Gateway security filtering method, electronic equipment, storage medium and program product

Abstract

The invention provides a gateway security filtering method, electronic equipment, a storage medium and a program product. The method comprises the following steps: receiving a to-be-processed message; performing message content analysis on the to-be-processed message according to the OPC DA protocol format to obtain message analysis data; when the message analysis data hits a preset OPC DA protocol security policy matching item, determining a policy predetermined action corresponding to the to-be-processed message; when the strategy predetermined action is a blocking action, constructing an ACK response message; replying an ACK response message to a source address corresponding to the message to be processed; and recording the transmission layer bearer data length corresponding to the to-be-processed message into the diffseq field of the connection information of the current industrial gateway equipment, and discarding the to-be-processed message. According to the method, on the basis of realizing the safe filtering function of the OPC DA protocol, the TCP connection cannot be disconnected, so that the real-time performance and the reliability of the OPC DA protocol are ensured.

Description

Technical Field

[0001] The present application relates to the field of communication security technology, and in particular to a gateway security filtering method, electronic equipment, storage medium and program product. Background Art

[0002] At present, in the field of industrial automation, in order to ensure the security of network communication, an OPC (OLE for Process Control) security gateway is usually deployed between the enterprise information network and the industrial control network. In the prior art, if the content of the OPC DA protocol message does not comply with the security policy of the industrial gateway device, the current message will be discarded and the OPC DA protocol communication connection will be disconnected. This practice makes it impossible for the OPC DA protocol client to obtain and read and write data on the server in real time, which seriously violates the real-time and effectiveness emphasized by the OPC DA protocol. Summary of the invention

[0003] The purpose of this application is to provide a gateway security filtering method, electronic device, storage medium and program product, which can ensure that the message forwarding that hits the security policy can be blocked without disconnecting the TCP connection on the basis of realizing the OPC DA protocol security filtering function, thereby ensuring the real-time and reliability requirements of the OPC DA protocol.

[0004] The first aspect of the present application provides a gateway security filtering method, comprising:

[0005] Receive messages to be processed;

[0006] Parsing the message content of the message to be processed according to the OPC DA protocol format to obtain message parsing data;

[0007] When the message parsing data hits the preset OPC DA protocol security policy matching item, determining the policy predetermined action corresponding to the message to be processed;

[0008] When the predetermined action of the strategy is a blocking action, constructing an ACK response message;

[0009] Replying the ACK response message to the source address corresponding to the message to be processed;

[0010] The transport layer bearer data length corresponding to the message to be processed is recorded in the diff_seq field of the current industrial gateway device connection information, and the message to be processed is discarded.

[0011] In the above implementation process, the method gives priority to receiving the message to be processed, so as to ensure that the industrial gateway device can receive the message from the OPC DA client or server, and then provide a data basis for subsequent parsing, policy matching and action execution. Then, the method parses the message content of the message to be processed according to the OPC DA protocol format to obtain the message parsing data; it can be seen that this step can extract key information in the message, such as function code, data length, source address and destination address, etc., by parsing the message content, so as to facilitate the execution of subsequent policy matching and action execution steps. At the same time, parsing according to the OPC DA protocol format can ensure the accuracy and consistency of the parsing. Secondly, when the message parsing data hits the preset OPC DA protocol security policy matching item, the method determines the policy preset action corresponding to the message to be processed; it can be seen that the method can perform security checks and filtering on the received messages through the preset security policy matching items, so as to protect the network from security threats such as malicious attacks and data leakage. Then, when the policy predetermined action is a blocking action, the method constructs an ACK response message and replies to the source address corresponding to the message to be processed; it can be seen that the method can construct an ACK response message and reply to the source address when the message is blocked, thereby simulating the state that the message has been successfully received, thereby avoiding the OPC DA client or server from initiating retransmission or closing the connection due to failure to receive a confirmation reply, thereby helping to maintain the stability and continuity of communication. Finally, the method records the transport layer bearer data length corresponding to the message to be processed in the diff_seq field of the current industrial gateway device connection information, and discards the message to be processed; it can be seen that the method can record the transport layer bearer data length of the message to be processed in the diff_seq field, thereby providing an important reference for the normal forwarding of subsequent messages. Specifically, when the subsequent message arrives, the industrial gateway device can adjust the TCP sequence number according to the record in the diff_seq field, thereby ensuring that the server can correctly receive and process the message. At the same time, discarding the message to be processed can also ensure that messages that do not comply with the security policy will not be forwarded to the network, thereby protecting the security of the network.

[0012] Furthermore, the method further comprises:

[0013] When the message parsing data does not hit the OPC DA protocol security policy matching item, determining the message to be processed as a message to be forwarded;

[0014] Obtain the diff_seq field value of the connection cache corresponding to the message to be forwarded;

[0015] When the diff_seq field value is greater than 0, the current message sequence number and the current TCP protocol checksum of the message to be forwarded are obtained;

[0016] Calculate the sequence number value according to the current message sequence number and the diff_seq field value;

[0017] Replacing the current message sequence number of the message to be forwarded with the sequence number value to obtain a replaced message;

[0018] Calculate the TCP checksum according to the replacement message to obtain a checksum value;

[0019] Replacing the current TCP protocol checksum of the replacement message with the checksum value to obtain a message to be sent;

[0020] Perform a forwarding operation on the message to be forwarded.

[0021] In the above implementation process, the method can prevent malicious messages or illegal data from entering the industrial network, thereby improving the security of the entire communication system; it can also obtain the diff_seq field value of the connection cache corresponding to the message to be forwarded before forwarding the message, and calculate the sequence number value and TCP checksum based on the value, thereby ensuring that the forwarded message is consistent with the original message in terms of sequence number and checksum, which helps the receiving end to correctly identify and process the message and avoid data confusion or loss.

