured to establish a control connection with the aggregation layer 1102 of the newly added network architecture when the aggregation layer device of the newly added network architecture supports the SDN protocol, so as to access the newly added network architecture.

[0060] In practice, the SDN controller can dynamically take over newly connected aggregation layer devices, enabling smooth network expansion. For example, when a new factory comes online, its aggregation layer switches enable the OpenFlow interface, and the SDN controller establishes a control session through a secure channel, incorporating the switch into the existing control domain without requiring network refactoring.

[0061] This application provides an industrial control network architecture, including a front-end network, a back-end network, a physical firewall, and an SDN controller. The front-end network comprises an access layer and an aggregation layer. The access layer connects to service terminals via ports and to the aggregation layer via trunk links. The aggregation layer is equipped with a distributed gateway to receive service data transmitted from the access layer via trunk links. Based on a pre-configured VLAN and VXLAN mapping table, it maps the VLAN identifier of the service data to a VXLAN identifier, performs encapsulation processing according to the VXLAN identifier, and forwards it to the back-end network. The SDN controller communicates with the aggregation layers of both the back-end and front-end networks. It generates a virtual firewall based on the physical firewall and uses the virtual firewall to restrict access and filter traffic for service data between the front-end and back-end networks, thus isolating and protecting the service data. To address the problem of interference between different service data due to the lack of flexible scheduling and isolation mechanisms in the network architecture, this application adopts a large Layer 2 flat network. Through the hierarchical design of the access and aggregation layers, it ensures unified aggregation of terminal data, avoids conflicts caused by direct communication between various service terminals, and initially achieves data partitioning management from a physical structure perspective. The distributed gateways and VLAN-to-VXLAN mapping at the aggregation layer enable different service data to be distinguished through identifier mapping before forwarding, narrowing the broadcast domain and reducing the possibility of broadcast storms, thereby improving network stability and scalability. The physical firewall, combined with the virtual firewall generated by the SDN controller, establishes a two-layer isolation mechanism between the front-end and back-end networks, and between different front-end networks. The physical firewall provides boundary isolation, while the virtual firewall provides logical isolation and dynamic policy adjustment, thus solving the problem of lack of flexible isolation between different service data. The centralized control capability of the SDN controller allows for dynamic generation and policy updates of the virtual firewall according to service needs, enabling flexible network configuration and reducing network reconstruction costs during service adjustments. Therefore, the embodiments of this application effectively solve the problems of mutual interference and insufficient scalability of service data caused by the lack of a unified flexible scheduling and isolation mechanism in the network architecture of the background art, thereby improving the security, flexibility, and scalability of industrial control networks.

[0062] It is understood that the same / similar parts between the various embodiments of the methods described above in this specification can be referred to each other. Each embodiment focuses on the differences from other embodiments, and relevant parts can be referred to the description of other method embodiments.

[0063] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0064] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0065] It should also be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0066] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0067] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0068] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. An industrial control network architecture, characterized by, The architecture comprises a foreground network, a background network, a physical firewall and an SDN controller. The foreground network comprises an access layer and an aggregation layer, the access layer is connected with business terminals through ports and connected with the aggregation layer through TRUNK links. The aggregation layer is provided with a distributed gateway for receiving service data transmitted by the access layer through the TRUNK link, mapping the VLAN identifier of the service data into a VXLAN identifier based on a pre-configured VLAN and VXLAN mapping table, performing encapsulation processing according to the VXLAN identifier, and forwarding to the background network. The SDN controller is in communication connection with the background network and the aggregation layer of the foreground network, for generating a virtual firewall based on the physical firewall, and performing access restriction and traffic filtering on service data between the foreground network and the background network through the virtual firewall, so as to isolate and protect the service data.

2. The industrial control network architecture of claim 1, wherein, The architecture comprises at least one foreground network and one background network, the background network comprises a background service module corresponding to each foreground network, and the virtual firewall establishes an independent access control instance for each foreground network, so as to limit each foreground network to access only the corresponding background service module.

3. The industrial control network architecture of claim 1, wherein, The port side of the aggregation layer is pre-provided with a broadcast storm suppression mechanism.

