JP6269683B2 - Quarantine protection system and method it performs bi-directional packet filtering inspection - Google Patents

Description

  The present invention relates to an isolation protection system used in a communication line and a method for performing a bidirectional packet filtering inspection, and is installed in a communication path (for example, between communication networks, in a gateway path, between different communication terminals). In this way, the security of the network is ensured, and both devices for communication are isolated and the two-way packet filtering inspection is realized. The present invention is particularly suitable for information networks and control networks at industrial sites.

  Many firewall or gateway products are employed as security products arranged between an information network and a control network in an industrial field.

  The conventional firewall technology has a problem in that it is insufficiently compatible with industrial communication protocols. For example, when adopting the OPC industrial protocol in an industrial setting, it is necessary to use a dynamic port from 1024 to 65535, so the firewall must open all ports within the above range. By doing so, the risk of network security is significantly increased. In addition, the firewall implements IP layer read control, but cannot read data. Although the firewall can inspect the data link layer, network layer, and transport layer of a general network, there are certain deficiencies in the inspection function of the application layer, and in particular, the inspection function for the industrial protocol is defective.

  The gateway technology first collects data from the server of the control system network, the gateway acts as the server function of the control system network, and the client terminal of the MES / ERP layer collects the data through the gateway. Achieve the goal of protecting your server. The deficiency in the gateway technology is that the gateway product has its own IP address, and even if it is an already deployed control system network, the MES / ERP layer client terminals still need to be reconfigured. Yes (change the server IP and server name, etc. and register the gateway server). In addition, the firewall function of the gateway is insufficient, and the gateway product has an IP address, so there is a risk of being attacked. Intrusion into gateway products increases the risk of equipment in the control system.

  As a conventional technology for protecting network security, particularly industrial field application networks, for example, Chinese Patent Publication CN101014048 (Filing Date February 12, 2007, Filing Number 200710063822.4, Invention Name: Distributed Firewall System and Firewall Content Detection To realize), and TOFINO industrial network security protection technology (which can be confirmed from the following link http://www.doc88.com/p-649582721525.html). The above prior art is used as a background technology for reference in combination with the present application.

  The above prior art can be described using the block diagram of FIG. The communication line for both communication (N1, N2) is provided with a security protection device 100, of which the filtering module F0 filters “round trip” packets. The disadvantage of the prior art is that all firewall security filtering modules in the prior art are executed on a single CPU. In such a situation, if a firewall is attacked when transmitting data from one communication method to the other, the entire security firewall is destroyed because the entire firewall is executed by a single CPU. , Can not be used. Furthermore, since the security firewall technology in the above prior art does not inspect the packet (for example, packet body contents) deeply, virus data lurking in the packet body may destroy the operation of the communication device (N1, N2) There is.

  The technical problem to be solved by the present invention is to provide an isolation protection system that is installed in a communication line and isolates and protects both communication apparatuses, and a method for performing a bidirectional packet filtering inspection. The protection system includes two protection devices that operate with independent CPUs, and one bidirectional data transmission module that performs bidirectional data communication between the two protection devices based on a dedicated communication protocol. As a result, the security of packet transmission between both parties is ensured, and at the same time, when the CPU of one communication side is damaged by an attack, the entire isolation protection system is prevented from being damaged and unusable.

Therefore, in the present invention, the first protection device and the second protection device respectively connected to one and the other communication device of both communication,
The first protection device is provided between the first protection device and the second protection device, connects the first protection device and the second protection device, and the first protection device based on a dedicated communication protocol. Transmitting the output data to the second protection device, comprising a bidirectional data transmission module for outputting the data output by the second protection device to the first protection device,
An isolation protection system that is installed in a communication line and isolates and protects both communication apparatuses.
The first protection device and the second protection device each have a completely independent hardware structure and operate with independent CPUs, respectively, the first protection device and the second protection device,
A first interface that receives a packet of a data stream from a communication device of a connected communication method and outputs data from the other communication method to the connected communication device;
A filtering module that performs a filtering check on the data stream received from the first interface and outputs data that meets security requirements;
A second interface for receiving data conforming to the security requirements and transmitting data conforming to the security requirements to the bidirectional data transmission module;
A transmission path for transmitting data from the second interface to the first interface;
An isolation protection system is provided.

