WO2014114232A1

WO2014114232A1 - Isolation protection system and method thereof for performing bidirectional data packet filtration inspection

Info

Publication number: WO2014114232A1
Application number: PCT/CN2014/071101
Authority: WO
Inventors: 杨磊; 杨剑楠; 赵岳云
Original assignee: 横河电机株式会社
Priority date: 2013-01-22
Filing date: 2014-01-22
Publication date: 2014-07-31
Also published as: CN103944865B; JP2016507979A; CN103944865A; JP6269683B2

Abstract

Disclosed are an isolation protection system and a method thereof for performing bidirectional data packet filtration inspection. The isolation protection system is arranged in a communication line to subject the communication facilities of two communication parties to isolation protection, and comprises: a first protective device and a second protective device, which are used for respectively connecting to the communication facility of one of the communication parties; and a bidirectional data transmission module, which is arranged between the first protective device and the second protective device, and is used for connecting the first protective device and the second protective device, transmitting data output by the first protective device to the second protective device according to a proprietary communication protocol, and transmitting data output by the second protective device to the first protective device. The system is characterized in that: the first protective device and the second protective device have completely independent hardware structures and respectively operate in independent central processing units.

Description

Isolation protection system and method for performing bidirectional packet filtering inspection

The invention relates to an isolation protection system used on a communication line and a method thereof for performing bidirectional packet filtering inspection, which are arranged in a communication path (for example, between communication networks, in a gateway path, and between different communication terminals) to implement a network Security protection, isolation protection of facilities on both sides of the communication, and two-way packet filtering check. Especially suitable for information networks and control networks in industrial sites. Background technique

Security products deployed between the information network and the control network of the existing industrial site mostly use firewalls or gateway products.

The shortcoming of existing firewall technology is insufficient support for industrial communication protocols. For example, in the industrial field application 0PC industrial protocol, a dynamic port of 1024 to 65535 is required, so the firewall must open all the ports in the above range, which significantly increases the security risk of the network. In addition, the firewall implements read control of the IP layer, but does not support read control of data. The firewall supports checking the data link layer, network layer, and transport layer of the general network. However, there are certain deficiencies in the inspection function of the application layer, especially the inspection function of the industrial protocol.

The gateway technology first collects data from the server of the control system network, and the gateway delegates the function of the server that controls the system network. The client of the MES/ERP layer collects data through the gateway, thereby achieving the purpose of protecting the server of the control system network. The disadvantage of gateway technology is that the gateway product has its own IP address. Even if the control system network is already configured, the client of the MES/ERP layer still needs to be reset (change the server IP and server name, etc., register the gateway server) . In addition, the firewall function of the gateway is insufficient. Because the gateway product has an IP address, it may be attacked. When the gateway product is compromised, the risk of the device in the control system increases.

As a prior art for protecting network security, especially for protecting industrial field application networks, see, for example, Chinese Patent Publication CN101014048 (Application Date: February 12, 2007, Application No. 200710063822. 4, Invention Name: Distributed Firewall System and Implementation of Firewall Content Detection Method), as well as Tofino (T0FIN0) industrial network security protection technology (available via link Http : //www. doc88. com/p- 649582721525. html to view). The above prior art is incorporated herein by reference.

The above prior art can be summarized by the block diagram of Fig. 1: In the communication line of both sides (N1, N2) of the communication, a security guard 100 is provided, wherein the filtering module F0 filters the "to" packets. A disadvantage of the above prior art is that the firewall security filter check modules of the prior art all run on a single central processing unit (CPU). In this case, when the firewall is attacked while transmitting data from one communication to another, the entire security firewall will be corrupted and unusable because the entire firewall runs on a single central processor. Moreover, the above-mentioned prior art security firewall technology does not perform deep inspection on data packets, for example, deep inspection of the contents of the package, so that the virus data deeply hidden in the package body may damage the communication facility (Nl, N2). ) operation. Summary of the invention

The technical problem to be solved by the present invention is to provide an isolation protection system for isolating and protecting communication facilities of communication parties in a communication line and a method for performing bidirectional packet filtering inspection, the isolation protection system being integrated with communication respectively Two two-way protection devices running on separate central processors and two-way data transmission modules for two-way data communication between the two protection devices in accordance with a proprietary communication protocol to ensure data packets between the communicating parties The security of the transmission is avoided while the entire isolation protection system is damaged and cannot be used due to the destruction of the central processor for a communication party.

