CN101127717A - Method and switch for message forwarding - Google Patents

Abstract

The invention discloses a message forwarding method, which relates to the technical field of industrial communication, including: pre-setting a list of message types allowed to be forwarded, a list of authorized device addresses for each port that is allowed to forward messages, and a list of unauthorized message types that are prohibited from forwarding messages. Authorized device address list; after receiving the message from the port, determine the source address of the message sent, if it is determined that the source address does not belong to the address in the authorized device address list and the unauthorized device address list, Then forward the message through a preset specific address; if it is determined that the source address is an address in the authorized device address list, and it is determined that the message type is in the allowed forwarding message type list type, forward the message according to the destination address of the message. The invention also discloses a switch. The method and switch of the invention can avoid the impact on the normal working equipment when the unauthorized equipment sends the message and the illegal type of message.

Description

Method and switch for message forwarding

technical field

The invention relates to the technical field of industrial communication, in particular to a message forwarding method and an industrial switch.

Background technique

In the industrial network system, in order to ensure real-time requirements, many servers use the User Datagram Protocol (UDP) broadcast message. In the field bus system, there are many broadcast messages used for periodic data transmission and scheduling. Correspondingly, Its network load is also very large. Therefore, the industrial control network and the monitoring network need to be separated by a proxy or a bridge, and different industrial control networks also need to be separated by a proxy or a bridge. This can better isolate different control networks, but if two different control networks When data exchange is required, the time for data transmission will be extended due to the existence of the agent or bridge.

In the course of the development of industrial communication, switches are playing an increasingly important role. Generally, switches are at the core switching position, and bridges, proxies and routers are at the edge of network switching and play a supplementary role. However, due to the fact that the current switches constitute the network for the purpose of exchanging data, and due to the limitation of the application environment of the industrial control network itself, the switches cannot meet the requirements of response time and data validity authentication required in industrial communication.

Switches in the traditional sense are all devices that work on the second layer. The forwarding of unicast data is realized through point-to-point transmission, while the forwarding of broadcast data will spread to all ports. Some switches that join the virtual local area network (VLAN) function , able to control the multicast data to several fixed ports. With the development of network technology, the current switch technology can complete the forwarding of the third layer or even the fourth layer, and complete part of the routing work, which makes it relatively easy to divide each network segment from the network layer.

However, the switches in the industrial control network are currently restricted, mainly because if there is an unauthorized device on the network, the data sent (especially broadcast data) will be spread to all ports, and the devices on other ports will be restricted by other ports. Interference, affecting the normal control of production by devices on other ports.

Contents of the invention

In view of this, the present invention provides a message forwarding method and a switch to solve the above-mentioned problem that unauthorized devices in the industrial control network affect other authorized and working devices when sending data through the switch.

As mentioned above, the present invention provides a method for controlling message forwarding of a switch, which is described in detail as follows:

Pre-set the list of message types that are allowed to be forwarded, the list of authorized device addresses that are allowed to forward messages for each port, and the list of unauthorized device addresses that are prohibited from forwarding messages;

After receiving the message from the port, judge the source address for sending the message, if it is judged that the source address does not belong to the addresses in the authorized device address list and unauthorized device address list, then send the The text is forwarded through the preset specific address;

If it is determined that the source address is an address in the authorized device address list, and the packet type is determined to be a type in the packet type list allowed to be forwarded, forward the packet according to the destination address of the packet.

Wherein, the method also includes:

Pre-set the list of message types that are prohibited from being forwarded;

If it is determined that the source address is an address in the unauthorized device address list, or it is determined that the packet type is a type in the prohibited-forwarding packet type list, then block the packet.

Wherein, the message is forwarded through the preset specific address as:

Forwarding the message to the host computer through a preset specific address;

After receiving the message, the upper computer replies with the permission information of the device to which the source address of the message belongs through the specific address, or blocks the port.

Wherein, the method also includes:

After receiving the permission information, judge the identifier in the permission information, and store the source address in the authorized device address list or the unauthorized device address list.