4. The industrial control network architecture of claim 3, wherein, The broadcast storm suppression mechanism comprises: setting a broadcast message rate threshold on the port side of the aggregation layer; when the broadcast message rate exceeds the threshold, discarding the excess messages, and limiting the forwarding range of the broadcast message to the broadcast domain corresponding to the same VXLAN identifier based on the VLAN to VXLAN mapping.

5. The industrial control network architecture of claim 1, wherein, The foreground network comprises a production foreground, and the access layer of the production foreground is connected with production equipment through ports for collecting production service data generated by the production equipment. The aggregation layer of the production foreground is configured to forward the messages of the production service data collected by the access layer ports to the background network through TRUNK links.

6. The industrial control network architecture of claim 5, wherein, The foreground network comprises an industrial control foreground, and the access layer of the industrial control foreground is connected with industrial control equipment through ports for collecting industrial control instruction data sent by the industrial control equipment. The aggregation layer of the industrial control foreground is configured to classify and forward the industrial control instruction data and other service data, and establish a queue based on VLAN priority in the aggregation layer to preferentially forward the industrial control instruction data to a background control server and place other service data in a low-priority forwarding queue.

7. The industrial control network architecture of claim 6, wherein, The foreground network comprises an OA foreground, and the access layer of the OA foreground is connected with office equipment through ports for collecting office data generated by the office equipment. The aggregation layer of the OA foreground is configured to forward the data messages of the office VLAN to an office server of the background network based on a matching rule of the VLAN identifier, and prohibit the data messages from accessing a production server and an industrial control server of the background network.

8. The industrial control network architecture of claim 7, wherein, The architecture further comprises a video monitoring network, the video monitoring network comprises an access layer and an aggregation layer, and the access layer of the video monitoring network is connected with video monitoring equipment through ports for collecting monitoring video data. The aggregation layer of the video surveillance network is also used to locally filter out surveillance video data that does not conform to preset access rules based on access control lists, and forward the filtered surveillance video data to the video server of the backend network.

9. The industrial control network architecture of claim 8, wherein, The distributed gateway of the aggregation layer is also used to parse the source MAC address or VLAN identifier of the service data when receiving service data from the access layer, so as to determine the network partition to which the service data belongs. The distributed gateway is further configured to perform forwarding and control operations corresponding to each of the network partitions; wherein, Business data belonging to the production front-end network partition is forwarded to the manufacturing execution module of the back-end network; Forward business data belonging to the industrial control front-end network partition to the control server of the back-end network; Business data belonging to the OA front-end network partition is only allowed to be forwarded to the office server in the back-end network, and access to the production server and industrial control server is prohibited. The service data belonging to the video surveillance network partition is filtered locally based on the access control list to remove surveillance video data that does not meet the preset access rules, and then the filtered surveillance video data is forwarded to the video server of the backend network through the TRUNK link.

10. The industrial control network architecture of claim 1, wherein, The backend network also includes a log recording module for storing the access time, source address, and destination address of business data passing through the physical firewall or virtual firewall.

11. The industrial control network architecture of claim 1, wherein, The SDN controller is specifically used for: Periodically scan the management interface of the aggregation layer devices to detect the identifiers of newly added front-end networks; If an unregistered foreground network identifier is detected, a virtual firewall is generated; Bind the virtual firewall to the identifier of the newly added front-end network; Based on the type of the newly added front-end network, a preset security control template is invoked to generate access control rules and distribute them to the virtual firewall; Activate the virtual firewall and register it to the control domain to achieve security protection and management of the newly added front-end network.

12. An industrial control network control method characterized by, The method is applied to the industrial control network architecture as described in any one of claims 1-11, and the method includes: The aggregation layer device management interface is periodically scanned. When an aggregation layer device corresponding to an unregistered front-end network is detected, the front-end network is identified as a newly added front-end network. If the aggregation layer device supports the SDN protocol, a control connection is established with the aggregation layer of the newly added front-end network through the SDN controller; Based on the control connection, the newly added aggregation layer is connected to the SDN control domain to access the newly added front-end network.

Images