CN111800343A - A speed limiting method and device suitable for industrial control Internet - Google Patents

Abstract

The invention relates to a speed-limiting method and a device suitable for industrial control Internet, belonging to the technical field of Internet speed limitation, wherein the method improves the traditional token bucket algorithm, sets a threshold value to process the condition of burst flow, consumes tokens in the threshold value and increases the speed-limiting grade by one grade if no token is available in the token bucket within a certain time, and forbids the flow to pass when the speed-limiting grade reaches a certain degree; however, when there are next tokens remaining in the token bucket, the rate limit level is adjusted downward. The insufficiency of the token bucket algorithm in handling the sudden increase of the flow can be effectively relieved, and the problem that the token bucket algorithm is poor in degree of dealing with the sudden flow is greatly relieved. The invention does not limit the speed of industrial control flow, only limits the speed of non-industrial control flow, is suitable for the safety protection of industrial control Internet, can properly and automatically adjust up and down the protocol analysis sequence, and reduces the time delay brought by the device to the industrial control protocol to the maximum extent.

Description

A speed limiting method and device suitable for industrial control Internet

technical field

The invention relates to a speed limiting method and device suitable for industrial control Internet, and belongs to the technical field of Internet speed limiting.

Background technique

With the continuous development of computer networks, the Internet has not only entered every household, but also made production more intelligent and convenient. However, for the industrial control Internet, the timeliness, accuracy and rapidity of the industrial control protocol are particularly important. However, the current speed limiting methods and devices limit the speed of all traffic, which seriously affects the timeliness, accuracy and speed of the industrial control Internet. It is not suitable for the industrial control Internet. How to ensure the fast and stable transmission of industrial control protocols and limit the speed of non-industrial control traffic is an urgent problem to be solved in the industrial control Internet.

The traditional token bucket algorithm is to limit the rate of non-industrial control traffic. The so-called token bucket algorithm is to preset a token bucket with a fixed size, and to generate tokens continuously every certain time; , all take the corresponding tokens from the bucket. If the number of tokens is less than the number of tokens to be deducted from the traffic packet, the traffic is not allowed to pass. However, the traditional token bucket algorithm cannot handle the surge in traffic.

SUMMARY OF THE INVENTION

In view of the deficiencies of the prior art, the present invention provides a speed limiting method and device suitable for industrial control Internet, improves the traditional token bucket algorithm, does not limit the speed of industrial control traffic, but only limits the speed of non-industrial control traffic, which is suitable for The security protection of the industrial control Internet, and can appropriately automatically increase and decrease the protocol parsing sequence, minimizing the delay caused by the device to the industrial control protocol.

The present invention adopts following technical scheme:

A speed limiting method suitable for industrial control Internet, comprising the following steps:

(1) Initialize the industrial control protocol, and judge whether the flow packet is an industrial control protocol, if it is an industrial control protocol, skip it, if it is a non-industrial control protocol, then further judge its destination ip and port to judge whether the flow packet meets the speed limit condition;

(2) If the traffic packet has a corresponding destination ip and port, it is further judged whether there is a condition with a source ip, and if both exist at the same time, the destination ip, port and source ip are the main ones;

(3) Judging whether to forward according to the improved token bucket algorithm, specifically: according to the number of tokens and the size of the flow packet to judge whether to forward the flow packet, if there is no token in the token bucket, judge according to the speed limit level Whether to forward or not, if the rate limit level does not reach the highest rate limit standard, the threshold token will be consumed, and the rate limit level will be increased by one level, and the traffic packet will be forwarded; if there are remaining tokens in the token bucket, forwarding will be performed, and Lower the speed limit by one level;

(4) When the speed limit level reaches the highest standard of speed limit, traffic packets will not be forwarded;

The speed limit level includes three levels, namely: release, alarm and block. The speed limit level is initialized to the release level. When there are no remaining tokens in the token bucket and the speed limit level is release, fill in the token bucket. 20% of the capacity, and then raise the level to alarm; when the token bucket rate limit level is alarm and the token consumption of the traffic packet to be forwarded is greater than the current remaining tokens, the level is raised to block, and all non-industrial control protocols are implemented. Do not forward processing.

When adding a new token to the token bucket, if it is a blocking level, only 80% of the token bucket is added, and the speed limit level is set to release; if it is an alarm mode, the filled 20% order is calculated according to the remaining tokens. card usage, remove an equal amount from the added tokens, and then set the speed limit level to pass.

Preferably, after the traffic packet is forwarded at Layer 2, it is judged according to step (1) whether it is an industrial control protocol, and the weight of the industrial control protocol type is fine-tuned. The industrial control protocol that has not passed the record is not analyzed, and the industrial control protocol with the largest number of passes is preferentially judged. .

Preferably, when judging the industrial control protocol in step (1), each time a traffic packet of an industrial control protocol is passed, the traffic packet is first parsed, the protocol type is analyzed, the protocol weight is recorded, and the priority of the industrial control protocol judgment is further adjusted. , adjust the parsing sequence, and no speed limit will be applied to industrial control protocols that are not recorded;

Parsing the industrial control protocol is an integrated framework for computing network traffic, capturing and grouping packets, which can automatically complete the functions of packet capture and packet grouping, and according to the content of the traffic packets, they are respectively put into the analysis portals of each level of the computer network: network layer, transmission Layer, application layer, etc., the type of industrial control protocol can be analyzed according to the layer of the computer network where the message is located, plus the key fields in the message.

The types of industrial control protocols that can be parsed include s7, s7plus, modbus, iec104, dnp3, opc and ams. At present, only 7 plug-ins are mounted, and it can be increased to 25, with good scalability;

The order of industrial control protocol analysis is initialized as: s7, s7plus, modbus, iec104, ams, dnp3 and opc, which are stored in an ordered list. If an opc protocol comes at this time, the weight of the opc protocol will increase by 1, and The left and right nodes compare and move their weights until a suitable position is found. Every ten minutes, the weights are recorded in the configuration file to ensure that when the device is restarted, it can operate according to the previous weights.

