Communication isolation device and safety communication method thereof

Abstract

The invention relates to a communication isolation device and a safety communication method of the isolation device, and belongs to the technical field of safety communication. According to the method, a communication port range is added in a secure communication strategy configuration file of a communication isolation device, the port range compatibly represents an existing single port mode, and the communication isolation device judges whether to communicate with a port requesting communication or not according to an ip address, an mac address and the communication port range in the secure communication strategy configuration file. And if the port requesting communication is within the normal communication port range configured in the security communication strategy configuration file, allowing communication, otherwise, blocking the communication request. The method and the device are used for solving the problems that in the prior art, when communication is carried out with different port services on the same physical link, a secure communication strategy configuration file needs to be modified again, so that the configuration process is troublesome, and use is inconvenient.

Description

Technical Field

[0001] This invention relates to a communication isolation device and a secure communication method for the isolation device, belonging to the field of secure communication technology. Background Technology

[0002] Existing isolation devices use secure communication policies for secure communication. These policies store rules such as IP addresses, MAC addresses, and communication ports that require legitimate communication, and only allow data that conforms to the rules configured in the policy to communicate.

[0003] If multiple services need to communicate through an isolation device on the same physical link (with the sender and receiver remaining unchanged, i.e., the sender's and receiver's IP addresses and MAC addresses remaining unchanged), and each service uses a different communication port, then multiple security policies with the same IP address and MAC address but different ports need to be added to satisfy the service communication. This can lead to problems such as complicated configuration and inconvenience in use. Summary of the Invention

[0004] The purpose of this invention is to provide a communication isolation device and a secure communication method for the isolation device, so as to solve the problem of complicated configuration process and inconvenient use caused by the fact that the existing secure communication policy configuration file stores a single communication port, which leads to multiple services needing to communicate.

[0005] To achieve the above objectives, the present invention includes: A secure communication method for a communication isolation device according to the present invention includes the following steps: Add a range of communication ports to the secure communication policy configuration file of the communication isolation device; the communication isolation device determines whether to communicate with the requested port based on the IP address, MAC address and communication port range in the secure communication policy configuration file.

[0006] Furthermore, the communication port range is represented by 4 bytes, with two bytes representing the starting port of the communication range and the other two bytes representing the ending port of the communication range.

[0007] Furthermore, the communication port range is also used to represent a single port.

[0008] Furthermore, when the communication port range represents a single port, the two bytes representing the starting port of the communication range are set to 0, and the two bytes representing the ending port of the lower-order communication range represent a single communication port.

[0009] Furthermore, the communication port range is stored in the secure communication policy configuration file in decimal format.

[0010] Furthermore, the isolation device determines whether to communicate with the requested port based on the IP address, MAC address, and communication port range in the secure communication policy configuration file as follows: It matches the IP address of the communication request with the IP address in the secure communication policy. If the IP address in the communication request matches the IP address in the secure communication policy, it then matches the MAC address corresponding to that IP address in the secure communication policy with the MAC address of the communication request. If the MAC address in the communication request matches the MAC address corresponding to that IP address in the secure communication policy, it determines whether the communication request port is within the normal communication port range of the secure communication policy. If so, the security policy is met, and communication is allowed; otherwise, the security policy is not met, and communication is blocked.

[0011] The present invention also provides a communication isolation device, which includes a secure communication policy configuration file. The secure communication policy configuration file includes a communication port range, which includes a start port and an end port of the communication range. The communication isolation device determines whether to communicate with the port requesting communication based on the IP address, MAC address and communication port range in the secure communication policy configuration file.

[0012] Furthermore, the communication port range is represented by 4 bytes, with two bytes representing the starting port of the communication range and the other two bytes representing the ending port of the communication range.

[0013] Furthermore, the communication port range is also used to represent a single port.

[0014] Furthermore, the two bytes representing the start port of the communication range are set to 0, and the two bytes representing the end port of the communication range represent a single communication port.

[0015] The beneficial effects of this invention are as follows: As an improved invention, this invention adds a communication port range to the secure communication policy configuration file of the communication isolation device. This communication port range includes a starting port and an ending port of the communication range. The communication isolation device determines whether to communicate with the requested port based on the IP address, MAC address, and communication port range in the secure communication policy configuration file. Therefore, the communication port range added to the secure communication policy configuration file of this invention represents multiple communicable ports. This enables communication with services on different ports on the same physical link without needing to modify the secure communication policy configuration file, simplifying the communication process and solving the problem in the prior art where different services use different communication ports on the same physical link, resulting in cumbersome configuration and inconvenience. Attached Figure Description

[0016] Figure 1 This is a flowchart of the secure communication process for the communication isolation device. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be described in detail below with reference to the accompanying drawings and embodiments.

[0018] The concept of this invention is to add a normal communication port range to the secure communication policy configuration file of the communication isolation device. Through this configuration file, it is possible to communicate with services on different ports on the same physical link without having to modify the secure communication policy configuration file again. This simplifies the communication process and solves the problem in the prior art that different services use different communication ports on the same physical link, which makes the configuration process cumbersome and inconvenient to use.

[0019] Device Example: This communication isolation device contains a secure communication policy configuration file. This file specifies the range of ports for normal communication. This range of ports can accommodate multiple different port services communicating on a single physical link, and is also compatible with single-port configuration. The communication isolation device determines whether to communicate with the requested port based on the IP address, MAC address, and communication port range specified in the secure communication policy configuration file. Figure 1 As shown, it consists of the following two steps.

[0020] 1. Configure the port range for secure communication policies.

