Decapsulating Firewall for Industrial Control Network Security

The patent introduces a decapsulating firewall as an intermediary device positioned between the IP network and non-IP network devices. This firewall intercepts IP packets, decapsulates embedded non-IP protocols, and applies access control rules to the extracted non-IP packets before forwarding them to destination devices. This intermediary mechanism prevents unauthorized access by blocking malicious packets that would otherwise bypass conventional firewalls through embedded protocol encapsulation.

The patent implements preliminary action by establishing access control rules in advance for each non-IP network device. The decapsulating firewall maintains an access control database that pre-defines which IP sources are authorized to communicate with which non-IP devices. When packets are intercepted, the firewall checks these pre-established rules before allowing communication, thus maintaining security control while enabling transparent Ethernet routing for authorized devices.

The patent applies the extraction principle by removing embedded non-IP packets from their IP packet encapsulation at the decapsulating firewall. The firewall extracts the inner non-IP protocol packets, examines their destination addresses and routing information, and applies access control rules to these extracted packets independently of the outer IP packet. This allows efficient routing to be maintained for authorized communications while blocking unauthorized access attempts through protocol encapsulation.