In the present invention, each time an industrial control protocol traffic packet is passed, the device will analyze the protocol type, thereby affecting the weight of the industrial control protocol, and further adjusting the priority of the industrial control protocol judgment. Without judgment, the time loss caused by the transmission to the industrial control protocol is minimized, and the accuracy and efficiency of the transmission of the industrial control protocol are greatly improved.

Preferably, for each non-industrial control protocol traffic packet that passes through, use the destination ip and port method to determine whether it needs speed limit, support Internet regionalized speed limit and device full port speed limit, after determining the destination ip of the traffic packet After the port and port belong to the rate-limiting queue, it is further judged whether there is a source ip, so as to more accurately limit the rate of traffic packets. The required tokens, if the remaining tokens in the token bucket are insufficient, the traffic packets will not be forwarded at Layer 2, so as to achieve the rate limiting effect;

If there is a limited queue of source IPs, use the destination IP, port and source IP to deduct the required tokens from the token bucket. If the remaining tokens in the token bucket are insufficient, the traffic packets will not be forwarded at Layer 2, so as to achieve the limit. quick effect.

Further preferably, the process of judging whether it belongs to the speed limit queue is:

Assuming that there are two existing devices A and B, the IPs are A (192.168.0.10) and B (192.168.0.20), and the two devices are connected through the device of the present invention;

At this point, there are six speed limit rules in the unit:

1.dest:192.168.0.20dport:*speed:20kb/s

(Any non-industrial control protocol sent to B has a speed limit of 20kb/s)

2.dest:192.168.0.20dport:60speed:50kb/s

(Any non-industrial control protocol sent to port 60 of machine B has a speed limit of 50kb/s)

3.dest:192.168.0.20dport:*source:192.168.0.10sport:*speed:30kb/s

(Any non-industrial control protocol sent from A to B has a speed limit of 30kb/s)

4.dest:192.168.0.20dport:*source:192.168.0.10sport:30speed:40kb/s

(Any non-industrial control protocol sent from port 30 of machine A to B has a speed limit of 40kb/s)

5.dest:192.168.0.20dport:60source:192.168.0.10sport:*speed:60kb/s

(Any non-industrial control protocol sent from A to port 60 of machine B has a speed limit of 60kb/s)

6.dest:192.168.0.20dport:60source:192.168.0.10sport:30speed:70kb/s

(Any non-industrial control protocol sent from port 30 of machine A to port 60 of machine B has a speed limit of 70kb/s)

① There is a non-industrial control protocol traffic packet sent from port 10000 of A to port 20000 of B:

The device will first determine whether its rate-limiting queue has a destination IP. Obviously, the destination IPs of rules 1-6 are all 192.168.0.20;

After that, it will continue to judge the destination port. 192.168.0.20 is the destination IP rule. The destination ports are 20, 30, 60 and *, of which 20, 30, and 60 are not satisfied. * means all ports and 20000 ports are satisfied; however, according to the figure As shown in 7, the destination port* also has a rule list and a rule, traversing the rule list finds that the source IP satisfies 192.168.0.10, and the source port satisfies the source port* in the detailed branch, so this traffic satisfies rules 1 and 3 at the same time , Rule No. 3 is more detailed than Rule No. 1, so rule No. 1 is abandoned, and the speed limit is carried out according to Rule No. 3.

② Then, another non-industrial control protocol traffic packet was sent from port 10000 of A to port 60 of B:

The device will still first determine whether the rate-limiting queue contains a rule whose destination IP is 192.168.0.20;

After that, the port number is judged, and it is found that both the destination port 60 and port * may have rules that meet the conditions;

At this time, the device will put the rule list of port * aside first, and prioritize the rule list of destination port 60;

It is found that in the rules of the destination port 60, the rules 2 and 5 are satisfied, and the rule 5 is more detailed than the rule 2, and the speed limit is performed according to the rule 5.

③ A traffic packet that satisfies the following 6 rules at the same time:

An existing non-industrial control protocol traffic packet is sent from port 30 of A to port 60 of B, and 6 rules are satisfied at the same time. The most detailed rule is rule 6, so the speed limit processing is performed according to rule 6.

The rules of the present invention are preferentially summarized:

1. The weight of rules with source IP is greater than that without source IP;

2. The explicit port number has more weight than *port;

3. If you encounter 4 and 5 of the above 6 rules, rule 5 with a clear destination port number will be matched first;

The rule priority can also be divided into six cases from low to high:

a. Destination IP + any destination port:

b. Destination IP + destination port:

c. Destination IP + any destination port + source IP + any source port:

d. Destination IP + any destination port + source IP + source port:

e. Destination IP + destination port + source IP + any source port;

f. Destination IP + destination port + source IP + source port.

Preferably, for the disadvantage that the traditional token bucket algorithm cannot handle outstanding traffic, the improved token bucket algorithm of the present invention is set with a threshold and a speed limit level. When there are no tokens to consume, increase the speed limit level by one level, and pour the tokens in the threshold into the token bucket to continue processing; when the speed limit level reaches a certain level (that is, the maximum speed limit level), stop Layer 2 forwarding of traffic packets to achieve the purpose of rate limiting; if there are tokens in the token bucket that can be consumed at the next moment (that is, when there are remaining tokens), it means that the burst traffic period has passed, and the rate will be limited The level is gradually lowered, which greatly alleviates the drawback that the token bucket algorithm cannot cope with burst traffic.

Aiming at the situation that the traditional token bucket algorithm cannot handle the sudden increase of traffic, the present invention improves the token bucket algorithm (namely the improved token bucket algorithm of the present invention), and sets a threshold to handle the situation of burst traffic. Within a certain period of time, if there are no tokens available in the token bucket, the tokens in the threshold will be consumed, and the speed limit level will be raised by one level. When the speed limit level reaches a certain level, traffic will be prohibited from passing. However, when there are remaining tokens in the token bucket, the rate limit level is lowered, which can effectively alleviate the insufficiency of the token bucket algorithm in handling the surge in traffic.

