A device network protection method and system based on system management bus

Abstract

The present invention relates to the field of network protection technology, and in particular to a device network protection method and system based on a system management bus; firstly, a preset address white list is obtained through a relay controller and stored; when a master device obtains access request information from an external device, corresponding serial data is generated based on the access request information, and the serial data includes a device address of a slave device requested to be accessed, and a register address of the slave device requested to be accessed; through the serial data, it is possible to know which slave device the external device wants to access, and the business data in which register of the slave device is to be accessed; then, the relay controller determines whether the register in the slave device that the external device wants to access is allowed to be accessed by the external device based on the preset address white list, and if the access is not allowed, the serial data is intercepted, that is, the sending of serial data to the corresponding slave device is prohibited; thereby realizing network protection for the slave device and avoiding malicious traffic attacks.

Description

Technical Field

[0001] The present invention relates to the technical field of network protection, and in particular to a device network protection method and system based on a system management bus. Background Art

[0002] SMBus (System Management Bus) is a low-speed communication bus proposed for use in computing device systems in 1995. Its purpose is to control devices on the motherboard and collect corresponding information through a low-cost and powerful bus (consisting of two lines); that is, the motherboard usually establishes communication connections between master devices and slave devices through the SMBus bus.

[0003] With the rapid development of computer technology, various types of network attacks have begun to appear. Among them, PDoS (Permanent denial-of-service attacks / phlashing) attacks can cause permanent hardware paralysis to the server's firmware, which must be updated to recover. Since the firmware retains the highest control authority, PDoS attacks on firmware can bypass traditional control attacks and are more difficult to prevent. At present, the slave devices on the motherboard do not have network protection functions and cannot avoid malicious traffic attacks. Summary of the invention

[0004] The main purpose of the present invention is to provide a device network protection method and system based on a system management bus, aiming to solve the problem that the slave device on the mainboard does not have a network protection function and cannot avoid being attacked by malicious traffic.

[0005] The technical solution proposed by the present invention is:

[0006] A device network protection method based on a system management bus is applied to a device network protection system based on a system management bus; the system includes a master device, a transfer controller and a slave device; the master device and the slave device are connected to the transfer controller via SMBus communication; the slave device includes a plurality of registers, each register is correspondingly provided with a unique register address, and the register is used to store business data; the master device is connected to an external device via Internet communication; the method includes:

[0007] The transfer controller obtains the preset address whitelist and stores it;

[0008] The master device obtains access request information from the external device, and generates corresponding serial data based on the access request information, wherein the serial data includes a device address of the slave device that the external device requests to access, and a register address of the slave device that the external device requests to access;

[0009] The master device marks the device address of the slave device that the external device requests to access in the serial data as the first target address, and marks the register address of the slave device that the external device requests to access in the serial data as the second target address;

[0010] The master device sends serial data to the relay controller via SMBus;

[0011] The transfer controller determines whether to intercept the serial data based on the preset address whitelist;

[0012] If so, the relay controller prohibits sending serial data to the slave device corresponding to the first target address;

[0013] If not, the relay controller sends the serial data to the slave device corresponding to the first target address via the SMBus.

[0014] Preferably, the number of slave devices and the preset address whitelist are consistent and both are multiple, and the slave devices and the preset address whitelist correspond to each other one by one; the preset address whitelist includes the register address of the corresponding slave device that the external device is allowed to access; the transfer controller determines whether to intercept the serial data based on the preset address whitelist, including:

[0015] The transfer controller marks the slave device corresponding to the first target address in the serial data as the first target device;

[0016] The transfer controller determines a preset address white list corresponding to the first target device, and establishes a correspondence between the serial data corresponding to the same first target device and the preset address white list;

[0017] The transfer controller determines whether the second target address in the serial data exists in the corresponding preset address white list;

[0018] If so, the relay controller determines not to intercept the serial data;

[0019] If not, the transit controller determines to intercept the serial data, prohibits sending the serial data to the first target device within a first preset time, and sends a stop response instruction to the master device;

[0020] After receiving the stop response instruction, the master device prohibits sending serial data to the transfer controller within a first preset time period.

