CN112104637A - Security gateway isolation method and method for sending extranet data to intranet - Google Patents

Abstract

The invention discloses a security gateway isolation method and a method for sending data from an external network to an internal network. The security gateway isolation method includes: S11, establishing a connection between a user and an isolation gateway: using a computer installed with a linux operating system And log in through the management program; S12, write a configuration file: write the configuration information required by the user; S13, import the gateway: import the configuration file written in step S12 into the gateway; S14, judge whether the configuration file passes: if passed , restart the computer, and the configuration file takes effect; if it fails, jump to step S12 to rewrite the configuration file. The present invention realizes the complete isolation of the gateway by writing the configuration file and importing it into the gateway; when the external network data is sent to the internal network, the above-mentioned gateway that has imported the configuration file enables reliable external network data to be sent to the internal network. , to ensure the security of data transmission in the industrial control system.

Description

A security gateway isolation method and a method for sending external network data to an internal network

technical field

The invention relates to the field of industrial control device and system functional security and information security, in particular to a method for isolating a security gateway and a method for sending data from an external network to an internal network.

Background technique

Data acquisition and monitoring and control (SCADA), distributed control system (DCS), process control system (PCS), programmable logic controller (PLC) and other industrial control systems are widely used in industry, energy, transportation, water conservancy and municipal and other fields. Used to control the operation of production equipment. Once there is a loophole in the information security of the industrial control system, it will cause major hidden dangers to the operation of industrial production and national economic security. With the development of computer and network technology, especially the in-depth integration of informatization and industrialization, industrial control system products increasingly use general protocols, general hardware and general software to connect with public networks such as MIS networks and the Internet in various ways. , causing threats such as viruses and Trojans to spread to the industrial control system, and the security problem of the industrial control system has become increasingly prominent. The "Stuxnet" virus incident in 2010 fully reflects the severe situation facing the information security of industrial control systems.

The industrial network security isolation gateway is a new network isolation product specially used in the industrial field in recent years. It adopts a "2+1" three-module architecture and has a built-in dual host system. The isolation unit establishes a secure channel through bus technology to safely Enables fast data exchange. Different from the gatekeeper, the application provided by the industrial network security isolation gateway is specially aimed at the security protection of the control network, so it only provides the common communication functions of the control network such as OPC, Modbus, etc., but does not provide the general Internet function.

SUMMARY OF THE INVENTION

In order to overcome the deficiencies of the above technologies, the present invention provides a method for isolating a security gateway and a method for sending data from an external network to an internal network.

The technical scheme adopted by the present invention to overcome its technical problems is:

A security gateway isolation method, comprising the following steps:

S11. Establish a connection between the user and the isolation gateway: use a computer installed with the Linux operating system and log in through the management program;

S12, write a configuration file: write the configuration information required by the user;

S13, import gateway: import the configuration file written in step S12 into the gateway;

S14. Determine whether the configuration file is passed: if it passes, restart the computer, and the configuration file takes effect; if it fails, jump to step S12 to rewrite the configuration file.

Further, when the user logs in in the step S11, four types of account login rights are included, namely, an authorized administrator, an authorized user, an authorized auditor, and an authorized security officer. Among them, authorized administrators at least have the functions of configuring management port parameters, configuring log system parameters and password modification; authorized users mainly refer to authorized control stations or authorized operation stations, which can communicate with each other in isolation; authorized auditors have a log system View permissions; authorized security officers have the functions of configuring security policies, viewing security policies, and backing up security configurations. In the security gateway isolation method of the present invention, when different account rights log in, different operation interfaces are displayed, and the authorized administrator login has functions of management port parameter modification, user password modification, uploading security isolation configuration file and log viewing; authorized auditor login It has the function of viewing system traffic logs; authorized security officers can log in to modify security parameters, upload configuration files, view current security parameters, change passwords, and synchronize configuration files.

Further, the step S12 specifically includes:

Determine the configuration information required by the user;

Write configuration files in XML document format;

Convert the prepared configuration file through the conversion tool and upload it to the gateway.

Further, in the step S12, the start flag of the configuration file is iGateConf, and under this flag, one or more of the following configuration items are loaded: the configuration of the file header, the binding of the MAC address and the IP address configuration, IP whitelist settings, access frequency control, SNET protocol type filtering, service access control, and cfg file generation.