[0022] Further, the calculating the sequence number value according to the current message sequence number and the diff_seq field value includes:

[0023] When the message to be forwarded is a message sent by the client, subtract the current message sequence number from the diff_seq field value to obtain a sequence number value;

[0024] When the message to be forwarded is a message sent by the server, the current message sequence number and the diff_seq field value are added to obtain a sequence number value.

[0025] In the above implementation process, the method can select an appropriate calculation method (subtraction or addition) according to the sender of the message (client or server), thereby ensuring that the forwarded message sequence number is consistent with the original message sequence number in relative position.

[0026] Further, constructing an ACK response message includes:

[0027] Determine the transport layer bearer data length of the message to be processed according to the message parsing data;

[0028] Acquire control information of the message to be processed according to the message parsing data; wherein the control information at least includes a destination MAC address, a source MAC address, a destination IP address, a source IP address, a TCP protocol destination port number, a TCP protocol source port number, a TCP protocol sequence number, and a TCP protocol confirmation number;

[0029] Construct an ACK response message according to the transport layer bearer data length and the control information.

[0030] In the above implementation process, the method can accurately construct an ACK response message using the control information parsed from the message to be processed (such as destination MAC address, source MAC address, destination IP address, source IP address, TCP protocol destination port number, TCP protocol source port number, etc.), thereby ensuring the stability and reliability of the TCP connection by correctly including this information in the ACK response message.

[0031] Further, constructing an ACK response message according to the transport layer bearer data length and the control information includes:

[0032] Construct the original ACK message;

[0033] Filling the destination MAC address into the source MAC address of the original ACK message to obtain a first processed message;

[0034] Filling the source MAC address into the destination MAC address of the first processed message to obtain a second processed message;

[0035] Filling the destination IP address into the source IP address of the second processed message to obtain a third processed message;

[0036] Filling the source IP address into the destination IP address of the third processed message to obtain a fourth processed message;

[0037] Set the ACK flag of the TCP protocol in the fourth processed message to 1 to obtain a fifth processed message;

[0038] Filling the TCP protocol destination port number into the TCP protocol source port number field of the fifth processing message to obtain a sixth processing message;

[0039] Filling the TCP protocol source port number into the TCP protocol destination port number field of the sixth processing message to obtain a seventh processing message;

[0040] Filling the TCP protocol confirmation number into the TCP protocol sequence number field of the seventh processing message to obtain an eighth processing message;

[0041] Calculate a new TCP protocol confirmation number based on the TCP protocol sequence number and the transport layer bearer data length;

[0042] Filling the TCP protocol new confirmation number into the TCP protocol confirmation number field of the eighth processing message to obtain a ninth processing message;

[0043] The TCP protocol payload data length of the ninth processing message is set to 0 to obtain an ACK response message.

[0044] In the above implementation process, the method can ensure that the generated ACK response message is logically consistent with the original request message through a series of precise address and port number filling steps, as well as the correct setting of the TCP protocol sequence number and the TCP protocol confirmation number, thereby ensuring the stability and reliability of the TCP connection.

[0045] Furthermore, the OPC DA protocol security policy matching items include one or more of function codes, address policies, and value policies, and the policy predetermined actions include release actions or blocking actions.

[0046] In the above implementation process, the design of OPC DA protocol security policy matching items has significant beneficial effects in improving communication security, increasing system flexibility, simplifying security management, and supporting multiple security policies.

[0047] Further, recording the transport layer bearer data length corresponding to the message to be processed into the diff_seq field of the current industrial gateway device connection information includes:

[0048] Obtaining the transport layer bearer data length corresponding to the message to be processed;

[0049] When there are multiple packets to be processed for discarding in the same connection, determine the diff_seq field value corresponding to the length of each transport layer bearer data; wherein the multiple packets to be processed for discarding correspond to different time periods respectively;

[0050] Performing a cumulative operation on all the diff_seq field values ​​to obtain the field value to be recorded;

[0051] The field value to be recorded is recorded in the diff_seq field of the current industrial gateway device connection information.

[0052] In the above implementation process, when a connection needs to discard multiple messages, the method can accumulate the transport layer bearer data lengths of multiple discarded messages of the connection, thereby ensuring that the application layer data length / transport layer bearer data length of each message is correctly recorded and tracked, which helps to optimize the data processing process and improve the accuracy and efficiency of data processing.

[0053] A second aspect of the present application provides a gateway security filtering device, the gateway security filtering device comprising:

[0054] A receiving unit, used for receiving a message to be processed;

[0055] A parsing unit, used for parsing the message to be processed according to the OPC DA protocol format to obtain message parsing data;

[0056] A determination unit, configured to determine a predetermined policy action corresponding to the message to be processed when the message parsing data hits a preset OPC DA protocol security policy matching item;

[0057] A construction unit, configured to construct an ACK response message when the predetermined action of the policy is a blocking action;

[0058] A reply unit, used to reply the ACK response message to the source address corresponding to the message to be processed;

[0059] A recording unit, used to record the transport layer bearer data length corresponding to the message to be processed into the diff_seq field of the current industrial gateway device connection information;

[0060] The discarding unit is used to discard the message to be processed.

[0061] Furthermore, the gateway security filtering device also includes:

[0062] A determination unit, configured to determine the message to be processed as a message to be forwarded when the message parsing data does not hit the OPC DA protocol security policy matching item;

[0063] An acquisition unit, used to acquire a diff_seq field value of a connection cache corresponding to the message to be forwarded;

[0064] The acquisition unit is further configured to acquire the current message sequence number and the current TCP protocol checksum of the message to be forwarded when the diff_seq field value is greater than 0;

[0065] A calculation unit, used to calculate a sequence number value according to the current message sequence number and the diff_seq field value;

[0066] A replacement unit, used to replace the current message sequence number of the message to be forwarded with the sequence number value to obtain a replacement message;

[0067] The calculation unit is further used to calculate the TCP checksum according to the replacement message to obtain a checksum value;

[0068] The replacement unit is further configured to replace the current TCP protocol checksum of the replacement message with the checksum value to obtain a message to be sent;

[0069] The forwarding unit is used to perform a forwarding operation on the message to be forwarded.

