CN115412351A - An industrial control firewall policy analysis method and device - Google Patents

Abstract

This application discloses an industrial control firewall strategy analysis method and device, including: obtaining and analyzing messages flowing through the industrial control firewall to generate asset entries; importing process flow files for analysis to generate process flow entries; setting strategy analysis granularity and strategy Grace period; conduct global strategy analysis on the first-level strategy and second-level strategy according to asset entries and process flow entries, generate strategy analysis reports and generate recommended strategies according to the granularity of strategy analysis and strategy grace period; deploy recommended strategies. The industrial control firewall policy analysis method and device provided in this application can perform overall correlation policy analysis according to the network environment and process flow deployed by the industrial control firewall, and can automatically adjust the fineness of policy analysis according to the preset policy analysis granularity.

Description

An industrial control firewall policy analysis method and device

technical field

The present application relates to the technical field of industrial control firewalls, in particular to an industrial control firewall policy analysis method and device.

Background technique

Please refer to Figure 1. There are generally two policies on the industrial control firewall: access control policy (ACL) and white list policy (or white list rule). Since the industrial control firewall is deployed at the gateway in the network, there are usually dozens or even hundreds of access control policies and whitelist rules, and as the network environment changes, the policies need to be adjusted accordingly. Therefore, a policy analysis method is needed to help configuration administrators quickly and efficiently analyze and locate which policies are redundant, conflicting, and have security risks.

The current industrial control firewalls rarely have the policy analysis function. Some industrial control firewalls with this function perform policy redundancy analysis based on the information (such as quintuple information, etc.) that comes with the policy in their respective policy modules; some are based on packet hits. The number of times the policy does a mismatch check.

The above two policy analysis methods can only be analyzed within the policy module based on information such as the five-tuple of the policy, and cannot be combined with application scenarios, and each policy module (access control policy and whitelist policy) can be analyzed independently, and cannot Global association policy analysis also cannot automatically adjust the fineness of policy analysis according to the granularity of policy analysis. The results of policy analysis can only be analyzed and viewed, and cannot be quickly deployed.

Contents of the invention

For this reason, the present application provides a method and device for industrial control firewall policy analysis to solve the problems existing in the prior art that cannot be combined with application scenarios for overall associated policy analysis and cannot automatically adjust the fineness of policy analysis.

In order to achieve the above object, the application provides the following technical solutions:

In the first aspect, an industrial control firewall policy analysis method includes:

Obtain and analyze the packets passing through the industrial control firewall to generate asset entries;

Import the process flow file for analysis and generate process flow entries;

Set policy analysis granularity and policy grace period;

Perform a global strategy analysis on the first-level strategy and the second-level strategy according to the asset entry and the process flow entry, generate a strategy analysis report, and generate a recommended strategy according to the strategy analysis granularity and the strategy grace period;

Deploy the recommended policy.

Further, the global policy analysis includes five aspects of policy analysis: non-coverage, redundancy, conflict, non-fitting scenarios, and policy grace period timeout.

Further, for a policy that has no packet matching within a specific time, if it is not within the policy grace period, the recommended policy will be filtered out after it is generated.

Further, the content of the asset entry includes mac address, ip address, destination port number and incoming interface.

Further, the analysis granularity is discrete address type, network segment type or address range type.

Further, when the analysis granularity is network segment type, a mask needs to be set.

Further, the process flow file is a user-defined process operation flow and operation instruction comparison table.

Further, the asset item can be manually added by the user.

In the second aspect, an industrial control firewall policy analysis device includes:

The asset collection and storage module is used to obtain and analyze the traffic flowing through the industrial control firewall, and generate asset entries;

The process flow analysis and storage module is used to import process flow files for analysis and generate process flow entries;

The strategy intelligent analysis module is used to set the strategy analysis granularity and the strategy grace period, conduct global strategy analysis on the first-level strategy and the second-level strategy according to the asset entry and the process flow entry, generate a strategy analysis report and analyze it according to the strategy Granularity and said policy grace period to generate a recommendation policy;

A strategy analysis result storage module, configured to store the recommended strategy;

A deployment module, configured to deploy the recommended strategy.

Further, the asset collection and storage module includes:

Asset self-learning and self-definition module, which is used to self-learn the packets flowing through the industrial control firewall, and generate asset entries including mac address, ip address, destination port number and incoming interface data;

Asset storage module, used to store generated asset entries.

Compared with the prior art, the present application has at least the following beneficial effects:

This application provides an industrial control firewall policy analysis method and device, including: obtaining and analyzing the messages flowing through the industrial control firewall to generate asset entries; importing process flow files for analysis to generate process flow entries; setting policy analysis granularity and policy width Deadline; according to asset entries and process entries, conduct global strategy analysis on primary and secondary strategies, generate strategy analysis reports and generate recommended strategies based on strategy analysis granularity and strategy grace period; deploy recommended strategies. The industrial control firewall policy analysis method and device provided in this application can perform overall correlation policy analysis according to the network environment and process flow deployed by the industrial control firewall, and can automatically adjust the fineness of policy analysis according to the preset policy analysis granularity.

