Method for collaborative filtering of data traffic in a communication network

Abstract

The invention relates to a method (100) for collaborative filtering of data traffic in a communication network (1), comprising filtering (101) the data traffic by a first security filtering module (2) based on a first filtering rule, inserting (102) a description of the first filtering rule into the filtered data traffic, filtering (103) the filtered data traffic by a second security filtering module (3) based on a second filtering rule taking into account the inserted description of the first filtering rule. Furthermore, the invention relates to a computer program, a device and a storage medium for this purpose.

Description

Technical Field

[0001] This invention relates to a method for collaborative filtering of data traffic in a communication network. Furthermore, this invention relates to a computer program, apparatus, and storage medium for this purpose. Background Technology

[0002] Security filtering modules, such as firewalls, are widely recognized as crucial components for protecting industrial systems from unauthorized access and cyber threats. These modules play a decisive role in filtering network traffic, preventing data breaches, and ensuring the integrity of critical processes. Traditional security filtering modules have been widely used in industrial communication networks to ensure these security measures. However, driven by technological advancements and the need for greater efficiency, industrial systems are rapidly evolving. This transformation presents new challenges and requirements for network and security measures.

[0003] Industrial communication networks often operate in real-time environments, where even slight delays or interruptions can have serious consequences. Therefore, there is a growing demand for more robust networking and security solutions, including specialized security filtering modules, to address these specific challenges and cover a wider range of applications, such as low-latency and time-critical applications, using existing hardware.

[0004] Today, security filtering modules are typically implemented as individual units in network configurations. However, network administrators are increasingly adopting dual configurations to improve performance, security, and fault tolerance. In this approach, multiple security filtering modules are implemented in parallel or sequentially, enabling load balancing and improved overall system stability. In cascaded configurations, all network traffic must pass through both security filtering modules. This configuration is often used in high-security environments to minimize security filtering module-specific vulnerabilities or to protect multiple subnets within an internal communication network with different security requirements. Summary of the Invention

[0005] The subject of this invention is a method having the features of claim 1, a computer program having the features of claim 8, an apparatus having the features of claim 9, and a computer-readable storage medium having the features of claim 10. Other features and details of the invention derive from the corresponding dependent claims, the description, and the drawings. Herein, the features and details described in conjunction with the method according to the invention also apply in conjunction with the computer program according to the invention, the apparatus according to the invention, and the computer-readable storage medium according to the invention, and vice versa, so that the disclosure of this invention may always be cross-referenced.

[0006] The subject of this invention is, in particular, a method for collaborative filtering of data traffic in a communication network, comprising: - Based on the first filtering rule, data traffic is filtered by the first security filtering module, wherein within the scope of this invention, the security filtering module may also be referred to as and understood as a firewall. - Insert the description of the first filtering rule into the filtered data traffic, specifically into each data packet that still exists after filtering. - Taking into account the description of the inserted first filtering rule, the filtered data traffic is filtered by a second security filtering module based on a second filtering rule, which is preferably at least partially and particularly preferably completely different from the first filtering rule, wherein the first filtering rule is no longer used for filtering by the second security filtering module.

[0007] By using appropriate filtering rules, data traffic in a communication network can be selectively filtered through corresponding security filtering modules or firewalls. Filtering rules are based on attributes of individual data packets, such as source and destination IP addresses, source and destination ports, protocol types (e.g., TCP, UDP), and other metadata. Within the scope of filtering, the corresponding security filtering module examines each arriving or departing data packet specifically against these filtering rules and determines, based on defined criteria, whether to allow, block, or modify the packet if necessary. In this way, data traffic can be controlled through filtering to prevent unauthorized access, protect network resources, and enforce security requirements.

[0008] The description can be understood as a data structure containing information about a first filtering rule applied by a first security filtering module. This data structure includes at least a list of identifiers for the applied first filtering rule. Without limiting the scope of the invention, this data structure may additionally contain other information, such as metadata or timestamps for the applied rule. This data structure is inserted into a defined optional header field of the data packet. The format and maximum size of the header field are described in more detail below. The information in the header field can be encrypted and digitally signed to ensure the integrity and authenticity of the information. Suitable encryption methods include, for example, AES, and suitable signing methods include, for example, RSA.