[0070] Further, the calculation unit is specifically used to, when the message to be forwarded is a message sent by the client, perform a subtraction calculation on the current message sequence number and the diff_seq field value to obtain a sequence number value;

[0071] The calculation unit is further specifically used to, when the message to be forwarded is a message sent by the server, perform addition calculation on the current message sequence number and the diff_seq field value to obtain a sequence number value.

[0072] Furthermore, the construction unit comprises:

[0073] A first determining subunit, configured to determine the transport layer bearer data length of the message to be processed according to the message parsing data;

[0074] A first acquisition subunit is used to acquire control information of the message to be processed according to the message parsing data; wherein the control information at least includes a destination MAC address, a source MAC address, a destination IP address, a source IP address, a TCP protocol destination port number, a TCP protocol source port number, a TCP protocol sequence number, and a TCP protocol confirmation number;

[0075] The construction subunit is used to construct an ACK response message according to the data length carried by the transport layer and the control information.

[0076] Furthermore, the construction subunit includes:

[0077] A construction module, used for constructing an original ACK message;

[0078] A filling module, used to fill the destination MAC address into the source MAC address of the original ACK message to obtain a first processed message;

[0079] The filling module is further used to fill the source MAC address into the destination MAC address of the first processed message to obtain a second processed message;

[0080] The filling module is further used to fill the destination IP address into the source IP address of the second processing message to obtain a third processing message;

[0081] The filling module is further used to fill the source IP address into the destination IP address of the third processing message to obtain a fourth processing message;

[0082] A setting module, used to set the ACK flag of the TCP protocol in the fourth processing message to 1, to obtain a fifth processing message;

[0083] The filling module is further used to fill the TCP protocol destination port number into the TCP protocol source port number field of the fifth processing message to obtain a sixth processing message;

[0084] The filling module is further used to fill the TCP protocol source port number into the TCP protocol destination port number field of the sixth processing message to obtain a seventh processing message;

[0085] The filling module is further used to fill the TCP protocol confirmation number into the TCP protocol sequence number field of the seventh processing message to obtain an eighth processing message;

[0086] A calculation module, used to calculate a new TCP protocol confirmation number according to the TCP protocol sequence number and the transport layer bearer data length;

[0087] The filling module is further used to fill the TCP protocol new confirmation number into the TCP protocol confirmation number field of the eighth processing message to obtain a ninth processing message;

[0088] The setting module is further used to set the TCP protocol payload data length of the ninth processing message to 0, and obtain an ACK response message.

[0089] Furthermore, the OPC DA protocol security policy matching items include one or more of function codes, address policies, and value policies, and the policy predetermined actions include release actions or blocking actions.

[0090] Furthermore, the recording unit includes:

[0091] A second acquisition subunit is used to obtain the transport layer bearer data length corresponding to the message to be processed;

[0092] A second determination subunit is used to determine the diff_seq field value corresponding to the length of each transport layer bearer data when there are multiple messages to be processed to be discarded in the same connection; wherein the multiple messages to be processed to be discarded correspond to different time periods respectively;

[0093] A calculation subunit, used for performing a cumulative operation on all the diff_seq field values ​​to obtain a field value to be recorded;

[0094] The recording subunit is used to record the field value to be recorded in the diff_seq field of the current industrial gateway device connection information.

[0095] A third aspect of the present application provides an electronic device, including a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the gateway security filtering method described in any one of the first aspects of the present application.

[0096] A fourth aspect of the present application provides a readable storage medium storing computer program instructions. When the computer program instructions are read and executed by a processor, the gateway security filtering method described in any one of the first aspects of the present application is executed.

[0097] A fifth aspect of the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it executes the gateway security filtering method of any one of the first aspects of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0098] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0099] Figure 1 A schematic diagram of a flow chart of a gateway security filtering method provided in an embodiment of the present application;

[0100] Figure 2 A flowchart of another gateway security filtering method provided in an embodiment of the present application;

[0101] Figure 3 A flowchart of another gateway security filtering method provided in an embodiment of the present application;

[0102] Figure 4 A schematic diagram of an example flow of a gateway security filtering method provided in an embodiment of the present application;

[0103] Figure 5 A schematic diagram of a blocking process for a message to be processed provided in an embodiment of the present application;

[0104] Figure 6A schematic diagram of the structure of a gateway security filtering device provided in an embodiment of the present application;

[0105] Figure 7 A schematic diagram of the structure of another gateway security filtering device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0106] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0107] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0108] Example 1

[0109] Please see Figure 1 , Figure 1 A schematic diagram of a flow chart of a gateway security filtering method provided in this embodiment. The gateway security filtering method includes:

[0110] S101: Receive a message to be processed.

[0111] S102: parse the message content of the message to be processed according to the OPC DA protocol format to obtain message parsing data.

[0112] In this embodiment, the method may parse the message content according to the OPC DA protocol format, for example, parsing the function code in the message to be IOXIDResolver::ResolveOxid.

[0113] S103: When the message parsing data hits the preset OPC DA protocol security policy matching item, determine the policy predetermined action corresponding to the message to be processed.

[0114] In this embodiment, the OPC DA protocol security policy matching items include one or more of function code, address policy, and value policy, and the policy predetermined actions include a release action or a blocking action.

[0115] In this embodiment, after acquiring the message parsing data, the method can match the function code in the message parsing data with the OPC DA protocol security policy matching item (function code: IOXIDResolver::ResolveOxid) on the industrial gateway device.

[0116] In this embodiment, the message content is parsed according to the OPC DA protocol format, and then compared with the matching item content set by the security policy, and if they are the same, it is considered a hit. Important parameters and examples are shown below.

[0117] OPC DA protocol security policy is a means of security filtering of protocol content, which is used to prevent the client from illegally reading and modifying data at a specified address (the address is optional, see below for details). The specific content of the security policy is as follows:

[0118] (1) Matching items:

[0119] Function code: can be understood as an operation code, that is, a read operation or a write operation.