To this end, the present invention provides an isolation protection system that is provided in a communication line to isolate and protect communication facilities of both communication parties, and includes:

a first protection device and a second protection device for respectively connecting to a communication facility of one of the communication parties;

a bidirectional data transmission module, disposed between the first protection device and the second protection device, configured to connect the first protection device and the second protection device, and the first communication device according to a proprietary communication protocol Data output by a protection device is transmitted to the second protection device, and data output by the second protection device is transmitted to the first protection device; characterized in that: the first protection device and the second The protection device has a completely independent hardware structure and operates separately on a separate central processor, wherein the first protection device and the second protection device Each of the set includes:

a first interface, configured to respectively receive a data packet of the data stream from a communication facility of the connected communication party and output data from another communication party to the connected communication facility;

a filtering module, configured to perform a filtering check on the data stream received from the first interface, and output data that meets security requirements;

a second interface, configured to receive the data that meets the security requirement, and transmit the data that meets the security requirement to the two-way data transmission module;

And a transmission channel, configured to transmit data from the second interface to the first interface. The above-described isolation protection system of the present invention adopts the "2+1" structure of the present invention, that is, the first protection device and the second protection device including a completely independent hardware structure and respectively operating in separate central processors, and A two-way data transmission module is connected between the first protection device and the second protection device to enable the communication parties to communicate according to a proprietary communication protocol to implement secure two-way data communication between the communication parties. Since the two protection devices operate on separate central processors, when one of the protection devices is attacked or physically damaged, the other protection device is not affected; since the two protection devices that constitute the isolation protection system operate on Separate central processing unit, so each protection device can be constructed in a separate manner in hardware implementation, so that when one of the protection devices is attacked or physically damaged, it can be easily replaced and targetedly repaired and maintained; In addition, since the hardware structures of the two protection devices constituting the isolation protection system are completely independent, it is possible to separately manufacture the protection devices whose hardware structures are completely independently controlled, and then according to the security of the communication party or the destination communication party to which the protection devices are connected. Sexual requirements program its hardware structure. Compared with the firewall security filtering check module running on a single central processor in the prior art, the configuration of the present invention can simplify the hardware manufacturing process as a whole. Provide separate guarantees for facilities on both sides of the communication Protection. In addition, the two-way data communication module disposed between the two protection devices included in the isolation protection system according to the present invention constructs a communication link between two protection devices for the communication parties according to a proprietary communication protocol, that is, The data packet passing through the data stream of one protection device must satisfy the proprietary communication protocol to be able to enter another protection device, so the two-way data transmission module is set between the two protection devices (that is, between the communication parties) A protective barrier. Since the isolation protection system according to the present invention implements secure two-way data transmission between the communication parties through the filter module and the two-way data transmission module in the protection device, the isolation protection system of the present invention The system overcomes the problem that the gateway product existing in the existing gateway technology must have its own IP address, that is, when the communication parties establish communication by using the isolation protection system according to the present invention, it is not required to configure each network end. Reset, so that because there is no IP address, the possibility of being attacked is further reduced.

The communication device of the communication party may be an input/output device of a computer, a server or other network information.

Preferably, the data filtering module may include a built-in firewall module for performing basic firewall checking on the data packets of the transmitted data stream and a packet filtering module for performing packet deep filtering.

The built-in firewall module may perform a header content check on a data packet of the data stream, and the packet filtering module may perform a package content check on the data packet of the data stream.

The header content relates to an IP address, a MAC address, protocol type information, and port information, and the package content relates to a communication target, a communication source, a communication destination, a communication type, and a communication content.