[0021] Preferably, the first target address is a binary code of a first preset number of digits; the second target address is a binary code of a second preset number of digits; the transfer controller determines whether to intercept the serial data based on the preset address whitelist, and the above also includes:

[0022] The transfer controller determines whether the serial data includes an instruction to write or modify the business data in the register of the slave device;

[0023] If so, executing the step of determining whether to intercept the serial data based on the preset address whitelist by the transfer controller;

[0024] If not, the relay controller sends the serial data to the slave device corresponding to the first target address via the SMBus.

[0025] Preferably, the SMBus includes an SDA data line and an SCL clock line; the serial data includes address bit data, instruction bit data and execution bit data arranged from front to back and transmitted on the SDA data line; when the SDA data line performs data transmission, the SCL clock line alternates between high level and low level; the transfer controller prohibits sending serial data to the slave device corresponding to the first target address, including:

[0026] The transfer controller sets all the corresponding SCL clock lines when the SDA data line transmits the execution bit data to a high level, so as to prohibit the execution bit data from being sent to the slave device corresponding to the first target address.

[0027] Preferably, the system further comprises a host computer connected to the transfer controller via an APB bus; the transfer controller obtains and stores a preset address whitelist, including:

[0028] The host computer generates a preset address whitelist;

[0029] The host computer sends the preset address whitelist to the transfer controller through the APB bus and stores it.

[0030] Preferably, it also includes:

[0031] The host computer marks the slave device whose preset address whitelist is to be updated as a suspended device;

[0032] The host computer generates a new preset address whitelist corresponding to the suspended device, and marks the time when the new preset address whitelist is generated as the starting time;

[0033] The host computer sends the new preset address whitelist to the transfer controller;

[0034] The transfer controller updates the preset address whitelist currently corresponding to the paused device with the received new preset address whitelist, and marks the time when the update is completed as the end time;

[0035] From the start time to the end time, the transfer controller prohibits sending serial data to the paused device.

[0036] Preferably, it also includes:

[0037] The transfer controller marks the intercepted serial data as risky data and sends the risky data to the main device;

[0038] The master device marks the external device corresponding to the risk data from the transit controller as a risk device;

[0039] The main device obtains the IP address of the risky device and marks it as a risky address;

[0040] When the main device obtains access request information from an external device, it determines whether the address of the external device that sends the access request information is a risky address;

[0041] If so, the main device determines that the external device sending the access request information is a risky device, and determines the ban duration of the risky device based on the access request information sent by the risky device;

[0042] The main device disconnects the network connection with the risky device, and the disconnection duration is the blocking duration.

[0043] Preferably, the same serial data includes one first target address and at least one second target address; the master device determines that the external device sending the access request information is a risky device, and determines the ban duration of the risky device based on the access request information sent by the risky device, including:

[0044] The master device generates corresponding serial data based on the access request information sent by the risky device, and marks it as data to be analyzed;

[0045] The master device obtains the total number of second target addresses in the data to be analyzed;

[0046] The master device obtains a preset address whitelist corresponding to the first target address in the data to be analyzed, and marks it as a list to be analyzed;

[0047] The master device obtains the number of second target addresses in the to-be-analyzed list from the to-be-analyzed data, and marks the number as risk-free;

[0048] The master device calculates the ban duration of the risky device based on the total number and the risk-free number:

[0049] ,

[0050] In the formula, The duration of the ban; It is the standard duration, and its value is greater than 0; is the risk-free quantity; is the total quantity stated.

[0051] Preferably, it also includes:

[0052] The transfer controller establishes a corresponding relationship between the intercepted serial data and the slave device corresponding to the first target address of the intercepted serial data;

[0053] The transfer controller obtains the number of serial data that have been intercepted corresponding to each slave device within the past second preset time length, and marks the slave device whose number of serial data that has been intercepted is greater than the third preset number as a device to be processed;

[0054] The transfer controller obtains the second target address that does not exist in the preset address whitelist from the intercepted serial data corresponding to the device to be processed, and marks it as an encrypted address;

[0055] The transfer controller marks other register addresses in the device to be processed except the encrypted address and the preset address white list as safe addresses;

[0056] The transfer controller randomly selects a fourth preset number of secure addresses and marks them as addresses to be transferred, and makes the addresses to be transferred correspond to the encrypted addresses one by one, wherein the fourth preset number is consistent with the number of encrypted addresses;

[0057] The device to be processed stores the service data in the register whose address is the encrypted address in the register whose address is the corresponding address to be transferred, and deletes the service data in the register whose address is the encrypted address.

