CN101170461A - A method and device for strengthening network security - Google Patents

Abstract

The invention discloses a method for strengthening network security, which includes: when a new wireless device accesses the network, the network side judges whether the authorization number of the new device is the same as that of the wireless device that has established a connection, and if the same , reject the access of the new device; otherwise, wait to receive the message of the new device. At the same time, the present invention also discloses a device for enhancing network security. The present invention can determine whether the authorization number of the new device is the same as that of other devices already connected when the new device accesses the network. , and then verify whether the new device is a legal device, and the invention can prevent illegal devices from accessing the network, and further enhance the security of the network.

Description

A method and device for strengthening network security

technical field

The invention relates to the technical field of network security, in particular to a method and device for strengthening network security.

Background technique

Commonly used wireless devices such as industrial wireless networks are linked through wireless technology, and users can easily access any device in the industrial network through the wireless network. Please refer to Figure 1, which is a schematic diagram of the control system structure of the industrial wireless network As a block diagram, an industrial wireless network usually includes a monitoring layer network and an on-site control layer network, wherein the monitoring layer network usually includes an engineer station 101, an operator station 102, a monitoring station 103, and a wireless network security management server 104, wherein the wireless network The security management server 104 is used to maintain and manage the access security of devices in the entire industrial wireless network; the field control layer network usually includes an intelligent bridge 105, a wireless routing device 106, and ordinary wireless devices connected to the wireless routing device 107 and wireless handheld devices 108 and so on.

However, at present, because the monitoring layer network in the existing industrial wireless network usually has no effective security verification means for the wireless devices connected to the on-site control layer network, therefore, illegal users can access malicious devices through the wireless network, such as Intercept the data of a transmission, tamper with the sampling or control data, and send the tampered data to the actuator, thus causing the entire system of the monitoring layer network in the industrial wireless network to be in a dangerous situation. Or in the monitoring network of the industrial wireless network, a mobile PC (computer) or wireless handheld device 108 can be disguised as an engineer station 101 or operator station 102 to maliciously modify the configuration of devices in the field control layer network information, causing the control system to be in a state of confusion.

Contents of the invention

The purpose of the present invention is to provide a method and device for strengthening network security, which can block the access of illegal devices in time, so as to improve the access security of the wireless network.

The present invention provides a method for strengthening network security, including:

When a new wireless device accesses the network, the network side judges whether the authorization number of the new device is the same as that of the wireless device that has established a connection. If the number is the same, the access of the new device is rejected; otherwise, the Waiting to receive the message of the new device.

Preferably, when it is judged that the authorization number of the new device is the same as that of the wireless device with which the connection has been established, the method further includes:

The network side modifies the authorization number of the renumbered wireless device.

Preferably, the method also includes:

The network side notifies the modified authorization number of the renumbered wireless device to the renumbered wireless device and the routing device connected to the device through a modification message, requesting to change to the modified authorization number. Number.

Preferably, before performing the judgment, the method further includes:

In the process of establishing a connection with the wireless device, the network side sends an authorization number detection request message to the wireless device;

After receiving the authorization number detection response message returned by the wireless device, the network side judges whether the authorization number in the response message is an authorization number that allows access, and if so, executes the determination step.

Preferably, before receiving the authorization number probe response message returned by the wireless device, it further includes:

The network side judges whether the authorization number detection response message returned by the wireless device is received within the preset maximum response time, and if so, performs the determination of whether the authorization number in the response message is allowed to access The authorization number step, otherwise, deny the access of the wireless device.

Preferably, after receiving the message of the new device, the method further includes:

The network side decrypts the received message according to the decryption method preset with the on-site control layer network where the new device is located;

Then encrypt the message obtained after decryption according to the encryption method preset with the monitoring layer network on the network side, and send it to the monitoring layer network after encryption.

Preferably, the address list of the on-site control layer network device and the monitoring layer network device is pre-stored in the device on the network side;

After receiving the message of the new device, the method also includes:

Judging whether the source address and the destination address in the received message exist in the address lists of the on-site control layer network device and the monitoring layer network device, if so, then forward the message; otherwise, discard the message.

