CN106790113A - A kind of hardware firewall configuring management method and device - Google Patents

Abstract

The invention discloses a hardware firewall configuration management method and device. The device comprises: a PC, a configuration management circuit and a hardware firewall module. The PC is connected with the configuration management circuit through the network cable, and the configuration management circuit is connected with the hardware firewall module through the RMII interface. The PC sends relevant configuration information to the configuration management circuit, and the configuration management circuit stores the relevant configuration information and forwards it to the hardware firewall module through the RMII interface. The configuration management circuit includes a power supply module, a 100M Ethernet interface module, an MCU module, an EEPROM module, a FLASH module, and an RMII interface module. The invention provides a solution to the configuration and management of multiple hardware firewalls when they are connected to internal and external networks. The configuration is convenient and the management is easy. The status of each hardware firewall can be checked at any time, and data transmission between certain internal and external networks is allowed or restricted.

Description

A hardware firewall configuration management method and device

technical field

The invention relates to the field of network security technology, network communication technology and embedded system, in particular to a hardware firewall configuration management method and device, which are used to configure and manage multiple hardware firewalls connected to internal and external networks.

Background technique

Embedded system is a special-purpose computer system based on application-centric hardware design and application-oriented software product development, widely used in manufacturing industry, process control, communication, instrument, meter, automobile, ship, aviation, aerospace, military equipment , consumer products and other fields. Typical embedded applications are hardware design based on microprocessor or microcontroller and software development based on embedded real-time operating system. The rapid development of network technology provides the necessary network infrastructure for the networking of embedded devices. Various protocol standards for connecting embedded devices to the network have been formulated to form various home device networks, personal information networks, and small office networks. , network applications have become an emerging application field of embedded systems, and embedded products connected to the network will provide a broader market and applications in the near future.

Today, as network security is getting more and more attention, hardware firewalls are becoming more and more popular. However, in a large-scale network system, when the internal network needs to be connected to multiple external networks, in order to protect the internal network from the invasion of illegal external users, multiple hardware firewalls must be connected. Multiple hardware firewalls can lead to confusion and errors when checking connections and configuring them. Therefore, the configuration of multiple hardware firewalls requires special equipment to simplify operations and perform unified management of multiple hardware firewalls.

Contents of the invention

The purpose of the present invention is to address the deficiencies in the prior art, and propose a hardware firewall configuration management method and device when multiple hardware firewalls are connected, the method provides configuration and management of multiple dedicated hardware firewalls when connecting to internal and external networks It is easy to configure and manage, and you can check the status of each hardware firewall at any time and change the configuration content at any time.

The purpose of the present invention is achieved like this:

A hardware firewall configuration management method is characterized in that the method includes the following specific steps:

a) Set configuration information in the PC, the configuration information is a network communication protocol, including a 56-byte message header and an unlimited data part; wherein, the message header identifies the type of configuration information, and the data The part is the specific configuration content, and the configuration content of the data part includes the basic parameters of the hardware firewall module and the rules that the hardware firewall module allows or restricts certain data transmission between internal and external networks. The configuration information is sent to the configuration management circuit through the network cable, and is processed by the MCU module in the configuration management circuit;

b) The MCU module judges the type of configuration information, and stores the configuration information in the EEPROM module and the FLASH module respectively;

c) The MCU module uses the configuration information stored in the EEPRON module to configure the basic parameters of the hardware firewall module. The basic parameters include the hardware firewall module ID, model, user name and password, IP address, port number, and the way the hardware firewall module obtains configuration information;

d) The MCU module sends the configuration information stored in the FLASH module to the hardware firewall module through the RMII interface, which is used to configure the rules that the hardware firewall module allows or restricts certain data transmission between internal and external networks.

Step c) configures the basic parameters of the hardware firewall module, specifically including the following steps:

ⅰ) Judging the 7th byte of the header of the configuration information message to determine the type of configuration information;

ii) Judging the 18th and 19th bytes of the header of the configuration information message to determine the type of the basic parameters to be configured;

iii) Judging the 20th byte of the header of the configuration information message to determine the number of basic parameters to be configured;

ⅳ) If the corresponding byte information of the packet header of the extracted configuration information meets the requirements, configure the data part according to the category, parameter type and parameter quantity.

A device for implementing the above method, the device includes a PC, a configuration management circuit and a hardware firewall module, the PC is connected to the configuration management circuit through a network cable, and the configuration management circuit is connected to the hardware firewall module; the configuration management circuit includes a power supply module , 100M Ethernet interface module, MCU module, EEPROM module, FLASH module and RMII interface module. Module, PMII interface module connection.

Compared with prior art, the beneficial effect of the present invention is:

(1) The core control part of the configuration management circuit of the present invention adopts the real-time operating system of RT-Thread and the LWIP protocol stack, which has good robustness and flexible control.

(2) The network communication protocol used in the present invention ensures the security of network communication. Even if the configuration information is intercepted by an illegal user, there is no way to know its meaning.

(3) The present invention is very convenient for the configuration of multiple hardware firewalls, and the management is easy, and the status of the hardware firewalls can be checked at any time, and the configuration content can be changed at any time.

Description of drawings

Fig. 1 is the schematic diagram of device structure of the present invention;

Fig. 2 is a structural block diagram of configuration management circuit of the present invention;

Fig. 3 is the working flow chart of the present invention.

detailed description,

Referring to Fig. 1, Fig. 1 is a schematic diagram of the structure of the device of the present invention; PC A sends the configuration information to the configuration management circuit C through the network cable, and then the MCU module in the configuration management circuit C processes the configuration information, and then configures the configuration information. The basic parameters of the hardware firewall module B, and finally forward the corresponding configuration information to the hardware firewall module B, and complete the configuration of the hardware firewall module B to allow or restrict certain data transmission rules between the internal and external networks.