[0120] Address strategy: It can be understood as a read operation or a write operation on a specified "string address".

[0121] Value strategy: It can be understood as the range (maximum value, minimum value) and data type (8 bits, 16 bits, 32; signed, unsigned; single precision, double precision) of the value written to a specified "string address".

[0122] (2) Action:

[0123] Accept: Allowed to pass

[0124] Drop: The packet cannot be released, that is, it cannot be forwarded.

[0125] Among them, the function code, address strategy, and value strategy in the OPC DA protocol security policy matching items can be freely combined (that is, it can be any one or any multiple), and the matching items need to be hit to execute the policy action.

[0126] S104: When the policy predetermined action is a blocking action, construct an ACK response message.

[0127] S105. Reply an ACK response message to the source address corresponding to the message to be processed.

[0128] S106. Record the transport layer bearer data length corresponding to the message to be processed into the diff_seq field of the current industrial gateway device connection information, and discard the message to be processed.

[0129] In this embodiment, when the hit strategy needs to execute the predetermined action blocking of the strategy, the method records the transport layer carrying data length (i.e., application layer message length) of the message to be discarded (i.e., the message to be processed) in the industrial gateway device connection information.

[0130] In this embodiment, the data cache record in the industrial gateway device connection information can ensure that subsequent messages can be forwarded normally without disconnecting the TCP connection.

[0131] In this embodiment, the executor of the method may be an industrial gateway device, which may be a computing device such as a computer or a server, and no limitation is made in this embodiment.

[0132] In this embodiment, the execution subject of the method may also be a smart device such as a smart phone, a tablet computer, etc., which is not limited in this embodiment.

[0133] It can be seen that the gateway security filtering method described in this embodiment can be implemented by decoding the message content (i.e., parsing the application layer content of the message received by the device according to the OPC DA protocol format), matching the industrial gateway device security policy (a security filtering policy set for the OPC DA protocol, the policy is mainly composed of matching items and policy actions), and executing the policy action when the policy matching item is hit. When the message content hits the security policy matching item and the security policy action is blocking, the method can only discard the message that hits the security policy without disconnecting the TCP connection, and the subsequent interactive messages can continue to be forwarded and filtered, thereby achieving the effect of ensuring that the industrial gateway device can filter according to the security policy, and can also meet the requirements of real-time and reliable communication of the OPC DA protocol.

[0134] Example 2

[0135] Please see Figure 2 , Figure 2 A schematic diagram of a flow chart of a gateway security filtering method provided in this embodiment. The gateway security filtering method includes:

[0136] S201: Receive a message to be processed.

[0137] S202: parse the message to be processed according to the OPC DA protocol format to obtain message parsing data.

[0138] S203: When the message parsing data hits the preset OPC DA protocol security policy matching item, determine the policy predetermined action corresponding to the message to be processed.

[0139] In this embodiment, the OPC DA protocol security policy matching items include one or more of function code, address policy, and value policy, and the policy predetermined actions include a release action or a blocking action.

[0140] S204: When the policy predetermined action is a blocking action, determine the transport layer bearer data length of the message to be processed according to the message parsing data.

[0141] S205. Obtain control information of the message to be processed according to the message parsing data.

[0142] In this embodiment, the control information includes at least a destination MAC address, a source MAC address, a destination IP address, a source IP address, a TCP destination port number, a TCP source port number, a TCP sequence number, and a TCP acknowledgment number.

[0143] S206: Construct an ACK response message according to the transport layer bearer data length and control information.

[0144] As an optional implementation, constructing an ACK response message according to the transport layer bearer data length and control information includes:

[0145] Construct the original ACK message;

[0146] Fill the destination MAC address into the source MAC address of the original ACK message to obtain a first processed message;

[0147] Filling the source MAC address into the destination MAC address of the first processed message to obtain a second processed message;

[0148] Fill the destination IP address into the source IP address of the second processed message to obtain a third processed message;

[0149] Filling the source IP address into the destination IP address of the third processed message to obtain a fourth processed message;

[0150] Set the ACK flag of the TCP protocol in the fourth processed message to 1 to obtain a fifth processed message;

[0151] Filling the TCP protocol destination port number into the TCP protocol source port number field of the fifth processing message to obtain a sixth processing message;

[0152] Filling the TCP protocol source port number into the TCP protocol destination port number field of the sixth processing message to obtain a seventh processing message;

[0153] Filling the TCP protocol confirmation number into the TCP protocol sequence number field of the seventh processing message to obtain an eighth processing message;

[0154] Calculate the new TCP protocol confirmation number based on the TCP protocol sequence number and the length of the transport layer data carried;

[0155] Filling the TCP protocol new confirmation number into the TCP protocol confirmation number field of the eighth processing message to obtain a ninth processing message;

[0156] The TCP protocol payload data length of the ninth processed message is set to 0, and an ACK response message is obtained.

[0157] In this embodiment, the new TCP protocol confirmation number refers to the TCP protocol confirmation number obtained through calculation.

[0158] S207. Reply an ACK response message to the source address corresponding to the message to be processed.

[0159] In this embodiment, since the OPC DA protocol is reliable, the client needs to receive the ACK message from the other end to confirm that the message has been received by the other end. However, when the industrial gateway device discards the message that hits the security policy, the OPC DA protocol server will not receive the current message and will not reply with an ACK message, which will cause:

[0160] (1) The OPC DA client keeps retransmitting messages because it does not receive a confirmation reply message. The retransmission may cause the blocked message to be sent to the OPC DA server, and the purpose of security filtering cannot be achieved.

[0161] (2) After retransmitting for a certain period of time, the OPC DA protocol client actively closes the current connection, causing communication abnormalities.

