Secure communication method and system based on national cryptographic algorithm and improved Modbus TCP protocol

Abstract

The invention discloses a secure communication method and system based on a national cryptographic algorithm and an improved Modbus TCP protocol. The secure communication method comprises the steps that a host and a slave share an initial public key; the host and the slave establish TCP connection and generate random numbers based on the password module; signature verification is carried out on the random number by adopting a national cryptographic algorithm, so that security identity authentication between the host and the slave is realized; negotiating an encryption key between the host and the slave based on a national cryptographic algorithm; and the host and the slave perform data transmission based on the encryption key. According to the invention, a standard Modbus TCP protocol is improved, a security check domain is added so as to realize replay attack prevention, the SM2 asymmetric algorithm and the SM4 symmetric algorithm are combined to expand the national secret protocol design so as to ensure the confidentiality of data, and by configuring the cryptographic module for national secret authentication, the security of the Modbus TCP protocol is improved. And the functions of cryptographic operation, key generation, random number generation and the like of the host / slave are supported. Therefore, the safety compliance communication of the industrial system based on the improved Modubs TCP protocol is realized.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a secure communication method and system based on a national secret algorithm and an improved Modbus TCP protocol. Background Art

[0002] Modbus is a communication protocol designed for industrial automation systems. It uses a master-slave mode, that is, a master device (usually a computer or programmable logic controller) communicates with multiple slave devices (such as sensors, actuators, etc.). Modbus TCP is a variant of the Modbus protocol. It uses TCP as the transport layer protocol to transmit data on Ethernet. Modbus TCP maintains the core features of the Modbus protocol, such as master-slave mode and function code, and uses the TCP protocol to provide network interconnection and transmission.

[0003] Modbus TCP has the characteristics of high speed, stability, and easy configuration, so it has been widely used in the field of industrial automation. However, Modbus TCP uses the TCP network to transmit Modbus messages. The protocol itself has no security authentication mechanism. Any network access can connect and communicate with the host or slave, and the identity of both parties cannot be verified. Moreover, the Modbus protocol itself does not contain an encryption mechanism. Therefore, when transmitting on the TCP network, all data is transmitted in plain text, which makes the transmitted data easy to be eavesdropped, tampered with, impersonated, and the host system and slave system are replayed and attacked.

[0004] The existing way to solve the security problem of Modbus TCP is to use the TLS / SSL protocol, but the TLS / SSL protocol uses non-domestic cryptographic algorithms such as RSA and ECC for protection and does not meet the cryptographic compliance requirements.

[0005] Therefore, there is a need for a solution to the defect of the Modbus TCP protocol in terms of lack of security design, which is to integrate the domestic cryptographic algorithm with the Modbus TCP protocol at the application protocol layer to improve the security of the Modbus TCP protocol. Summary of the invention

[0006] In order to overcome the shortcomings of the above technologies, the present invention provides a secure communication method and system based on the national secret algorithm and the improved Modbus TCP protocol, which integrates cryptographic applications such as signature, signature verification, encryption, decryption, and key exchange during the communication process, and realizes the integration of the domestic cryptographic algorithm with the Modbus TCP / TP protocol at the application protocol layer, aiming to achieve the security and compliance of the Modbus TCP protocol.

[0007] The technical solution adopted by the present invention to overcome its technical problems is: the first aspect of the present invention is to propose a secure communication method based on a national secret algorithm and an improved Modbus TCP protocol, which is applied to a communication system composed of a host and a plurality of slaves based on the improved Modbus TCP protocol communication, wherein the host and the slave are both equipped with a password module, and the secure communication method specifically includes: sharing an initial public key between the host and the slave; establishing a TCP connection between the host and the slave and generating random numbers based on the password module respectively; signing and verifying the random numbers using a national secret algorithm, thereby realizing secure identity authentication between the host and the slave; negotiating an encryption key between the host and the slave based on the national secret algorithm; and transmitting data based on the improved Modbus TCP protocol by the host and the slave based on the encryption key.

[0008] Furthermore, the improved Modbus TCP protocol includes a security check field, which is a random number generated by the host and the slave based on the cryptographic module for each data transmission.

[0009] Furthermore, the improved Modbus TCP protocol also includes a message header and a protocol data unit, wherein the message header includes at least a transaction processing identifier, a protocol identifier, a length and a unit identifier, and the protocol data unit includes at least a function code, data and a random number.

[0010] The Modbus TCP protocol is improved by adding random numbers as security verification fields to achieve anti-replay.