The built-in firewall module and the packet filtering module included in each protection device of the isolation protection system of the present invention perform two filtering checks on the data packets flowing through the data flow, wherein the built-in firewall module pairs the data flow flowing through The packet header of the packet performs a basic firewall check, and the packet filtering module performs packet deep filtering check on the packet of the data stream. Further, performing the basic firewall check may include performing a header content check on the data packet of the data stream, and performing a packet depth filtering check on the data packet of the data stream may include performing a package content check on the data packet of the data stream . The two packets are successively filtered in a protection device to ensure the security of the packets flowing through. In addition, since a two-way data transmission module is also provided between the two protection devices, the two-way data transmission module further protects between the two protection devices in accordance with a proprietary communication protocol. Therefore, even in a protection device, the unsafe data packet that has passed the two filtering check processes performed by the built-in firewall module and the packet filtering module cannot pass the bidirectional data transmission module without satisfying the proprietary communication protocol. Entering another protection device, in other words, after passing the built-in firewall module and packet filtering module, the further transmission of the insecure data packet is also blocked by the two-way data communication module, which further increases the security of data transmission between the two communication parties. .

Preferably, the data packet filtering module has built-in support for the industrial communication protocol. Filter list.

In the isolation protection system of the present invention, since the packet filtering module in each protection device can check the application data of the industrial protocol, the network isolation protection system of the present invention can fully support the industrial communication protocol and enhance the inspection of the application layer. The check function can be easily applied between the industrial field information network and the control network.

The present invention also provides a method for performing a two-way packet filtering check using the above-described isolation protection system, comprising the steps of:

Providing, in the communication line, a first protection device and a second protection device having completely independent hardware structures and respectively operating in separate central processors for communication facilities of the communication parties;

A filtering check is performed on the data packets of the transmitted data stream using the filtering modules provided in the first protection device and the second protection device.

The filtering check includes:

Perform a basic firewall check on the packets of the transmitted data stream, and

Performs deep filtering on the packets of the transmitted data stream.

The performing a basic firewall check on the data packet of the transmitted data stream includes performing a header content check on the data packet of the data stream, and performing depth filtering on the data packet of the transmitted data stream includes data on the data stream The package performs a package body check.

According to the present invention, an isolation protection system for providing isolation protection for communication facilities of both communication parties in a communication line and a method for performing bidirectional packet filtering inspection thereof can be performed not only at the data link layer but also through a built-in firewall module in the protection device. The network layer and the transport layer perform filtering check on the data packet and can perform deep filtering check on the data packet by the packet filtering module in the protection device to establish two-way data communication between the communication parties, thereby making the isolation protection of the present invention The system and its method of performing two-way packet filtering check can realize the security of two-way data transmission of both communicating parties; and because the first protection device and the second protection device for both sides of the communication included in the isolation protection system according to the present invention are operated On separate central processors, so when one of the protection devices is attacked or physically damaged, the other protection device does not Will be affected by it. DRAWINGS

The invention will be more readily understood and its attendant advantages and features will be more readily understood by the following description in conjunction with the accompanying drawings in which:

FIG. 1 is a schematic diagram showing the principle of a prior art security firewall product;

Figure 2 shows a block diagram of an isolation protection system in accordance with a first embodiment of the present invention; Figure 3 shows a block diagram of an isolation protection system in accordance with a second embodiment of the present invention; Figure 4 illustrates the use of an isolation protection system in accordance with the present invention. A flowchart of a method of packet filtering check performed by the isolation protection system of the second embodiment when transmitting data from a client to a server; and FIG. 5 illustrates an isolation protection system using a second embodiment according to the present invention A flowchart of a method of packet filtering checks performed when data is transmitted from a server to a client. detailed description

In order to make the content of the present invention clearer and easier to understand, the specific embodiments of the present invention are described in detail below with reference to the accompanying drawings. In the present invention, the isolation protection system proposed by the present invention and its method of performing two-way packet filtering inspection are described by way of example, but the present invention is not limited to the specific form of the disclosed preferred embodiment. Modifications and variations of the present invention are intended to be included within the scope of the present invention.