In the improved token bucket algorithm, the invention increases the judgment of industrial control protocol traffic, and for the analysis of various industrial control protocols such as s7, s7plus, etc., it does not limit the speed of industrial control traffic, but only limits the speed of non-industrial control traffic, which is suitable for industrial control. Internet security protection, and will parse and record the types of traffic that pass through, and automatically adjust the protocol parsing order appropriately. The industrial control protocol that has not passed the record will not be parsed, minimizing the delay caused by the device to the industrial control protocol. Time.

A speed limiting device suitable for industrial control Internet, including source equipment, router and destination equipment, and the router includes:

The industrial control protocol analysis module is used to determine whether the traffic packet is an industrial control protocol;

Matching speed limit module, used to judge whether the traffic packet meets the speed limit condition;

The improved token bucket algorithm module is used to judge whether traffic packets need to be forwarded through the improved token bucket algorithm;

The forwarding traffic packet module is used to forward traffic packets that conform to the standard;

Adjust the protocol parsing module, which is used to judge whether the weight and priority of industrial control protocol parsing need to be adjusted.

In the present invention, first, the source device first sends a traffic packet to the destination device, and the traffic packet is forwarded to the destination device through the router.

The router judges the traffic packets as follows:

1. Whether the traffic packet is an industrial control protocol;

2. Whether the traffic packet meets the speed limit conditions;

3. Determine whether to forward traffic packets according to the improved token bucket algorithm;

4. Whether the weight and priority of industrial control protocol analysis need to be adjusted.

When judging the industrial control protocol, initialize it first, and judge the s7 and s7plus protocols in order. If an industrial control protocol is encountered, skip it and go to the next step.

Preferably, when judging by the industrial control protocol parsing module, each time a traffic packet of an industrial control protocol is passed, it first parses the traffic packet, parses the protocol type, records the protocol weight, and further adjusts the priority of the industrial control protocol judgment, and adjusts the parsing. Sequentially, the undocumented industrial control protocol does not limit the speed.

Preferably, for each non-industrial control protocol traffic packet that passes through, use the destination ip and port to determine whether it needs speed limiting, and after determining that the destination ip and port of the traffic packet belong to the speed limiting queue, further determine whether there is a source ip, if there is no rate-limiting queue for the source ip, the required token is deducted from the token bucket using the criteria of the destination ip and port. If the remaining tokens in the token bucket are insufficient, the traffic packet will not be forwarded at Layer 2, thus achieve the speed limit effect;

If there is a limited queue of source IPs, use the destination IP, port and source IP to deduct the required tokens from the token bucket. If the remaining tokens in the token bucket are insufficient, the traffic packets will not be forwarded at Layer 2, so as to achieve the limit. quick effect.

Preferably, a threshold and a speed limit level are set in the improved token bucket algorithm module. When the current traffic exceeds the set speed, that is, when there are no tokens to consume in the token bucket, the speed limit level is increased by one. When the speed limit level reaches a certain level (that is, the maximum speed limit level), the Layer 2 forwarding of traffic packets is stopped, so as to achieve the purpose of speed limit; If at the next moment, there are tokens in the token bucket that can be consumed (that is, when there are remaining tokens), it means that the burst traffic period has passed, and the speed limit level is gradually lowered.

The speed limit of Internet traffic is realized through Layer 2 forwarding. Suppose there is a traffic packet, which is sent from the source device to the destination device, through the router in the middle, and the router will judge whether the traffic packet is an industrial control protocol according to the conditions and whether it reaches the speed limit condition. , whether the token bucket has remaining tokens to decide whether to forward it or discard it.

For a flow packet, first judge seven industrial control protocols. The seven industrial control protocols include s7, s7plus, modbus, iec104, dnp3, opc and ams. The judgment priority of the industrial control protocol is automatically fine-tuned, and the delay of the transmission of the industrial control protocol is minimized to the greatest extent, and the accuracy and efficiency of the transmission of the industrial control protocol are further improved.

For a traffic packet of a non-industrial control protocol, the destination ip+port is used as the most important key value, and the source ip is used as the auxiliary key value to accurately limit the speed between devices, not only to limit the flow rate of traffic packets. size, you can also limit the number of traffic packets.

For the drawbacks of the token bucket algorithm for traffic rate limiting, the device sets a threshold and limit level to greatly alleviate the problem that the token bucket algorithm can deal with the poor degree of burst traffic.

The method and device of the present invention support the Linux platform, can effectively ensure that the industrial control Internet filters out unnecessary complicated traffic, make the industrial control protocol more quickly, accurately, and transmit to the corresponding equipment with low delay, and is suitable for the industrial control of small and medium-sized production enterprises. Internet security protection.

The device of the present invention parses the protocol passing through the traffic packets, matches the rate-limiting queue, and then uses the improved token bucket algorithm to greatly alleviate the disadvantage that the traditional token bucket algorithm cannot handle the sudden surge of traffic, thereby realizing a The speed limiting method and device suitable for the industrial Internet can greatly reduce the cumbersome traffic in the industrial control Internet of industrial production enterprises, and make the transmission and transmission of industrial control protocol traffic packets more convenient, fast, and low-latency.

In the present invention, the existing technology can be used for the places that are not detailed.

The beneficial effects of the present invention are:

1) The present invention improves the traditional token bucket algorithm, and sets a threshold to deal with the situation of burst traffic. In a certain period of time, if there is no token available in the token bucket, the token in the threshold will be consumed. , and increase the speed limit level by one level. When the speed limit level reaches a certain level, traffic is prohibited from passing; however, when there are remaining tokens in the token bucket, the speed limit level is lowered. It can effectively alleviate the insufficiency of the token bucket algorithm in dealing with the sudden increase in traffic, and greatly alleviate the problem that the token bucket algorithm can deal with the poor degree of burst traffic.

2) The present invention does not limit the speed of industrial control traffic, but only limits the speed of non-industrial control traffic, which is suitable for the security protection of the industrial control Internet, and can appropriately automatically increase and decrease the protocol parsing sequence, and minimize the burden of the device on the industrial control protocol. come delay.

