CN115801572A - A method for upgrading firmware of industrial firewall - Google Patents

Abstract

The invention discloses an industrial firewall firmware upgrading method, which comprises the following steps: A. setting a topological structure and a data processing flow of the industrial firewall; after entering an industrial firewall from a data inlet, data to be transmitted sequentially passes through the data processing modules connected in series to be monitored and filtered; B. when the firmware of the industrial firewall needs to be upgraded, sequentially upgrading the firmware of each data processing module from a data inlet end, and keeping the data transmission of other online data processing modules which do not execute the firmware upgrading operation by using a data transmission bypass; C. the data processing module after the firmware is upgraded is subjected to online operation again, and the upgraded firmware is verified in the subsequent data monitoring and filtering; D. and C, repeating the steps B and C until the firmware of all the data processing modules is upgraded. The invention can improve the defects of the prior art, and realizes the firmware upgrade while monitoring data by the firewall on the premise of not using a firewall redundant module.

Description

A method for upgrading firmware of industrial firewall

technical field

The invention relates to the technical field of industrial network security, in particular to a method for upgrading firmware of an industrial firewall.

Background technique

A firewall is a network security component that monitors and filters network transmission data. Because network attack behaviors are always changing dynamically, the firmware of the firewall also needs to be upgraded accordingly for network attack behaviors. In the prior art, in order to ensure that the firewall can normally perform data monitoring during the upgrade process, redundant firewall modules are usually provided, and the redundant modules can be used for uninterrupted data monitoring when the firewall is upgraded. However, the utilization rate of these redundant firewall modules is extremely low, which increases the complexity of the firewall system.

Contents of the invention

The technical problem to be solved by the present invention is to provide an industrial firewall firmware upgrade method, which can solve the deficiencies of the prior art, and implement firmware upgrade while implementing firewall monitoring data without using firewall redundant modules.

In order to solve the above technical problems, the technical solutions adopted by the present invention are as follows.

A method for upgrading firmware of an industrial firewall, comprising the following steps:

A. Set up the topology structure and data processing flow of the industrial firewall; the industrial firewall includes several data processing modules connected in series, and a data transmission bypass is set between non-adjacent data processing modules; the data to be transmitted enters the industrial firewall from the data entrance After that, monitor and filter through the data processing modules connected in series in turn;

B. When the firmware of the industrial firewall needs to be upgraded, starting from the data entry port, upgrade the firmware of each data processing module in turn, perform offline operations on the data processing modules that perform firmware upgrades, and use the data transmission bypass to keep the firmware upgrade operation from being executed Data transmission of other online data processing modules;

C. The data processing module whose firmware has been upgraded is re-operated online, and the upgraded firmware is verified in the subsequent data monitoring and filtering;

D. Steps B and C are repeated until the firmware upgrades of all data processing modules are completed.

As a preference, in step A, each data processing module contains the same number of rule files, and the rule files in different data processing modules correspond one-to-one, and the linearity of the corresponding rule files in adjacent data processing modules in the topology exceeds the set threshold.

As a preference, in step A, the data to be transmitted passes sequentially through the data processing modules connected in series, and when the corresponding rule files in two adjacent data processing modules determine that the data to be transmitted is illegal data, the transmission of the data to be transmitted is stopped .

Preferably, in step B, when the data to be transmitted is transmitted to the offline data processing module, use the data transmission bypass to transmit the data to be transmitted to the next data processing module adjacent to the offline data processing module, and then obtain and Any one of the two online data processing modules adjacent to the offline data processing module judges the data to be transmitted as illegal data, and extracts the source IP address, source port, destination IP address, and destination port of the data to be transmitted Compare the transmission protocol with the preset blacklist, and if there is a successful comparison item, stop the transmission of the data to be transmitted.

Preferably, in step B, first perform firmware data backup on the off-line data processing module, and then download the firmware upgrade file to upgrade the existing firmware.

Preferably, in step C, the digest data of the firmware is calculated, and the digest data is compared with the digital signature of the firmware for verification.

The beneficial effect of adopting the above technical solution is that the present invention uses the monitoring results of multiple data processing modules to judge data by redesigning the monitoring and filtering rules of the firewall, thereby establishing a foundation for the online firmware upgrade of the firewall. During the firmware upgrade process, each data processing module is upgraded sequentially. During the upgrade process, the monitoring results of other data processing modules adjacent to the firmware upgrade module are used to replace the monitoring of the firmware upgrade module, thereby realizing the data monitoring and firmware of the firewall. Simultaneously with the upgrade.

Description of drawings

Fig. 1 is a schematic diagram of a specific embodiment of the present invention.