[0009] Security and efficiency can be significantly improved by the method according to the invention, which allows multiple security filtering modules to cooperate; hence, it is called kooperative filtering. In other words, the method according to the invention introduces a scheme for performing filtering that incorporates the description of filtering rules into the data traffic itself, thereby enabling better awareness and coordinated response to potential threats.

[0010] The description can be understood as follows: a second security filtering module evaluates the description of the applied first filtering rules contained in the header field of the data packet. The second security filtering module may perform decryption and signature verification. The second security filtering module verifies, based on the included identifiers, which first filtering rules have already been applied by the first security filtering module. First filtering rules whose identifiers are included in the description are not reapplied by the second security filtering module. Before forwarding the data packet, the second security filtering module adds the identifiers of the second filtering rules it applied to the description on its side; these second filtering rules are different from the first filtering rules.

[0011] The method according to the invention specifically includes sequencing multiple security filtering modules in a communication network, wherein each security filtering module can filter data traffic based on different filtering rules. Before a data traffic packet is forwarded to the next or second security filtering module, the first security filtering module can now add a corresponding description of the applied filtering rules to the data traffic packet. The second security filtering module can then use this description to apply its own filtering rules more precisely and avoid redundancy. Thus, security and efficiency in a communication network can be improved by the method according to the invention.

[0012] Advantageously, in this invention, the insertion may be specified to include: - The description of the first filtering rule is encrypted and / or authenticated. Encryption and authentication ensure that data traffic is transmitted not only confidentially but also authentically. During encryption, the content of each data packet in the data traffic is converted into a form unreadable by unauthorized individuals, specifically using cryptographic methods such as symmetric (AES) or asymmetric (RSA) encryption. Authentication is performed, for example, through digital certificates issued by a trusted Certificate Authority (CA), which can verify the sender's identity. Combined with a digital signature generated using the sender's private key, the receiver can verify the integrity and authenticity of the data traffic. Therefore, during transmission, the data traffic cannot be altered undetected or viewed by a third party.

[0013] It may be advantageous if, within the scope of this invention, a description of the first filtering rule is inserted into a defined header field of each packet of the filtered data traffic. This, in particular, enables the efficient and transparent transmission of the description between security filtering modules without requiring additional infrastructure or communication steps.

[0014] It can be further advantageously specified that the method additionally includes: - Define corresponding identifiers for all filtering rules, such as setting specific bits for each. - The defined identifier is provided to all security filtering modules in the communication network, either centrally through a centralized data processing device or distributed on a per-security-module basis, for example, by attaching the identifier as additional information to the filtered data traffic. Within the insertion scope, the identifier corresponding to the first filtering rule is inserted as a description of the first filtering rule into the filtered data traffic, wherein the identifier of the first filtering rule is specifically encoded into each data packet of the filtered data traffic. Thus, the second security filtering module can determine, based on the identifier, which filtering rules have been applied as the first filtering rule within the filtering scope by the first security filtering module. In this way, efficient and secure management of filtering rules in the communication network can be achieved. Using a central identifier for filtering rules particularly simplifies information exchange between security filtering modules. By encoding the identifier into each data packet, a transparent and traceable method can be ensured.

[0015] An identifier (Kennung) can be understood as a unique identifier for each defined filtering rule. This identifier is centrally generated by a management instance (Verwaltungsinstanz) existing within or outside the communication network and distributed to all security filtering modules in the network. The type of management instance is not important to this invention. Identifiers are fixedly assigned to filtering rules, enabling efficient and compact representation of the rules in the description.

[0016] Optionally, the method may further include: Taking into account the individual computing power and / or location of the specific security filtering module, specific filtering rules are assigned to the specific security filtering module in the communication network, in particular, specific filtering rules are assigned to the first security filtering module as the first filtering rule, and other specific filtering rules are assigned to the second security filtering module as the second filtering rule.