[0162] In order to solve the above problem, this method constructs an ACK message and replies an ACK response message to the source address of the blocked message (OPC DA protocol client address) so that the client knows that the message content has been received and confirms how many bytes of data have been successfully received through the ACK message.

[0163] S208: Obtain the transport layer bearer data length corresponding to the message to be processed.

[0164] S209. When there are multiple messages to be processed that need to be discarded in the same connection, determine the diff_seq field value corresponding to the length of the data carried by each transport layer; wherein the multiple messages to be processed that need to be discarded correspond to different time periods.

[0165] In this embodiment, during the interaction between the OPC DA client and the server, messages at different times in the same connection may hit the security filtering policy multiple times and need to be blocked. In the repeated process, the number of messages to be processed will increase.

[0166] Among them, since only one message can be processed at a time for the same connection, when the message needs to be discarded, it needs to be calculated based on the message payload length and the connection cache diff_seq field value and recorded in the connection cache diff_seq field.

[0167] For example, the diff_seq of the connection cache corresponding to the message to be forwarded is actually a field on the connection. When there are multiple discarded messages on the same connection (the connection and the message are associated with five-tuple information), the accumulation process is roughly as follows:

[0168] Discard message 1 first: diff_seq = the length of the data carried by message 1;

[0169] Continue to discard message 2: diff_seq = the bearer data length of message 1 + the bearer data length of message 2;

[0170] Continue to discard message 3: diff_seq = the bearer data length of message 1 + the bearer data length of message 2 + the bearer data length of message 3.

[0171] S210: Perform a cumulative operation on all diff_seq field values ​​to obtain a field value to be recorded.

[0172] S211. Record the value of the field to be recorded into the diff_seq field of the current industrial gateway device connection information.

[0173] In this embodiment, the diff_seq field corresponds to the connection and is uniquely corresponding. That is, a link has only one diff_seq field, and the above diff_seq field value only refers to the value in the calculation process (and also refers to the purpose of its calculation to be recorded in the diff_seq field). It should be understood that the value recorded in the diff_seq field is only the above-mentioned field value to be recorded.

[0174] S212: discard the message to be processed.

[0175] In this embodiment, when discarding the current OPC DA protocol message (i.e., the message to be processed), it is necessary to first ensure that the data cache for the OPC DA protocol message has been completed, as well as the sending of the ACK response message, so as to ensure that the discarding of the current OPC DA protocol message will not cause the OPC DA client to initiate retransmission or close the connection.

[0176] In this embodiment, the execution subject of the method may be a computing device such as a computer or a server, and no limitation is made in this embodiment.

[0177] In this embodiment, the execution subject of the method may also be a smart device such as a smart phone, a tablet computer, etc., which is not limited in this embodiment.

[0178] It can be seen that the gateway security filtering method described in this embodiment can be implemented by decoding the message content (i.e., parsing the application layer content of the message received by the device according to the OPC DA protocol format), matching the industrial gateway device security policy (a security filtering policy set for the OPC DA protocol, the policy is mainly composed of matching items and policy actions), and executing the policy action when the policy matching item is hit. When the message content hits the security policy matching item and the security policy action is blocking, the method can only discard the message that hits the security policy without disconnecting the TCP connection, and the subsequent interactive messages can continue to be forwarded and filtered, thereby achieving the effect of ensuring that the industrial gateway device can filter according to the security policy, and can also meet the requirements of real-time and reliable communication of the OPC DA protocol.

[0179] Example 3

[0180] Please see Figure 3 , Figure 3 A schematic diagram of a flow chart of a gateway security filtering method provided in this embodiment. The gateway security filtering method includes:

[0181] S301: Receive a message to be processed.

[0182] S302: parse the message to be processed according to the OPC DA protocol format to obtain message parsing data.

[0183] S303: When the message parsing data does not hit the OPC DA protocol security policy matching item, the message to be processed is determined as a message to be forwarded.

[0184] In this embodiment, the OPC DA protocol security policy matching items include one or more of function code, address policy, and value policy, and the policy predetermined actions include a release action or a blocking action.

[0185] In this embodiment, before step S303 is successfully executed, there are multiple hits of OPC DA protocol security policy matching items.

[0186] For example, when step S303 is executed, the to-be-processed message with a message application layer length of 72 bytes has been discarded.

[0187] In this example, since 72 bytes of pending messages have been discarded, in order to ensure that the OPC DA protocol connection is not disconnected, the forwarded pending messages need to be adjusted. Among them, because the OPC DA protocol server has not received the discarded message, the data maintained in the host's protocol stack is still the sequence number of the previous message (the message sent to the server by the previous client before the message was discarded by the industrial gateway device). When the OPC DA client sends a new message (the message sent to the server by the next client after the message was discarded by the industrial gateway device), because the ACK message responded by the industrial gateway device is received, it is considered to be returned by the OPC DA server, so the confirmation number of the received ACK message is used as the sequence number of the message to send the next message. If the industrial gateway device does not make corresponding modifications and directly forwards the message, it will cause the server to receive the message and the data maintained by the local protocol stack will be inconsistent (72 bytes different), and continue to wait for reception, which will also cause abnormal OPCDA protocol communication.

[0188] S304: Obtain the diff_seq field value of the connection cache corresponding to the message to be forwarded.

[0189] S305. When the diff_seq field value is greater than 0, obtain the current message sequence number and the current TCP protocol checksum of the message to be forwarded.

[0190] Based on the above example, it can be seen that before receiving the message sent by the OPC DA client and completing the forwarding, this method needs to determine whether the diff_seq field value is greater than 0. If so, the TCP sequence number needs to be recalculated, that is, the length of the message discarded by the industrial gateway device is subtracted (here it means subtracting 72 bytes), so that after the server receives the message, it is consistent with the data cached locally, thereby ensuring the normal reception and processing of the message.

[0191] S306. Calculate the sequence number value according to the current message sequence number and the diff_seq field value.

