Modbus TCP security protection method and device

Abstract

The invention discloses a security protection method and device for Modbus TCP communication. The method comprises the following steps: when receiving a Modbus TCP data packet, checking the legality of multiple pieces of preset tuple information of a data packet transmission layer; detecting the legality of the data format of the data packet application layer; detecting the legality of a functioncode in the data packet; detecting the legality of a current communication session transaction access rate; and detecting the legality of a register or a coil of the data packet. It can thus be seen that the access rate of the Modbus TCP communication session is limited, so as to block the data packet in the current communication process when the access rate exceeds a preset access rate threshold,so that the flood attack of the access is securely protected, and the security of the communication session is ensured; also, fake information and illegal transaction access function codes are blocked, and illegal register values or coil values are prevented from being written.

Description

technical field [0001] The invention relates to the field of data security, in particular to a Modbus TCP security protection method and device. Background technique [0002] With the rapid development of deep integration of informatization and industrialization, more and more standard and open communication protocols are used in industrial control systems, and the security risks of communication protocols are becoming increasingly prominent. Among them, the Modbus TCP protocol, as an industrial standard, provides an open and unified standard interface between field devices, automatic control applications, and enterprise management application software, and the Modbus TCP protocol has been widely used in the control field. However, as the Modbus TCP protocol is widely used, the security issues of the Modbus TCP protocol are also more and more widely concerned. [0003] In the prior art, in the process of protecting the Modbus TCP protocol, the access flood attack is not pro...

AI Technical Summary

Problems solved by technology

[0003] In the prior art, in the process of protecting the Modbus TCP protocol, the access flood attack is not protected, that is, when the data access rate of the master station to the slave station is too high, the data of the slave station may be affected. Processing performance, even cause the slave station to crash, thus affecting the ModbusTCP communication between the master station and the slave station

Images