[0017] Filtering rules can be automatically assigned using a dispatch algorithm that considers the individual computing power and / or location of the security filtering modules. An example of such an algorithm is the weighted round-robin algorithm.

[0018] This allows for the efficient distribution of filtering rules to different security filtering modules. By considering individual computing power and location (Standorte), security filtering modules can be used optimally, resulting in improved resource management and overall efficiency.

[0019] Another advantage within the scope of this invention can be achieved if a centralized data processing device is configured for assignment, in order to accordingly configure successive security filtering modules, particularly the first and second security filtering modules. This centralized data processing device can assign specific filtering rules to the first and second security filtering modules, and, if necessary, other successive security filtering modules. This centralized configuration enables the efficient and uniform distribution of filtering rules to different security filtering modules, which advantageously takes into account the individual computing power and location of the different security filtering modules.

[0020] According to another possibility, the method may further include: - Based on the current available computing capacity of the security filtering modules, particularly the first and / or the second security filtering modules, and / or based on the current load of the communication network, dynamically determine the corresponding filtering rules of the security filtering modules, particularly the first and second filtering rules.

[0021] This approach allows for more efficient use of the security filtering module's computing power. By dynamically determining filtering rules, the load on the security filtering module can be adapted to its current capacity and the current load of the communication network. This significantly improves the overall performance of the security filtering module and minimizes the risk of overload scenarios, especially under changing network conditions.

[0022] Similarly, the subject of this invention is a computer program, and more particularly a computer program product, comprising instructions that, when executed by at least one computer, cause the computer to perform the method according to the invention. Therefore, the computer program according to the invention provides the same advantages as those already described in detail regarding the method according to the invention.

[0023] Similarly, the subject of this invention is an apparatus for performing data processing, the apparatus being configured to execute the method according to the invention. As an apparatus, at least one computer may be provided, which executes a computer program according to the invention. The computer may have at least one processor for executing the computer program. A non-volatile data memory may also be provided, in which the computer program may be stored, and which the processor may read from the non-volatile data memory for execution.

[0024] Similarly, the subject of this invention is a computer-readable storage medium having a computer program according to the invention and / or including instructions that, when executed by at least one computer, cause the computer to perform a method according to the invention. The storage medium is configured, for example, as a data storage device, such as a hard disk and / or non-volatile memory and / or a memory card. The storage medium can, for example, be integrated into a computer.

[0025] Furthermore, the method according to the invention can also be performed as a computer-implemented method. Alternatively or additionally, at least one of the disclosed method steps can be computer-implemented and / or automatically implemented. Attached Figure Description

[0026] Other advantages, features, and details of the invention will become apparent from the following description, in which embodiments of the invention are described in detail with reference to the accompanying drawings. Here, the features mentioned in the claims and in the specification are important to the invention, either individually or in any combination. Wherein: Figure 1 A schematic visualization illustrating a method, apparatus, storage medium, and computer program according to embodiments of the present invention is provided. Figure 2 A schematic diagram of a communication network according to an embodiment of the present invention is shown. Detailed Implementation

[0027] exist Figure 1 The diagram schematically illustrates a method 100, apparatus 10, storage medium 15, and computer program 20 according to an embodiment of the present invention.

[0028] Figure 1 Specifically, an embodiment of a method 100 for collaborative filtering of data traffic in a communication network 1 is shown. In a first step 101, data traffic is filtered by a first security filtering module 2 based on a first filtering rule. In a second step 102, a description of the first filtering rule is inserted into the filtered data traffic. In a third step 103, the filtered data traffic is filtered by a second security filtering module 3 based on a second filtering rule, taking into account the inserted description of the first filtering rule.

[0029] Figure 2 A schematic diagram of a communication network 1 according to an embodiment of the present invention is shown. In the communication network, preferably, a first security filtering module 2 and a second security filtering module 3 are arranged serially to filter data traffic sequentially. Furthermore, a centralized data processing device 4 may be provided, which can assign corresponding specific filtering rules to specific security filtering modules 2 and 3 in the communication network 1.