The security product deployed between the information network and the control network of the existing industrial site mostly adopts a firewall or a gateway product, and in the prior art, the two-way data transmission can only be realized by a firewall product running on a single central processor. For security issues, an isolation protection system and its method of performing two-way packet filtering checks are proposed. In order to achieve secure two-way data transmission between two communicating parties, the present invention provides an isolation protection system for isolating and protecting communication facilities of communication parties in a communication line, which adopts the "2+1" structure of the present invention (ie, Two protection devices for two communication units running on two separate central processors, and a two-way data transmission module connecting between the two protection devices to control data transmission between the two protection devices by using a proprietary communication protocol ) to establish secure two-way data transmission between the two communicating parties. Wherein, the two protection devices for the two sides of the communication are respectively operated in independent central On the processor, therefore, when the protection device for one communication party is attacked or physically damaged, the protection device for the other communication party is not affected; since the two protection devices constituting the isolation protection system operate in independent central processing Therefore, in the hardware implementation, each protection device can be constructed in a discrete manner, so that when one of the protection devices is attacked or physically damaged, it can be easily disassembled and replaced; in addition, due to the two protections that constitute the isolation protection system The hardware structure of the device is completely independent, so the hardware device can separately manufacture the protection device with completely independent control of the hardware structure, and then program the hardware structure according to the security requirements of the communication party or the destination communication party to which the protection device is connected ( This mainly involves the configuration of the communication protocol. Compared with the firewall security filtering check module running on a single central processor in the prior art, the configuration of the present invention can simplify the hardware manufacturing process as a whole. , providing points for facilities of both parties to the communication Protection. In addition, the two-way data communication module in the isolation protection system utilizes a proprietary communication protocol to construct a communication link between two protection devices for the communication parties, that is, the data flow through a protection device must satisfy the proprietary communication protocol. It is only possible to enter another protection device, so that the two-way data transmission module provides another protection barrier between the two protection devices (that is, between the communication parties). This also overcomes the problem that the gateway products existing in the existing gateway technology must have their own IP addresses, that is, when the data communication is established between the networks by using the isolation protection system according to the present invention, it is not required to be configured. Each network side is reset, so that the possibility of being attacked is further reduced because there is no IP address.

The isolation protection system of the present invention will now be described with reference to the accompanying drawings.

Fig. 2 shows a block diagram of an isolation protection system 1 according to a first embodiment of the invention. The isolation protection system 1 according to the present invention may be disposed between the first communication party N1 and the second communication party N2 to implement secure two-way data communication between the first communication party N1 and the second communication party N2. The communication facilities of the first communication party N1 and the second communication party N2 may be input/output devices of a computer, a server or other network information. As shown in FIG. 2, the isolation protection system 1 may include a first protection device 10, a second protection device 20, and a bidirectional data transmission module 4, that is, the "2+1" structure of the present invention. The first protection device 10 and the second protection device 20 perform bidirectional data communication through the bidirectional data transmission module 4. A proprietary communication protocol is built in the bidirectional data transmission module 4, which may be a proprietary communication protocol hardware or a proprietary communication protocol software or a combination of the two to establish security between the first protection device 10 and the second protection device 20. Barrier The data packet of the proprietary communication protocol is intercepted and blocked by the data packet that does not conform to the proprietary communication protocol, so that secure data interaction between the first protection device 10 and the second protection device 20 can be ensured.

As shown in FIG. 2, the first protection device 10 includes a first interface A1 for bidirectional data communication with the first communication party N1 and a second interface Bi0 for bidirectional communication with the two-line data communication module 4 at the first protection device 10. There is also included a filtering module F1 and a transmission channel C1 that transmits the data packet from the second interface B1 to the first interface A1. The filtering module F1 is disposed between the first interface A1 and the second interface B1, and is configured to perform a filtering check on the data packet to be transmitted from the first communication party N1 to the second communication party N2 received from the first interface A1. And outputting the data packet conforming to the communication protocol as the security requirement built in the filter module F1 to the second interface B1. The second interface B1 outputs the data packet that has passed the filtering check of the filtering module F1 to the bidirectional data transmission module 4, and the bidirectional data transmission module 4 outputs the data of the first protection device 10 through the second interface A2 according to a proprietary communication protocol. Transfer to the second protection device 20.