Detailed ways

With reference to Fig. 1, a specific embodiment of the present invention comprises the following steps:

A. Set up the topology structure and data processing flow of the industrial firewall; the industrial firewall includes several data processing modules connected in series, and data transmission bypasses are set between non-adjacent data processing modules; each data processing module contains the same number of Rule files, rule files in different data processing modules correspond one by one, and the linearity of the corresponding rule files in adjacent data processing modules in the topology exceeds the set threshold; after the data to be transmitted enters the industrial firewall from the data entrance, it passes through the serial The connected data processing modules perform monitoring and filtering; the data to be transmitted sequentially passes through the data processing modules connected in series, and when the corresponding rule files in two adjacent data processing modules determine that the data to be transmitted is illegal data, the data to be transmitted is stopped transmission;

B. When the firmware of the industrial firewall needs to be upgraded, starting from the data entry port, upgrade the firmware of each data processing module in turn. First, backup the firmware data of the offline data processing module, and then download the firmware upgrade file to upgrade the existing firmware. , perform offline operations on the data processing module performing firmware upgrade, use the data transmission bypass to maintain the data transmission of other online data processing modules that have not performed firmware upgrade operations; when the data to be transmitted is transmitted to the offline data processing module, use data transmission The bypass transmits the data to be transmitted to the next data processing module adjacent to the offline data processing module, and then obtains any one of the two online data processing modules adjacent to the offline data processing module to determine as For illegal data to be transmitted, compare the source IP address, source port, destination IP address, destination port, and transmission protocol of the extracted data to be transmitted with the preset blacklist. If there is a successful comparison item, stop the transmission of the data to be transmitted;

C. Re-operate the data processing module with the firmware upgraded online, and verify the upgraded firmware in the subsequent data monitoring and filtering, calculate the summary data of the firmware, and use the summary data to compare and verify with the digital signature of the firmware test;

D. Steps B and C are repeated until the firmware upgrades of all data processing modules are completed.

The basic principles and main features of the present invention and the advantages of the present invention have been shown and described above. Those skilled in the industry should understand that the present invention is not limited by the above-mentioned embodiments. What are described in the above-mentioned embodiments and the description only illustrate the principle of the present invention. Without departing from the spirit and scope of the present invention, the present invention will also have Variations and improvements are possible, which fall within the scope of the claimed invention. The protection scope of the present invention is defined by the appended claims and their equivalents.

Claims (6)

1. A kind of industrial firewall firmware upgrade method is characterized in that comprising the following steps: A. Set up the topology structure and data processing flow of the industrial firewall; the industrial firewall includes several data processing modules connected in series, and a data transmission bypass is set between non-adjacent data processing modules; the data to be transmitted enters the industrial firewall from the data entrance After that, monitor and filter through the data processing modules connected in series in turn; B. When the firmware of the industrial firewall needs to be upgraded, starting from the data entry port, upgrade the firmware of each data processing module in turn, perform offline operations on the data processing modules that perform firmware upgrades, and use the data transmission bypass to keep the firmware upgrade operation from being executed Data transmission of other online data processing modules; C. The data processing module whose firmware has been upgraded is re-operated online, and the upgraded firmware is verified in the subsequent data monitoring and filtering; D. Steps B and C are repeated until the firmware upgrades of all data processing modules are completed. 2. The method for upgrading firmware of an industrial firewall according to claim 1, characterized in that: in step A, each data processing module includes the same number of rule files, and the rule files in different data processing modules correspond one-to-one. The linearity of the corresponding rule file in the adjacent data processing module exceeds the set threshold. 3. The firmware upgrade method of industrial firewall according to claim 2, characterized in that: in step A, the data to be transmitted passes through the data processing modules connected in series successively, when the corresponding rule files in two adjacent data processing modules appear When it is determined that the data to be transmitted is illegal data, the transmission of the data to be transmitted is stopped. 4. The method for upgrading the firmware of an industrial firewall according to claim 3, wherein in step B, when the data to be transmitted is transmitted to the offline data processing module, the data to be transmitted is transmitted to the offline data processing module using a data transmission bypass. In the next data processing module adjacent to the data processing module, then obtain the data to be transmitted that is judged to be illegal by any one of the two online data processing modules adjacent to the offline data processing module, and extract the data to be transmitted The source IP address, source port, destination IP address, destination port and transmission protocol of the transmitted data are compared with the preset blacklist. If there is a successful comparison item, the transmission of the data to be transmitted is stopped. 5. The firmware upgrade method of industrial firewall according to claim 4, characterized in that: in step B, first carry out firmware data backup to the off-line data processing module, and then download the firmware upgrade file to upgrade the existing firmware. 6. The method for upgrading the firmware of an industrial firewall according to claim 5, wherein in step C, the digest data of the firmware is calculated, and the digest data is compared with the digital signature of the firmware for verification.

Images