 The isolation protection system of the present invention employs the “2 + 1” structure of the present invention, that is, a first protection that has a completely independent hardware structure and that operates on an independent CPU. By adopting a structure comprising a device and a second protection device, and a bidirectional data transmission module that is connected between the first protection device and the second protection device and makes both communications communicate based on a dedicated communication protocol, Realize secure two-way data communication between both parties. Since two protection devices operate with independent CPUs, when one of the protection devices is attacked or physically damaged, the other protection device is not affected. Since the two protection devices of the isolation protection system are configured to operate with independent CPUs, each protection device can be configured to be independent from the hardware side. Or when it is physically damaged, it can be convenient for replacement and proper repair and maintenance. In addition, since the hardware structures of the two protection devices of the isolation protection system are completely independent, it is possible to individually manufacture protection devices whose hardware structures are completely independently controlled. Based on the security requirements of the communication method to which the communication is connected or the destination communication method, its hardware structure is programmed, and compared with the firewall security filtering module executed by one CPU of the prior art, the present invention Such an arrangement can simplify the entire hardware manufacturing process and at the same time protect both communication devices. In addition, the bidirectional data communication module provided between the two protection devices provided in the isolation protection system of the present invention establishes a communication link between the two protection devices for both communication based on a dedicated communication protocol. In other words, since a packet of a data stream that has passed through one protection device can enter another protection device as long as it satisfies the dedicated communication protocol, the bidirectional data transmission module is between two protection devices ( In other words, another protective barrier is installed between the two). The isolation protection system of the present invention realizes safe bidirectional data transmission between both communications by the filtering module and the bidirectional data transmission module in the protection device. Therefore, the isolation protection system of the present invention solves the problem that the gateway product needs to have its own IP address, which exists in the conventional gateway technology, that is, both communications adopt the isolation protection system of the present invention. Thus, when establishing communication, there is no need to reset each network endpoint that has already been placed. Thus, since there is no IP address, the possibility of being attacked is even lower.

 Among them, the communication device may be a computer, a server, or other network information input / output device.

  The filtering module preferably comprises a built-in firewall module that performs basic firewall inspection on packets of the data stream to be transmitted and a packet filtering module that performs deep level packet filtering.

 The built-in firewall module may perform header content inspection on the data stream packets, and the packet filtering module may perform packet body content inspection on the data stream packets.

  The header content includes an IP address, a MAC address, protocol type information, and port information, and the packet body content includes a communication destination, a communication source, a communication purpose, a communication type, and a communication content.

  The built-in firewall module and the packet filtering module included in each protection device of the isolation protection system of the present invention sequentially perform two filtering inspections on the packets of the flowing data stream, of which the built-in firewall module flows. A basic firewall check is performed on the stream packet header, and the packet filtering module performs a deep level packet filtering check on the data stream packets. Further, performing basic firewall inspection may include performing header content inspection on data stream packets, and performing deep level packet filtering inspection on data stream packets may include packet body content on data stream packets. It may include performing an inspection. Within one protection device, two filtering processes are sequentially performed on the packets to ensure the safety of the flowing packets. In addition, since a bidirectional data transmission module is further provided between the two protection devices, the bidirectional data transmission module provides further protection between the two protection devices based on a dedicated communication protocol. Therefore, in one protection device, an insecure packet that has passed two filtering inspection processes by the built-in firewall module and the packet filtering module passes through the bidirectional data transmission module if the dedicated communication protocol is not satisfied. In other words, after passing through the built-in firewall module and the packet filtering module, further transmission of insecure packets is blocked by the two-way data communication module, further increasing the security of data transmission for both communications. It is improving.

  The packet filtering module preferably has a built-in filtering list that can support an industrial communication protocol.

  In the isolation protection system of the present invention, since the packet filtering module in each protection device can inspect the application data of the industrial protocol, the network isolation protection system of the present invention sufficiently supports the industrial communication protocol, and the application layer The inspection function is strengthened and can be easily applied to industrial field information networks and control networks.