3) The present invention greatly reduces numerous cumbersome traffic in the industrial control Internet, and makes the transmission and transmission of industrial control protocol traffic packets more convenient, fast and low-latency. In addition, on this basis, the adjustment of the parsing sequence of the industrial control protocol is added, so that the time-consuming of traffic packets from parsing to Layer 2 forwarding is less, and it is more suitable for the principle of accurate and fast delivery of industrial control protocols.

The invention not only has the matching priority of automatic adjustment to the industrial control protocol, but the improved token bucket algorithm can also respond to the sudden traffic situation in the network, which greatly relieves the traditional token bucket algorithm when it encounters sudden large traffic. The negative impact brought by it ensures the smooth communication, which can effectively limit unnecessary traffic for industrial control production enterprises, transmit industrial control protocols more efficiently for industrial control production enterprises, limit speed testing for small and medium-sized enterprises and scientific research institutions, and provide network shooting range. Provide support for the protection of industrial control protocols.

Description of drawings

Fig. 1 is the flow chart of the speed limiting method applicable to the industrial control Internet of the present invention;

2 is a schematic diagram of a control protocol judgment process according to an embodiment of the present invention;

3 is a schematic diagram of a speed limiting process according to an embodiment of the present invention;

4 is a schematic diagram of an improved token bucket algorithm according to an embodiment of the present invention;

5 is a schematic structural diagram of a speed limiting device suitable for industrial control Internet according to an embodiment of the present invention;

6 is a schematic diagram of a router composition structure according to an embodiment of the present invention;

7 is a storage structure diagram of six speed limit rules according to Embodiment 2 of the present invention;

8 is a schematic structural diagram of four devices A, B, C, and D according to Embodiment 4 of the present invention;

9 is a schematic diagram of an S7COMM message according to Embodiment 4 of the present invention;

FIG. 10 is a schematic diagram of a message of an SSH protocol according to Embodiment 4 of the present invention.

Detailed ways:

In order to make the technical problems, technical solutions and advantages to be solved by the present invention clearer, the following will be described in detail in conjunction with the accompanying drawings and specific embodiments, but not limited to this, the present invention is not described in detail, all according to the conventional technology in the art.

Example 1:

A speed limit method suitable for industrial control Internet, as shown in Figure 1-4, includes the following steps:

(1) Initialize the industrial control protocol, and judge whether the flow packet is an industrial control protocol, if it is an industrial control protocol, skip it, if it is a non-industrial control protocol, then further judge its destination ip and port to judge whether the flow packet meets the speed limit condition;

(2) If the traffic packet has a corresponding destination ip and port, it is further judged whether there is a condition with a source ip, and if both exist at the same time, the destination ip, port and source ip are the main ones;

(3) Judging whether to forward according to the improved token bucket algorithm, specifically: according to the number of tokens and the size of the flow packet to judge whether to forward the flow packet, if there is no token in the token bucket, judge according to the speed limit level Whether to forward or not, if the rate limit level does not reach the highest rate limit standard, the threshold token will be consumed, and the rate limit level will be increased by one level, and the traffic packet will be forwarded; if there are remaining tokens in the token bucket, forwarding will be performed, and Lower the speed limit by one level;

(4) When the speed limit level reaches the highest standard of speed limit, traffic packets will not be forwarded;

The speed limit level includes three levels, namely: release, alarm and block. The speed limit level is initialized to the release level. When there are no remaining tokens in the token bucket and the speed limit level is release, fill in the token bucket. 20% of the capacity, and then raise the level to alarm; when the token bucket rate limit level is alarm and the token consumption of the traffic packet to be forwarded is greater than the current remaining tokens, the level is raised to block, and all non-industrial control protocols are implemented. Do not forward processing.

When adding a new token to the token bucket, if it is a blocking level, only 80% of the token bucket will be added, and the speed limit level will be set to release; if it is an alarm mode, the 20% order will be calculated according to the remaining tokens. card usage, remove an equal amount from the added tokens, and then set the speed limit level to pass.

After the traffic packet is forwarded at Layer 2, it is judged according to step (1) whether it is an industrial control protocol, and the weight of the industrial control protocol type is fine-tuned. The industrial control protocol that has not passed the record will not be parsed, and the industrial control protocol with the largest number of passed is given priority.

When judging the industrial control protocol in step (1), each time a traffic packet of an industrial control protocol passes, first parse the traffic packet, analyze the protocol type, record the protocol weight, and further adjust the priority of the industrial control protocol judgment, and adjust the analysis. order, no speed limit is applied to industrial control protocols that are not recorded;

Parse the industrial control protocol and calculate the network traffic capture and packet integration framework, which can automatically complete the function of packet capture and packet grouping, and according to the content of the traffic packet, it will be put into the analysis portal of each level of the computer network: network layer, transport layer , application layer, etc., the type of industrial control protocol can be parsed according to the layer of the computer network where the message is located, plus the key fields in the message.

The types of industrial control protocols that can be parsed include s7, s7plus, modbus, iec104, dnp3, opc and ams. At present, only 7 plug-ins are mounted, and it can be increased to 25, with good scalability;

The order of industrial control protocol analysis is initialized as: s7, s7plus, modbus, iec104, ams, dnp3 and opc, which are stored in an ordered list. If an opc protocol comes at this time, the weight of the opc protocol will increase by 1, and The left and right nodes compare and move their weights until a suitable position is found. Every ten minutes, the weights are recorded in the configuration file to ensure that when the device is restarted, it can operate according to the previous weights.

In the present invention, each time an industrial control protocol traffic packet is passed, the device will analyze the protocol type, thereby affecting the weight of the industrial control protocol, and further adjusting the priority of the industrial control protocol judgment. Without judgment, the time loss caused by the transmission to the industrial control protocol is minimized, and the accuracy and efficiency of the transmission of the industrial control protocol are greatly improved.