[0011] Furthermore, the national secret algorithm adopts a combination of the SM2 asymmetric algorithm and the SM4 symmetric algorithm, wherein the SM2 asymmetric algorithm is used for signature verification and negotiation of the SM4 symmetric key, and the SM4 symmetric algorithm is used for data encryption transmission.

[0012] The host and the slave establish a TCP connection and respectively generate random numbers based on the cryptographic module, and use the national secret algorithm to sign and verify the random numbers, thereby realizing secure identity authentication between the host and the slave, specifically including: after the host and the slave establish a TCP connection, the host generates a first random number based on the cryptographic module, and sends it to the slave; the slave generates a second random number based on the cryptographic module, and signs the first and second random numbers based on the slave's asymmetric private key and sends them to the host; the host verifies the signature based on the slave's asymmetric public key to realize slave identity authentication; the host signs the second random number based on the host's asymmetric private key and sends it to the slave; the slave verifies the signature based on the host's asymmetric public key, completes the host's identity authentication after verification, and returns a confirmation message.

[0013] Through the combination of SM2 asymmetric algorithm and SM4 symmetric algorithm, the authentication method of Modbus TCP communication is improved and the security of communication is enhanced.

[0014] Furthermore, the host and the slave negotiate an encryption key based on a national secret algorithm, specifically including: the host generates a first symmetric key based on a hardware cryptographic module, encrypts it based on a slave public key to obtain a first encrypted ciphertext, and signs the first encrypted ciphertext based on the host asymmetric private key to generate a first signature message, thereby sending the first encrypted ciphertext and the first signature message to the slave; the slave verifies the first signature message based on the slave asymmetric public key, and after the verification is passed, decrypts the first encrypted ciphertext based on the slave asymmetric private key to obtain a first symmetric key as an encryption key; both the host and the slave use the first symmetric key as the encryption key.

[0015] Furthermore, the host and the slave perform data transmission based on the improved Modbus TCP protocol based on the encryption key, specifically including: the host encrypts the function code and data of the plaintext protocol data unit in the improved Modbus TCP protocol based on the encryption key to generate a second ciphertext and sends it to the slave; the slave decrypts the received second ciphertext based on the encryption key to obtain plaintext, and obtains the function code, data and random number based on the plaintext; the slave performs an operation based on the obtained function code and data, and sends the operation result to the host based on the encryption key.

[0016] The SM4 symmetric key is negotiated through SM2 asymmetric algorithm signature verification and SM2 asymmetric algorithm encryption, and then the data is encrypted through SM4 symmetric key to ensure the confidentiality of the data, thereby realizing secure communication in one host / multiple slaves mode in an industrial control environment.

[0017] Furthermore, the host and the slave are both configured with a random number storage table for storing random number fields. Each communication between the host and the slave compares the random number fields in the Modbus TCP message with the data stored in the random number table to achieve anti-replay; a shared key configuration table is configured between the host and the slave for sharing an initial public key.

[0018] Furthermore, each time the host and the slave communicate, the random number field in the Modbus TCP message is compared with the data stored in the random number table to achieve anti-replay, specifically including: if the random number in the message already exists in the random number storage table, it indicates that the message transmitted this time is a replayed message, and the host / slave discards the message transmitted this time and does not process it; if the random number is not in the random number table, the random number in the message is put into the random number table, and the host / slave performs corresponding operations according to the received function code and data.

[0019] Another aspect of the present invention also proposes a secure communication system based on a national secret algorithm and an improved Modbus TCP protocol, including a host and several slaves that communicate based on the improved Modbus TCP protocol, wherein the host and the slaves at least include a Modbus application module, a security protocol parsing and encapsulation module and a password module, wherein the security protocol parsing and encapsulation module responds to instructions issued by the Modbus application module, and sends the parsed instructions to the Modbus application module; the security protocol parsing and encapsulation module encapsulates the issued instructions into messages to be sent based on the improved Modbus TCP protocol, or parses the decrypted messages into instructions to be executed; the password module is used for cryptographic operations of the host and the slave, generates public and private keys based on the national secret algorithm and adds random numbers to the messages to be sent, as well as encrypts and signs the messages to be sent, verifies the signature and decrypts the received messages.

[0020] Through the cryptographic support capabilities of the cryptographic module, the national cryptographic algorithm is integrated into the Modbus TCP protocol and industrial application system to meet the information security compliance communication of the industrial application system.