[0030] According to the present invention, the performance and efficiency of security filtering modules (especially firewalls) can be improved by introducing cooperation between them. In conventional configurations, multiple security filtering modules along the network path of communication network 1 may redundantly apply the same filtering rules, which may lead to unnecessary processing and latency. This redundancy has a particularly negative impact on the overall performance and efficiency of communication network 1.

[0031] Furthermore, a particular objective of this invention is to address the challenges associated with resource utilization and scalability in the arrangement of multiple security filtering modules. Conventional setups often struggle to effectively utilize computing resources and adapt to the increasing demands of the communication network 1.

[0032] By addressing these specific challenges and shortcomings, the present invention improves the performance of security filtering modules by reducing latency, optimizing computational resource utilization, and / or improving scalability. This means that the present invention is particularly aimed at making security filtering modules more efficient and capable of handling more demanding network loads without compromising security.

[0033] According to the present invention, the inefficiency and performance limitations of traditional firewall systems can be eliminated by enabling collaboration between successive security filtering modules. Here, a preceding security filtering module can share a description of the applied filtering rules with at least one subsequent security filtering module.

[0034] When a filtering rule has already been applied by another previous security filtering module, this information exchange allows subsequent security filtering modules to avoid redundant filtering. Therefore, this invention optimizes the filtering process, reduces unnecessary processing, and improves overall performance and efficiency.

[0035] The collaborative security filtering module solution according to the present invention offers a number of advantages. By eliminating redundant filtering, the invention reduces unnecessary processing, resulting in faster and more efficient filtering of data traffic in communication network 1. This particularly improves overall system efficiency and enables the handling of higher data traffic volumes. Furthermore, the invention minimizes latency by eliminating double filtering and ensuring smooth and rapid network traffic flow through the security filtering module. This specifically results in lower latency and improved response times. The optimized filtering process and improved performance of the invention further enhance network protection. By avoiding redundant filtering and ensuring efficient data traffic, unauthorized access and network threats can be better identified and prevented, thereby improving general network security.

[0036] This invention specifically introduces a cooperative mechanism that improves the efficiency of successive security filtering modules in a network path. This mechanism allows a preceding security filtering module to share a description of the applied filtering rules with at least one subsequent security filtering module. To this end, the preceding security filtering module can encrypt and / or authenticate the description of the applied filtering rules, thereby securely inserting it into the filtered data traffic. This description of the applied filtering rules can then be transmitted, for example, as a header field, to at least one subsequent security filtering module. Upon receiving the filtered data traffic, at least one subsequent security filtering module can access this header field and avoid redundant filtering for already applied filtering rules. By eliminating the need for redundant application of the same filtering rules, this innovative solution significantly reduces unnecessary processing and latency, thereby improving overall performance.

[0037] Information about the applied filtering rules can be inserted as encrypted and authenticated data to ensure the security and integrity of the firewall's collaboration. Encrypting information makes it much more difficult for unauthorized individuals to manipulate or forge data. Authentication further guarantees the authenticity of the information, making it more difficult for attackers to impersonate a legitimate security filtering module and falsely claim that specific filtering rules have been enforced.

[0038] For the proposed solution to be successfully implemented, it is perhaps absolutely necessary that all participating security filtering modules support the header field. At least, and particularly, each subsequent and every other security filtering module involved in the collaboration needs to have the ability to understand and identify this header field.

[0039] To minimize the amount of additional information, an efficient approach according to embodiments of the present invention involves using centrally defined and communicated identifiers for these filtering rules. This additional information is added to individual data packets or header fields to convey a description of the filtering rules. Specifically, these identifiers, assigned to different filtering rules, can then be transmitted to all relevant security filtering modules. Once a security filtering module is established, it can directly encode the filtering rules into the data packets of the data traffic using these identifiers. By applying this approach, the amount of additional data added to the data packets can be minimized, thereby reducing network overhead.