Wherein, the address list includes a unicast list, a multicast and a broadcast domain list.

Wherein, the addresses in the address list include:

Source media access control MAC address, source Internet IP address, destination MAC address, destination IP address, and switch port number to which the device is connected.

Wherein, the process of determining that the source address is an address in the authorized device address list includes:

Find out the source and destination MAC addresses of the message in the authorized device address list;

Forward according to the destination address of the message as:

Forward according to the destination MAC address.

Among them, the method also includes:

Set the routing function in the switch to ON;

The process of determining that the source address is an address in the authorized device address list includes:

Find out the source and destination MAC and IP addresses of the message in the authorized device address list;

Forward according to the destination address of the message as:

Forward according to the destination MAC and IP address.

Among them, it also includes regularly receiving ARP, ICMP, IGMP or DHCP messages from the device from each port, analyzing the subnet mask of the message received from the port, and judging the multicast and broadcast domain to which the message belongs. address, recorded in the domain list.

Wherein, the method also includes:

Regularly compare the communication data monitored by the switch with the communication data set by the user. If they are not the same, it is judged that the port is faulty, the port is closed, and the authorized device address is downloaded through the specific address and the authorized device is updated. device address list.

The present invention also provides a switch, including: a transceiver unit, an address judging unit, an authorization judging unit, and a storage unit;

The transceiver unit is used to receive or send messages;

The storage unit is used to store a list of message types that are allowed to be forwarded, a list of authorized device addresses that are allowed to forward messages at each port, and a list of unauthorized device addresses that are prohibited from forwarding messages;

The address judging unit is used to judge the source address of the message received by the receiving unit, and if it is judged that the source address does not belong to the addresses in the authorized device address list and the unauthorized device address list, notify the The transceiver unit forwards the message through a preset specific address;

The authorization judging unit is used to judge the source address and message type of the message, if it is judged that the source address is an address in the authorized device address list, and it is judged that the message type is the If the type in the packet type list is allowed to be forwarded, the sending and receiving unit is notified to forward the packet according to the destination address of the packet.

Wherein, the storage unit can also store a list of message types that are prohibited from being forwarded;

The switch also includes:

A shielding unit, configured to determine the source address and message type of the message, if it is determined that the source address is an address in the unauthorized device address list, or it is determined that the message type is the prohibited forwarding type in the packet type list, the packet will be blocked.

Among them, also include:

The address updating unit is configured to, after receiving the authority information of the device to which the source address belongs, judge the identifier in the authority information, and store the source address in the authorized device address list or the unauthorized device address list.

in,

The address list in the storage unit includes a unicast list, a multicast and broadcast domain list;

Also includes:

The analysis unit is used to notify the transceiver unit to regularly receive ARP, ICMP, IGMP or DHCP messages from the device from each port, analyze the subnet mask of the message received from the port, and determine the multicast and Broadcast domain address, recorded in the domain list.

Among them, also include:

The automatic update unit regularly compares the communication data monitored by the switch with the communication data set by the user. If they are not the same, it is judged that the port is faulty, the port is closed, the authorized device address is downloaded through the specific address and Update to the authorized device address list.

It can be seen from the above technical solution that the present invention establishes an address list, a type list, and sets a specific address through the message forwarding method and the switch of the present invention. , forwarding through a specific address, so as to prevent unauthorized devices from sending messages and illegal types of messages from affecting normal working devices. Moreover, for the first device message, it is sent to the upper computer through a specific address, and is forwarded after being authorized by the user. During the working process, the address list is constantly updated, and through the automatic analysis of the message data, the faulty port is closed to reduce the impact on the normal working equipment, thereby ensuring normal industrial production and improving production efficiency.