Preferably, access rights are preset in each monitoring layer device on the network side;

When receiving the access request message sent to the on-site control layer device by the monitoring layer device, the method also includes:

Judging whether the monitoring layer device sending the access request message has the access operation authority, if so, forwarding the access request message to the on-site control layer device; otherwise, refusing to forward the access request message.

Based on the above technical solution, the present invention also discloses a device for strengthening network security, including:

The list unit is used to save the authorization numbers of all wireless devices that have established connections with the network;

A judging processing unit, configured to judge whether the authorization number of the new device is the same as the authorization number stored in the list unit when a new wireless device accesses the network, and reject the access of the new device if the number is the same ; Otherwise, wait to receive the message of the new device.

Preferably, the device also includes:

A modifying unit, configured to modify the authorization number of the wireless device that has been renumbered in the established connection when the judging processing unit judges that the authorization number of the new device is the same as that of the wireless device that has established the connection;

A sending unit, configured to notify the wireless device whose number has been renumbered and the routing device connected to the device through a modification message of the new authorization number modified by the modifying unit.

Compared with the prior art, the present invention has the following advantages:

When a new wireless device accesses the network, the present invention can judge whether the authorization number of the new device is the same as that of other wireless devices that have established connections before accessing, thereby checking whether the new device is an illegal device , the invention can prevent illegal devices from accessing the network, and further enhance the security of the network.

Description of drawings

Fig. 1 is a schematic block diagram of a control system structure of an industrial wireless network in the prior art;

FIG. 2 is a schematic block diagram of a method for establishing a connection by a wireless device according to an embodiment of the present invention;

Fig. 3 is a schematic flow diagram of the method for monitoring illegal device intrusion in the present invention;

Fig. 4 is the block flow diagram of the method embodiment of intelligent network bridge security filtering of the present invention;

FIG. 5 is a schematic flow diagram of an embodiment of an access right verification method of the present invention;

Fig. 6 is a structural block diagram of a device embodiment of the present invention;

Fig. 7 is a structural block diagram of another device embodiment of the present invention.

Detailed ways

A method for strengthening network security disclosed in the embodiment of the present invention can be detected when a device is connected to a wireless network. After the connection is established, it can continue to check whether any illegal device has joined the connected device. At the same time, it is also possible to further improve the security of the network by encrypting the transmitted data in the wireless network, and monitor the access rights of the equipment to comprehensively realize the security of network access, so as to prevent the network from being destroyed by illegal equipment. .

Various monitoring implementation modes of the present invention will be further described in detail below in conjunction with the accompanying drawings.

An embodiment of a method for establishing a connection of a wireless device disclosed in the present invention, this embodiment maintains a list of authorization numbers allowed to access on the routing device on the network side in advance, and all devices allowed to access the wireless network are saved in the table At the same time, a legal wireless device is provided with an authorization number that allows access to the wireless network, which is used to check whether the accessed device is illegally accessed according to the list when a new device is connected to the network. As shown in FIG. 2, it is a schematic block diagram of a method for establishing a connection with a wireless device according to an embodiment of the present invention, and the method includes:

S201: When the routing device on the network side detects that a wireless device attempts to establish a wireless connection with the routing device, the routing device sends an authorization number detection request message to the wireless device.

S202: After receiving the request message, the wireless device carries its authorization number in the authorization number detection response message and sends it to the wireless routing device.

S203: After receiving the authorization number detection response message sent by the wireless device, the wireless routing device determines whether the authorization number in the response message exists in the list of authorized numbers stored in itself, If yes, execute S204; otherwise, execute S205.

Wherein, the list of authorization numbers allowed to access saved on the routing device can be obtained from the management server of the network where the routing device is located, and the authorization numbers of all wireless devices in the list are set by the management server.

S204: The wireless routing device judges that the wireless device is a legal device. At this time, the wireless routing device adds the authorization number of the wireless device to the list of devices that have established connections, and at the same time forwards the authorization number of the wireless device. All messages.

S205: It is determined that the wireless device is an illegal device, and at this time, all packets of the wireless device may be refused to be forwarded.