The present application can also quickly deploy the recommended strategy after applying the strategy analysis.

Description of drawings

In order to illustrate the prior art and the present application more intuitively, several exemplary drawings are given below. It should be understood that the specific shapes and structures shown in the accompanying drawings should generally not be regarded as limiting conditions for the implementation of the present application; for example, those skilled in the art are able to The increase/decrease/attribution division, specific shape, positional relationship, connection mode, size ratio relationship, etc. of some units (parts) are easy to make conventional adjustments or further optimization.

Fig. 1 is a schematic structural diagram of the prior art;

FIG. 2 is a basic flowchart of an industrial control firewall policy analysis method provided in Embodiment 1 of the present application;

FIG. 3 is a schematic flowchart of an industrial control firewall policy analysis method provided in Embodiment 1 of the present application;

FIG. 4 is a flowchart of global policy analysis provided by Embodiment 1 of the present application.

Detailed ways

The present application will be further described in detail through specific embodiments below in conjunction with the accompanying drawings.

In the description of this application: unless otherwise specified, "plurality" means two or more. The terms "first", "second", and "third" in this application are intended to distinguish the referred objects, and have no special meaning in terms of technical connotation (for example, it should not be understood as a reference to the degree of importance or order, etc. emphasis). Expressions such as "comprising", "including", and "having" also mean "not limited to" (certain elements, components, materials, steps, etc.).

Terms such as "upper", "lower", "left", "right", "middle", etc. quoted in this application are usually for the convenience of intuitive understanding with reference to the drawings, rather than absolute terms for the positional relationship in the actual product limited. Without departing from the technical concept disclosed in this application, changes in these relative positional relationships should also be regarded as the scope of this application.

Embodiment one

Please refer to Fig. 2 and Fig. 3, this embodiment provides a kind of industrial control firewall policy analysis method, including:

S1: Obtain and analyze the packets passing through the industrial control firewall, and generate asset entries;

Because the traffic (that is, the message) in the industrial control production environment has the characteristics of continuous and relatively fixed content, so this embodiment can analyze the traffic passing through the industrial control firewall according to this characteristic, and generate an asset entry. The content in the asset entry includes : mac address, ip address, destination port number, interface name flowing into the industrial control wall, etc. At the same time, users can also manually add asset entries containing the above data.

S2: Import the process flow file for analysis, and generate process flow entries;

Because the business process flow of industrial production usually does not change in real time, by importing the process flow file, the user-defined process operation process and operation instruction comparison table can be imported into the industrial control firewall to generate process flow entries.

S3: Set policy analysis granularity and policy grace period;

Specifically, the analysis granularity can be a discrete address type, a network segment type, or an address range type; when the analysis granularity is a network segment type, a mask needs to be set.

More specifically, the address range type refers to a special network segment, which is a network segment with an address of 0.0.0.0 and a mask of 0.0.0.0.

S4: Perform a global strategy analysis on the first-level strategy and the second-level strategy according to the asset entry and the process flow entry, generate a strategy analysis report, and generate a recommended strategy (new strategy) according to the strategy analysis granularity and the strategy grace period ;

Specifically, because the policies of industrial control firewalls are dependent, they can be divided into first-level policies (access control policies) and second-level policies (whitelist policies). Only after passing the first-level policies can they enter the matching of the second-level policies , the first-level strategy can be compared to opening an opening, and the second-level strategy is equivalent to performing more dimensional matching and filtering on packets entering through this opening.

Please refer to Figure 4. When doing global policy analysis, it includes policy analysis in five aspects: non-coverage, redundancy, conflict, non-fitting scenarios, and policy grace period timeout.

more specific:

Uncovered: Uncovered means that the ip, mac, and operation instructions contained in the asset entry or process entry are not found in the existing policies, and these assets and process flows are not included in the policy protection scope, which belongs to the policy Protection against high-risk vulnerabilities;

Redundancy: Redundancy refers to the fact that one or more policies are the same as other policies or belong to a proper subset of other policies;

Conflict: Conflict refers to the fact that some policies have the same quintuple information but perform different actions; conflicts also include: the first-level policy protects network segment A, but the second-level policy that refers to the first-level policy protects both networks A and B. paragraph, which is also a kind of conflict;

Non-fitting scenario: Non-fitting scenario refers to the protection range or part of the protection range of the policy is not in the asset item or process flow;

Policy grace period timeout: policy grace period timeout means that the protection scope of the policy is within the asset entry or process flow, but the policy has no packet hit within a certain period of time, which belongs to the unmatched policy (that is, useless policy).