[0058] The present invention also proposes a device network protection system based on a system management bus, which applies a device network protection method based on a system management bus; the system includes a master device, a transit controller and a slave device; the master device and the slave device are both connected to the transit controller via SMBus communication; the slave device includes a plurality of registers, each register is correspondingly provided with a unique register address, and the register is used to store business data; the master device is connected to an external device via Internet communication.

[0059] Through the above technical solution, the following beneficial effects can be achieved:

[0060] The present invention proposes a device network protection method based on a system management bus, which can perform network security protection on slave devices; the specific scheme is: first, a preset address white list is obtained through a transit controller and stored; when the master device obtains access request information from an external device, corresponding serial data is generated based on the access request information, and the serial data includes a device address of the slave device requested to be accessed (i.e., a first target address), and a register address of the slave device requested to be accessed (i.e., a second target address); through the serial data, it can be known which slave device the external device wants to access, and the business data in which register of the slave device is to be accessed; then the transit controller determines whether the register in the slave device that the external device wants to access is allowed to be accessed by the external device based on the preset address white list, and if access is not allowed, the serial data is intercepted, that is, the sending of serial data to the slave device corresponding to the first target address is prohibited; thereby achieving network protection for the slave device and avoiding malicious traffic attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying creative work.

[0062] Figure 1 A flowchart of a first embodiment of a device network protection method based on a system management bus proposed by the present invention;

[0063] Figure 2 This is a structural block diagram of a device network protection system based on a system management bus proposed by the present invention;

[0064] Figure 3 A timing diagram of the SMBus communication between the main device and the transfer controller in the device network protection system based on the system management bus proposed by the present invention;

[0065] Figure 4 The present invention provides a timing diagram corresponding to the interception of serial data by a transfer controller of a device network protection system based on a system management bus (SMBus) and a slave device. DETAILED DESCRIPTION

[0066] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0067] The present invention provides a device network protection method and system based on a system management bus.

[0068] As attached Figure 1 and attached Figure 2 As shown, in a first embodiment of a device network protection method based on a system management bus proposed by the present invention, the method is applied to a device network protection system based on a system management bus; the system includes a master device, a transfer controller and a slave device; the master device and the slave device are both connected to the transfer controller via SMBus communication (the transfer controller here can be an FPGA module (Field Programmable Gate Array, field programmable gate array), CPLD (Complex Programmable Logic Device, i.e., complex programmable logic device), CPU (central processing unit), preferably an FPGA module in this embodiment); the slave device includes a plurality of registers, each register is correspondingly provided with a unique register address, and the register is used to store business data; the master device is connected to an external device via Internet communication; this embodiment includes the following steps:

[0069] Step S110: The transfer controller obtains and stores a preset address whitelist.

[0070] Specifically, the preset address whitelist here is the register address of the slave device that the external device is allowed to access.

[0071] Step S120: the master device obtains access request information from the external device, and generates corresponding serial data based on the access request information, wherein the serial data includes the device address of the slave device that the external device requests to access, and the register address of the slave device that the external device requests to access.

[0072] Specifically, the serial data can be used to know which slave device the external device wants to access, and the service data in which register of the slave device is to be accessed.

[0073] Step S130: the master device marks the device address of the slave device that the external device requests to access in the serial data as the first target address, and marks the register address of the slave device that the external device requests to access in the serial data as the second target address.

[0074] Step S140: The master device sends the serial data to the transfer controller via the SMBus.

[0075] Specifically, SMBus is a serial bus consisting of two lines, an SDA data line and an SCL clock line, which can send and receive data.

[0076] Step S150: The transfer controller determines whether to intercept the serial data based on the preset address whitelist.