In addition, in the above S202 and S203, it may also include: after the wireless routing device sends the authorization number detection request message, start a timer to time the response time; at the same time, the wireless routing device determines that the maximum Within the response time, whether the authorization number detection response message returned by the wireless device has been received, if yes, continue to execute the S203; otherwise, execute the S205.

At the same time, the embodiment of the present invention discloses a method for monitoring the intrusion of illegal devices. In this embodiment, a management server on the network side dynamically maintains a list of authorization numbers of all devices that are allowed to access the network in advance. Wherein, the management server may be a wireless network security management server. A list of connected devices is dynamically maintained on the wireless routing device connected to the wireless network security management server, and the list stores all wireless devices that have been connected to the wireless network through the routing device Authorization Number. In this embodiment, it is possible to determine whether a newly accessed device is illegally accessed by checking whether there is a duplicate name in the list of established connected devices. As shown in Figure 3, it is a schematic block diagram of the method for monitoring illegal device intrusion according to the present invention, and the method may be based on the embodiment shown in Figure 2 above, including:

S301: After a new device in the network is connected to the wireless network through the routing device, and after the routing device records the authorization number of the new device in the list of connected devices saved by itself, the routing device Sending the list of connected devices including the new device authorization number to the management server. Wherein, the management server may be a security management server of the wireless network.

S302: The management server judges whether the authorization number of the new device in the list of established connected devices is the same as the authorization number of the connected device stored in itself. That is, it is judged whether there are two devices with the same authorization number accessing the network at the same time in the network. If they are the same, execute S303; otherwise, execute S306.

S303: The management server determines that the new device is an illegal device, and at this time, notifies the routing device connected to the new device to stop forwarding all packets of the new device. Simultaneously execute S304.

S304: The management server modifies the authorization number of the re-numbered legal device, and records the modified new authorization number in the list of authorization numbers allowed to access saved by itself, and at the same time, sends the authorization number to the routing device and the The device whose number has been renumbered sends a modification message to inform the replacement of the authorization number.

S305: After receiving the modification message sent in S304, the routing device records the authorization number to be replaced specified in the modification message in the list of authorization numbers allowed to be accessed saved by itself, and replaces the original authorization number. At the same time, after receiving the modification message, the device whose number has been renumbered modifies its own authorization number to that specified in the message, and then re-establishes a connection between the device and the wireless routing device.

S306: The management server determines that the new device is a legal device, and at this time, may continue to wait for receiving a message sent by the new device.

In addition, in S301 in the above embodiment, in addition to sending the entire list of connected devices including the new device authorization number to the management server for subsequent inspection, the routing device may also only send the The authorization number of the new device is notified to the management server, so that whenever a new device requests to access the network and the routing device allows access, it can notify the management server of the newly accessed device, and the management server The server judges each time whether the new device authorization number is the same as the previously saved existing device authorization number.

In addition, whenever the connection of devices in the network changes, for example, when the device is disconnected, the wireless routing device may also send the authorization of all devices that have connected to the network to the wireless network security management server. number list.

In addition, in the above S303, in addition to judging the authorization numbers of newly connected devices in the list, the management server can also judge whether the authorization numbers of all devices that have already connected to the network in the entire network are duplicated. The imported heavy number device is deleted. At the same time, in S302, the wireless routing device does not need to send the authorization number list of devices connected to the network to the management server every time a device is connected or disconnected, and can be sent periodically.

In addition, when a device in the network is disconnected, the routing device in the network can also send the list of connected devices saved by itself to the management server; or, the management server can also regularly check whether the devices in the network are There is duplicate authorization, for example, the routing device is required to periodically send a list of authorization numbers of all devices that have established connections to the management server.

In addition, on the basis of the above-mentioned embodiments shown in FIG. 2 and FIG. 3 , after the wireless device establishes a connection with the network, in order to further enhance the security of the wireless network, it is also possible to Encryption, for example, if the network side is connected to the management server and the routing device and the wireless device through an intelligent bridge, wherein the routing device and the wireless device are located in the field control layer network, and the management server is located in the monitoring layer network . Then the message sent by the wireless device to the network side can be encrypted according to the preset encryption method, and after the smart bridge monitors the message from the on-site control layer network, it can decrypt the message according to the pre-agreed decryption method with the on-site control layer network , decrypt the received message, and then re-encrypt the decrypted message according to the encryption method agreed with the monitoring layer network, and then send the encrypted message to the management server located in the monitoring layer network . Wherein, the decryption may be an XOR decryption algorithm, and the encryption may be an XOR encryption algorithm.