Further, the step S13 specifically includes:

Put the configuration file to be uploaded in the current directory of the client, and convert it into iGateWay.en format through the configuration file conversion and encryption program;

When it is confirmed that the file exists in the current directory, the import to the gateway is performed.

The invention also discloses a method for sending data from an external network to an internal network, which at least undergoes information isolation, and the information isolation includes at least the following steps:

S21, the external network sends the data packet to the gateway isolated by the security gateway isolation method described in any one of the above;

S22, judging whether the quintuple is in the whitelist: if so, jump to the next step; if not, discard the data packet;

S23. Determine whether the application layer protocol field satisfies the whitelist: if yes, the gateway forwards the data packet to the intranet; if not, discards the data packet.

Further, the range of accessible network segments within the internal and external networks is restricted through the IP access control list, so that the network segments within the preset range can access each other.

Further, in the step S23, the gateway encrypts the data through a private protocol, and forwards the data to the internal network by deconstructing and reorganizing the data packets of the external network.

Further, the quintuple includes a source IP address, a source port, a destination IP address, a destination port and a transport layer protocol, wherein the source IP address refers to the source IP in the data packet received by the security isolation device; the destination IP address refers to the destination IP in the data packet received by the security isolation device; source port refers to the source port number in the data packet received by the security isolation device; destination port refers to the destination port number in the data packet received by the security isolation device ;The protocol number in the transport layer protocol refers to the protocol type of the data packet received by the security isolation device, such as TCP, UDP, etc. The quintuple can distinguish different sessions, and the corresponding session is unique.

Further, for users with different login rights, the gateway divides different areas, and corresponding users can only access corresponding security domains. On the basis of the original, access control for different user identities has been added. The three types of administrator users have corresponding identity sensitive tags. The authorized administrator is admin, the authorized security officer is security, and the authorized auditor is auditor. When users with different identities access the gateway, access control is performed for different users. For example, Authorized administrators cannot access the area where the gateway main program and the management port control program are located, and have no rights to view, delete, and modify files in this area, but have the rights to read and modify databases in their respective areas.

The beneficial effects of the present invention are:

The present invention realizes complete isolation of the gateway by writing the configuration file and importing it into the gateway; when the external network data is sent to the internal network, the above-mentioned gateway that has imported the configuration file enables reliable external network data to be sent to the internal network. , to ensure the security of data transmission in the industrial control system.

The invention also realizes physical isolation, electrical isolation and information isolation by designing the security gateway. Among them, the security gateway module uses the internal cascade power supply to realize power isolation, realizes the isolation of signal lines by ensuring the isolation distance, and realizes the layout isolation of the base network port by ensuring the distance between the external network interface and the internal network interface; the external network of the security gateway module Both the input and the internal network output are provided with independent isolation transformers to achieve electrical isolation.

Description of drawings

FIG. 1 is a schematic diagram of a method for isolating a security gateway and a method for sending data from an external network to an internal network according to an embodiment of the present invention.

Detailed ways

In order to facilitate those skilled in the art to better understand the present invention, the present invention will be described in further detail below with reference to the accompanying drawings and specific embodiments. The following are only exemplary and do not limit the protection scope of the present invention.

Embodiment 1,

As shown in FIG. 1, this embodiment provides a security gateway isolation method, including the following steps:

S11. Establish a connection between the user and the isolation gateway: use a computer installed with a linux operating system and log in through a management program.

When a user logs in, there are four types of account login permissions, namely authorized administrator, authorized user, authorized auditor, and authorized security officer. Among them, authorized administrators at least have the functions of configuring management port parameters, configuring log system parameters and password modification; authorized users mainly refer to authorized control stations or authorized operation stations, which can communicate with each other in isolation; authorized auditors have a log system View permissions; authorized security officers have the functions of configuring security policies, viewing security policies, and backing up security configurations.

In this embodiment, the logging in through the management program refers to logging in through any one of an authorized administrator, an authorized auditor, or an authorized security officer. When logging in with different account permissions, different operation interfaces are displayed. The authorized administrator login has the functions of management port parameter modification, user password modification, uploading security isolation configuration files and log viewing; the authorized auditor login has the function of viewing system traffic logs; the authorized security officer login can modify security parameters and upload Configure files, view current security parameters, change passwords, and synchronize configuration files.

S12, write a configuration file: write the configuration information required by the user.

Specifically, the configuration information required by the user is determined first, then the configuration file is written according to the XML document format, and the written configuration file is converted by the conversion tool and uploaded to the gateway.