In the present invention, the first protection device and the second protection device each having a completely independent hardware structure and operating with independent CPUs are installed on the communication line, and the steps are assigned to both communication devices. When,
Performing a filtering check on packets of a data stream to be transmitted by a filtering module provided in the first protection device and the second protection device;
There is further provided a method for performing a bidirectional packet filtering test employing the above-described isolation protection system.

The filtering inspection includes
Performing basic firewall checks on the packets of the data stream to be transmitted; and
Performing deep level packet filtering on the packets of the data stream to be transmitted.

 Note that the basic firewall inspection performed on the packet of the data stream to be transmitted includes performing a header content inspection on the packet of the data stream, and is executed deeply on the packet of the data stream to be transmitted. Level packet filtering involves performing packet body content inspection on packets of the data stream.

 The header content includes an IP address, a MAC address, protocol type information, and port information, and the packet body content includes a communication destination, a communication source, a communication purpose, a communication type, and a communication content.

  According to the isolation protection system for isolating and protecting both communication apparatuses installed in a communication line and the method for performing a bidirectional packet filtering inspection according to the present invention, the data link layer, the network, and the network are provided by the built-in firewall module in the protection apparatus. Filtering inspection can be performed on the packet in the layer and transport layer, and the packet filtering module in the protection device can perform a deep level filtering inspection on the packet to construct two-way data communication between both communication, The isolation protection system of the present invention and the method in which it performs the bidirectional packet filtering inspection can not only realize the security of bidirectional data transmission of both communication, but also the both of the communication provided by the isolation protection system of the present invention. Since one protection device and the second protection device operate with independent CPUs, when one of the protection devices is attacked or physically damaged, the other protection device is affected. There is no.

It is a principle schematic diagram of the security firewall product of the prior art. 1 is a block diagram of an isolation protection system according to Embodiment 1 of the present invention. It is a block diagram of the isolation protection system of Example 2 of the present invention. FIG. 10 is a flowchart of a packet filtering inspection method executed when data is transmitted from a client terminal to a server by the isolation protection system according to the second embodiment of the present invention. FIG. 10 is a flowchart of a packet filtering inspection method executed when data is transmitted from a server to a client terminal by the isolation protection system according to the second exemplary embodiment of the present invention.

  The following description in conjunction with the drawings will make it easier to understand the invention and the advantages and features associated therewith.

 In order to make the content of the present invention clearer and easier to understand, specific embodiments of the present invention will be described in detail below in combination with the drawings. In the present invention, by way of example, the isolation protection system proposed by the present invention and the method by which it performs a bidirectional packet filtering check will be described. However, the present invention is not limited to the specific form of the disclosed preferred embodiment. Those skilled in the art can make modifications and variations to the present invention based on the contents disclosed in the present invention. These modifications and variations are intended to be included within the scope of the present invention, which is limited by the claims.

 In the present invention, many security products arranged between an information network and a control network in an industrial field employ a firewall or a gateway product, and a firewall product that is executed by a single CPU in the prior art. In response to the problem of realizing the security of bidirectional data transmission alone, an isolation protection system and a method for performing a bidirectional packet filtering inspection are provided. In order to realize secure two-way data transmission between both communication, the isolation protection system provided by the present invention for isolating and protecting both communication apparatuses installed on the communication line is “2 + 1” of the present invention. Adopting a structure (that is, two protection devices that operate on two CPUs that are independent of each other, corresponding to both communications, and two protection devices are connected, and the two protection devices are connected by a dedicated communication protocol. The structure of one bidirectional data transmission module that controls the data transmission of the communication) and a secure bidirectional data transmission between both the communication are constructed. Among them, since two protection devices for both communications operate on independent CPUs, when the protection system for one communication method is attacked or physically damaged, the protection device for the other communication method is It will not be affected. Since the two protection devices of the isolation protection system operate with independent CPUs, each protection device can be configured to be independent from the hardware, so that one of the protection devices can be attacked. When it is physically damaged, it can be easily removed and replaced. In addition, since the hardware structures of the two protection devices of the isolation protection system are completely independent, it is possible to individually manufacture protection devices whose hardware structures are completely independently controlled, and to which each protection device is connected. Based on the security requirements of the destination or destination communication method, the hardware structure is programmed (mainly related to the communication protocol layout), compared to the firewall security filtering module that is executed by a single CPU in the prior art. Such an arrangement of the present invention can simplify the entire hardware manufacturing process and at the same time protect both communication devices. In addition, the two-way data communication module in the isolation protection system establishes a communication link between two protection devices for both communication by a dedicated communication protocol. In other words, since the data stream that has passed through one protection device can enter another protection device as long as it satisfies the dedicated communication protocol, the bidirectional data transmission module is between two protection devices (ie, Another protective barrier is installed between the two). As a result, the problem that the gateway product needs to have its own IP address, which exists in the conventional gateway technology, has been solved. In other words, the isolation protection system of the present invention is adopted between the networks to construct the data communication. When doing so, there is no need to reconfigure each network endpoint that has been placed. Thus, since there is no IP address, the possibility of being attacked is even lower.

