An active network defense system for embedded and its defense method

Abstract

An active network defense system for embedded equipment includes a network protocol stack module and an active network defense module. The active network defense module comprises a firewall upper-layer module and a firewall bottom-layer module. The firewall upper-layer module includes a message detection module and an exception handling module. A system defense method includes: 1, installing an active network defense system; 2, enabling the message detection module to analyzes a received network message to determine whether the message has a problem, directly transmitting the message to a protocol stack if not, or going to the next step if so; 3, enabling an exception handling unit to determine whether an exception message is an attack message, going to the next step if so, or sending a request message to query the real environment of the network and returning to step 2 if not; 4, discarding the current message, setting a white / black list, and opening a bottom-layer filter. The active network defense system for embedded equipment has characteristics of active identification and defense, and can prevent common embedded network attacks suffered by embedded equipment, thereby protecting the network security of the embedded equipment.

Description

technical field [0001] The invention belongs to the embedded field, in particular to an embedded active network defense system and a defense method thereof. Background technique [0002] With the rapid development of embedded devices, more and more embedded devices are being connected to the network in their applications, such as automotive electronic equipment, medical equipment and power equipment. When these devices are able to access the network, if adequate security issues are not considered, then they will be vulnerable to cyber attacks. Without some corresponding security measures, these attacks may damage the functions, systems and information inside the device. [0003] Nowadays, there are many network firewalls on the market, but most of these firewalls are used in the fields of servers, enterprises and personal PCs. There are relatively few network firewalls for embedded devices. [0004] The existing embedded network firewall currently has the following defect...

AI Technical Summary

Problems solved by technology

[0012] The exception handling module is used to handle exceptions after packet detection finds problems. The exception handling methods are divided into two types: the first one is for network packets that can clearly determine problems, such as SYN floods, network storms, Distributed denial-of-service attacks, etc., the exception handling module notifies the firewall filter of the driver layer, and starts to perform corresponding filtering operations on the network packets received by the embedded device; ARP spoofing, replay attacks, etc., the exception handling module actively sends request messages, asks the device communicating with it, and determines whether there is a problem

Images