[0192] As an optional implementation, calculating the sequence number value according to the current message sequence number and the diff_seq field value includes:

[0193] When the message to be forwarded is a message sent by the client, the current message sequence number is subtracted from the diff_seq field value to obtain the sequence number value;

[0194] When the message to be forwarded is a message sent by the server, the current message sequence number and the diff_seq field value are added to obtain the sequence number value.

[0195] S307: Replace the current message sequence number of the message to be forwarded with the sequence number value to obtain a replaced message.

[0196] S308. Calculate the TCP checksum according to the replaced message to obtain a checksum value.

[0197] S309: Replace the current TCP protocol checksum of the message to be sent with the checksum value to obtain the message to be sent.

[0198] In this embodiment, because the industrial gateway device modifies the content of the TCP segment, the TCP checksum data calculated by the OPC DA client when sending the packet can no longer be used (the OPC DA protocol client calculates the checksum of the TCP segment of the message to be sent, and then the server verifies the checksum of the received TCP segment. The purpose is to find out whether the TCP header and data have changed between the client and the server. If the server detects that the checksum is wrong, the TCP message will be directly discarded). It is necessary to recalculate the TCP checksum based on the modified content.

[0199] Therefore, before forwarding the OPC DA protocol message, the TCP protocol sequence number and TCP checksum need to be recalculated.

[0200] S310: Perform a forwarding operation on the message to be forwarded.

[0201] In this embodiment, the execution subject of the method may be a computing device such as a computer or a server, and no limitation is made in this embodiment.

[0202] In this embodiment, the execution subject of the method may also be a smart device such as a smart phone, a tablet computer, etc., which is not limited in this embodiment.

[0203] It can be seen that the gateway security filtering method described in this embodiment can be implemented by decoding the message content (i.e., parsing the application layer content of the message received by the device according to the OPC DA protocol format), matching the industrial gateway device security policy (a security filtering policy set for the OPC DA protocol, the policy is mainly composed of matching items and policy actions), and executing the policy action when the policy matching item is hit. When the message content hits the security policy matching item and the security policy action is blocking, the method can only discard the message that hits the security policy without disconnecting the TCP connection, and the subsequent interactive messages can continue to be forwarded and filtered, thereby achieving the effect of ensuring that the industrial gateway device can filter according to the security policy, and can also meet the requirements of real-time and reliable communication of the OPC DA protocol.

[0204] Example 4

[0205] Please see Figure 4 , Figure 4The following is a flow chart of an example of a gateway security filtering method provided in this embodiment. The gateway security filtering method includes:

[0206] S401. Parse the message content according to the OPC DA protocol format and match it with the OPC DA protocol security policy matching items on the industrial gateway device. When the matching policy needs to execute the policy predetermined action blocking, the industrial gateway device connection information needs to record the current message transport layer carrying data length.

[0207] In this embodiment, the transport layer bearer data length is the application layer message length.

[0208] In this embodiment, in order to ensure normal forwarding of subsequent messages and not disconnect the TCP connection, data cache records should be kept here.

[0209] In this embodiment, the industrial gateway device needs to parse the content of the forwarded OPC DA message. When the security policy function code, address policy, and control policy of the industrial gateway device security engine are hit and blocking is executed, it is necessary to record the current message TCP layer load message length, that is, the application layer message length is recorded in the diff_seq field of the current industrial gateway device connection information (the diff_seq field is the industrial gateway device recording the application layer message length discarded by the current connection, or the sequence number difference). If multiple messages are discarded, it is necessary to accumulate the transport layer bearer data lengths of the discarded messages in sequence, and record the accumulated results in the diff_seq of the connection.

[0210] S402, the industrial gateway device needs to create an ACK message and reply an ACK response message to the source address of the blocked message (OPC DA protocol client address), in order to tell the client that the message content has been received and confirm how many bytes of data have been successfully received through the ACK message.

[0211] In this embodiment, an ACK message is constructed, and the following operations are performed:

[0212] (1) Fill the destination MAC address of the current message into the source MAC address of the copied message;

[0213] (2) Fill the source MAC address of the current message into the destination MAC address of the copied message;

[0214] (3) Fill the destination IP address of the current message into the source IP address of the copied message;

[0215] (4) Fill the source IP address of the current message into the destination IP address of the copied message;

[0216] (5) Set the ACK flag of the TCP protocol of the copied message to 1;

[0217] (6) Fill the TCP protocol destination port number of the current message into the TCP protocol source port number field of the copied message;

[0218] (7) Fill the TCP source port number of the current message into the TCP destination port number field of the copied message;

[0219] (8) Fill the TCP protocol sequence number of the current message + "application layer memory length of the discarded message" into the TCP protocol confirmation number of the copied message;

[0220] (9) Fill the TCP protocol confirmation number of the current message into the TCP protocol sequence number of the copied message;

[0221] (10) Set the TCP protocol payload data length of the copied message to 0;

[0222] (11) The industrial gateway device sends the created ACK message to the source address device, that is, the client device.

[0223] S403: When data caching has been completed and the ACK confirmation message has been sent, the current OPC DA protocol message is discarded, thereby ensuring that the OPC DA client does not initiate retransmission or close the connection.

[0224] In this embodiment, since the industrial gateway device does not need to forward the currently blocked OPC DA protocol message, a discarding method is adopted.

[0225] S404: During the interaction between the OPC DA client and the server, the message may hit the security filtering policy multiple times and needs to be blocked, and steps S401 to S403 are repeated.

[0226] In this embodiment, the industrial gateway device does not allow forwarding because the OPC DA protocol message hits the security policy, and in order to keep the OPC DA protocol connection connected, the industrial gateway device sends a confirmation message to the OPC DA client. Therefore, at this time, there is a difference in the data recorded by the OPC DA client and the server protocol stack. If the subsequent OPC DA protocol message continues to be forwarded, the TCP protocol sequence number needs to be recalculated.

