METHOD FOR CONTROLLING TRANSMISSION SECURITY OF INDUSTRIAL COMMUNICATIONS FLOW BASED ON SDN ARCHITECTURE

• US 20170339109A1
• Filed: 12/25/2015
• Published: 11/23/2017
• Est. Priority Date: 07/29/2015
• Status: Active Grant

• Current Assignee: Shenyang Institute Of Automation ,Chinese Academy Of Sciences
• Original Assignee: Shenyang Institute Of Automation ,Chinese Academy Of Sciences
• Inventors: ZENG, Peng, SHANG, Wenli, LI, DONG, WAN, Ming, ZHAO, Jianming, LIU, Jindi, YANG, Ming
• Granted Patent: US 10,447,655 B2
• Time in Patent Office: Days
• CPC Class Codes: G05B 19/418 Total factory control, i.e. centrally controlling a plurality of machines, e.g. direct or distributed numerical control [DNC], flexible manufacturing systems [FMS], integrated manufacturing systems [IMS] or computer integrated manufacturing [CIM]
• CPC Class Codes: G05B 19/41855 by local area network [LAN], network structure
• CPC Class Codes: G05B 2219/45103 Security, surveillance applications
• CPC Class Codes: H04L 45/745 Address table lookup; Address filtering
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 49/253 using establishment or release of connections between ports
• CPC Class Codes: H04L 49/70 Virtual switches
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 69/326 in the transport layer [OSI layer 4] H04L69/16 takes precedence
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

The present invention discloses a method for controlling transmission security of an industrial communication flow based on an SDN architecture. The method comprises: designing a flow security control module in a management controller, performing in-depth parsing on industrial communication flow data, matching the parsing result with each preset industrial rule policy, and executing a control processing operation of the industrial rule policy, to implement transmission control of an industrial communication flow. The management controller comprises an industrial rule policy database used for storing all industrial rule policies set by a user. An SDN switch maintains a structure of a flow table, and an industrial communication flow is forwarded according to the flow table. The flow table comprises a security control identifier used for indicating whether security transmission of this communication flow needs to be controlled. The present invention can detect the legality of an industrial communication data flow, to control access of industrial communication that does not conform to an industrial rule policy, so that the security and reliability of industrial control systems based on an SDN architecture are guaranteed.

Claims

1. A method for controlling transmission security of an industrial communication flow based on an SDN architecture, which comprises the following steps:

Step 1;

after receiving an industrial communication data flow sent by an industrial control terminal, an SDN switch parses a data packet first, matches with a flow table stored therein entry by entry, and if the data packet is matched with a certain entry, go to step 2; and

if the data packet is matched with none of the entries of the flow table, go to step 3;

Step 2;

the SDN switch checks whether a security control identifier of a corresponding matched entry of the flow table is 1, sends a flow ID, an industrial communication protocol type and application layer information in the data packet to a management controller if the security control identifier is 1, to request to detect communication content, go to step 4; and

the SDN switch executes corresponding operations according to actions in the flow table if the security control identifier is 0;

Step 3;

the SDN switch sends the data packet to the management controller, the management controller parses the data packet, establishes a flow transmission path, computes forwarded flow table information and allocates a flow ID for the data packet using an internal basic service function, then judges whether this data flow needs to be managed and controlled through a flow security control module, and if so, sets the security control identifier in the flow table information to be 1;

otherwise, sets the security control identifier to be 0, and then sends the flow table information to all the SDN switches on the path;

Step 4;

the flow security control module performs in-depth parsing on the application layer information in the data packet according to different industrial communication protocols, matches the parsing result with each industrial rule policy in the industrial rule policy database, and sends the detection result to the SDN switch if matching is successful, go to step 5; and

informs the SDN switch to drop the overall industrial communication data flow if matching is not successful; and

Step 5;

the SDN switch further processes the industrial communication data flow according to the detection result.

2. The method for controlling transmission security of an industrial communication flow based on an SDN architecture of claim 1, characterized in that the table entry structure of the flow table comprises Packet header field, Count, Security control identifier and Action,

wherein the packet header field is used for matching data packets;

the Count is used for counting the number of matched data packets;

the security control identifier is used for judging whether to perform flow security control; and

the action is used for displaying a manner of processing matched data packets.

3. The method for controlling transmission security of an industrial communication flow based on an SDN architecture of claim 2, characterized in that the action of the flow table includes Forward, Drop, Enqueue and/or Modify-Field.

4. The method for controlling transmission security of an industrial communication flow based on an SDN architecture of claim 1, characterized in that the management controller has the basic service function for basic network management, including network topology management, network device registration, route computation, Qos guarantee, can maintain basic information about the entire network by maintaining the view of the entire network, can compute route path information, establish forwarded flow table information and allocate a flow ID for each communication data flow, and can send the flow table information to each SDN switch on the patch.

5. The method for controlling transmission security of an industrial communication flow based on an SDN architecture of claim 1, characterized in that the flow table information is sent to all SDN switches on the path, only the security control identifier in the flow table information of the first SDN switch on the transmission path is set to be 1, and security control identifiers in the flow table information of other SDN switches are all set to be 0.

6. The method for controlling transmission security of an industrial communication flow based on an SDN architecture of claim 1, characterized in that the flow security control module is used for completing two functions, including:

(1) for a data packet of a certain industrial communication data flow received for the first time, judging whether security transmission of the flow needs to be managed and controlled according to the industrial rule policy database, i.e. whether a security control identifier needs to be set when the forwarded flow table information is established; and

(2) for a data packet of which security transmission of the flow needs to be managed and controlled, performing in-depth parsing on packet application layer content according to different industrial communication protocol specifications, matching the parsing result with each preset industrial rule policy, and executing a specified control processing operation of the industrial rule policy.

7. The method for controlling transmission security of an industrial communication flow based on an SDN architecture of claim 1, characterized in that the industrial rule policy database is used for storing all industrial rule policies set by a user, and the industrial rule policy database is custom-added by the user, so that the user can perform modification, update and deleting operations on each of the industrial rule policies, wherein each industrial rule policy comprises a rule ID, a source IP address, a target IP address, an industrial communication protocol type, key field information content specified by a protocol specification and a processing operation part.

8. The method for controlling transmission security of an industrial communication flow based on an SDN architecture of claim 1, characterized in that the industrial communication protocol type comprises general industrial communication protocols of Modbus/TCP, Modbus/UDP, DNP3, OPC, Profinet, IEC60870-5-104, MMS and GOOSE.

9. The method for controlling transmission security of an industrial communication flow based on an SDN architecture of claim 1, characterized in that the flow security control module of the management controller saves a correlation between rule IDs of the industrial rule policies and flow IDs, the correlation being a one-to-one correlation or a one-to-many correlation, thereby facilitating searching corresponding industrial rule policies through the flow IDs.

10. The method for controlling transmission security of an industrial communication flow based on an SDN architecture of claim 1, characterized in that the detection result of the security control module of the management controller reflects control processing operations specified by corresponding industrial rule policies, including two manners, i.e. dropping and processing according to actions in the flow table.