Description of drawings

Fig. 1 is the flowchart of the embodiment of the present invention;

Fig. 2 is a flow chart of updating the authorized device address in the embodiment of the present invention;

Fig. 3 is the flowchart of data link layer message forwarding in the embodiment of the present invention;

Fig. 4 is the flowchart of network layer message forwarding in the embodiment of the present invention;

Fig. 5 is a flowchart of message processing between the monitoring device and the switch in an embodiment of the present invention;

Fig. 6 is a schematic diagram of setting by the user through the monitoring device in the embodiment of the present invention;

Fig. 7 is a flow chart of the switch regularly updating the authorized device address list in the embodiment of the present invention;

Fig. 8 is the flowchart of switch monitoring port data in the embodiment of the present invention;

FIG. 9 is a schematic diagram of a switch structure in an embodiment of the present invention;

Fig. 10 is a schematic diagram of interconnection of switches in an embodiment of the present invention.

Detailed ways

The basic idea of the present invention is: establish address list, type list, and set specific address, after receiving message, if sending this message address does not belong to the address in the list, forward through specific address, to avoid unauthorized When the device sends packets and illegal type packets appear, it will affect the normal operation of the device.

In order for those skilled in the art to have a better understanding of the technical solutions of the present invention, the present invention will be described in detail below in conjunction with the accompanying drawings and embodiments.

Please refer to FIG. 1 , which is a flow chart of Embodiment 1 of a message forwarding method according to the present invention.

Include the following steps:

Step S101: Set a list of message types that are allowed to be forwarded, and set a list of authorized device addresses that are allowed to forward messages and a list of unauthorized device addresses that are prohibited from forwarding messages for each port.

Step S102: After receiving the message from the port, perform a judgment operation on the source address.

Step S103: Judging that the source address does not belong to the addresses in the authorized device address list or the unauthorized device address list, if yes, go to step S104; otherwise, end.

Step S104: Forward the message through a preset specific address.

Step S105: judging whether the source address is an address in the authorized device address list, and whether the message type is a type in the allowed forwarding message type list, and if so, proceed to step 105; otherwise, end;

Step S106: forwarding according to the destination address of the message.

In this embodiment, there is no sequential relationship between step S103 and step S105. Depending on the specific circumstances, the judgments may be executed successively, or may be judged simultaneously.

In this embodiment, some messages with illegal addresses can also be shielded, so as to avoid unnecessary impact on other devices working in the network. Therefore, this embodiment may also include the following steps,

Pre-set the list of message types that are prohibited from being forwarded;

A list of message types prohibited from forwarding may be set before performing the judgment operation in step S103 and step S105.

When performing the process of judging the source address of sending the message, if it is judged that the source address is an address in the address list of the unauthorized device, or it is judged that the message type is the prohibited forwarding message type If the type in the list is not specified, the message will be blocked. In this way, these illegal messages can be shielded.

In this embodiment, if the engineer performs a wrong connection operation on the switch, or the connected device is not authorized, then the switch receives a message sent by an unauthorized device or receives an illegal type message due to a wrong connection. For such messages, the switch will shield the messages after receiving them; or perform step S104 to forward these messages through a specific address.

When forwarding through a specific address, if there is an upper-level switch connected, it will be sent to the upper-level switch until it is sent to the upper computer; after the upper computer receives it, it will notify the user in various forms, and usually display the information of the message to the user through the display. user. After receiving the message, the user authorizes the device to which the source address of the message belongs, and sends the authority information of the device to which the source address belongs to the switch through a specific address, or directly sends a command to the switch to block the port that received the message.

After receiving the permission information through the specific address, the switch can store the source address of the message in the authorized device address list or unauthorized address list by judging the identifier in the permission information. After receiving the message sent by the source address next time, the corresponding operation will be performed through judgment.

The function of a specific address not only includes the above-mentioned applications, but also can be used to update various address lists in the exchange regularly or non-periodically. These lists can be updated simultaneously or sequentially. The following uses the authorized device address list as an example to describe the process of updating the authorized device address in this embodiment.

The update process can be seen in Figure 2, including the following steps:

Step S201: The user sets configuration information.

Step S202: The user configuration software downloads the address of the authorized device to the switch through a specific address.

Wherein, the specific address is a port on the switch, and the authorized device address includes: source media access control MAC address, source Internet IP address, destination MAC address, destination IP address, switch port number to which the device is connected, and the like.

