Security protection method and system for DNP3 protocol

Abstract

The invention provides a security protection method and system for a DNP3 protocol. The method comprises the following steps: extracting a TCP protocol application layer data packet in a TCP / IP message of an internet access of a DNP3 client; analyzing the data packet according to a frame structure defined by a DNP3 protocol, extracting a feature data frame conforming to a format defined by the DNP3 protocol in the data packet, judging whether the feature data frame contains a service interface or not, and if not, discarding the TCP / IP message; checking a service interface white list of the feature data frame according to a DNP3 protocol, judging whether the feature data frame is legal or not, and if not, discarding the TCP / IP message; and extracting a request data frame in the feature data frame, checking an object group variant white list of the request data frame according to a DNP3 protocol to judge whether the request data frame is legal or not, if so, allowing the TCP / IP message to be transmitted to a DNP3 server, and otherwise, discarding the TCP / IP message. According to the invention, the security protection of the DNP3 protocol is realized, and a basis is provided for the construction of a DNP3 protocol firewall.

Description

technical field [0001] The invention relates to the technical field of industrial information, in particular to a safety protection method and system for the DNP3 protocol. Background technique [0002] In the field of industrial control, in order to realize the interoperability between the application software and hardware products of the industrial control system, it is necessary to solve the problems of system integration and data communication at the application level. DNP is called Distributed Network Protocol, which is a telecontrol communication protocol launched by HARRS company, and is a mainstream communication protocol in the current power system automation product market. DNP3 is a national standard formulated by the American IEEE Electrical Engineering Society on the basis of IEC. [0003] With the deep integration of industry and information technology, in industrial enterprises such as electric power, energy, chemical industry, water conservancy, pharmaceutic...

AI Technical Summary

Problems solved by technology

[0004] However, in the interconnection between the enterprise information network and the industrial control network, there are also some security risks. The common security threats in the enterprise information network are introduced into the industrial control network, such as network viruses, hacker attacks, and malicious operations. The industrial control network brings serious information security problems, and the "Stuxnet" virus incident is a typical example

Since the data exchange between hardware suppliers and software developers is transparent as long as the DNP3 rules are followed, more and more security risks are introduced

Images