  The isolation protection system of the present invention will be described below with reference to the drawings.

  FIG. 2 is a block diagram of the isolation protection system 1 according to the first embodiment of the present invention. The isolation protection system 1 according to the present invention provides a first communication method N1 and a second communication method N2 so as to realize secure bidirectional data communication between the first communication method N1 and the second communication method N2. Can be installed between. Among them, the communication devices of the first communication method N1 and the second communication method N2 may be computers, servers, or other network information input / output devices. As shown in FIG. 2, the isolation protection system 1 can include a first protection device 10, a second protection device 20, and a bidirectional data transmission module 4, that is, “2 + 1” of the present invention. Is the structure. The first protection device 10 and the second protection device 20 perform bidirectional data communication by the bidirectional data transmission module 4. The bidirectional data transmission module 4 contains a dedicated communication protocol, which may be dedicated communication protocol hardware or dedicated communication protocol software, or a combination of the two, and the first protection device 10 and the second protection device 20. A safe barrier is constructed between the first protection device 10 and the second protection device 20 to allow packets that conform to the dedicated communication protocol to pass, and packets that do not conform to the dedicated communication protocol are blocked or blocked. Ensure secure exchange of data between.

 As shown in FIG. 2, the first protection device 10 includes a first interface A1 that performs bidirectional data communication with the first communication method N1, and a second interface that performs bidirectional communication with the bidirectional data transmission module 4. Interface B1 is provided. The first protection device 10 further includes a filtering module F1 and a transmission path C1 for transmitting packets from the second interface B1 to the first interface A1. The filtering module F1 is provided between the first interface A1 and the second interface B1, and attempts to transmit the first communication method N1 received from the first interface A1 to the second communication method N2. A filtering check is performed on the packet to be output, and a packet that is built in the filtering module F1 and that conforms to the communication protocol as a security request is output to the second interface B1. The second interface B1 outputs a packet that has passed the filtering inspection of the filtering module F1 to the bidirectional data transmission module 4. The bidirectional data transmission module 4 is based on a dedicated communication protocol, and the first protection device 10 The data output by the interface B1 is transmitted to the second protection device 20.

 The second protection device 20 is completely independent of the first protection device 10 in terms of hardware structure. The second protection device 20 includes a first interface A2 that performs bidirectional data communication with the second communication method N2, and a second interface B2 that performs bidirectional communication with the bidirectional data transmission module 4. The second protection device 20 further includes a filtering module F2 and a transmission path C2 for transmitting packets from the second interface B2 to the first interface A2. The filtering module F2 is provided between the first interface A2 and the second interface B2, and tries to transmit from the second communication method N2 received from the first interface A2 to the first communication method N1. A filtering check is performed on the packet, and a packet built in the filtering module F2 and conforming to the communication protocol as a security request is output to the second interface B2. The second interface B2 outputs a packet that has passed the filtering inspection of the filtering module F2 to the bidirectional data transmission module 4. The bidirectional data transmission module 4 is based on a dedicated communication protocol, and the second protection device 20 The packet output by the interface B2 is transmitted to the first protection device 10.