Step S203: the switch updates the authorized device address list.

After the switch receives the authorized device address, it judges whether the downloaded address exists in the authorized device address list. If it exists, it updates it, that is, adds the address not in the list to the list. When adding, it controls the MAC address according to the source media access , source Internet IP address, destination MAC address, destination IP address, and the switch port number connected to the device are added to the list as a record; if the switch does not have a list, create a list of authorized device addresses and add all downloaded addresses to the list .

Step S204: Forward to the lower-level switch.

If the switch is also connected to a lower-level switch, the downloaded address is sent to the lower-level switch through a specific address.

In the above embodiment, the addresses in the list can be further divided into a unicast list, a multicast and a broadcast domain list, so as to be processed by the switch during message forwarding.

In order to realize hierarchical forwarding, the routing function can be set in the switch. If the routing function is turned off, the switch will realize the packet sending control of Ethernet; if the routing function is turned on, the forwarding of different network segments will be realized. Referring to FIG. 3 below, it illustrates the process of forwarding packets when the routing function is disabled.

Specifically include the following steps:

Step S301: Receive an Ethernet message.

Step S302: It is determined that the source address is an address in the authorized device address list, and it is determined that the packet type is a type in the allowed-forwarding packet type list.

Since the Ethernet message is received, the switch obtains the MAC address of the message to be forwarded after receiving the Ethernet message. If it is unicast, it searches in the unicast address list in the authorized device address list; if If it is broadcast or multicast, compare it with the broadcast or multicast address domain list in the authorized device address list. Match the MAC address with the MAC addresses in the authorized device address list, find the same MAC address, and execute step S303.

Step S303: forwarding according to the destination MAC address of the message.

The message to be forwarded is a message from the authorized device, and the switch forwards the message to be forwarded to the corresponding device according to the MAC address.

The process when the routing function is turned off is described in detail above, and the process when the routing function is turned on is described in detail below. Refer to FIG. 4 , which is a flow chart of network layer packet forwarding in an embodiment of the present invention.

Specifically include the following steps:

Step S401: Receive an Ethernet packet.

Step S402: It is determined that the source address is an address in the authorized device address list, and it is determined that the packet type is a type in the allowed-forwarding packet type list.

After receiving the Ethernet message, the switch obtains the MAC address and IP address of the message to be forwarded. If it is unicast, it will search in the unicast address list in the authorized device address list; if it is broadcast or multicast, Then compare it with the broadcast or multicast address domain list in the authorized device list. Match the obtained MAC and IP addresses with the records in the authorized device address list, find the same MAC and IP addresses, and execute step S403.

Step S403: Forward according to the destination address of the message.

The message to be forwarded is a message from the authorized device, and the switch forwards the message to be forwarded to the corresponding device according to the MAC and IP addresses.

The above describes the process of forwarding packets when the routing function in the switch is enabled or disabled. By setting the routing function, the switch can forward packets at different layers. Since the protocols used by switches in industrial applications are relatively fixed, in order to speed up the processing speed of switches, different types of messages in different layers can be shielded separately. In this embodiment, it may also include that the switch performs a source address judgment operation after receiving the message, that is, after step S301 or step S401, if it is judged that the source address is an address in the unauthorized device address list, Or if it is determined that the packet type is a type in the packet type list prohibited from forwarding, then block the packet.

For the judged type, if the switch does not enable the routing function, it only judges the source address and destination address of the second layer, and no longer judges whether the type of the third layer packet is in the list of packet types allowed to be forwarded or forbidden to be forwarded. type, only matches at the second level.

If the switch enables the routing function, it not only needs to make matching judgments on the second layer, but also needs to make matching judgments on the third layer, and can perform type matching judgments on non-third-layer packets such as UDP, TCP, or ICMP. Thereby expanding the security and legality of its forwarded data.