[0077] Specifically, when the second target address in the serial data is not in the preset address whitelist, it means that the register requested to be accessed by the external device is a register that is not allowed to be accessed by the external device, and it is estimated that interception is required to achieve network protection for the slave device to avoid malicious traffic attacks; otherwise, no interception operation is performed.

[0078] If yes, execute step S160: the transfer controller prohibits sending serial data to the slave device corresponding to the first target address.

[0079] If not, executing step S170: the transfer controller sends serial data to the slave device corresponding to the first target address via the SMBus.

[0080] The present invention proposes a device network protection method based on a system management bus, which can perform network security protection on slave devices; the specific scheme is: first, a preset address white list is obtained through a transit controller and stored; when the master device obtains access request information from an external device, corresponding serial data is generated based on the access request information, and the serial data includes a device address of the slave device requested to be accessed (i.e., a first target address), and a register address of the slave device requested to be accessed (i.e., a second target address); through the serial data, it can be known which slave device the external device wants to access, and the business data in which register of the slave device is to be accessed; then the transit controller determines whether the register in the slave device that the external device wants to access is allowed to be accessed by the external device based on the preset address white list, and if access is not allowed, the serial data is intercepted, that is, the sending of serial data to the slave device corresponding to the first target address is prohibited; thereby achieving network protection for the slave device and avoiding malicious traffic attacks.

[0081] In a second embodiment of a device network protection method based on a system management bus proposed by the present invention, based on the first embodiment, the number of slave devices and the preset address whitelist are consistent and both are multiple, and the slave devices and the preset address whitelist correspond to each other one by one; the preset address whitelist includes register addresses in the corresponding slave device that are allowed to be accessed by external devices (for the slave device, registers not in the preset address whitelist are registers that need to be protected, and the business data in these registers are not allowed to be accessed by external devices); step S150 includes the following steps:

[0082] Step S210: the transfer controller marks the slave device corresponding to the first target address in the serial data as the first target device.

[0083] Specifically, the first target device here is the slave device that the external device corresponding to the current serial data wants to access.

[0084] Step S220: the transfer controller determines a preset address white list corresponding to the first target device, and establishes a correspondence between the serial data corresponding to the same first target device and the preset address white list.

[0085] Step S230: The transfer controller determines whether the second target address in the serial data exists in the corresponding preset address whitelist.

[0086] Specifically, if the second target address in the serial data is in the preset address whitelist, it means that the register of the slave device that the external device wants to access is a register that is allowed to be accessed, and no interception is required; otherwise, it means that the register of the slave device that the external device wants to access is a register that is not allowed to be accessed, and interception is required.

[0087] If so, execute step S240: the transfer controller determines not to intercept the serial data.

[0088] If not, execute step S250: the transit controller determines to intercept the serial data, prohibits sending the serial data to the first target device within a first preset time period (eg, 24 hours), and sends a stop response instruction to the main device.

[0089] Specifically, if interception is required, any serial data is directly prohibited from being sent to the first target device for a first preset time period, thereby providing security protection for the first target device.

[0090] Step S260: After receiving the stop response instruction, the master device prohibits sending serial data to the transfer controller within a first preset time period.

[0091] Specifically, when serial data that needs to be intercepted appears, it indicates that there is an external device with malicious attacks, so the master device directly prohibits sending any serial data to the transfer controller within a first preset time period, thereby further providing security protection for all slave devices.

[0092] In a third embodiment of a device network protection method based on a system management bus proposed by the present invention, based on the second embodiment, the first target address is a binary code of a first preset number of bits (in this embodiment, the first preset number is 7, that is, the first target address is a 7-bit binary code, so the number of first target addresses is at most 2 to the seventh power, that is, 128; because different first target addresses correspond to different slave devices, the number of slave devices is at most 128, so the maximum number of preset address whitelists is also 128); the second target address is a binary code of a second preset number of bits (in this embodiment, the first preset number is 8, that is, the second target address is an 8-bit binary code); step S150, before which also includes the following steps:

[0093] Step S310: The transit controller determines whether the serial data includes an instruction to write or modify the service data in the register of the slave device.