Referring to Figure 2, A represents a PC, and B represents a hardware firewall module. The configuration management circuit includes a power supply module 1, an MCU module 2, a 100M Ethernet interface module 3, an EEPROM module 4, a FLASH module 5 and an RMII interface module 6, wherein:

The power supply module 1 is connected with the MCU module 2 and the 100M Ethernet interface module 3 to supply power for the entire configuration management circuit;

MCU module 2 is connected with 100M Ethernet module 3, EEPROM module 4, FLASH module 5 and RMII interface module 6 respectively, and is the core processing control module, receiving the configuration information of PC A and storing it in EEPROM module 4 and FLASH module 5 , and read the configuration information of the EEPROM module 4 to configure the basic parameters of the hardware firewall module, read the configuration information in the FLASH module 5 and send it to the hardware firewall module;

The 100M Ethernet interface module 3 is connected to PC A through a network cable, and receives the configuration information sent by PC A;

The EEPROM module 4 is connected with the MCU module 2, and stores configuration information of the basic parameters of the hardware firewall module;

The FLASH module 5 is connected with the MCU module 2, and the storage hardware firewall module is set to allow configuration information of internal and external network communication rules;

The RMII interface module 6 is connected with the MCU module 2, communicates with the hardware firewall module, and sends configuration information to the hardware firewall module.

Referring to Fig. 3, the present invention works like this:

First, PC A is connected to the configuration management circuit through the 100M Ethernet interface module 3, and the hardware firewall module B is connected to the configuration management circuit through the RMII interface module 6. The configuration information of the basic parameters of the hardware firewall module is sent from the PC A to the configuration management circuit. The basic parameters include the hardware firewall ID, model, user name and password, IP address, port number and the way the hardware firewall obtains configuration information from the configuration management circuit. There are two ways for the hardware firewall module to obtain configuration information from the configuration management circuit: directly read the initialization configuration information from the FLASH module 5, and wait for the configuration information sent by the PC A and forwarded by the MCU module 2. There will be initial configuration information in the EEPROM module 4, generally only need to send the configuration content that needs to be changed.

The MCU module 2 stores the configuration content to be changed in the EEPROM module 4, and changes the relevant parameters of the hardware firewall module according to the content. After the configuration is completed, MCU module 2 sends a response to PC A. If the configuration fails, operate PC A to send the configuration information again.

The configuration information for configuring the rules of the hardware firewall module B is sent from the PC A to the configuration management circuit, and the configuration information includes the IP address, MAC address and port number for allowing the external network to access the internal network. These configuration information determine the internal network and which external networks can transmit network data.

The MCU module 2 stores the configuration information into the FLASH module 5 and sends it to the hardware firewall module B through the RMII interface 6 . At this time, the hardware firewall module will reply a message, if the sending fails, the MCU module 2 will read the configuration information from the FLASH module 5 and send it to the hardware firewall module again. If the sending is successful, the configuration process ends.

Claims (3)

1. a kind of hardware firewall configuring management method, it is characterised in that the method includes step in detail below：

Configuration information is set in PC, and configuration information is sent to configuration management circuit by netting twine, by configuration management circuit MCU module processed；The configuration information is a kind of network communication protocol, including the heading of 56 bytes and unrestricted Data division；Wherein, heading identifies the classification of configuration information, and data division is specific configuration content, its configuration Content includes that the basic parameter and hardware firewall module of hardware firewall module allow or limit data between some intranet and extranet The rule of transmission；

MCU module judges the classification of configuration information, and configuration information is respectively stored into EEPROM module and FLASH modules；

Configuration information of the MCU module using storage in EEPRON modules, configures the basic parameter of hardware firewall module；It is described Basic parameter includes hardware firewall module I D, model, user name password, IP address, port numbers and hardware firewall module Obtain the mode of configuration information；

The configuration information that MCU module will be stored in FLASH modules is sent to hardware firewall module by RMII interfaces, is used for The rule of data transfer between configuring the permission of hardware firewall module or limiting some intranet and extranet.

2. hardware firewall configuring management method according to claim 1, it is characterised in that：Step c）The configuration hardware The basic parameter of FWSM, specifically includes following steps：

ⅰ）Judge the byte of configuration information heading the 7th to determine the classification of configuration information；

ⅱ）Judge configuration information heading the 18th, 19 bytes to determine the type of basic parameter that will be configured；

ⅲ）Judge the byte of configuration information heading the 20th to determine the quantity of basic parameter that will be configured；

ⅳ）If the heading respective byte information of configuration information extracted all meets the requirements, by data division according to classification, Parameter type and number of parameters are configured.

3. it is a kind of implement claim 1 methods described device, it is characterised in that the device include PC, configuration management circuit and Hardware firewall module, PC is connected by netting twine with configuration management circuit, configuration management circuit and hardware firewall module phase Even；Described configuration management circuit includes power module, 100 m ethernet interface module, MCU module, EEPROM module, FLASH Module and RMII interface modules, power module are connected with MCU module, 100 m ethernet interface module, and MCU module is respectively with 100,000,000 Ethernet interface module, EEPROM module, FLASH modules, the connection of PMII interface modules.