Example 2:

A speed-limiting method applicable to the industrial control Internet is different from that described in Embodiment 1. For each non-industrial control protocol traffic packet that passes through, the destination ip and port are used to determine whether it needs speed-limiting, Support Internet regionalized speed limit and device port speed limit. After confirming that the destination IP and port of the traffic packet belong to the speed limit queue, it is further judged whether there is a source IP, so as to more accurately limit the speed of the traffic packet. If there is no source IP If there is not enough remaining tokens in the token bucket, the traffic packet will not be forwarded at Layer 2, so as to achieve the effect of speed limiting;

If there is a limited queue of source IPs, use the destination IP, port and source IP to deduct the required tokens from the token bucket. If the remaining tokens in the token bucket are insufficient, the traffic packets will not be forwarded at Layer 2, so as to achieve the limit. quick effect.

The process of judging whether it belongs to the speed limit queue is as follows:

Assuming that there are two existing devices A and B, the IPs are A (192.168.0.10) and B (192.168.0.20), and the two devices are connected through the device of the present invention;

At this time, there are six speed limit rules in the device (the storage structure is shown in Figure 7):

1.dest:192.168.0.20dport:*speed:20kb/s

(Any non-industrial control protocol sent to B has a speed limit of 20kb/s)

2.dest:192.168.0.20dport:60speed:50kb/s

(Any non-industrial control protocol sent to port 60 of machine B has a speed limit of 50kb/s)

3.dest:192.168.0.20dport:*source:192.168.0.10sport:*speed:30kb/s

(Any non-industrial control protocol sent from A to B has a speed limit of 30kb/s)

4.dest:192.168.0.20dport:*source:192.168.0.10sport:30speed:40kb/s

(Any non-industrial control protocol sent from port 30 of machine A to B has a speed limit of 40kb/s)

5.dest:192.168.0.20dport:60source:192.168.0.10sport:*speed:60kb/s

(Any non-industrial control protocol sent from A to port 60 of machine B has a speed limit of 60kb/s)

6.dest:192.168.0.20dport:60source:192.168.0.10sport:30speed:70kb/s

(Any non-industrial control protocol sent from port 30 of machine A to port 60 of machine B has a speed limit of 70kb/s)

① There is a non-industrial control protocol traffic packet sent from port 10000 of A to port 20000 of B:

The device will first determine whether its rate-limiting queue has a destination IP. Obviously, the destination IPs of rules 1-6 are all 192.168.0.20;

After that, it will continue to judge the destination port. 192.168.0.20 is the destination IP rule. The destination ports are 20, 30, 60 and *, of which 20, 30, and 60 are not satisfied. * means all ports and 20000 ports are satisfied; however, according to the figure As shown in 7, the destination port* also has a rule list and a rule, traversing the rule list finds that the source IP satisfies 192.168.0.10, and the source port satisfies the source port* in the detailed branch, so this traffic satisfies rules 1 and 3 at the same time , Rule No. 3 is more detailed than Rule No. 1, so rule No. 1 is abandoned, and the speed limit is carried out according to Rule No. 3.

② Then, another non-industrial control protocol traffic packet was sent from port 10000 of A to port 60 of B:

The device will still first determine whether the rate-limiting queue contains a rule whose destination IP is 192.168.0.20;

After that, the port number is judged, and it is found that both the destination port 60 and port * may have rules that meet the conditions;

At this time, the device will put the rule list of port * aside first, and prioritize the rule list of destination port 60;

It is found that in the rules of the destination port 60, the rules 2 and 5 are satisfied, and the rule 5 is more detailed than the rule 2, and the speed limit is performed according to the rule 5.

③ A traffic packet that satisfies the following 6 rules at the same time:

An existing non-industrial control protocol traffic packet is sent from port 30 of A to port 60 of B, and 6 rules are satisfied at the same time. The most detailed rule is rule 6, so the speed limit processing is performed according to rule 6.

The rules of the present invention are preferentially summarized:

1. The weight of rules with source IP is greater than that without source IP;

2. The explicit port number has more weight than *port;

3. If you encounter 4 and 5 of the above 6 rules, rule 5 with a clear destination port number will be matched first;

The rule priority can also be divided into six cases from low to high:

a. Destination IP + any destination port:

b. Destination IP + destination port:

c. Destination IP + any destination port + source IP + any source port:

d. Destination IP + any destination port + source IP + source port:

e. Destination IP + destination port + source IP + any source port;

f. Destination IP + destination port + source IP + source port.

For the disadvantage that the traditional token bucket algorithm cannot handle outstanding traffic, the improved token bucket algorithm of the present invention is set with a threshold value and a speed limit level. When the current traffic exceeds the set speed, that is, there is no order in the token bucket When the card can be consumed, increase the speed limit level by one level, and pour the tokens in the threshold into the token bucket to continue processing; when the speed limit level reaches a certain level (that is, the maximum speed limit level), stop the traffic packet If there are tokens in the token bucket that can be consumed at the next moment (that is, when there are remaining tokens), it means that the burst traffic period has passed, and the speed limit level will be gradually lowered. , which greatly alleviates the disadvantage that the token bucket algorithm cannot cope with burst traffic.

Aiming at the situation that the traditional token bucket algorithm cannot handle the sudden increase of traffic, the present invention improves the token bucket algorithm (namely the improved token bucket algorithm of the present invention), and sets a threshold to handle the situation of burst traffic. Within a certain period of time, if there are no tokens available in the token bucket, the tokens in the threshold will be consumed, and the speed limit level will be raised by one level. When the speed limit level reaches a certain level, traffic will be prohibited from passing. However, when there are remaining tokens in the token bucket, the rate limit level is lowered, which can effectively alleviate the insufficiency of the token bucket algorithm in handling the surge in traffic.

In the improved token bucket algorithm, the invention increases the judgment of industrial control protocol traffic, and for the analysis of various industrial control protocols such as s7, s7plus, etc., it does not limit the speed of industrial control traffic, but only limits the speed of non-industrial control traffic, which is suitable for industrial control. Internet security protection, and will parse and record the types of traffic that pass through, and automatically adjust the protocol parsing order appropriately. The industrial control protocol that has not passed the record will not be parsed, minimizing the delay caused by the device to the industrial control protocol. Time.