[0227] In this embodiment, the industrial gateway device discards the OPC DA protocol service message, which has caused the serial number and confirmation number recorded by the protocol stack on both ends of the OPC DA protocol client and server to be inconsistent. In order for the subsequent forwarded messages of the same connection to communicate normally, the industrial gateway device must refer to the diff_seq content of the connection record to modify the TCP protocol sequence number and checksum in the message, otherwise the protocol stack cannot be accepted and processed normally.

[0228] Please see Figure 5 , Figure 5 A schematic diagram of a blocking process for a message to be processed is shown. Figure 5 The process of a message to be processed hitting a security policy, blocking the message to be processed and disconnecting the connection is specifically shown.

[0229] S405. Before the industrial gateway device forwards the message, it will make a judgment based on the diff_seq value recorded on the industrial gateway device connection. If it is 0, no modification is required and it is sent directly.

[0230] S406. If diff_seq is greater than 0, the industrial gateway device needs to perform the following processing before sending.

[0231] S407: If the message comes from the client, it is necessary to obtain the current message sequence number and subtract the diff_seq field value, that is, the length of the discarded message. The obtained sequence number value overwrites the original sequence number of the current message.

[0232] S408: If the message comes from the server, it is necessary to obtain the current message sequence number and add the diff_seq field value, that is, discard the message length. The obtained sequence number value overwrites the original sequence number of the current message.

[0233] In this embodiment, because the TCP protocol sequence number of the current message has been modified, the TCP checksum needs to be recalculated and overwritten with the TCP protocol checksum of the current message.

[0234] S409. The industrial gateway device forwards the OPC DA protocol message.

[0235] In this embodiment, the execution subject of the method may be a computing device such as a computer or a server, and no limitation is made in this embodiment.

[0236] In this embodiment, the execution subject of the method may also be a smart device such as a smart phone, a tablet computer, etc., which is not limited in this embodiment.

[0237] It can be seen that the gateway security filtering method described in this embodiment can be implemented by decoding the message content (i.e., parsing the application layer content of the message received by the device according to the OPC DA protocol format), matching the industrial gateway device security policy (a security filtering policy set for the OPC DA protocol, the policy is mainly composed of matching items and policy actions), and executing the policy action when the policy matching item is hit. When the message content hits the security policy matching item and the security policy action is blocking, the method can only discard the message that hits the security policy without disconnecting the TCP connection, and the subsequent interactive messages can continue to be forwarded and filtered, thereby achieving the effect of ensuring that the industrial gateway device can filter according to the security policy, and can also meet the requirements of real-time and reliable communication of the OPC DA protocol.

[0238] Example 5

[0239] Please see Figure 6 , Figure 6 This is a schematic diagram of the structure of a gateway security filtering device provided in this embodiment. Figure 6 As shown, the gateway security filtering device includes:

[0240] A receiving unit 510, configured to receive a message to be processed;

[0241] The parsing unit 520 is used to parse the message content of the message to be processed according to the OPC DA protocol format to obtain message parsing data;

[0242] The determination unit 530 is used to determine the policy predetermined action corresponding to the message to be processed when the message parsing data hits the preset OPC DA protocol security policy matching item;

[0243] A construction unit 540, configured to construct an ACK response message when the policy predetermined action is a blocking action;

[0244] A reply unit 550 is used to reply an ACK response message to the source address corresponding to the message to be processed;

[0245] The recording unit 560 is used to record the transport layer bearer data length corresponding to the message to be processed into the diff_seq field of the current industrial gateway device connection information;

[0246] The discarding unit 570 is used to discard the message to be processed.

[0247] In this embodiment, the explanation of the gateway security filtering device can refer to the description in Example 1, Example 2, Example 3 or Example 4, which will not be further described in this embodiment.

[0248] It can be seen that the gateway security filtering device described in this embodiment can decode the message content (i.e., parse the application layer content of the message received by the device according to the OPC DA protocol format), match the industrial gateway device security policy (a security filtering policy set for the OPC DA protocol, the policy is mainly composed of matching items and policy actions), and execute the policy action if the policy matching item is hit. When the message content hits the security policy matching item and the security policy action is blocking, the method can only discard the message that hits the security policy without disconnecting the TCP connection, and the subsequent interactive messages can continue to be forwarded and filtered, thereby achieving the effect of ensuring that the industrial gateway device can filter according to the security policy, and can also meet the requirements of real-time and reliable communication of the OPC DA protocol.

[0249] Example 6

[0250] Please see Figure 7 , Figure 7 This is a schematic diagram of the structure of a gateway security filtering device provided in this embodiment. Figure 7 As shown, the gateway security filtering device includes:

[0251] A receiving unit 510, configured to receive a message to be processed;

[0252] The parsing unit 520 is used to parse the message content of the message to be processed according to the OPC DA protocol format to obtain message parsing data;

[0253] The determination unit 530 is used to determine the policy predetermined action corresponding to the message to be processed when the message parsing data hits the preset OPC DA protocol security policy matching item;

[0254] A construction unit 540, configured to construct an ACK response message when the policy predetermined action is a blocking action;

[0255] A reply unit 550 is used to reply an ACK response message to the source address corresponding to the message to be processed;

[0256] The recording unit 560 is used to record the transport layer bearer data length corresponding to the message to be processed into the diff_seq field of the current industrial gateway device connection information;

[0257] The discarding unit 570 is used to discard the message to be processed.

[0258] As an optional implementation, the gateway security filtering device further includes:

[0259] The determination unit 580 is configured to determine the message to be processed as a message to be forwarded when the message parsing data does not hit the OPC DA protocol security policy matching item;

[0260] An acquisition unit 590 is used to acquire a diff_seq field value of a connection buffer corresponding to a message to be forwarded;

[0261] The acquisition unit 590 is further configured to acquire the current message sequence number and the current TCP protocol checksum of the message to be forwarded when the diff_seq field value is greater than 0;

[0262] A calculation unit 600, configured to calculate a sequence number value according to a current message sequence number and a diff_seq field value;

[0263] A replacement unit 610, configured to replace a current message sequence number of a message to be forwarded with a sequence number value to obtain a replacement message;

[0264] The calculation unit 600 is further used to calculate the TCP checksum according to the replacement message to obtain the checksum value;

[0265] The replacement unit 610 is further used to replace the current TCP protocol checksum of the replacement message with the checksum value to obtain the message to be sent;

[0266] The forwarding unit 620 is used to perform a forwarding operation on the message to be forwarded.