[0021] The beneficial effects of the present invention are: 1. Add the random number field of Modbus TCP message as a security verification field to prevent replay attacks; 2. Improved the connection establishment method of Modbus TCP communication. When establishing a connection between the master and slave, the connection is established only by the handshake and waving process of the TCP protocol. The improvement is to add the identity authentication and key negotiation process based on SM2 when establishing the connection, which improves security; 3. The design of the extended national secret protocol is based on the combination of SM2 asymmetric algorithm and SM4 symmetric algorithm to ensure data security. The SM2 asymmetric algorithm signature verification and SM2 asymmetric algorithm encryption negotiation SM4 symmetric key are used, and then the SM4 symmetric key is used for data encryption to ensure data confidentiality, thereby realizing secure communication in one host / multiple slaves mode in industrial control environment; 4. Through the cryptographic support capabilities of the cryptographic module, the national cryptographic algorithm is integrated into the Modbus TCP protocol and industrial application system to meet the information security compliance communication of the industrial application system. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 A flow chart of a secure communication method based on a national encryption algorithm and an improved Modbus TCP protocol according to an embodiment of the present invention; Figure 2 A schematic diagram of the process of performing identity authentication according to an embodiment of the present invention; Figure 3A schematic diagram of a process of negotiating an encryption key between a host and a slave based on a national secret algorithm according to an embodiment of the present invention; Figure 4 A schematic diagram of a data transmission process between a host and a slave based on an encryption key according to an embodiment of the present invention; Figure 5 A schematic diagram of an improved Modbus TCP message format according to an embodiment of the present invention; Figure 6 The present invention is a schematic diagram of the architecture of a secure communication system based on a national encryption algorithm and an improved Modbus TCP protocol according to an embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to facilitate those skilled in the art to better understand the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. The following is only exemplary and does not limit the protection scope of the present invention.

[0024] like Figure 1 As shown, it is a flow chart of a secure communication method based on the national secret algorithm and the improved Modbus TCP protocol, including sharing the initial public key between the host and the slave; the host and the slave establish a TCP connection and generate random numbers based on the password module respectively; the random numbers are signed and verified using the national secret algorithm, thereby realizing the secure identity authentication between the host and the slave; the host and the slave negotiate the encryption key based on the national secret algorithm; the host and the slave perform data transmission based on the improved Modbus TCP protocol based on the encryption key. Each step is described in detail below according to a specific embodiment.

[0025] S1, the initial public key is shared between the master and slave.

[0026] In one embodiment of the present invention, the host / slave configures a shared key preset table. The shared key preset table stores the SM2 public key corresponding to each host / slave. Through the shared key preset table, the host and each slave share the initial SM2 public key.

[0027] S2, the master and slave establish a TCP connection and generate random numbers based on the cryptographic module respectively.

[0028] The random number is generated by the hardware cryptographic modules of the host and slave, and is generated once for each data transmission.

[0029] It should be noted that in this step, the random number is used for signature, and the signature data is the data transmitted for identity verification when the host and slave establish a connection. After the master / slave both verify their identities and complete the negotiation of keys, formal communication begins, and the function code, operation data and random number are transmitted through the improved Modbus TCP protocol, where the random number in formal communication is used as a security verification field.

[0030] S3, uses the national secret algorithm to sign and verify the random number, thereby achieving secure identity authentication between the host and the slave.

[0031] In one embodiment of the present invention, a combination of national secret algorithms based on the SM2 asymmetric algorithm and the SM4 symmetric algorithm is used to ensure data security. First, the SM2 signature verification technology is used to implement a secure identity authentication mechanism between the host and the slave; then the SM2 asymmetric encryption technology is used to securely negotiate an SM4 symmetric key between the client and the server; finally, the negotiated SM4 symmetric key is used to encrypt the transmitted data to ensure the confidentiality of the data. Among them, the host and the slave have an SM2 public-private key pair generated by the cryptographic module, and the host and each slave share the initial SM2 public key with each other.

[0032] The process flow diagram of identity authentication is as follows: Figure 2 As shown, the specific steps are as follows.

[0033] S31, after the host and the slave establish a TCP connection, the host generates a first random number N1 based on the cryptographic module and sends it to the slave.

[0034] S32, the slave generates a second random number N2 based on the cryptographic module, signs the first random number N1 and the second random number N2 based on the SM2 private key, and sends them to the host.

[0035] S33, the host verifies the signature based on the asymmetric public key of the slave to authenticate the identity of the slave.

[0036] S34, the host signs the slave random number N2 based on the host asymmetric private key and sends it to the slave.

