Abstract
Network security has recently become a critical issue in the Internet community. Network administrators generally install network security devices, such as firewalls and Intrusion Detection and Prevention Systems (IPS), near the routers of an enterprise network to prevent attacks from the Internet. However, more than 80% of attacks on a network are launched from infected hosts inside its intranet. Therefore, the concept of defense-in-depth has emerged, to prevent attacks not only from the Internet, but also from internal hosts. Therefore, security switches provide first-mile protection, while network access control (NAC) technologies ensure that network endpoints are updated without vulnerability. This study proposes a scalable High Availability (HA) architecture for network security switches with hardware bypass ports. In this architecture, each “security switch” has a traditional layer-2 switch and a “security switch engine (SSE)”, which provides layer-7 packet inspection service and NAC functionality. These two components are connected via a Gigabit Ethernet link. The proposed security switch architecture is especially suitable for industrial networks where L2 switches are designed with special consideration and not probable to fully replacement. A mechanism is designed to interconnect the SSEs so that the “security switches” group provides HA. Experimental results indicate that the system reliability is still high when many SSEs are linked with low reliability. A mathematical analysis model is also proposed, and the analytical results are confirmed by the experimental results. A mathematical analysis model is also proposed, and the analytical results are confirmed by the experimental results. Most importantly, the SSE can be realized on a high-performance but cost-effective standard IPC, meaning that the proposed HA security system can be implemented in a very cost-efficient way. Ring-based industrial networks must possess a fast recovery algorithm when either the switch node or link is faulty. This work also presents a simple yet extremely fast recovery algorithm based on the last-in-backup (LIB) concept, in which the final link added to the ring is the backup link. When link failure occurs later on, the backup link can be activated immediately to recover the ring. Construction time of the spanning tree and link-down recovery time of the proposed mechanism are also analyzed. Analysis results indicate the proposed LIB algorithm performs significantly better than the state-of-the-art MRP protocol developed in the latest version of the IEC 62439 standard. The proposed LIB algorithm is implemented in industrial Ethernet switches as well. Our results further demonstrate that the proposed recovery algorithm is extremely feasible with a link-down recovery time of 5.5ms for 50 switches and 6.5ms for 250 switches.