[0094] Specifically, interception judgment is required only when the serial data includes instructions for writing or modifying the service data in the register of the slave device.

[0095] If so, execute step S150.

[0096] If not, executing step S320: the transfer controller sends serial data to the slave device corresponding to the first target address via the SMBus.

[0097] Specifically, when the serial data does not include instructions for writing or modifying the business data in the register of the slave device, it means that the external device only reads the business data in the register of the slave device and does not modify or write new data, and does not cause substantial damage to the business data in the register. Therefore, there is no need to intercept it, so the serial data is sent directly to the slave device corresponding to the first target address through the SMBus.

[0098] In a fourth embodiment of a device network protection method based on a system management bus proposed by the present invention, based on the second embodiment, the SMBus includes an SDA (Serial Data) data line and an SCL (Serial Clock Line) clock line; the serial data includes address bit data, instruction bit data and execution bit data arranged from front to back and transmitted on the SDA data line; when the SDA data line performs data transmission, the SCL clock line alternates between high level and low level; step S160 includes the following steps:

[0099] Step S410: the transfer controller sets all the SCL clock lines corresponding to the SDA data line when transmitting the execution bit data to high level, so as to prohibit the execution bit data from being sent to the slave device corresponding to the first target address.

[0100] Specifically, as attached Figure 3 and attached Figure 4As shown; when the transit controller prohibits sending serial data to the slave device corresponding to the first target address, by setting all the SCL clock lines between the transit controller and the slave device corresponding to the SDA data line between the transit controller and the slave device transmitting the execution bit data to a high level, the slave device receiving the serial data cannot correctly read the execution bit data transmitted by the SDA data line between the transit controller and the slave device based on the SCL clock line between the transit controller and the slave device, so as to intercept the execution bit data, thereby achieving the purpose of prohibiting the sending of execution bit data to the slave device corresponding to the first target address; after intercepting the execution bit data, even if the slave device receives the address bit data and the instruction bit data, the purpose of the external device accessing the business data in the register cannot be achieved.

[0101] Specifically, as attached Figure 3 and attached Figure 4 As shown in the figure, in the data transmitted by the SDA data line, the S bit is the data start flag, the P bit is the data end flag, the W bit indicates that the master device is writing data to the slave device, and the A bit is the continuous read and write flag.

[0102] In a fifth embodiment of a device network protection method based on a system management bus proposed by the present invention, based on the second embodiment, the system further includes a host computer that is communicatively connected to the transfer controller via an Advanced Peripheral Bus (APB) bus; step S110 includes the following steps:

[0103] Step S510: The host computer generates a preset address whitelist.

[0104] Step S520: The host computer sends the preset address whitelist to the transfer controller via the APB bus and stores it.

[0105] Specifically, this embodiment provides a technical solution for generating a preset address whitelist and sending it to the transit controller for storage.

[0106] In a sixth embodiment of a device network protection method based on a system management bus proposed by the present invention, based on the fifth embodiment, this embodiment further includes the following steps:

[0107] Step S610: the host computer marks the slave device in the preset address whitelist to be updated as a suspended device.

[0108] Specifically, the preset address whitelist corresponding to the slave device is not static and may need to be updated during use, so the slave device whose preset address whitelist is to be updated is marked as a suspended device.

[0109] Step S620: the host computer generates a new preset address whitelist corresponding to the paused device, and marks the time when the new preset address whitelist is generated as the starting time.

[0110] Specifically, the preset address whitelist generated here can be input by the administrator.

[0111] Step S630: The host computer sends the new preset address whitelist to the transfer controller.

[0112] Step S640: the transfer controller updates the preset address whitelist currently corresponding to the paused device to the received new preset address whitelist, and marks the time when the update is completed as the end time.

[0113] Step S650: From the start time to the end time, the transfer controller prohibits sending serial data to the paused device.

[0114] Specifically, during the period from the start time to the end time, the paused device is updating the preset address whitelist. In order to improve security protection, it is possible to prohibit sending any serial data to the paused device during this period.

[0115] In a seventh embodiment of a device network protection method based on a system management bus proposed by the present invention, based on the first embodiment, this embodiment further includes the following steps:

[0116] Step S710: The transit controller marks the intercepted serial data as risky data, and sends the risky data to the main device.