In step S103 of this embodiment, when the switch forwards the message, if there is an upper-layer switch connected, then the message is sent to the upper-layer switch with a specific address, and the upper-layer switch sends it to the upper computer, that is, the monitoring device or workstation; if connected directly to the monitoring device, send the message to the monitoring device.

After step S103 in this embodiment, the message processing process between the monitoring device and the switch may also be included. The message processing process between the monitoring device and the switch will be described in detail below in conjunction with FIG. 5 . Referring to FIG. 5 , it is a flow chart of message processing between the monitoring device and the switch in the embodiment of the present invention.

Specifically include the following steps:

Step S501: the monitoring device receives the forwarding message sent from the switch.

Step S502: the monitoring device prompts the user that there is a new device on the network.

Step S503: the monitoring device receives the information selected by the user and sends it to the switch.

Step S504: When the switch judges that the information selected by the user is configuration information, the user sets the configuration information again and downloads it to the switch.

Step S505: When the switch judges that the information selected by the user is incorrect access or illegal device information, it closes the port receiving the forwarded message.

The user checks the information from the switch through the monitoring device. If it is a device that is newly powered on and joins the network, the user can set the destination address of the unicast message sent by the device, and can also send broadcast or multicast messages to the device. The domain is set, and the schematic diagram of the specific setting through the monitoring device can be seen in Figure 6.

When a new device is powered on, the IP of the newly powered device and the destination IP address will be displayed on the monitoring device, and the corresponding domain settings will be prefabricated. The domain settings used here are the same as the subnet mask settings. After adding Submit to the configured list below.

Taking a new device access as an example, the switch detects that the address has not been set on the port, and sends its message to a specific address. The monitoring device detects the corresponding message and displays the basic information of the message. And prefabricate the corresponding domain for it. Wherein, ALL shown in FIG. 6 means that the sending range is not restricted. Users can set the scope of their domain as needed, and send it to their switch ports, and the authorized device can send data in its designated domain. This ensures that any device connected to the system can complete its communication function only after being authorized.

The switch can also periodically analyze the packets from each device in each port, obtain the unicast address, broadcast or multicast domain address of the device corresponding to each port address, and add the obtained address to the corresponding list . The following describes in detail with reference to FIG. 7 . Referring to FIG. 7 , it is a flow chart of periodically updating the authorized device address list by the switch in the embodiment of the present invention.

Specifically include the following steps:

Step S701: Enter the packet analysis cycle.

The user can pre-set the message analysis cycle of the switch, and the switch enters the analysis cycle after a predetermined time interval.

Step S702: Receive messages from each port.

Step S703: Determine whether there are packets that can be analyzed.

Whether the switch has ARP, ICMP, IGMP, DHCP and other messages in the port; if yes, execute step S704; if not, execute step 706.

Step S704: Analyzing the subnet mask corresponding to the port through the packet, so as to determine the domain corresponding to the port.

Step S705: Determine whether it is larger than the record of the authorized device address list; if larger, execute step S708; if smaller, end.

The switch compares the analyzed domain address with the domain address in the authorized device address list, and if there is a domain address not in the authorized device address list, it judges that it is greater than the domain address in the authorized device address list.

Step S706: Determine whether there are broadcast and multicast packets on the port; if yes, execute step S707; if not, end.

Step S707: Obtain the domain where the port is located through broadcast and multicast messages, and judge whether it is greater than the record in the authorized device address list; if greater, execute step S708; if less, end.

The switch compares the analyzed domain address with the domain address in the authorized device address list, and if there is a domain address not in the authorized device address list, it judges that it is greater than the domain address in the authorized device address list.

Step S708: updating the broadcast and multicast address domain list in the authorized device address list.

The above-mentioned domain can also be divided into sub-domains. If the analysis shows that the domain of broadcast and multicast is a sub-domain, wire-speed forwarding can be realized in subsequent transmissions.

In the above-mentioned embodiment, the switch can also include a monitoring operation. During the working process of the switch, each port will be monitored all the time. If there is an abnormal communication, the communication port will be closed. The process of monitoring each communication port and dealing with problems. Referring to FIG. 8 , it is a flow chart of a switch monitoring port data in an embodiment of the present invention.