[0037] S35, the slave verifies the signature based on the host's asymmetric public key, completes the identity authentication of the host after the signature verification, and returns a confirmation message.

[0038] S4, the process diagram of the host and the slave negotiating the encryption key based on the national secret algorithm is as follows Figure 3 The method includes the following steps.

[0039] S41, the host generates a first symmetric key based on the hardware cryptographic module, that is, generates a 16-byte random number K, encrypts it based on the slave SM2 public key to obtain a first encrypted ciphertext C, and signs the first encrypted ciphertext C based on the host SM2 private key to generate a first signature message Sc, thereby sending the first encrypted ciphertext C and the first signature message Sc to the slave.

[0040] S42, after receiving the first encrypted ciphertext C and the first signature message Sc, the slave verifies the first signature message Sc based on the slave SM2 public key, and after the verification is passed, decrypts the first encrypted ciphertext C based on the slave SM2 private key to obtain the first symmetric key K, and returns a confirmation message.

[0041] S43, the host and the slave both use the first symmetric key K as a mutual encryption key.

[0042] S5, the host and the slave transmit data based on the encryption key of the improved Modbus TCP protocol. The flow chart is as follows Figure 4 shown.

[0043] S51, the host encrypts the function code and data of the plaintext PDU protocol data unit in the improved Modbus TCP protocol based on the encryption key K to generate a second ciphertext E and sends it to the slave.

[0044] In order to resist the replay attack of the protocol message, in one embodiment of the present invention, the Modbus TCP message is modified, and a random number field of the Modbus TCP message is added as a security check field. A 16-byte random number field is added at the end of the Modbus TCP message as a security check field.

[0045] It should be noted that there are two main improvements in the Modbus TCP protocol in the technical solution of the present invention. The first is the improvement of the Modbus TCP communication connection establishment: originally, when the master / slave machine establishes a connection, it only relies on the handshake and waving process of the TCP protocol to establish a connection. After the improvement, the identity authentication and key negotiation process based on SM2 are added when establishing the connection.

[0046] The second point is the improvement of the message data structure of the formal communication transmission in the Modbus TCP protocol: the frame structure of the original Modbus TCP protocol communication formal transmission data is improved from "MBAP message header + PDU protocol data unit" to "MBAP message header + PDU protocol data unit + random number security domain", that is, a random number field is added after the transmission data.

[0047] Improve Modbus TCP frame structure such as Figure 5As shown. Among them, the MBAP message header includes a transaction identifier, a protocol identifier, a length, and a unit identifier. Among them, the transaction identifier occupies 2 bytes and is used for transaction pairing. It is the transaction code of Modbus and is added by 1 after each communication. The protocol identifier occupies 2 bytes and is used for multiplexing within the system. When its value is 0 (00 00), it indicates the use of the Modbus TCP security protocol. The length occupies 2 bytes and is used to indicate how many bytes are left below, so that even if TCP divides the entire message into multiple packets for transmission, the receiver can still identify the message boundary. The unit identifier occupies 1 byte. When the Modbus client sets this field in the request, the server must return this field with the same value in the response, which can be understood as the device address. The PDU protocol data unit includes a function code and data. The function code occupies 1 byte and is the code for performing the function operation. The data length is uncertain and is the data required to perform the operation. The random number field in the security domain occupies 16 bytes and is used to resist replay attacks.

[0048] Among them, E=SM4_enc(plain text M), where plain text M=(function code||data).

[0049] It should be noted that the MBAT message header and security check domain do not need to be encrypted. In some embodiments, the message header is data of a general data structure, and the message header data is equivalent to being automatically generated according to the content and order of the data packet; the random number needs to be compared and checked as soon as it is received, and the data packet is discarded if the check fails; only the function code and data are plain text messages entered and sent by the user, which need to be encrypted.

[0050] The random number is generated by the hardware password module of the host and slave, and is generated once for each data transmission. In contrast, the host and slave are respectively configured with a random number storage table, which records the random number of each data transmission. The principle of the random number field anti-replay attack is that the random number in the Modbus TCP message is compared with the data in the random number table for each communication. If the random number in the message already exists in the random number table of the system, it indicates that the message transmitted this time is a replayed message, and the host / slave discards the data packet and does not process it. If the random number is not in the random number table, the random number in the message is placed in the random number table, and the host / slave performs the corresponding operation according to the received function code and data. The random number storage table configured by the host / slave is cleaned up every 30 seconds to avoid excessive memory overhead of the host / slave.