[0117] Step S720: the master device marks the external device corresponding to the risk data from the transit controller as a risky device, and the master device obtains the IP address of the risky device and marks it as a risky address.

[0118] Step S730: When the main device obtains access request information from the external device, it determines whether the address of the external device sending the access request information is a risky address.

[0119] If yes, step S740 is executed: the master device determines that the external device sending the access request information is a risky device, and determines the blocking duration of the risky device based on the access request information sent by the risky device.

[0120] Specifically, if yes, it means that the master device has received access request information from the risky device again.

[0121] Step S750: the master device disconnects the network connection with the risky device, and the disconnection duration is the blocking duration.

[0122] Specifically, when the main device receives access request information from the risky device again, in order to avoid network attacks, it needs to disconnect the network connection with the risky device, and the disconnection duration is determined according to the risk level of the access request information of the risky device.

[0123] In an eighth embodiment of a device network protection method based on a system management bus proposed by the present invention, based on the seventh embodiment, the same serial data includes one first target address and at least one second target address; step S740 includes the following steps:

[0124] Step S810: The master device generates corresponding serial data based on the access request information sent by the risky device, and marks it as data to be analyzed.

[0125] Step S820: The master device obtains the total number of second target addresses in the data to be analyzed.

[0126] Step S830: the master device obtains a preset address whitelist corresponding to the first target address in the data to be analyzed, and marks it as a list to be analyzed.

[0127] Step S840: The master device obtains the number of second target addresses in the to-be-analyzed list from the to-be-analyzed data, and marks them as risk-free numbers.

[0128] Step S850: The master device calculates the ban duration of the risky device based on the total number and the risk-free number:

[0129] ,

[0130] In the formula, The duration of the ban; It is the standard duration, and its value is greater than 0, for example, 30 days; is the risk-free quantity; is the total quantity stated.

[0131] Specifically, this embodiment discloses a specific scheme for determining the ban duration of a risky device based on the access request information sent by the risky device; this embodiment proposes a specific formula for calculating the ban duration, in which the ban duration and the risk-free number are inversely proportional; specifically, the number of second target addresses in the list to be analyzed in the data to be analyzed is the risk-free number; when the risk-free number is larger, it means that the number of registers allowed to be accessed in the total number of registers that the risky device wants to access is larger, and the security risk is smaller, so the corresponding ban duration can be appropriately reduced; conversely, when the risk-free number is smaller, it means that the number of registers not allowed to be accessed in the total number of registers that the risky device wants to access is larger, and the security risk is greater, so the corresponding ban duration can be set longer to improve security.

[0132] In a ninth embodiment of a device network protection method based on a system management bus proposed by the present invention, based on the eighth embodiment, this embodiment further includes the following steps:

[0133] Step S910: the transit controller establishes a corresponding relationship between the intercepted serial data and the slave device corresponding to the first target address of the intercepted serial data.

[0134] Specifically, a corresponding relationship is established between the intercepted serial data and the slave device to which the intercepted serial data is intended to be sent.

[0135] Step S920: the transit controller obtains the number of serial data intercepted by each slave device in the past second preset time (eg, 7 days), and marks the slave devices whose number of serial data intercepted is greater than a third preset number (eg, 5) as devices to be processed.

[0136] Specifically, the slave devices whose serial data are intercepted more than 5 times in the past 7 days are marked as pending devices, and the pending devices are slave devices that are easily attacked by illegal network attacks by external devices.

[0137] Step S930: The transit controller obtains the second target address that does not exist in the preset address whitelist in the intercepted serial data corresponding to the device to be processed, and marks it as an encrypted address.

[0138] Specifically, the encrypted address here is a register address of the device to be processed that is not allowed to be accessed by the rescued device but that the external device wants to access.

[0139] Step S940: The transit controller marks other register addresses in the device to be processed except the encrypted address and the preset address whitelist as safe addresses.

[0140] Specifically, the security address here is also a register address that the device to be processed does not allow to be accessed by external devices and to which no external device has ever initiated an access request.