In this embodiment, for a policy that has no packet matching within a period of time, if it is not within the policy grace period, the new policy after policy analysis will filter out the policy.

S5: Deploy the recommended policy.

The industrial control firewall policy analysis method provided in this embodiment can perform overall correlation policy analysis according to the network environment and business process flow deployed by the industrial control firewall, and can automatically adjust the fineness of policy analysis according to the preset policy analysis granularity, and can Quickly deploy new policies after applying policy analysis.

Embodiment two

This embodiment provides an industrial control firewall policy analysis device, including:

The asset collection and storage module is used to obtain and analyze the traffic flowing through the industrial control firewall, and generate asset entries;

Specifically, the asset collection and storage module includes:

Asset self-learning and self-definition module, which is used to self-learn the packets flowing through the industrial control firewall, and generate asset entries including mac address, ip address, destination port number and incoming interface data;

Asset storage module, used to store generated asset entries.

The process flow analysis and storage module is used to import process flow files for analysis and generate process flow entries;

The strategy intelligent analysis module is used to set the strategy analysis granularity and the strategy grace period, conduct global strategy analysis on the first-level strategy and the second-level strategy according to the asset entry and the process flow entry, generate a strategy analysis report and analyze it according to the strategy Granularity and said policy grace period to generate a recommendation policy;

A strategy analysis result storage module, configured to store the recommended strategy;

A deployment module, configured to deploy the recommended strategy.

For specific limitations on the industrial control firewall policy analysis device, please refer to the above-mentioned limitations on the industrial control firewall policy analysis method, and details will not be repeated here. Each module in the above-mentioned industrial control firewall policy analysis device can be fully or partially realized by software, hardware and combinations thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, and can also be stored in the memory of the computer device in the form of software, so that the processor can invoke and execute the corresponding operations of the above-mentioned modules.

The technical features of the above embodiments can be combined arbitrarily (as long as there is no contradiction in the combination of these technical features), for the sake of concise description, all possible combinations of the various technical features in the above embodiments are not described; these are not clear All the written examples should also be regarded as within the scope of the description in this specification.

The present application has been described more specifically and in detail through general descriptions and specific examples above. It should be understood that based on the technical concept of the present application, some conventional adjustments or further innovations can also be made to these specific embodiments; Also fall within the protection scope of the claims of the present application.

Claims (10)

1. A method for analyzing industrial control firewall policies is characterized by comprising the following steps:

obtaining and analyzing messages flowing through an industrial control firewall to generate asset items;

importing a process flow file for analysis to generate a process flow item;

setting strategy analysis granularity and strategy grace period;

performing global strategy analysis on a primary strategy and a secondary strategy according to the asset entries and the process flow entries, generating a strategy analysis report, and generating a recommendation strategy according to the strategy analysis granularity and the strategy grace period;

and deploying the recommendation strategy.

2. The industrial control firewall policy analysis method according to claim 1, wherein the global policy analysis includes policy analysis in five aspects of uncovered, redundant, conflicting, non-conforming scenarios and policy grace period timeout.

3. The method for analyzing the industrial control firewall policy according to claim 1, wherein for a policy that no message is matched within a specific time, if the policy is not within the policy grace period, the recommended policy is filtered out after being generated.

4. The industrial control firewall policy analysis method of claim 1, wherein the asset entry content comprises a mac address, an ip address, a destination port number and an ingress interface.

5. The industrial control firewall policy analysis method according to claim 1, wherein the analysis granularity is of a discrete address type, a segment type, or an address range type.

6. The method for analyzing industrial control firewall policies according to claim 5, wherein a mask is required to be set when the analysis granularity is a network segment type.

7. The method for analyzing the industrial control firewall policy of claim 1, wherein the process flow file is a user-defined comparison table of process operation flows and operation instructions.

8. The industrial firewall policy analysis method of claim 1, wherein the asset entries can be added manually by a user.

9. The utility model provides an industrial control firewall policy analysis device which characterized in that includes:

the asset collecting and storing module is used for acquiring and analyzing the flow passing through the industrial control firewall to generate asset items;

the process flow analyzing and storing module is used for importing a process flow file for analyzing and generating process flow items;

the intelligent strategy analysis module is used for setting strategy analysis granularity and a strategy grace period, performing overall strategy analysis on a primary strategy and a secondary strategy according to the asset entries and the process flow entries, generating a strategy analysis report and generating a recommendation strategy according to the strategy analysis granularity and the strategy grace period;

the strategy analysis result storage module is used for storing the recommendation strategy;

and the deployment module is used for deploying the recommendation strategy.

10. The industrial control firewall policy analysis device according to claim 9, wherein the asset collection and storage module comprises:

the asset self-learning and self-defining module is used for self-learning the messages flowing through the industrial control firewall and generating asset items including a mac address, an ip address, a destination port number and inflow interface data;

and the asset storage module is used for storing the generated asset entry.

Images