In this embodiment, the start flag bit of the configuration file is iGateConf, and under this flag bit, one or more of the following configuration items are loaded: configuration of the file header, binding of MAC address and IP address, IP whitelist settings, access frequency control, SNET protocol type filtering, service access control, cfg file generation. Among them, the file header is mainly used to describe the overall composition of the configuration file and the configuration information of the gateway's internal network. The beginning of the file header is Header, and the format version (FormatVsn) and the magic field (Magic) need to be indicated at the same time; MAC address binding The specified rule will bind the corresponding relationship between the host IP and MAC address to prevent ARP spoofing. If this option is not configured, the filtering rule will not take effect; IP access control lists limit the range of accessible network segments on the internal and external networks, only Only the network segments in the rule can access each other, that is, those belonging to the IP whitelist can access each other. The start flag is IPSegList, and each rule should indicate the start IP, end IP, and mask information; access frequency control limits the corresponding network The maximum frequency of segment access, calculated in seconds as the count interval, the start flag is IPRateList, and each rule should indicate the start IP, end IP, mask information, and access frequency; BrdHead filtering is in the SNET protocol type filtering. One, which filters the Type field of the BrdHead structure at the beginning of the network packet application layer data, which should be between Min and Max (including Min and Max); the start flag of service access control is ServiceList, which mainly restricts the server-side protocol ( TCP/UDP), port number, client rules and application layer rules; after filling in the XML document, run the conversion script in the linux environment to obtain the configuration file, that is, the cfg file.

S13. Import the gateway: import the configuration file prepared in step S12 into the gateway.

Specifically, put the configuration file to be uploaded in the current directory of the client, and convert it into iGateWay.en through the configuration file conversion and encryption program; when it is confirmed that the file exists in the current directory, the operation of importing to the gateway is performed.

S14. Determine whether the configuration file is passed: if it passes, restart the computer, and the configuration file takes effect; if it fails, jump to step S12 to rewrite the configuration file.

On the basis of the security gateway isolation method described above, at least the following functions can be completed, specifically:

IP address access control function: need to use IP address filtering module, basic communication module, data transfer module between network cards and log statistics module to detect the source IP of data packets, filter IP addresses outside the whitelist, and pass the log statistics module Log abnormal access to the database.

Function of MAC address filtering module: MAC address filtering module, basic communication module, inter-NIC data transfer module and log statistics module are required to implement MAC address detection in ARP requests to filter MAC addresses outside the whitelist, and the log statistics module will Abnormal access is logged to the database.

Access frequency control function: need to use the access frequency control module, basic communication module, data ferry module between network cards and log statistics module to count the number of accesses to IP addresses per unit time to prevent DDOS attacks, and record abnormal access to the log statistics module. in the database.

Data packet anti-tampering function: It is necessary to use the data packet compliance detection module, the basic communication module, the inter-NIC data transfer module and the data packet reconstruction module to perform compliance detection and reconstruction on the data packets passing through the gateway to prevent attackers from forging packets are destroyed.

The communication encryption function between the management port and the client side: It is necessary to use the basic communication module, the data ferry module between network cards and the communication encryption module to encrypt the sent data packets and decrypt the received data packets to realize the function of communication encryption.

Embodiment 2,

This embodiment provides a method for sending data from an external network to an internal network, at least through information isolation. Preferably, in this embodiment, in addition to information isolation, the security gateway isolation measures also include physical isolation and electrical isolation.

In this embodiment, by setting a security gateway isolation module, the security gateway isolation module adopts an internal cascade power supply and an external power distribution power supply respectively, and the internal cascade power supply and the external power distribution power supply come from different power supply systems, so as to realize power supply isolation. ;In the layout of the security gateway base, the signal lines are isolated from each other, and the wiring ensures that the isolation distance is greater than 4mm (to meet the requirements of greater than 2mm, isolation withstand voltage > 2KV), and there are isolation transformers inside the security gateway module to ensure that The signal lines of the internal network and the external network are isolated; the external network interface of the base is a 1×2 RJ45 port, and the internal network interface is a 4x1 RJ45 port. 2KV) to ensure the isolation characteristics of the interface part; the external network input and internal network output of the security gateway module are equipped with independent isolation transformers, isolation withstand voltage > 2KV, to ensure the isolation requirements between external signals and internal signals.

In this embodiment, the information isolation includes at least the following steps:

S21. The external network sends a data packet to the gateway isolated by the security gateway isolation method described in Embodiment 1.