[0021] The communication port range of the communication isolation device in this invention is 1-65535, therefore, the port can be represented by 2 bytes, i.e., the maximum is 0xFFFF. The communication port range includes the starting port and the ending port of the communication range, therefore, 4 bytes are used to represent the communication port range, with the high 2 bytes representing the starting port and the low 2 bytes representing the ending port. For example, when configuring the secure communication strategy of the isolation device, the port can be configured as a range such as "1~3", which should be represented as 0x00010003. In this case, the high 2 bytes 0x0001 represent the starting port as 1, and the low 2 bytes 0003 represent the ending port as 3, i.e., the communication port range is 1~3. As another implementation, the low 2 bytes can also represent the starting port of the port range, and the high 2 bytes can represent the ending port. Similarly, as another implementation, the number of high and low bytes here is not limited to 2 bytes and can be adjusted according to the number of ports of the communication isolation device itself.

[0022] To ensure compatibility with single-port representation, it's agreed that a high 2-byte value of 0 indicates single-port mode, while the low 2-byte represents the communication port. For example, configuring a single port 3 can be represented as 0x00000003. In this case, the high 2-byte 0x0000 indicates single-port mode, and the low 2-byte 0003 indicates port 0x0003, signifying a single communication port of port 3. Alternatively, in another implementation, a low 2-byte value of 0 can be used to represent single-port mode, while the high 2-byte represents the communication port.

[0023] For ease of storage, the communication port range is converted to decimal and stored in the security communication policy configuration file. For example, 0x00010003 should be converted to decimal "65539" and stored in the security communication policy configuration file; that is, the communicable port range in the security communication policy configuration file is represented as "65539". As another implementation, the port range can also be stored in binary or hexadecimal format instead of decimal.

[0024] 2. After receiving a communication request, the isolation device performs matching according to the secure communication policy.

[0025] When the isolation device receives a communication request, it matches it against the rules in the secure communication policy. First, it matches the IP address in the secure communication policy with the IP address of the communication request. After a successful IP address match, it matches the MAC address of the communication request with the MAC address corresponding to the IP address in the secure communication policy. After a successful MAC address match, it matches the port of the communication request with the corresponding rules for the IP and MAC address in the secure communication policy.

[0026] If the communication port of the rule corresponding to the IP and MAC address in the security communication policy is less than 65535, it indicates a single port, not a port range. The port in the communication request will be matched against the port in the request. If they match, the security communication policy is in effect, and communication is allowed. If they do not match, the security communication policy is not in effect, and the communication request is blocked. Conversely, if the communication port of the rule corresponding to the IP and MAC address in the security communication policy is greater than 65535, it indicates a port range. If the port in the communication request is within the range, the security communication policy is in effect, and communication is allowed. If the port in the communication request is not within the range, the security communication policy is not in effect, and the communication request is blocked.

[0027] Method Implementation Examples: The present invention discloses a secure communication method for a communication isolation device, which involves adding a normal communication port range to the secure communication policy configuration file of the communication isolation device; the communication isolation device determines whether to communicate with the port requesting communication based on the IP address, MAC address and communication port range in the secure communication policy configuration file. This method has been described clearly enough in the device embodiments and will not be repeated here.

Claims

1. A secure communication method for a communication isolation device, characterized in that, Includes the following steps: Add a communication port range to the secure communication policy configuration file of the communication isolation device. This communication port range includes the starting port and the ending port of the communication range. The communication isolation device determines whether to communicate with the requested port based on the IP address, MAC address and communication port range in the secure communication policy configuration file.

2. The secure communication method of the communication isolation device according to claim 1, characterized in that, The communication port range is represented by 4 bytes, with two bytes representing the starting port of the communication range and the other two bytes representing the ending port of the communication range.

3. The secure communication method of the communication isolation device according to claim 1 or 2, characterized in that, The communication port range is also used to represent a single port.

4. The secure communication method of the communication isolation device according to claim 3, characterized in that, When the communication port range represents a single port, the two bytes representing the starting port of the communication range are set to 0, and the two bytes representing the ending port of the communication range represent a single communication port.

5. The secure communication method of the communication isolation device according to claim 1, characterized in that, The communication port range is stored in a secure communication policy configuration file in decimal format.

6. The secure communication method of the communication isolation device according to claim 1, characterized in that, The isolation device determines whether to communicate with the requested port based on the IP address, MAC address, and communication port range in the secure communication policy configuration file as follows: It matches the IP address of the communication request with the IP address in the secure communication policy. If the IP address in the communication request matches the IP address in the secure communication policy, it then matches the MAC address corresponding to that IP address in the secure communication policy with the MAC address of the communication request. If the MAC address in the communication request matches the MAC address corresponding to that IP address in the secure communication policy, it determines whether the requested port is within the normal communication port range of the secure communication policy. If so, the security policy is met, and communication is initiated. Otherwise, it does not comply with the security policy, and communication will be blocked.

7. A communication isolation device, wherein the isolation device is provided with a secure communication policy configuration file, characterized in that, The secure communication policy configuration file includes a communication port range, which includes the starting port and the ending port of the communication range. The communication isolation device determines whether to communicate with the port requesting communication based on the IP address, MAC address and communication port range in the secure communication policy configuration file.

8. The communication isolation device according to claim 7, characterized in that, The communication port range is represented by 4 bytes, with two bytes representing the starting port of the communication range and the other two bytes representing the ending port of the communication range.

9. The communication isolation device according to claim 7, characterized in that, The communication port range is also used to represent a single port.

10. The communication isolation device according to claim 7, characterized in that, When the communication port range represents a single port, the two bytes representing the starting port of the communication range are set to 0, and the two bytes representing the ending port of the communication range represent a single communication port.

Images