In addition, on the basis of the above-mentioned several embodiments, the intelligent network bridge at the network side can also verify the received message before forwarding, so as to further strengthen the security filtering of the network. As shown in Figure 4, it is a flowchart of a method embodiment of intelligent network bridge security filtering of the present invention, the method includes:

S401: An address list of all wireless devices in the on-site control layer network and an address list of devices such as a management server in the monitoring layer network are stored in advance on the intelligent network bridge. Wherein, the list information may be written and saved by the management server on the network side to the intelligent network bridge.

S402: The intelligent network receives a wireless network packet. Wherein, the wireless network message may be a message sent from the on-site control layer network to the monitoring layer network, or may be a message sent from the monitoring layer network to the on-site control layer network.

S403: The intelligent network judges whether the source address and the destination address in the message exist in the wireless device address list and the address list of the monitoring layer device respectively stored by the intelligent network, and if so, forwards the message; otherwise, discards the message, and report the error to the management server on the network side.

It should be noted that the above embodiment is not limited to be implemented by the intelligent bridge, and may also be implemented by other devices capable of forwarding messages in the monitoring layer network and the field control layer network. In addition, in the above-mentioned embodiment shown in Figure 4, the device addresses in the on-site control layer network and the device addresses in the monitoring layer network are directly stored in the intelligent bridge, and when verifying, it is directly judged whether the address in the message exists in the two address lists. In addition, two address lists can be set for the devices in each layer of the network, one of which is for the case of transferring into this layer, and the list at this time is the destination address list; The list at this time is the source address list. In this way, when verifying the message, it can be judged whether the source address and the destination address in the message are the combination of the wireless device address list and the monitoring layer device address list in the field control layer, that is, the source address and the destination address of the wireless device in the field control layer. The combination of the destination address of the monitoring layer device, or the combination of the source address of the monitoring layer device and the destination address of the wireless device in the field control layer. The advantage of such fine-grained judgment is that the security of the wireless network is further enhanced.

In addition, on the basis of the above-mentioned several embodiments, the present invention can also set access rights to the devices in the monitoring layer network on the network side, so as to authorize all the messages sent by the monitoring layer devices to the on-site control layer devices. Authentication, thereby further increasing the security of network access. As shown in Figure 5, it is a schematic flow diagram of an embodiment of the access right verification method of the present invention, the method includes:

S501: Pre-set access rights on each device in the monitoring layer network on the network side. Wherein, the authority can be set by the management server on the network side.

S502: The management server intercepts the access request message sent by the monitoring layer device to the field control layer device.

S503: The management server judges whether the monitoring layer device that sends the access request message has the access operation authority, and if so, executes S504; otherwise, executes S505.

S504: Forward the access request message to the on-site control layer device.

S505: Give up forwarding the access request packet, and return a response packet related to the request to the monitoring layer device, so as to inform the monitoring layer device that the access right is not obtained.

Based on the above technical solution, the present invention also discloses a device for strengthening network security, which can be integrated on a wireless network security management server on the network side. As shown in Figure 6, the device includes: a list unit 601, a judgment processing unit 602; wherein, the list unit 601 is used to store the authorization numbers of all wireless devices that have established connections with the network; the judgment processing unit 602 , for judging whether the authorization number of the new device is the same as the authorization number stored in the list unit 601 when a new wireless device accesses the network, and if the number is the same, rejecting the access of the new device; otherwise , then wait to receive the message of the new device.

Based on the technical solution of the device embodiment shown in Figure 6, the present invention also discloses a device embodiment, as shown in Figure 7, which is a structural block diagram of another device embodiment of the present invention, in addition to the device shown in Figure 6 In addition to the unit, it also includes: a modifying unit 701 and a sending unit 702, wherein the modifying unit 701 is used for when the judging processing unit 602 judges that the authorization number of the new device is the same as that of the wireless device that has established a connection Modifying the authorization number of the renumbered wireless device in the established connection; the sending unit 702 is configured to notify the renumbered wireless device of the new authorization number modified in the modification unit 701 through a modification message number of wireless devices, and routing devices connected to the device.