Example 3:

A speed limiting device suitable for industrial control Internet, as shown in Figure 5, includes a source device, a router and a destination device, and the router includes:

The industrial control protocol analysis module is used to determine whether the traffic packet is an industrial control protocol;

Matching speed limit module, used to judge whether the traffic packet meets the speed limit condition;

The improved token bucket algorithm module is used to judge whether traffic packets need to be forwarded through the improved token bucket algorithm;

The forwarding traffic packet module is used to forward traffic packets that conform to the standard;

Adjust the protocol parsing module, which is used to judge whether the weight and priority of industrial control protocol parsing need to be adjusted.

In the present invention, first, the source device first sends a traffic packet to the destination device, and the traffic packet is forwarded to the destination device through the router.

The router judges the traffic packets as follows:

1. Whether the traffic packet is an industrial control protocol;

2. Whether the traffic packet meets the speed limit conditions;

3. Determine whether to forward traffic packets according to the improved token bucket algorithm;

4. Whether the weight and priority of industrial control protocol analysis need to be adjusted.

When judging the industrial control protocol, initialize it first, and judge the s7 and s7plus protocols in order. If an industrial control protocol is encountered, skip it and go to the next step.

When judging by the industrial control protocol parsing module, each time a traffic packet of an industrial control protocol is passed, it first parses the traffic packet, parses the protocol type, records the protocol weight, and further adjusts the priority of the industrial control protocol judgment, and adjusts the parsing sequence. The recorded industrial control protocol does not limit the speed.

For each non-industrial control protocol traffic packet that passes through, the destination ip and port are used to determine whether it needs rate limiting. After determining that the destination ip and port of the traffic packet belong to the rate limiting queue, it is further judged whether there is a source ip, if If there is no rate-limiting queue for the source IP, the required tokens are deducted from the token bucket using the criteria of the destination IP and port. If the remaining tokens in the token bucket are insufficient, the traffic packets will not be forwarded at Layer 2 to achieve the rate limit. Effect;

If there is a limited queue of source IPs, use the destination IP, port and source IP to deduct the required tokens from the token bucket. If the remaining tokens in the token bucket are insufficient, the traffic packets will not be forwarded at Layer 2, so as to achieve the limit. quick effect.

The improved token bucket algorithm module is set with a threshold and a speed limit level. When the traffic at this time exceeds the set speed, that is, when there are no tokens to consume in the token bucket, the speed limit level will be increased by one level, and Pour the tokens in the threshold into the token bucket and continue processing; when the speed limit level reaches a certain level (that is, the maximum speed limit level), stop the Layer 2 forwarding of traffic packets, so as to achieve the purpose of speed limit; At the moment, there are tokens in the token bucket that can be consumed (that is, when there are remaining tokens), it means that the burst traffic period has passed, and the speed limit level is gradually lowered.

Example 4:

A speed limiting device suitable for industrial control Internet, as shown in Figure 8, assuming that the existing four devices are A, B, C, and D respectively, the IP of A is: 192.168.1.10; the IP of B is: 192.168.1.20 ; C's IP is 192.168.1.135; D's IP is 192.168.1.157, and the four devices are connected through a speed limiting device. When the speed limiter is running, the number of token buckets is related to the speed limit (usually b), and the speed limit level is initialized to the release level.

At this point, there are two rules in the device:

1.dest:192.168.1.135dport:*source:192.168.1.157sport:*speed:10kb/s

(Any non-industrial control protocol sent from A to B has a speed limit of 10kb/s)

2.dest:192.168.1.157dport:*source:192.168.1.135sport:*speed:10kb/s

(Any non-industrial control protocol sent from A to B has a speed limit of 10kb/s)

1) Now a S7COMM message is received, as shown in Figure 9, S7COMM is transmitted based on tcp, and the industrial control protocol analysis module in the device starts first, uses the integrated framework of packet capture and grouping, and throws it to the tcp interface, and then According to the keyword of the message and the computer network layer, the type of the message is judged.

When the device starts, the parsing sequence of the industrial control protocol is initialized, and the industrial control protocol is matched according to the order of s7, s7plus, modbus, iec104, ams, dnp3 and opc, and the protocol analysis of s7 is performed first, and it is found that the message is the s7comm protocol. Packets are released unconditionally and forwarded at Layer 2.

Then the weight of the s7 protocol is increased by 1, and compared with the weight of the left protocol, it is found that it is already on the far left and cannot be moved left.

Because the industrial control protocol is passed, no processing is performed on the token bucket and the speed limit level.

2) Next, an SSH protocol message is received, as shown in Figure 10: SSH protocol is transmitted based on tcp, and the industrial control protocol parsing module in the device starts first, uses the integrated framework of packet capture and grouping, and throws it to tcp Interface. Then according to the keyword of the message and the computer network layer to judge the type of the message.

When the device starts, the parsing sequence of the industrial control protocol is initialized, and the industrial control protocol is matched and parsed in the order of s7, s7plus, modbus, iec104, ams, dnp3 and opc. First analyze the industrial control protocol, and find that the message is a non-industrial control protocol. Afterwards, the device performs rate-limiting queue matching on the packet.

It can be seen from the message in Figure 10 that the message is sent from 192.168.1.135:22 to 192.168.1.157:3363;

The destination IP is 192.168.1.157, the destination port is 3363, the source IP is 192.168.1.135, and the source port is 22, which satisfies rule 2, so rate limiting processing is performed.

Then judge the remaining tokens in the token bucket. Since the first pass is an industrial control protocol and does not consume tokens, the token bucket is still full at this time, the speed limit condition is 10kb/s, there are 10240 (10kb=10240b) tokens in the token bucket, and this The packet length is 1460. It is allowed to pass, and the remaining tokens are 10240-1460=8780. Forward the message. Speed limit level at this time: release.