Specifically include the following steps:

Step S801: Monitor communication data in each port.

Step S802: regularly compare the communication data monitored to the switch port with the communication data set by the user, if they are not the same, perform step S803; if they are the same, perform step S801.

Step S803: It is determined that the port is faulty, and the port is automatically closed; or the user is notified through the monitoring device, and the user handles it. When a certain port is closed, the user updates the authorized device address list through the configuration software. That is to download configuration information such as the new IP address forwarding domain, each port number and the MAC address and/or IP address of the device corresponding to each port to the switch through a specific address, and the switch creates or updates the MAC address, IP address, Switch port number, etc.

The above is the preferred solution of the present invention for realizing the message forwarding process, and the present invention also provides a switch for realizing all the steps of the above message forwarding process. Refer to FIG. 9 for a structural diagram of the switch, which includes: a transceiver unit 901 , an address judging unit 903 , an authorization judging unit 904 , and a storage unit 902 . in,

The transceiver unit 901 is configured to receive or send messages.

The storage unit 902 is configured to store a list of message types that are allowed to be forwarded, a list of authorized device addresses that are allowed to forward messages on each port, and a list of unauthorized device addresses that are prohibited from forwarding messages.

The address judging unit 903 is configured to judge the source address of the message received by the receiving unit 901, and if it is judged that the source address does not belong to the addresses in the authorized device address list and the unauthorized device address list, notify The transceiver unit forwards the message through a preset specific address.

The authorization judging unit 904 is configured to judge the source address and message type of the message received by the receiving unit 901, if it is judged that the source address is an address in the authorized device address list, and it is judged that the If the message type is a type in the list of message types allowed to be forwarded, the sending and receiving unit is notified to forward the message according to the destination address of the message.

Wherein, the storage unit 902 may also store a list of packet types that are prohibited from being forwarded.

The switch also includes:

A shielding unit 905, configured to determine the source address and message type of the message received by the receiving unit 901, if it is determined that the source address is an address in the unauthorized device address list, or it is determined that the message If the type is a type in the prohibited-forwarding packet type list, the packet is blocked.

Also includes:

The address update unit 906 is configured to, after receiving the authority information of the device to which the source address belongs, judge the identifier in the authority information, and store the source address in the authorized device address list or the unauthorized device address list.

The address list in the storage unit 902 includes a unicast list, a multicast and a broadcast domain list.

Also includes:

The analysis unit 907 is used to notify the transceiver unit 901 to regularly receive ARP, ICMP, IGMP or DHCP messages from the device from each port, analyze the subnet mask of the message received from the port, and determine the message to which the message belongs. The multicast and broadcast domain addresses are recorded in the domain list.

Also includes:

The automatic update unit 908 regularly compares the communication data monitored by the switch with the communication data set by the user. If they are not the same, it is judged that the port is faulty, the port is closed, and the authorized device address is downloaded through the specific address. And update to the authorized device address list.

The above is the structural diagram of the switch embodiment of the present invention. When several switches 90 are connected to the monitoring device 10, the schematic diagram can be referred to in FIG. The address of is the specific address stated.

For the methods and devices described in the various embodiments of the present invention, any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims (15)

1. A method for forwarding a message, comprising:

presetting a message type list allowing forwarding, presetting an authorized equipment address list allowing forwarding of the message by each port and an unauthorized equipment address list forbidding forwarding of the message;

after receiving a message from the port, judging a source address for sending the message, and forwarding the message through a preset specific address when judging that the source address does not belong to an address in the authorized equipment address list or an unauthorized equipment address list;

and when the source address is judged to be the address in the authorized equipment address list and the message type is the type in the message type list allowed to be forwarded, forwarding according to the destination address of the message.

2. The method of claim 1, further comprising:

presetting a list of message types forbidden to be forwarded;

and shielding the message when the source address is the address in the unauthorized equipment address list or the message type is the type in the message type list forbidden to be forwarded.