[0141] Step S950: The transfer controller randomly selects a fourth preset number of secure addresses and marks them as addresses to be transferred, and makes the addresses to be transferred correspond to the encrypted addresses one by one, wherein the fourth preset number is consistent with the number of encrypted addresses.

[0142] Specifically, the address to be transferred is a subset of the safe addresses.

[0143] Step S960: the device to be processed stores the service data in the register whose address is the encrypted address in the register whose address is the corresponding address to be transferred, and deletes the service data in the register whose address is the encrypted address.

[0144] Specifically, the business data in the register whose address is the encrypted address is stored in the register whose address is the corresponding address to be transferred, and the business data in the register of the original encrypted address is deleted; thereby achieving the safe transfer of the business data stored in the register, which can further enhance the security protection effect of the business data.

[0145] The present invention also proposes a device network protection system based on a system management bus, which applies a device network protection method based on a system management bus; the system includes a master device, a transit controller and a slave device; the master device and the slave device are both connected to the transit controller via SMBus communication; the slave device includes a plurality of registers, each register is correspondingly provided with a unique register address, and the register is used to store business data; the master device is connected to an external device via Internet communication.

[0146] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0147] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the enlightenment of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the purpose of the present invention and the claims, which all fall within the protection of the present invention.

Claims

1. A device network protection method based on a system management bus, characterized in that: Applicable to a device network protection system based on a system management bus; the system includes a master device, a transfer controller and a slave device; the master device and the slave device are both connected to the transfer controller via SMBus communication; the slave device includes a plurality of registers, each register is correspondingly provided with a unique register address, and the register is used to store business data; The main device is connected to the external device via Internet communication; the method comprises: The transfer controller obtains the preset address whitelist and stores it; The master device obtains access request information from the external device, and generates corresponding serial data based on the access request information, wherein the serial data includes a device address of the slave device that the external device requests to access, and a register address of the slave device that the external device requests to access; The master device marks the device address of the slave device that the external device requests to access in the serial data as the first target address, and marks the register address of the slave device that the external device requests to access in the serial data as the second target address; The master device sends serial data to the relay controller via SMBus; The transfer controller determines whether to intercept the serial data based on the preset address whitelist; If so, the relay controller prohibits sending serial data to the slave device corresponding to the first target address; If not, the relay controller sends the serial data to the slave device corresponding to the first target address via the SMBus.

2. A device network protection method based on a system management bus according to claim 1, characterized in that: The number of slave devices and preset address whitelists is consistent and both are multiple, and the slave devices and preset address whitelists correspond one to one; The preset address whitelist includes register addresses in the corresponding slave device that are allowed to be accessed by the external device; The transfer controller determines whether to intercept the serial data based on the preset address whitelist, including: The transfer controller marks the slave device corresponding to the first target address in the serial data as the first target device; The transfer controller determines a preset address white list corresponding to the first target device, and establishes a correspondence between the serial data corresponding to the same first target device and the preset address white list; The transfer controller determines whether the second target address in the serial data exists in the corresponding preset address white list; If so, the relay controller determines not to intercept the serial data; If not, the transit controller determines to intercept the serial data, prohibits sending the serial data to the first target device within a first preset time, and sends a stop response instruction to the master device; After receiving the stop response instruction, the master device prohibits sending serial data to the transfer controller within a first preset time period.

3. A device network protection method based on a system management bus according to claim 2, characterized in that: The first target address is a binary code of a first preset number of digits; the second target address is a binary code of a second preset number of digits; The transfer controller determines whether to intercept the serial data based on the preset address white list, and also includes: The transfer controller determines whether the serial data includes an instruction to write or modify the business data in the register of the slave device; If so, executing the step of determining whether to intercept the serial data based on the preset address whitelist by the transfer controller; If not, the relay controller sends the serial data to the slave device corresponding to the first target address via the SMBus.