The device embodiments described above are only illustrative, and the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in One place, or it can be distributed to multiple network elements. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. It can be understood and implemented by those skilled in the art without any creative effort.

Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be implemented by means of software plus a necessary general-purpose hardware platform, and of course also by hardware, but in many cases the former is a better implementation Way. Based on this understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art can be embodied in the form of software products, and the computer software products can be stored in storage media, such as ROM/RAM, disk , CD, etc., including several instructions to make a computer device (which may be a personal computer, server, or network device, etc.) execute the methods described in various embodiments or some parts of the embodiments of the present invention.

The embodiments of the present invention described above are not intended to limit the protection scope of the present invention. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims (11)

1. A method for strengthening network security, comprising: When a new wireless device accesses the network, the network side judges whether the authorization number of the new device is the same as that of the wireless device that has established a connection. If the number is the same, the access of the new device is rejected; otherwise, the Waiting to receive the message of the new device. 2. The method for strengthening network security according to claim 1, wherein when it is judged that the authorization number of the new device is the same as that of the wireless device that has established a connection, it further includes: The network side modifies the authorization number of the renumbered wireless device. 3. The method for strengthening network security as claimed in claim 2, further comprising: The network side notifies the modified authorization number of the renumbered wireless device to the renumbered wireless device and the routing device connected to the device through a modification message, requesting to change to the modified authorization number. Number. 4. The method for strengthening network security as claimed in claim 1, further comprising: In the process of establishing a connection with the wireless device, the network side sends an authorization number detection request message to the wireless device; After receiving the authorization number detection response message returned by the wireless device, the network side judges whether the authorization number in the response message is an authorization number that allows access, and if so, executes the determination step. 5. The method for strengthening network security according to claim 4, further comprising: before receiving the authorization number detection response message returned by the wireless device: The network side judges whether the authorization number detection response message returned by the wireless device is received within the preset maximum response time, and if so, performs the determination of whether the authorization number in the response message is allowed to access The authorization number step, otherwise, deny the access of the wireless device. 6. The method for strengthening network security as claimed in claim 1, wherein, after receiving the message of the new device, the method further comprises: The network side decrypts the received message according to the decryption method preset with the on-site control layer network where the new device is located; Then encrypt the message obtained after decryption according to the encryption method preset with the monitoring layer network on the network side, and send it to the monitoring layer network after encryption. 7. the method for strengthening network security as claimed in claim 1, is characterized in that, the address list of on-site control layer network equipment and monitoring layer network equipment is preserved in advance in the equipment of network side; After receiving the message of the new device, the method also includes: Judging whether the source address and the destination address in the received message exist in the address lists of the on-site control layer network device and the monitoring layer network device, if so, then forward the message; otherwise, discard the message. 8. the method for strengthening network security as claimed in claim 1, is characterized in that, access authority is all preset in each monitoring layer equipment of network side; When receiving the access request message sent to the on-site control layer device by the monitoring layer device, the method also includes: Judging whether the monitoring layer device sending the access request message has the access operation authority, if so, forwarding the access request message to the on-site control layer device; otherwise, refusing to forward the access request message. 9. A device for enhancing network security, comprising: The list unit is used to save the authorization numbers of all wireless devices that have established connections with the network; A judging processing unit, configured to judge whether the authorization number of the new device is the same as the authorization number stored in the list unit when a new wireless device accesses the network, and reject the access of the new device if the number is the same ; Otherwise, wait to receive the message of the new device. 10. The device for strengthening network security as claimed in claim 9, wherein the device further comprises: A modifying unit, configured to modify the authorization number of the wireless device whose number has been renumbered in the established connection when the judging processing unit judges that the authorization number of the new device is the same as that of the wireless device with the established connection; A sending unit, configured to notify the wireless device whose number has been renumbered and the routing device connected to the device through a modification message of the new authorization number modified by the modifying unit. 11. The device for enhancing network security according to claim 9 or 10, characterized in that the device is integrated on a wireless network security management server on the network side.

Images