[0051] S52, the slave decrypts the received second ciphertext E based on the encryption key K to obtain a plaintext M, M= SM4_dec(E), and obtains a function code, data and a random number based on the plaintext.

[0052] S53, the slave performs an operation based on the obtained function code and data, and sends the operation result to the host based on the encryption key K.

[0053] It should be noted that the formal communication process is that the master / slave transmits data to each other, and the random number is used as a security verification field and also as a part of the verification field of the transmitted data. The hardware password module generates a random number once for each communication, and the random number is sent together with other data. The host and the slave are both configured with a random number storage table for storing random number fields. Each communication between the host and the slave compares the random number field in the Modbus TCP message with the data stored in the random number table to achieve anti-replay. By comparing the random numbers in the transmitted data in each communication, if the random numbers carried in the communication are the same in a short period of time, the data packet is discarded and the message is not replied, which can prevent the master / slave from sending a large number of repeated messages in a short period of time and prevent replay attacks.

[0054] In another embodiment of the present invention, Figure 6 The schematic diagram of the architecture of a secure communication system based on a national secret algorithm and an improved Modbus TCP protocol is shown, including a host system and several slave systems based on the improved Modbus TCP protocol communication, the host system and the slave system at least including a Modbus application module, a security protocol parsing and encapsulation module and a password module, the security protocol parsing and encapsulation module responds to the instructions issued by the Modbus application module, and sends the parsed instructions to the Modbus application module. The security protocol parsing and encapsulation module encapsulates the issued instructions into messages to be sent based on the improved Modbus TCP protocol, or parses the decrypted messages into instructions to be executed. The password module is used for cryptographic operations of the host and the slave, generates public and private keys based on the national secret algorithm, adds random numbers to the messages to be sent, and encrypts and signs the messages to be sent, verifies the signature and decrypts the received messages.

[0055] In one embodiment of the present invention, the cryptographic module is a hardware cryptographic module that provides cryptographic support capabilities, and the hardware cryptographic module has a commercial cryptographic product model certificate issued by the State Cryptography Bureau and can meet the information security compliance requirements of the application system.

[0056] The cryptographic module can support the cryptographic operation, key generation and random number generation of the host / slave, and can support the implementation of Modbus TCP protocol to extend the domestic cryptographic protocol.

[0057] Through the password module, random numbers are generated for authentication signatures and as random number fields in Modbus TCP messages to achieve anti-replay attack for communication. It can also implement signature verification, generate symmetric keys, implement symmetric encryption and decryption, implement parsing and encapsulation of Modbus TCP protocol extension domestic cryptographic protocols, and implement Modbus TCP protocol extension domestic cryptographic protocols, thereby achieving safe and compliant communication of industrial systems.

[0058] The present invention is based on improving the standard Modbus TCP protocol, adding a security check domain to achieve anti-replay attack, and expanding the national secret protocol design by combining the SM2 asymmetric algorithm and the SM4 symmetric algorithm to ensure the confidentiality of data, and supporting the host / slave cryptographic operations, key generation, and random number generation functions by configuring the national secret certified cryptographic module. Thus, secure and compliant communication based on the improved Modubs TCP protocol is achieved in the industrial system.

[0059] It should be noted that: in other embodiments, the steps of the corresponding method are not necessarily performed in the order shown and described in this specification. In some other embodiments, the steps included in the method may be more or less than those described in this specification. In addition, a single step described in this specification may be decomposed into multiple steps for description in other embodiments; and multiple steps described in this specification may be combined into a single step for description in other embodiments.

[0060] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. The system and system embodiment described above are only illustrative, and some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative work.

[0061] Professionals can appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

Claims

1. A secure communication method based on a national secret algorithm and an improved Modbus TCP protocol, characterized in that: Applied to a communication system consisting of a host and several slaves based on improved Modbus TCP protocol communication, wherein both the host and the slaves are equipped with a password module, the secure communication method specifically includes: The initial public key is shared between the master and slave; The master and slave establish a TCP connection and generate random numbers based on the cryptographic module respectively; The random number is signed and verified using the national secret algorithm, thereby achieving secure identity authentication between the host and the slave; The host and slave negotiate the encryption key based on the national secret algorithm; The master and slave perform data transmission based on the improved Modbus TCP protocol based on encryption keys.

2. A secure communication method based on a national secret algorithm and an improved Modbus TCP protocol according to claim 1, characterized in that: The improved Modbus TCP protocol includes a security check field, which is a random number generated by the host and the slave based on the password module for each data transmission.