4. The device network protection method based on system management bus according to claim 2 is characterized in that: The SMBus includes an SDA data line and an SCL clock line; the serial data includes address bit data, instruction bit data and execution bit data arranged from front to back and transmitted on the SDA data line; when the SDA data line is transmitting data, the SCL clock line is alternately high and low; The transfer controller prohibits sending serial data to the slave device corresponding to the first target address, including: The transfer controller sets all the corresponding SCL clock lines when the SDA data line transmits the execution bit data to a high level, so as to prohibit the execution bit data from being sent to the slave device corresponding to the first target address.

5. The device network protection method based on system management bus according to claim 2 is characterized in that: The system also includes a host computer connected to the transfer controller via an APB bus; the transfer controller obtains and stores a preset address whitelist, including: The host computer generates a preset address whitelist; The host computer sends the preset address whitelist to the transfer controller through the APB bus and stores it.

6. A method for protecting a device network based on a system management bus according to claim 5, characterized in that: Also includes: The host computer marks the slave device whose preset address whitelist is to be updated as a suspended device; The host computer generates a new preset address whitelist corresponding to the suspended device, and marks the time when the new preset address whitelist is generated as the starting time; The host computer sends the new preset address whitelist to the transfer controller; The transfer controller updates the preset address whitelist currently corresponding to the paused device with the received new preset address whitelist, and marks the time when the update is completed as the end time; From the start time to the end time, the transfer controller prohibits sending serial data to the paused device.

7. The device network protection method based on system management bus according to claim 1 is characterized in that: Also includes: The transfer controller marks the intercepted serial data as risky data and sends the risky data to the main device; The master device marks the external device corresponding to the risk data from the transit controller as a risk device; The main device obtains the IP address of the risky device and marks it as a risky address; When the main device obtains access request information from an external device, it determines whether the address of the external device that sends the access request information is a risky address; If so, the main device determines that the external device sending the access request information is a risky device, and determines the ban duration of the risky device based on the access request information sent by the risky device; The main device disconnects the network connection with the risky device, and the disconnection duration is the blocking duration.

8. A device network protection method based on a system management bus according to claim 7, characterized in that: The same serial data includes one first target address and at least one second target address; The master device determines that the external device that sends the access request information is a risky device, and determines the ban duration of the risky device based on the access request information sent by the risky device, including: The master device generates corresponding serial data based on the access request information sent by the risky device, and marks it as data to be analyzed; The master device obtains the total number of second target addresses in the data to be analyzed; The master device obtains a preset address whitelist corresponding to the first target address in the data to be analyzed, and marks it as a list to be analyzed; The master device obtains the number of second target addresses in the to-be-analyzed list from the to-be-analyzed data, and marks the number as risk-free; The master device calculates the ban duration of the risky device based on the total number and the risk-free number: ， In the formula, The duration of the ban; It is the standard duration, and its value is greater than 0; is the risk-free quantity; is the total quantity stated.

9. A method for protecting a device network based on a system management bus according to claim 8, characterized in that: Also includes: The transfer controller establishes a corresponding relationship between the intercepted serial data and the slave device corresponding to the first target address of the intercepted serial data; The transfer controller obtains the number of serial data that have been intercepted corresponding to each slave device within the past second preset time length, and marks the slave device whose number of serial data that has been intercepted is greater than the third preset number as a device to be processed; The transfer controller obtains a second target address that does not exist in the preset address whitelist from the intercepted serial data corresponding to the device to be processed, and marks it as an encrypted address; The transfer controller marks other register addresses in the device to be processed except the encrypted address and the preset address white list as safe addresses; The transfer controller randomly selects a fourth preset number of secure addresses and marks them as addresses to be transferred, and makes the addresses to be transferred correspond to the encrypted addresses one by one, wherein the fourth preset number is consistent with the number of encrypted addresses; The device to be processed stores the service data in the register whose address is the encrypted address in the register whose address is the corresponding address to be transferred, and deletes the service data in the register whose address is the encrypted address.

10. A device network protection system based on a system management bus, characterized in that: The device network protection method based on the system management bus as described in any one of claims 1 to 9 is applied; the system includes a master device, a transit controller and a slave device; the master device and the slave device are connected to the transit controller via SMBus communication; the slave device includes a plurality of registers, each register is correspondingly provided with a unique register address, and the register is used to store business data; the master device is connected to the external device via Internet communication.

Images