The second protection device 20 is completely independent of the first protection device 10 in hardware configuration. The second protection device 20 includes a first interface A2 for bidirectional data communication with the second communication party N2 and a second interface B2 for bidirectional communication with the two-line data communication module 4. Also included in the second protection device 20 is a filtering module F2 and a transmission channel C2 for transmitting data packets from the second interface B2 to the first interface A2. The filtering module F2 is disposed between the first interface A2 and the second interface B2, and is configured to perform a filtering check on the data packet that is received from the first interface A2 and is to be transmitted from the second communication party N2 to the first communication party N1. And outputting the data packet conforming to the communication protocol as the security requirement built in the filter module F2 to the second interface B2. The second interface B2 outputs the data packet that has passed the filtering check of the filtering module F2 to the bidirectional data transmission module 4, and the bidirectional data transmission module 4 outputs the data of the second protection device 20 through the second interface B2 according to a proprietary communication protocol. The packet is delivered to the first protection device 10.

The first protection device 10 and the second protection device 20 in the isolation protection system 1 according to the present invention are respectively operated on a central processing unit CPU1 and a central processing unit CPU2 which are independent of each other (i.e., independently operated and operated), wherein each One central processor corresponds to one memory. This configuration ensures that when one of the central processors is compromised or physically damaged, the other central processor is not affected. The two first protection device 10 and the second protection device 20 independently operating on the respective central processors are fed through the bidirectional data transmission module 4 according to a proprietary communication protocol. Line two-way data transmission.

As can be seen from the above, the isolation protection system 1 according to the first embodiment of the present invention is provided between the filter module and the two protection devices provided in the protection device included in the independent central processing unit The two-way data transmission module performs data transmission on both sides of the communication, and therefore, when the data is exchanged between the networks by the isolation protection system 1 according to the first embodiment of the present invention, it is not required to be the same as the existing gateway product, and to the client and the server side. The IP address is set so that it has no effect on the existing network.

Since the security policy of the isolation protection system 1 according to the present invention is implemented by setting the filter modules included in the protection device, an appropriate security policy can be set according to the security requirements of both communication parties.

With the isolation protection system 1 according to the first embodiment of the present invention, when a data packet is to be transmitted from the first communication party N1 to the second communication party N2, the data packet flows as shown by the path L1 in Fig. 2 . Specifically, the data from the first communication device N1 enters the first protection device 10 by the first interface A1 of the first protection device 10; inside the first protection device 10, the data packet is filtered and checked by the filtering module F1; The data packet conforming to the security requirement passes through the filtering module F1 and enters the bidirectional data transmission module 4 via the second interface A2 of the first protection device 10; if the data packet does not comply with the proprietary communication protocol built in the bidirectional data transmission module 4, The data packet will be blocked from entering the second protection device 20. If the data packet conforms to the proprietary communication protocol, it can enter the second protection device 20 through the intermediate communication module 4; within the second protection device 20, the data The packet is directly transmitted by the second interface B2 to the first interface A2 through the transmission channel C2, thereby completing the packet transmission from the first communication party N1 to the second communication party N2. In the process of transmitting a data packet from the first communication party N1 to the second communication party N2, the data packet first passes the filtering check of the filtering module F1 set in the first protection device 10, and then from the first according to the proprietary communication protocol. The protection device 10 enters the second protection device 20, such a configuration assuring data security transmitted from the first communication party N1 to the second communication party N2. The packet transmission flow from the second communicating party N2 to the first communicating party N1 is shown as a path L2 in Fig. 2, which is similar to the path L1, and a description thereof will be omitted herein.

Compared to the prior art firewall shown in Fig. 1, the isolation protection system 1 according to the present invention employs the "2+1" structure of the present invention: that is, two central processors operating independently of each other for the communication parties Two protection devices 10, 20 and settings that are completely independent on the hardware structure A two-way data communication module 4 that performs secure data interaction between two protection devices 10, 20 between two protection devices 10, 20 and in accordance with a proprietary communication protocol enables bidirectional data communication between the communication parties. The two protection devices include a filtering module for filtering and checking the data packets, so that the communication protocol as a security requirement of the filtering module can be set according to the security requirements of the communication parties to meet the security requirements of the communication parties. . In the isolation protection system 1 according to the first embodiment of the present invention, the first protection device 10 and the second protection device 20 are respectively operated on separate central processors, so that two protection devices that are completely independent of each other in hardware can be realized. The bidirectional data transmission module 4 is disposed between the first protection device 10 and the second protection device 20 and implements secure communication between the first protection device 10 and the second protection device 20 using a proprietary communication protocol, such as the present invention The "2+1" architecture can bring many advantages in hardware implementation. For example, the first protection device 10 and the second protection device 20 can be fabricated as two separate hosts, the host including a central processor, and each central processor can have a corresponding memory. For each host, a dedicated embedded Linux operating system with a bootloader as the boot loader can be used. In this way, the performance of the other protection device is not affected by one attack or physical damage between the two protection devices. For another example, the first protection device 10 and the second protection device 20 may be fabricated as a device in the form of a plug-in, that is, a device manufactured in a detachable form, and the bidirectional data transmission module 4 is manufactured as a backplane incorporating a proprietary communication protocol. Thus, when the two protection devices are inserted into the backplane, an isolation protection system for isolating and protecting the communication facilities of both communication parties according to the present invention is formed. In this case, when one of the protection devices is broken, replacement and maintenance can be easily performed, and the other protection device is not affected at all.