  The first protection device 10 and the second protection device 20 in the isolation protection system 1 of the present invention operate on the CPU 1 and the CPU 2 that are independent from each other (that is, operate and calculate independently), of which each CPU is It corresponds to one memory. In such a structure, when one of the CPUs is invaded or physically damaged, the other CPU is not affected. Both the first protection device 10 and the second protection device 20 that operate independently in each CPU perform bidirectional data transmission by the bidirectional data transmission module 4 in accordance with a dedicated communication protocol.

 As can be seen from the above, the isolation protection system 1 according to the first embodiment of the present invention is provided between the two protection devices and the filtering module provided in the protection device operating in an independent CPU included in the system. In order to perform data transmission between the two communications by the bidirectional data transmission module, when the data is exchanged between the networks by the isolation protection system 1 of the first embodiment of the present invention, the client terminal and the client terminal as in the conventional gateway product. Since there is no need to set the server IP address, it does not have any effect on the existing network.

 Since the security measure of the isolation protection system 1 of the present invention is realized by installing the filtering module included in the protection device, it is possible to install an appropriate security measure based on security requirements for both communications. it can.

 When attempting to transmit a packet from the first communication method N1 to the second communication method N2 by the isolation protection system 1 of the first embodiment of the present invention, the packet flow is as shown in the path L1 of FIG. Become. Specifically, data from the first communication method N1 enters the first protection device 10 via the first interface A1 of the first protection device 10, and inside the first protection device 10 The packet is subjected to filtering inspection by the filtering module F1, and a packet that meets the security requirements passes through the filtering module F1 and enters the bidirectional data transmission module 4 via the second interface A2 of the first protection device 10. If the packet does not conform to the dedicated communication protocol built in the bidirectional data transmission module 4, the packet is blocked and cannot enter the second protection device 20. If the packet conforms to the dedicated communication protocol, it can pass through the intermediate communication module 4 and enter the second protection device 20, and inside the second protection device 20, the packet is sent to the second interface B2. Thus, the packet is transmitted directly to the first interface A2 via the transmission path C2, and the packet transmission from the first communication method N1 to the second communication method N2 is completed. In the packet transmission process from the first communication method N1 to the second communication method N2, the packet first passes the filtering inspection by the filtering module F1 provided in the first protection device 10, and then based on the dedicated communication protocol Then, the first protective device 10 enters the second protective device 20. Such an arrangement can ensure the safety of data transmitted from the first communication method N1 to the second communication method N2. The flow of packet transmission from the second communication method N2 to the first communication method N1 is as shown in the route L2 of FIG. 2, and is similar to the route L1, and therefore the description thereof is omitted here.

 Compared to the firewall of the prior art shown in FIG. 1, the isolation protection system 1 of the present invention adopts the “2 + 1” structure of the present invention, that is, two independent of each other corresponding to both communication. The two protection devices 10 and 20 that operate on the CPU and are completely independent on the hardware structure are provided between the two protection devices 10 and 20 and are based on a dedicated communication protocol. Bidirectional data communication between the two sides is realized by the bidirectional data communication module 4 that exchanges data safely between the two. Both of the two protection devices include a filtering module that performs a filtering check on the packet, thereby enabling a communication protocol as a security request in the filtering module to be set according to the security requirements of both communications, Both communication security requirements can be met. In the isolation protection system 1 according to the first embodiment of the present invention, each of the first protection device 10 and the second protection device 20 is operated by independent CPUs, so that two protection devices completely independent from each other in hardware are realized. doing. A bidirectional data transmission module 4 is provided between the first protection device 10 and the second protection device 20, and secure communication between the first protection device 10 and the second protection device 20 is performed by a dedicated communication protocol. Implemented, such a “2 + 1” structure of the present invention can provide many advantages in hardware. For example, the first protection device 10 and the second protection device 20 can be manufactured as two mutually independent host computers, the host computer includes a CPU, and each CPU can be provided with a memory. For each host computer, a dedicated embedded Linux (registered trademark) operating system using Bootloader as a boot / load program can be provided. In this way, between the two protection devices, one is not attacked or physically damaged, so that the performance of the other protection device is not affected. Further, as an example, the first protection device 10 and the second protection device 20 are manufactured as a plug-in type device, that is, manufactured as a detachable device, so that the bidirectional data transmission module 4 has a dedicated communication protocol. It can be manufactured as a built-in baseboard. As described above, when the two protection devices are inserted into the base board, the isolation protection system according to the present invention for isolating and protecting both communication devices can be formed. In such a situation, if one of the protection devices is damaged, replacement and maintenance can be easily performed, and the other protection device is not affected in any way.