S22. Determine whether the quintuple is in the whitelist: if so, skip to the next step; if not, discard the data packet.

Wherein, the quintuple includes IP address, source port, destination IP address, destination port and transport layer protocol, the source IP address refers to the source IP in the data packet received by the security isolation device; the destination IP address refers to the security isolation device Destination IP in the data packet received by the device; source port refers to the source port number in the data packet received by the security isolation device; destination port refers to the destination port number in the data packet received by the security isolation device; transport layer protocol The protocol number in refers to the protocol type of the data packet received by the security isolation device, such as TCP, UDP, etc. The quintuple can distinguish different sessions, and the corresponding session is unique.

S23, determine whether the application layer protocol field satisfies the whitelist: if so, the gateway forwards the data packet to the intranet, and specifically, the gateway encrypts the data packet through a private protocol, deconstructs and reorganizes the extranet data packet, and forwards the data to the intranet; If not, drop the packet.

In this embodiment, for users with different login rights, the gateway divides different areas, and corresponding users can only access corresponding security domains. On the basis of the original, access control for different user identities has been added. The three types of administrator users have corresponding identity sensitive tags. The authorized administrator is admin, the authorized security officer is security, and the authorized auditor is auditor. When users with different identities access the gateway, access control is performed for different users. For example, Authorized administrators cannot access the area where the gateway main program and the management port control program are located, and have no rights to view, delete, and modify files in this area, but have the rights to read and modify databases in their respective areas.

The above only describes the basic principles and preferred embodiments of the present invention, and those skilled in the art can make many changes and improvements based on the above description, and these changes and improvements should belong to the protection scope of the present invention.

Claims (10)

1. A security gateway isolation method is characterized by comprising the following steps:

s11, establishing connection between the user and the isolation gateway: logging in by using a computer provided with a linux operating system through a management program;

s12, writing a configuration file: writing the configuration information required by the user;

s13, importing the gateway: importing the configuration file written in the step S12 into a gateway;

s14, judging whether the configuration file passes: if the configuration file passes the preset time, restarting the computer, and enabling the configuration file to take effect; if not, the process goes to step S12 to rewrite the configuration file.

2. The security gateway isolation method of claim 1, wherein the user login in step S11 includes four types of account login permissions, which are an authorized administrator, an authorized user, an authorized auditor, and an authorized security clerk.

3. The security gateway isolation method according to claim 1, wherein the step S12 specifically includes:

determining configuration information required by a user;

compiling a configuration file according to an XML document format;

and converting the written configuration file through a conversion tool and uploading the converted configuration file to the gateway.

4. The security gateway isolation method of claim 1, wherein in step S12, a start flag of the configuration file is iGateConf, and under the flag, one or more of the following configuration items are loaded: configuration of a file header, binding of a MAC address and an IP address, setting of an IP white list, access frequency control, SNET protocol type filtering, service access control and generation of cfg files.

5. The security gateway isolation method according to claim 1, wherein the step S13 specifically includes:

the configuration file to be uploaded is placed in a current directory of a client, and is converted into an iGateWay.en format through a configuration file conversion and encryption program;

and when the current directory of the file is confirmed, executing the operation of importing the file into the gateway.

6. A method for sending data of an external network to an internal network is characterized by at least comprising the following steps of information isolation:

s21, the external network sends a data packet to the gateway isolated by the security gateway isolation method of any claim 1 to 5;

s22, judging whether the quintuple is in the white list: if yes, jumping to the next step; if not, discarding the data packet;

s23, judging whether the application layer protocol field meets a white list: if yes, the gateway forwards the data packet to the intranet; if not, the data packet is discarded.

7. The method of sending extranet data to intranet according to claim 6 wherein the range of the intranet and extranet accessible network segments is limited by IP access control list so that the network segments within the preset range can access each other.

8. The method according to claim 6, wherein in step S23, the gateway forwards the data to the intranet by encrypting according to a proprietary protocol, and by deconstructing and reassembling the extranet data packet.

9. The method according to claim 6, wherein the five-tuple comprises a source IP address, a source port, a destination IP address, a destination port and a transport layer protocol; the quintuple can distinguish different sessions and the corresponding session is unique.

10. The method for sending extranet data to the intranet according to claim 6, wherein the gateway divides different regions for users with different login permissions, and the corresponding user can only access the corresponding security domain.

Images