Next, an isolation protection system 2 according to a second embodiment of the present invention will be described with reference to FIG. The same reference numerals in the second embodiment shown in Fig. 3 as those in the first embodiment shown in Fig. 2 denote the same components, and the description thereof will not be repeated.

Different from the isolation protection system 1 of the first embodiment of the present invention, in the isolation protection system 2 according to the second embodiment of the present invention, the filter module F1 in the first protection device 10 includes a built-in firewall module K1 and packet filtering. The module S1, and the filtering module F2 in the second protection device 20 includes a built-in firewall module K2 and a packet filtering module S2, as shown in FIG. The built-in firewall module K1 can perform firewall filtering check on the data packet received from the first communication party N1 to the second communication party N2 from the first interface A1, and the firewall filtering check can be a basic firewall check to ensure General cyber attacks are hard to work with. Basic firewall technology The communication rules of setting protocol, port, IP, etc. implement the defense function, that is, the data packet can be checked at the data link layer, the network layer, and the transport layer, which mainly involves performing packet header content inspection on the data packet. Check that packets that do not satisfy the communication rule will be intercepted. Packet filtering module

S1 is used to perform packet filtering check on the data packet filtered by the built-in firewall module K1. The packet filtering check is different from the firewall filtering check, which may be based on deep filtering check and protocol analysis of the data packet on the application layer. It mainly involves performing a package content check on the data stream. When the isolation protection system 2 according to the present invention is deployed between an information network and a control network of an industrial site as an industrial network security isolation system, an industrial communication protocol can be built in the packet filtering module S1 to check an application conforming to the industrial communication protocol. data. The header content relates to an IP address, a MAC address, protocol type information, and port information, and the contents of the package relate to a communication target, a communication source, a communication destination, a communication type, and a communication content. The filter module F2 in the second protection device 20 includes a built-in firewall module K2 and a packet filtering module S2. The built-in firewall module K2 is configured to perform firewall filtering check on the data packet input from the first interface A2 to be transmitted from the second communication party N2 to the first communication party N1, and the firewall filtering check may be a basic firewall check. To ensure that general network attacks are difficult to achieve, the basic firewall technology implements defense functions by setting communication protocols such as protocols, ports, and IPs, that is, data can be checked at the data link layer, network layer, and transport layer. This mainly involves checking the packet header of the packet, and packets that do not satisfy the communication rule will be intercepted. The packet filtering module S2 is configured to perform packet filtering check on the data packet filtered by the built-in firewall module K2, and the packet filtering check is different from the firewall filtering check, which may be based on the deep filtering of the data packet on the application layer. Check, protocol analysis, which mainly involves performing package content check on data packets of the data stream. When the isolation protection system 2 according to the present invention is deployed between an information network and a control network of an industrial site as an industrial network security isolation system, an industrial communication protocol can be built in the packet filtering module S2 to check an application conforming to the industrial communication protocol. data. The header content relates to an IP address, a MAC address, protocol type information, and port information, and the package content relates to a communication target, a communication source, a communication destination, a communication type, and a communication content.