3) After passing through several SSH packets, the token bucket gradually loses tokens, and only 5 tokens remain. At this time, another SSH packet is still sent, and it is found that it is not an industrial control protocol and complies with rule 2. , to limit the speed. At this time, there are only 5 tokens left in the token bucket, and the packets that do not meet the length of 1460 are allowed to pass, and the speed limit level of the device is judged to be released, the packets are forwarded, and the remaining tokens are cleared to 0. Then fill in 20% tokens (2048 tokens) of the token bucket, and the speed limit level is raised to alarm. Now there are 2048 tokens remaining, and the speed limit level is: alarm.

4) At this time, another SSH message came, and it was found that it was not an industrial control protocol and complied with rule 2, and the speed limit judgment was performed.

At this time, there are only 2048 tokens left in the token bucket. After deducting the 1460 required for the packet to pass through, the packet is forwarded. At this time, there are 588 tokens remaining, and the rate limit level is: alarm.

5) Finally, another SSH message came, and it was found that it was not an industrial control protocol and complied with rule 2, and a speed limit judgment was required.

If the length of the remaining packets does not meet the length of 1460, it is judged that the rate limit level of the device at this time is an alarm, then all tokens in the token bucket are removed, and the rate limit level is raised to blocking, blocking this packet and the following rules. 2 all messages.

The rate limiting device refreshes the token bucket every second, filling the token bucket with new tokens.

If the speed limit level of the device is release at this time, the token bucket is refreshed.

If the speed limit level of the device is alarm at this time, the added tokens will be deducted according to the number of remaining tokens. For example, in the alarm mode of the above situation, the speed limit is 10kb/s, the token bucket capacity is 10240, and there are 588 tokens remaining, indicating that the added 20% token bucket (2048) uses 1460 tokens, then the multi-purpose tokens are deducted. Just add the rest to the token bucket (add 2048-1460=588);

If the speed limit level of the device is blocking at this time, it means that not only the tokens in the 20% token bucket added in the alarm mode are used more, but also the remaining traffic packets are blocked, and 80% tokens are added to the token bucket. Adjust the speed limit level to the release level.

The above are the preferred embodiments of the present invention. It should be pointed out that for those skilled in the art, without departing from the principles of the present invention, several improvements and modifications can be made. It should be regarded as the protection scope of the present invention.

Claims (10)

1. A speed limiting method suitable for an industrial control Internet is characterized by comprising the following steps:

(1) initializing an industrial control protocol, judging whether a flow packet is the industrial control protocol, skipping if the flow packet is the industrial control protocol, and further judging whether a destination ip and a port of the flow packet meet a speed limit condition if the flow packet is a non-industrial control protocol;

(2) if the flow packet has a corresponding destination ip and a corresponding port, further judging whether a condition with a source ip exists, and if the condition with the source ip exists, mainly using the destination ip, the port and the source ip;

(3) judging whether to forward according to an improved token bucket algorithm, specifically: judging whether to forward the flow packet according to the number of tokens and the size of the flow packet, if no token exists in the token bucket, judging whether to forward according to the speed limit level, if the speed limit level does not reach the highest standard of the speed limit, consuming the tokens of a threshold value, and increasing the speed limit level by one level to forward the flow packet; if the token bucket has residual tokens, forwarding and reducing the speed limit level by one level;

(4) when the speed limit grade reaches the highest standard of the speed limit, the flow packet is not forwarded;

the speed limit grades comprise three grades which are respectively as follows: releasing, alarming and blocking, wherein the speed limit level is initialized to the releasing level, when no token remains in the token bucket and the speed limit level is releasing, 20% of the capacity of the token bucket is filled, and then the level is promoted to be alarming; when the speed limit level of the token bucket is alarming and the token consumed by the flow packet to be forwarded is larger than the current remaining tokens, the level is promoted to be blocked, and all non-industrial control protocols are not forwarded;

when a new token is added to the token bucket, if the token bucket is a blocking level, only 80% of the token bucket is added, and the speed limit level is set to be released; if the token is in the alarm mode, the use condition of 20% of the filled tokens is calculated according to the rest tokens, equal quantity is removed from the added tokens, and then the speed limit grade is set to be released.

2. The method for limiting speed of industrial control internet according to claim 1, wherein after the traffic packet is forwarded in two layers, it is determined whether the traffic packet is an industrial control protocol according to step (1), the weight of the type of the industrial control protocol is finely adjusted, the recorded industrial control protocol is not analyzed, and the industrial control protocol with the largest number of traffic packets is preferentially determined.

3. The method for limiting speed of industrial control internet according to claim 2, wherein in the step (1), when the industrial control protocol is judged, each flow packet of the industrial control protocol passes through, the flow packet is analyzed first, the protocol type is analyzed, the protocol weight is recorded, the priority of the industrial control protocol judgment is further adjusted, the analysis sequence is adjusted, and the industrial control protocol which is not recorded does not limit speed;

the sequence of industrial control protocol analysis is initialized as follows: s7, s7plus, modbus, iec104, ams, dnp3 and opc are stored in an ordered list, and if an opc protocol comes in at the moment, the weight of the opc protocol is added with 1, and the weight comparison and the shifting are carried out on the left and right nodes until a proper position is found, and the weight is recorded into a configuration file every ten minutes, so that the device can operate according to the previous weight when being restarted.

4. The speed-limiting method suitable for the industrial control internet according to claim 3, characterized in that for each traffic packet passing through the non-industrial control protocol, whether the traffic packet needs speed limiting is determined by adopting a destination ip and port mode, internet regionalization speed limiting and equipment full-port speed limiting are supported, after the destination ip and the port of the traffic packet are determined to belong to a speed-limiting queue, whether a source ip exists is further judged, so that the speed limiting of the traffic packet is more accurately performed, if the speed-limiting queue of the source ip does not exist, the required tokens are deducted from the token bucket by using the standards of the destination ip and the port, if the remaining tokens of the token bucket are insufficient, the traffic packet is not forwarded by two layers, so that the speed-limiting effect is achieved;

if the limit queue of the source ip exists, the destination ip, the port and the source ip are used for deducting the required tokens from the token bucket, if the token bucket has insufficient remaining tokens, the flow packet is not forwarded in two layers, and therefore the speed limiting effect is achieved.