 Hereinafter, the isolation protection system 2 according to Embodiment 2 of the present invention will be described with reference to FIG. In the second embodiment shown in FIG. 3 and the first embodiment shown in FIG. 2, the same reference numerals represent the same members, and therefore description thereof will not be repeated here.

  The difference from the isolation protection system 1 of the first embodiment of the present invention is that, in the isolation protection system 2 of the second embodiment of the present invention, as shown in FIG. 3, the filtering module F1 in the first protection device 10 includes a built-in firewall module K1 and a packet. The filtering module S2 includes the filtering module S1, and the filtering module F2 in the second protection device 20 includes a built-in firewall module K2 and a packet filtering module S2. The built-in firewall module K1 performs a firewall filtering check on the packet received from the first interface A1 that attempts to transmit from the first communication method N1 to the second communication method N2, and the firewall filtering check is basic. It may be a static firewall check, making it less susceptible to general network attacks. Basic firewall technology realizes a defense function by setting communication rules such as protocol, port, IP, etc., and can inspect the flowing packets at the data link layer, network layer, and transport layer. This is mainly related to performing a header content check on the packet, and packets that do not meet the communication rules are blocked. The packet filtering module S1 performs a packet filtering inspection on the packet after being filtered by the built-in firewall module K1, and the packet filtering inspection is different from the firewall filtering inspection, and a deep level filtering inspection based on the packet on the application layer. Protocol analysis, which mainly performs packet body content inspection on packets of the data stream. When the isolation protection system 2 of the present invention is arranged as an industrial network security isolation system between an information network and a control network at an industrial site, the packet filtering module S1 is instructed to inspect application data according to an industrial communication protocol. Communication protocol can be built in. The header content includes an IP address, a MAC address, protocol type information, and port information, and the packet body content includes a communication destination, a communication source, a communication purpose, a communication type, and a communication content. The filtering module F2 in the second protection device 20 includes a built-in firewall module K2 and a packet filtering module S2. The built-in firewall module K2 performs a firewall filtering check on the packet input from the first interface A2 that is going to be transmitted from the second communication method N2 to the first communication method N1, and the firewall filtering check is basic. It may be a static firewall check that makes it less susceptible to general network attacks. Basic firewall technology realizes a defense function by setting communication rules such as protocol, port, IP, etc., and inspects data flowing on the data link layer, network layer, and transport layer This is mainly a check on the packet header, and packets that do not meet the communication rules are blocked. The packet filtering module S2 performs a packet filtering inspection on the packet after being filtered by the built-in firewall module K2. The packet filtering inspection is different from the firewall filtering inspection, and a deep level filtering inspection based on the packet on the application layer. Protocol analysis, which mainly performs packet body content inspection on packets of the data stream. When the isolation protection system 2 of the present invention is arranged as an industrial network security isolation system between an information network and a control network in an industrial field, the packet filtering module S2 is used for industrial applications so as to inspect application data according to an industrial communication protocol. A communication protocol can be incorporated. The header content includes an IP address, a MAC address, protocol type information, and port information, and the packet body content includes a communication destination, a communication source, a communication purpose, a communication type, and a communication content.

 As can be seen from the above contents, both the first protection device 10 and the second protection device 20 include a built-in firewall module and a packet filtering module that sequentially perform a filtering inspection on packets. The inspection can perform a filtering inspection on different parts of the packets of the data stream, for example, the built-in firewall module can realize inspection on the data link layer, network layer, transport layer of a general network, that is, , Which mainly performs filtering inspection on the packet header, and the packet filtering module can implement inspection on application layer data, that is, filtering inspection mainly on packet contents Is performed. Therefore, a plurality of industrial communication protocols can be incorporated in the packet filtering module so as to inspect application data according to the industrial protocol. Since each protection device included in the isolation protection system of the present invention includes a built-in firewall module and a packet filtering module that sequentially perform filtering inspection on data, it is possible to ensure the safety of data that has passed, In order to adapt to the security requirements between the information network and the control network in the industrial field, a desired industrial communication protocol is installed in the packet filtering module in advance so that the network security protection system of the present invention fully supports the industrial protocol. Can be.