It can be seen from the above that both the first protection device 10 and the second protection device 20 include a built-in firewall module and a packet filtering module for filtering and checking data packets successively, and the two filtering checks can be directed to the data stream. Filtering checks on different parts of the packet. For example, the built-in firewall module supports checking the data link layer, network layer, and transport layer of the general network. It is mainly used to filter the packet header of the data packet; the packet filtering module supports checking the application layer data, and sp, mainly filtering and checking the content of the data packet, so it can be built in the packet filtering module. Industrial communication protocol for checking application data in compliance with industrial protocols. Since each protection device included in the isolation protection system according to the present invention includes a built-in firewall module and a packet filtering module that successively filter and check data, it is possible to ensure security through data and can pass data in The desired industrial communication protocol is preset in the packet filtering module to enable the network security protection system of the present invention to fully support the industrial communication protocol to accommodate the security requirements between the information network and the control network at the industrial site.

In the present invention, the built-in firewall module S1 and the built-in firewall module S2 can be identical, that is, provide the same basic firewall filtering check. The packet filtering module S1 and the packet filtering module S2 may be the same, that is, the same communication protocol may be built therein; or different built in according to different security requirements of the first communication party N1 and the second communication party N2. The communication protocol, for example, when the first communication party N1 is the sender of the data packet, and the second communication party N2 is the receiver of the data packet, it may be based on the security requirement of the second communication party N2 as the data packet receiver. The communication protocol built in the packet filtering module S1 in the first protection device 10 is set; and when the first communication party N1 is the receiver of the data packet and the second communication party N2 is the sender of the data packet, The security of the communication party N1 requires setting the communication protocol built in the packet filtering module S2 in the second protection device 20, thereby satisfying the security requirements of both parties.

Since the two-way data transmission module 4 with a proprietary communication protocol is provided between the first protection device 10 and the second protection device 20, the data packets transmitted from one communication party to another communication party are protected even if they are protected. The filtering check of the built-in firewall module and the packet filtering module in the device is also blocked and blocked when it does not satisfy the proprietary communication protocol built in the bidirectional data transmission module 4, and cannot reach another communication party, which further The security of data transmission on the communication lines of both communication parties is increased.

The isolation protection system 2 according to the second embodiment of the present invention can be applied between an industrial field information network and a control network to perform security protection on the control network. This is mainly because, in the isolation protection system 2 of the present invention, both the first protection device 10 and the second protection device 20 contain packet filtering checks in addition to the conventional built-in firewall filtering check. A variety of automation product manufacturers' proprietary communication protocols can be built into the packet filtering module for both client and service. Effective communication between industrial protocols such as OPC and Modbus is carried out between the terminals, and data read and write control is supported. Other non-industrial data is discarded.

Next, a method of performing bidirectional packet filtering inspection using the isolation protection system 2 of the present invention will be described in detail with reference to Fig. 3 and with reference to Figs. 4 and 5.

For convenience of description, in FIG. 4 and FIG. 5, the client and the server are used as communication parties as an example to describe how the isolation protection system 2 according to the present invention implements secure transmission of data on the client side and the server side.

Figure 4 shows a flow chart for transferring data from the client to the server. In step S71, the client transmits a data packet; in step S72, the data packet is sent to the CPU (first protection device 10) connected to the client; in step S73, a basic firewall check is performed, and the data packet of the invalid data is It is discarded (step S76), and the valid data is further subjected to packet filtering check (step S74); if the data subjected to the packet filtering check in step S74 is determined to be invalid data, the packet is discarded (step S76). And the data determined to be valid is transmitted to the CPU (second protection device 20) connected to the server side (step S75); further, in step S77, the received data packet is transmitted to the server side.

Figure 5 shows a flow chart for transferring data from the server to the client. In step S81, the server sends a data packet; in step S82, the data packet is sent to the CPU (second protection device 20) connected to the server; in step S83, a basic firewall check is performed, and the data packet of the invalid data is It is discarded (step S86), and the valid data is further subjected to packet filtering check (step S84); if the data of the packet filtering check in step S84 is determined to be invalid data, the packet is discarded (step S86). And the data determined to be valid is transmitted to the CPU (first protection device 10) connected to the client (step S85); further, in step S87, the received data packet is transmitted to the client.