5. The speed limiting method suitable for the industrial control internet as claimed in claim 4, wherein the process of judging whether the speed limiting queue belongs to is as follows:

assume that there are two devices a and B, IP: a is 192.168.0.10, B is 192.168.0.20, two pieces of apparatus link up through the speed limiting device of the invention;

at this time, the device has the following six speed-limiting rules:

1.dest:192.168.0.20dport:*speed:20kb/s

2.dest:192.168.0.20dport:60speed:50kb/s

3.dest:192.168.0.20dport:*source:192.168.0.10sport:*speed:30kb/s

4.dest:192.168.0.20dport:*source:192.168.0.10sport:30speed:40kb/s

5.dest:192.168.0.20dport:60source:192.168.0.10sport:*speed:60kb/s

6.dest:192.168.0.20dport:60source:192.168.0.10sport:30speed:70kb/s

firstly, a non-industrial control protocol traffic packet is sent from 10000 ports of A to 20000 ports of B:

the device will judge whether the destination IP is in the speed-limited queue or not, obviously, the destination IP of the No. 1-6 rule is 192.168.0.20;

then, the destination port is further judged, 192.168.0.20 is the rule of the destination IP, and the destination ports have 20, 30, 60 and x, wherein 20, 30 and 60 are not satisfied, which means that all the ports satisfy 20000 ports; however, the destination port has a rule list and a rule, and the rule list is traversed to find that the source IP meets 192.168.0.10, and the source port meets the source port in the detailed branch, so that the flow simultaneously meets the rules 1 and 3, and the rule 3 is more detailed than the rule 1, so that the rule 1 is abandoned, and the speed is limited according to the rule 3;

secondly, a non-industrial control protocol traffic packet is sent from 10000 ports of A to 60 ports of B:

the device still judges whether the speed limit queue contains the rule with the destination IP of 192.168.0.20 or not;

then, the port number is further judged, and the fact that the target port 60 and the port have rules which meet the conditions possibly is found;

at this time, the device will put the rule list of the port to one side first, and preferentially judge the rule list of the destination port 60;

it is found that, among the rules of the destination port 60, the rule No. 2 and the rule No. 5 are satisfied, and the rule No. 5 is more detailed than the rule No. 2, and the speed is limited according to the rule No. 5;

flow packets of 6 rules that are satisfied simultaneously:

the existing non-industrial control protocol flow packet is sent from a 30 port of A to a 60 port of B and simultaneously meets 6 rules, and the most detailed rule is a No. 6 rule, so that the speed limit processing is carried out according to the No. 6 rule;

the rule priority of the invention is divided into the following six cases from low to high:

a. destination IP + any destination port;

b. destination IP + destination port;

c. destination IP + any destination port + source IP + any source port;

d. destination IP + any destination port + source IP + source port;

e. destination IP + destination port + source IP + arbitrary source port;

f. destination IP + destination port + source IP + source port.

6. The speed limit method suitable for the industrial control internet as claimed in claim 5, wherein the improved token bucket algorithm is provided with a threshold value and a speed limit grade, when the flow at the moment exceeds the set speed, namely when no token can be consumed in the token bucket, the speed limit grade is raised by one grade, and the token in the threshold value is poured into the token bucket for continuous processing; when the speed limit grade reaches the highest speed limit degree, stopping the two-layer forwarding of the flow packet, thereby achieving the purpose of speed limit; if the tokens in the token bucket can be consumed at the next moment, namely when the tokens remain, the situation that the burst flow time period is over is shown, and the speed limit level is gradually adjusted downwards.

7. The utility model provides a speed limiting device suitable for industry control internet which characterized in that, includes source equipment, router and purpose equipment, the router includes:

the industrial control protocol analysis module is used for judging whether the flow packet is an industrial control protocol or not;

the matching speed limit module is used for judging whether the flow packet meets the speed limit condition or not;

the improved token bucket algorithm module is used for judging whether the flow packet needs to be forwarded or not through an improved token bucket algorithm;

a forwarding flow packet module for forwarding the flow packet meeting the standard;

and the adjustment protocol analysis module is used for judging whether the weight and the priority degree of the industrial control protocol analysis need to be adjusted.

8. The device for limiting speed applicable to industrial control internet according to claim 7, wherein when the industrial control protocol analysis module performs the determination, each time a flow packet of an industrial control protocol passes through, the flow packet is analyzed first, the protocol type is analyzed, the protocol weight is recorded, the priority level of the industrial control protocol determination is further adjusted, the analysis sequence is adjusted, and no speed limitation is performed on the industrial control protocol that is not recorded.

9. The speed limiting device applicable to the industrial control internet as claimed in claim 8, wherein for each traffic packet passing through the non-industrial control protocol, whether the traffic packet needs speed limiting is determined by adopting a destination ip and port mode, after the destination ip and port of the traffic packet are determined to belong to a speed limiting queue, whether a source ip exists is further determined, if no source ip speed limiting queue exists, the required tokens are deducted from the token bucket by using the standards of the destination ip and port, and if the remaining tokens in the token bucket are insufficient, the traffic packet is not subjected to two-layer forwarding, so that the speed limiting effect is achieved;

if the limit queue of the source ip exists, the destination ip, the port and the source ip are used for deducting the required tokens from the token bucket, if the token bucket has insufficient remaining tokens, the flow packet is not forwarded in two layers, and therefore the speed limiting effect is achieved.

10. The speed limiting device suitable for the industrial control internet as claimed in claim 9, wherein the improved token bucket algorithm module is provided with a threshold and a speed limiting grade, when the flow at this time exceeds a set speed, that is, when no token can be consumed in the token bucket, the speed limiting grade is raised by one level, and the token in the threshold is poured into the token bucket for further processing; when the speed limit grade reaches a certain degree, namely the highest speed limit degree, stopping the two-layer forwarding of the flow packet, thereby achieving the purpose of speed limit; if the tokens in the token bucket can be consumed at the next moment, namely when the tokens remain, the situation that the burst flow time period is over is shown, and the speed limit level is gradually adjusted downwards.

Images