[0040] In scenarios where basic or standard filtering rules are sufficient for a single security filtering module to apply, a collaborative mechanism can still be used to improve efficiency. In this case, when a single security filtering module processes a packet and applies basic filtering rules, these rules can be securely added as a description to the packet in a header field. Subsequent security filtering modules in the network path can then refer to this header field and recognize that basic filtering rules have been applied, allowing them to focus solely on implementing non-generic filtering rules specific to their own security filtering module. The additional header information will be particularly limited, and preferably will only indicate whether (network-wide defined) basic filtering rules have been executed, with the additional header information added to the packet as a description of the applied filtering rules.

[0041] By implementing intelligent configuration technology, the application of specific filtering rules can be distributed to different security filtering modules, for example, based on their individual computing power, location, and / or other capabilities. This approach optimizes the utilization of computing resources and ensures that filtering rules corresponding to each security filtering module's strengths are assigned. To facilitate this process, a centralized coordination and management center in the form of a centralized data processing device 4 can be utilized to configure the successive security filtering modules accordingly. This centralized data processing device 4 can act as a trust anchor for all collaborating security filtering modules and can be responsible for coordinating and optimizing the distribution of filtering rules to the security filtering modules. By utilizing this intelligent configuration scheme, overall efficiency and effectiveness can be significantly improved.

[0042] The collaborative security filtering module according to the invention can provide significant advantages in a variety of fields, particularly in complex network architectures with security filtering modules and demanding applications. Such fields include, for example, the industrial sector, where applications such as automation, industrial control, and industrial IoT can greatly benefit from the improved connectivity and security provided by the method according to the invention.

[0043] The foregoing explanation of the embodiments describes the invention only within the scope of examples. Of course, the various features of the embodiments can be freely combined with each other without departing from the scope of the invention, as long as it is technically meaningful.

Claims

1. A method (100) for collaborative filtering of data traffic in a communication network (1), comprising: -Based on the first filtering rule, the data traffic of (101) is filtered by the first security filtering module (2). - Insert the description of the first filtering rule into (102) the filtered data traffic. - Taking into account the description of the first filtering rule inserted, the filtered data traffic is filtered (103) by the second security filtering module (3) based on the second filtering rule.

2. The method (100) according to claim 1, characterized in that, Insertion (102) includes: - Encrypt and / or authenticate the description of the first filtering rule.

3. The method (100) according to any one of the preceding claims, characterized in that, The description of the first filtering rule is inserted into the defined header fields of each packet of the filtered data traffic.

4. The method (100) according to any one of the preceding claims, characterized in that, The method (100) further includes: Define corresponding identifiers for all filtering rules. - Provide the defined identifier to all security filtering modules (2, 3) in the communication network (1). In the scope of insertion (102), the identifier corresponding to the first filtering rule is inserted into the filtered data traffic as a description of the first filtering rule, wherein the identifier of the first filtering rule is specifically encoded into each data packet of the filtered data traffic.

5. The method (100) according to any one of the preceding claims, characterized in that, The method (100) further includes: - Taking into account the individual computing power and / or location of a particular security filtering module, a particular filtering rule is assigned to a particular security filtering module in the communication network (1), in particular, the particular filtering rule is assigned as the first filtering rule to the first security filtering module (2), and other particular filtering rules are assigned as the second filtering rule to the second security filtering module (3).

6. The method (100) according to claim 5, characterized in that, For the purpose of assignment, a centralized data processing device (4) is set up so as to configure successive security filtering modules, in particular the first security filtering module (2) and the second security filtering module (3).

7. The method (100) according to any one of the preceding claims, characterized in that, The method (100) further includes: - Based on the current available computing capacity of the security filtering modules, particularly the first and second filtering rules, and / or based on the current load of the communication network (1), the corresponding filtering rules of the security filtering modules are dynamically determined.

8. A computer program (20) comprising instructions that, when executed by at least one computer (10), cause the computer to perform the method (100) according to any one of the preceding claims.

9. An apparatus (10) for performing data processing, the apparatus being configured to perform the method (100) according to any one of claims 1 to 7.

10. A computer-readable storage medium (15) comprising instructions that, when executed by at least one computer (10), cause the computer to perform the steps of the method (100) according to any one of claims 1 to 7.

Images