The above shows an isolation protection system and a method thereof for performing two-way packet filtering inspection according to the present invention. The isolation protection system of the present invention adopts the "2+1" structure of the present invention, that is, the first protection device and the second protection device capable of two-way communication with the communication parties, respectively, and the first protection device and the A bidirectional data transmission module with a built-in proprietary communication protocol controlled by data interaction between the second protection devices, wherein the first protection device and the second protection device in the isolation protection system of the present invention are respectively operated on independent hosts Above, controlled by independent CPU processors, which ensures that when one of the hosts fails or When compromised by a virus, another host will not be affected. In addition, the first protection device and the data packet filtering module in the second protection device in the isolation protection system of the present invention are for deep inspection and protocol analysis of application layer data packets, and a plurality of proprietary industrial communication protocols are built therein. It can realize the protection mode based on the built-in industrial communication protocol, and carry out in-depth inspection of data packets at the application layer to provide a unique, industrial-grade professional isolation protection solution for industrial communication. Therefore, the isolation protection system of the present invention is particularly suitable for application to secure interaction of data between an industrial field information network and a control network.

It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to be limiting, and the present invention will be described in detail with reference to the preferred embodiments. Modifications or equivalents are made without departing from the spirit and scope of the invention.

Claims

Claim

1. An isolation protection system that is installed in a communication line to protect the communication facilities of both communication parties. It includes:

a first protection device (10) and a second protection device (20) for respectively connecting with a communication facility of one of the communicating parties;

a bidirectional data transmission module (4) disposed between the first protection device (10) and the second protection device (20) for connecting the first protection device (10) and the second protection a device (20), and transmitting data output by the first protection device (10) to the second protection device (20) according to a proprietary communication protocol, and data output by the second protection device (20) Transfer to the first protection device (10); characterized by:

The first protection device (10) and the second protection device (20) have completely independent hardware structures and respectively operate on separate central processing units (CPU1, CPU2), wherein the first protection device (10) And each of the second protection devices (20) includes:

a first interface (Al, A2) for receiving a data packet of the data stream from a communication facility of the connected communication party and outputting data from another communication party to the connected communication facility;

a filtering module (F1, F2) for performing a filtering check on the data stream received from the first interface (Al, A2), and outputting data complying with security requirements;

a second interface (B1, B2) for receiving the data meeting the security requirement, and transmitting the data meeting the security requirement to the two-way data transmission module (4); and the transmission channel (Cl, C2) ) for transmitting data from the second interface (B2, B1) to the first interface (Al, A2).

2. The isolation protection system according to claim 1, wherein said communication device of said communication party is an input/output device of a computer, a server or other network information.

3. The isolation protection system according to claim 1, wherein the filtering module (F1, F2) comprises a built-in firewall module (K1, Κ2) for performing basic firewall checking on data packets of the transmitted data stream, respectively A packet filtering module (S1, S2) for performing packet depth filtering.

4. The isolation protection system according to claim 3, wherein said built-in firewall module (K1, K2) performs a header content check on a data packet of the data stream, and said packet filtering module (SI, S2) pairs data The streamed packet performs a body content check.

5. The isolation protection system according to claim 4, wherein the header content relates to an IP address, a MAC address, protocol type information, port information, and the package content relates to a communication target, a communication source, a communication destination, and a communication type. And communication content.

6. The isolation protection system according to claim 1, wherein a filter list supporting an industrial communication protocol is built in the data packet filtering module (SI, S2).

7. A method of performing a two-way packet filtering check using the isolation protection system of claim 1 comprising the steps of:

Providing, in the communication line, a first protection device (10) and a second protection device (20) having completely independent hardware structures and respectively operating on separate central processing units (CPU1, CPU2) for communication facilities of the communication parties; as well as

A filtering check is performed on the packets of the transmitted data stream using the filtering modules (F1, F2) provided in the first protection device (10) and the second protection device (20).

8. The method of claim 7, wherein the filtering check comprises:

Perform packet depth filtering on packets of the transmitted data stream.

9. The method of claim 8 wherein

Performing a basic firewall check on the data packet of the transmitted data stream includes performing a header content check on the data packet of the data stream, and

Performing packet depth filtering on the data packets of the transmitted data stream includes performing a body content check on the data packets of the data stream.

10. The method of claim 9, wherein the header content relates to an IP address, The MAC address, the protocol type information, and the port information, and the contents of the package relate to a communication target, a communication source, a communication destination, a communication type, and a communication content.