3. A secure communication method based on a national secret algorithm and an improved Modbus TCP protocol according to claim 2, characterized in that: The improved Modbus TCP protocol also includes a message header and a protocol data unit, wherein the message header includes at least a transaction identifier, a protocol identifier, a length and a unit identifier, and the protocol data unit includes at least a function code, data and a random number.

4. A secure communication method based on a national secret algorithm and an improved Modbus TCP protocol according to claim 1, characterized in that: The national secret algorithm adopts a combination of the SM2 asymmetric algorithm and the SM4 symmetric algorithm, wherein the SM2 asymmetric algorithm is used for signature verification and negotiation of the SM4 symmetric key, and the SM4 symmetric algorithm is used for data encryption transmission.

5. A secure communication method based on a national secret algorithm and an improved Modbus TCP protocol according to claim 1, characterized in that: The host and the slave establish a TCP connection and generate random numbers based on the password module respectively, and use the national secret algorithm to sign and verify the random numbers, thereby realizing the secure identity authentication between the host and the slave, which specifically includes: After the host and the slave establish a TCP connection, the host generates a first random number based on the cryptographic module and sends it to the slave; The slave generates a second random number based on the cryptographic module, signs the first random number and the second random number based on the slave asymmetric private key, and sends the signatures to the host; The host verifies the signature based on the slave's asymmetric public key to authenticate the slave. The host signs the second random number based on the host asymmetric private key and sends it to the slave; The slave verifies the signature based on the host's asymmetric public key, completes the host's identity authentication after verification, and returns a confirmation message.

6. A secure communication method based on a national secret algorithm and an improved Modbus TCP protocol according to claim 1, characterized in that: The host and the slave negotiate an encryption key based on the national secret algorithm, specifically including: The host generates a first symmetric key based on the hardware cryptographic module, encrypts it based on the slave public key to obtain a first encrypted ciphertext, and signs the first encrypted ciphertext based on the host asymmetric private key to generate a first signed message, thereby sending the first encrypted ciphertext and the first signed message to the slave; The slave verifies the first signed message based on the slave asymmetric public key, and after the verification is passed, decrypts the first encrypted ciphertext based on the slave asymmetric private key to obtain a first symmetric key as an encryption key; Both the master and the slave use the first symmetric key as an encryption key.

7. A secure communication method based on a national secret algorithm and an improved Modbus TCP protocol according to claim 2, characterized in that: The host and the slave perform data transmission based on the improved Modbus TCP protocol based on the encryption key, specifically including: The host encrypts the function code and data of the plaintext protocol data unit in the improved Modubus TCP protocol based on the encryption key to generate a second ciphertext and sends it to the slave; The slave decrypts the received second ciphertext based on the encryption key to obtain a plaintext, and obtains a function code, data and a random number based on the plaintext; The slave performs operations based on the obtained function code and data, and sends the operation results to the host based on the encryption key.

8. A secure communication method based on a national secret algorithm and an improved Modbus TCP protocol according to claim 1, characterized in that: The host and the slave are both configured with a random number storage table for storing random number segments, and each communication between the host and the slave compares the random number segments in the Modbus TCP message with the data stored in the random number table to achieve anti-replay; A shared key configuration table is configured between the host and the slave for sharing an initial public key.

9. A secure communication method based on a national secret algorithm and an improved Modbus TCP protocol according to claim 8, characterized in that: Each communication between the host and the slave compares the random number field in the Modbus TCP message with the data stored in the random number table to achieve anti-replay, specifically including: If the random number in the message already exists in the random number storage table, it indicates that the message being transmitted is a replayed message, and the host / slave discards the message being transmitted and does not process it; If the random number is not in the random number table, the random number in the message is placed in the random number table, and the host / slave performs corresponding operations based on the received function code and data.

10. A secure communication system based on national secret algorithm and improved Modbus TCP protocol, characterized in that: It includes a host and several slaves based on improved Modbus TCP protocol communication. The host and the slave both include at least a Modbus application module, a security protocol parsing and encapsulation module and a password module. The security protocol parsing and encapsulation module responds to the instruction issued by the Modbus application module, and sends the parsed instruction to the Modbus application module; The security protocol parsing and encapsulation module encapsulates the issued instructions into messages to be sent based on the improved Modbus TCP protocol, or parses the decrypted messages into instructions to be executed; The cryptographic module is used for cryptographic operations of the host and slave, generating public and private keys based on the national secret algorithm and adding random numbers to messages to be sent, as well as encrypting and signing messages to be sent, verifying signatures and decrypting received messages.

Images