3. The method according to claim 1, wherein forwarding the packet through a preset specific address is:

forwarding the message to an upper computer through a preset specific address;

further comprising:

and after receiving the message, the upper computer replies the authority information of the equipment to which the source address of the message belongs through the specific address, or shields the port.

4. The method of claim 3, further comprising:

and after receiving the authority information, judging the identifier in the authority information, and storing the source address into an authorized equipment address list or an unauthorized equipment address list.

5. The method of claim 1, wherein the address list comprises a unicast list, a multicast and a broadcast domain list.

6. The method of claim 1, wherein the addresses in the address list comprise:

the source media access control MAC address, the source internet IP address, the destination MAC address, the destination IP address and the port number of the exchanger connected with the equipment.

7. The method of claim 6, wherein determining the source address is an address in the authorized device address list comprises:

finding out the source and destination MAC addresses of the message in the authorized equipment address list;

the forwarding according to the message destination address is as follows:

and forwarding according to the destination MAC address.

8. The method of claim 6, further comprising, prior to the method:

setting a routing function in the switch to on;

the process of judging that the source address is the address in the authorized equipment address list comprises the following steps:

finding out the source and destination MAC and IP addresses of the message in the authorized equipment address list;

the forwarding according to the message destination address is as follows:

and forwarding according to the destination MAC and IP addresses.

9. The method of claim 5, further comprising periodically receiving an ARP, ICMP, IGMP, or DHCP message from the device from each port, analyzing a subnet mask of the message received from the port, determining a multicast and broadcast domain address to which the message belongs, and recording the domain address in the domain list.

10. The method of claim 1, further comprising:

and regularly comparing the monitored communication data of the switch with the communication data set by the user, if the monitored communication data of the switch are different from the communication data set by the user, judging that the port has a fault, closing the port, downloading the address of the authorized equipment through the specific address, and updating the address list of the authorized equipment.

11. A switch, comprising: the device comprises a transceiving unit, an address judging unit, an authorization judging unit and a storage unit;

the receiving and sending unit is used for receiving or sending messages;

the storage unit is used for storing a message type list allowing forwarding, an authorized equipment address list allowing forwarding of the message by each port and an unauthorized equipment address list forbidding forwarding of the message;

the address judging unit is used for judging a source address of a message received by the receiving unit, and if the source address is judged not to belong to the addresses in the authorized equipment address list and the unauthorized equipment address list, the receiving and sending unit is informed to forward the message through a preset specific address;

the authorization judging unit is configured to judge a source address and a packet type of the packet, and if the source address is judged to be an address in the authorization device address list and the packet type is judged to be a type in the forwarding permission packet type list, notify the transceiver unit to forward the packet according to a destination address of the packet.

12. The switch of claim 11, wherein the storage unit is further configured to store a list of prohibited message types to be forwarded;

the switch further comprises:

and the shielding unit is used for judging the source address and the message type of the message, and shielding the message if the source address is judged to be the address in the unauthorized equipment address list or the message type is judged to be the type in the message type list forbidden to be forwarded.

13. The switch of claim 11, further comprising:

and the address updating unit is used for judging the identifier in the authority information after receiving the authority information of the equipment to which the source address belongs, and storing the source address into an authorized equipment address list or an unauthorized equipment address list.

14. The switch according to claim 11,

the address list in the storage unit comprises a unicast list, a multicast and broadcast domain list;

further comprising:

and the analysis unit is used for informing the transceiving unit to regularly receive ARP, ICMP, IGMP or DHCP messages from equipment from each port, analyzing subnet masks of the messages received from the ports, judging multicast and broadcast domain addresses to which the messages belong, and recording the domain addresses in the domain list.

15. The switch of claim 11, further comprising:

and the automatic updating unit is used for regularly comparing the monitored communication data of the switch with the communication data set by the user, judging that the port has a fault if the monitored communication data of the switch are different from the communication data set by the user, closing the port, downloading the address of the authorized equipment through the specific address and updating the address into the address list of the authorized equipment.

Images