 In the present invention, the built-in firewall module S1 and the built-in firewall module S2 may be the same, that is, provide the same basic firewall filtering inspection. The packet filtering module S1 and the packet filtering module S2 may be the same, and can have the same communication protocol built in, based on different security requirements of the first communication method N1 and the second communication method N2. Different communication protocols may be incorporated. For example, when the first communication method N1 is a packet transmission method and the second communication method N2 is a packet reception method, the first communication method N1 is based on the security request of the second communication method N2 as the packet reception method. When the communication protocol built in the packet filtering module S1 in the protection device 10 is set, the first communication method N1 is the packet reception method, and the second communication method N2 is the packet transmission method, the first communication method N1 Based on the security request, the communication protocol built in the packet filtering module S2 in the second protection device 20 can be set. By doing so, both communication security requirements can be satisfied.

 Since the bidirectional data transmission module 4 with a built-in dedicated communication protocol is installed between the first protection device 10 and the second protection device 20, it tries to transmit from one communication method to the other communication method. Even if a packet passes the filtering inspection of the built-in firewall module and the packet filtering module in the protection device, it is blocked if it does not satisfy the dedicated communication protocol built in the bidirectional data transmission module 4, and to the other communication method The security of data transmission on both communication lines is further improved.

 The isolation protection system 2 according to the second embodiment of the present invention can be applied between an industrial field information network and a control network to perform security protection for the control network. This is mainly because in the isolation protection system 2 of the present invention, both the first protection device 10 and the second protection device 20 include packet filtering inspections other than the regular built-in firewall filtering inspection. is there. In the packet filtering module, effective protocol data communication such as OPC, Medbus, etc. between the client terminal and the server can be performed, and the communication protocol of multiple automation product manufacturers can be built in to enable data read / write control. it can. All other non-industry data is discarded.

 Hereinafter, a method of performing a bidirectional packet filtering inspection by the isolation protection system 2 of the present invention will be described in detail with reference to FIGS. 4 and 5 in combination with FIG.

 For convenience of explanation, in FIG. 4 and FIG. 5, taking an example in which the client terminal and the server are both communicating, how the isolation protection system 2 of the present invention performs secure transmission of data between the client terminal and the server. A method for realizing this will be described.

  FIG. 4 is a flowchart for transmitting data from the client terminal to the server. In step S71, the client terminal transmits a packet. In step S72, the packet is transmitted to the CPU (first protection device 10) connected to the client terminal. In step S73, a basic firewall inspection is performed. Discarded (step S76), the valid data is further subjected to packet filtering inspection (step S74), and the data subjected to the packet filtering inspection of step S74 is discarded if it is determined as invalid data (step S76), and valid data. If it is determined that the received packet is transmitted to the CPU (second protection device 20) connected to the server (step S75), the received packet is transmitted to the server in step S77.

  FIG. 5 is a flowchart for transmitting data from the server to the client terminal. In step S81, the server transmits a packet. In step S82, the packet is transmitted to the CPU (second protection device 20) connected to the server. In step S83, a basic firewall inspection is performed and the invalid data packet is discarded. (Step S86) The valid data is further subjected to packet filtering inspection (Step S74), and the data that has undergone the packet filtering inspection of Step S84 is discarded if it is determined to be invalid data (Step S86), and is determined to be valid data. If so, it is transmitted to the CPU (first protection device 10) connected to the client terminal (step S85), and in step S87, the received packet is transmitted to the client terminal.

 The quarantine protection system of the present invention and the method by which it performs a bidirectional packet filtering test have been described. The isolation protection system of the present invention adopts the “2 + 1” structure of the present invention, that is, the first protection device and the second protection device capable of bidirectional communication for both of the communication, A two-way data transmission module with a dedicated communication protocol provided between them and controlling data exchange between the first protection device and the second protection device, the feature of which is the isolation protection system of the present invention The first protection device and the second protection device in FIG. 1 respectively operate on independent host computers and are controlled by independent CPUs. As a result, when one of the host computers is damaged or damaged by a virus, the other host computer is not affected. In addition, the packet filtering module in the first protection device and the second protection device in the isolation protection system of the present invention performs deep level inspection and protocol analysis on application layer packets, and incorporates multiple dedicated industrial communication protocols. By doing so, a defense mode based on the built-in industrial communication protocol can be realized, the packet is inspected deeply at the application layer, and an industrial level dedicated isolation protection solution unique to industrial communication is developed. provide. Therefore, the isolation protection system of the present invention is particularly suitable for secure exchange of data between the industrial field information network and the control network.

 Lastly, it should be noted that the above embodiments are used only for explaining the technical solution of the present invention, and do not limit the present invention. Although detailed description has been given, those skilled in the art should understand that the technical solution of the present invention may be modified or equivalently substituted without departing from the spirit and scope of the technical solution of the present invention.

1 Isolation protection system
N1 first communication method
N2 Second communication method
10 First protective device
20 Second protection device
4 Bidirectional data transmission module
CPU1, CPU2 CPU
A1, A2 first interface
B1, B2 second interface
F1, F2 filtering module
C1, C2 transmission path

Claims (6)

A first protection device (10) and a second protection device (20) respectively connected to one and the other communication devices of both communication;
Provided between the first protection device (10) and the second protection device (20), and connecting the first protection device (10) and the second protection device (20); Based on a dedicated communication protocol, the data output from the first protection device (10) is transmitted to the second protection device (20), and the data output from the second protection device (20) is transmitted to the first protection device (20). A bidirectional data transmission module (4) for output to the protective device (10),
An isolation protection system that is installed in a communication line and isolates and protects both communication apparatuses.
The first protection device (10) and the second protection device (20) have a completely independent hardware structure and operate with independent CPUs (CPU1, CPU2), respectively, and the first protection device The device (10) and the second protection device (20) are each
Receiving a packet data stream from the connected communication apparatus, the data from the other communication device, a first interface for output to the connected communication device and (A1, A2),
A filtering module (F1, F2) that performs a filtering check on the data stream received from the first interface (A1, A2), and outputs data that meets the security requirements;
A second interface (B1, B2) for receiving data conforming to the security requirement and transmitting data conforming to the security requirement to the bidirectional data transmission module (4);
Transmission paths (C1, C2) for transmitting data from the second interface (B2, B1) to the first interface (A1, A2);
With
The filtering modules (F1, F2) are built-in firewall modules (K1, K2) that perform header content inspection on packets of a data stream to be transmitted;
A packet filtering module (S1, S2) for performing packet body content inspection on a packet after the header content inspection is performed by the built-in firewall module (K1, K2). . Before SL communications device computer, server, or other an input / output device of the network information, isolation protection system according to claim 1,.   2. The isolation protection system according to claim 1, wherein the header content includes an IP address, a MAC address, protocol type information, and port information, and the packet body content includes a communication destination, a communication source, a communication purpose, a communication type, and a communication content. .   The isolation protection system according to claim 1, wherein each of the packet filtering modules (S1, S2) includes a filtering list that can correspond to an industrial communication protocol. The first protection device (10) and the second protection device (20), which have a completely independent hardware structure and operate with independent CPUs (CPU1, CPU2), respectively, are installed on the communication line, and dedicated communication Data output from the first protection device (10) based on the protocol is transmitted to the second protection device (20), and data output from the second protection device (20) is transmitted to the first protection device. Outputting to (10) ;
Performing filtering inspection on packets of the data stream to be transmitted by the filtering modules (F1, F2) provided in the first protection device (10) and the second protection device (20);
Including
The filtering inspection includes
Performing a header content check on the packets of the data stream to be transmitted; and
2. The method of performing a bidirectional packet filtering inspection employing the quarantine protection system of claim 1, comprising performing a packet body content inspection on a packet after the header content inspection is performed. .   6. The method according to claim 5, wherein the header content includes an IP address, a MAC address, protocol type information, and port information, and the packet body content includes a communication destination, a communication source, a communication purpose, a communication type, and a communication content.

Images