[0267] As an optional implementation, the calculation unit 600 is specifically configured to, when the message to be forwarded is a message sent by the client, perform a subtraction calculation on the current message sequence number and the diff_seq field value to obtain a sequence number value;

[0268] The calculation unit 600 is further specifically used to, when the message to be forwarded is a message sent by the server, perform addition calculation on the current message sequence number and the diff_seq field value to obtain a sequence number value.

[0269] As an optional implementation, the construction unit 540 includes:

[0270] A first determining subunit 541 is used to determine the transport layer bearer data length of the message to be processed according to the message parsing data;

[0271] The first acquisition subunit 542 is used to acquire control information of the message to be processed according to the message parsing data; wherein the control information at least includes a destination MAC address, a source MAC address, a destination IP address, a source IP address, a TCP protocol destination port number, a TCP protocol source port number, a TCP protocol sequence number, and a TCP protocol confirmation number;

[0272] The construction subunit 543 is used to construct an ACK response message according to the transport layer bearer data length and control information.

[0273] As an optional implementation, the construction subunit 543 includes:

[0274] A construction module, used for constructing an original ACK message;

[0275] A filling module, used to fill the destination MAC address into the source MAC address of the original ACK message to obtain a first processed message;

[0276] The filling module is further used to fill the source MAC address into the destination MAC address of the first processed message to obtain a second processed message;

[0277] The filling module is further used to fill the destination IP address into the source IP address of the second processed message to obtain a third processed message;

[0278] The filling module is further used to fill the source IP address into the destination IP address of the third processed message to obtain a fourth processed message;

[0279] A setting module, used to set the ACK flag of the TCP protocol in the fourth processing message to 1, to obtain a fifth processing message;

[0280] The filling module is further used to fill the TCP protocol destination port number into the TCP protocol source port number field of the fifth processing message to obtain a sixth processing message;

[0281] The filling module is further used to fill the TCP protocol source port number into the TCP protocol destination port number field of the sixth processing message to obtain a seventh processing message;

[0282] The filling module is further used to fill the TCP protocol confirmation number into the TCP protocol sequence number field of the seventh processing message to obtain an eighth processing message;

[0283] A calculation module, used for calculating a new TCP protocol confirmation number according to a TCP protocol sequence number and a transport layer carried data length;

[0284] The filling module is further used to fill the TCP protocol new confirmation number into the TCP protocol confirmation number field of the eighth processing message to obtain a ninth processing message;

[0285] The setting module is also used to set the TCP protocol payload data length of the ninth processing message to 0, and obtain an ACK response message.

[0286] In this embodiment, the OPC DA protocol security policy matching items include one or more of function code, address policy, and value policy, and the policy predetermined actions include a release action or a blocking action.

[0287] As an optional implementation, the recording unit 560 includes:

[0288] The second acquisition subunit 561 is used to obtain the transport layer bearer data length corresponding to the message to be processed;

[0289] The second determining subunit 562 is used to determine the diff_seq field value corresponding to the length of the data carried by each transport layer when there are multiple pending messages to be discarded in the same connection; wherein the multiple pending messages to be discarded correspond to different time points;

[0290] The calculation subunit 563 is used to perform a cumulative operation on all diff_seq field values ​​to obtain a field value to be recorded;

[0291] The recording subunit 564 is used to record the field value to be recorded in the diff_seq field of the current industrial gateway device connection information.

[0292] In this embodiment, the explanation of the gateway security filtering device can refer to the description in Example 1, Example 2, Example 3 or Example 4, which will not be further described in this embodiment.

[0293] It can be seen that the gateway security filtering device described in this embodiment can decode the message content (i.e., parse the application layer content of the message received by the device according to the OPC DA protocol format), match the industrial gateway device security policy (a security filtering policy set for the OPC DA protocol, the policy is mainly composed of matching items and policy actions), and execute the policy action if the policy matching item is hit. When the message content hits the security policy matching item and the security policy action is blocking, the method can only discard the message that hits the security policy without disconnecting the TCP connection, and the subsequent interactive messages can continue to be forwarded and filtered, thereby achieving the effect of ensuring that the industrial gateway device can filter according to the security policy, and can also meet the requirements of real-time and reliable communication of the OPC DA protocol.

[0294] An embodiment of the present application provides an electronic device, including a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the gateway security filtering method in Embodiment 1, Embodiment 2, Embodiment 3 or Embodiment 4 of the present application.

[0295] An embodiment of the present application provides a computer-readable storage medium storing computer program instructions. When the computer program instructions are read and executed by a processor, the gateway security filtering method in Embodiment 1, Embodiment 2, Embodiment 3 or Embodiment 4 of the present application is executed.

[0296] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0297] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0298] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0299] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0300] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0301] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A gateway security filtering method, characterized in that: The method comprises: Receive messages to be processed; Parsing the message content of the message to be processed according to the OPC DA protocol format to obtain message parsing data; When the message parsing data hits the preset OPC DA protocol security policy matching item, determining the policy predetermined action corresponding to the message to be processed; When the predetermined action of the strategy is a blocking action, constructing an ACK response message; Replying the ACK response message to the source address corresponding to the message to be processed; The transport layer bearer data length corresponding to the message to be processed is recorded in the diff_seq field of the current industrial gateway device connection information, and the message to be processed is discarded.

2. The gateway security filtering method according to claim 1, characterized in that: The method further comprises: When the message parsing data does not hit the OPC DA protocol security policy matching item, determining the message to be processed as a message to be forwarded; Obtain the diff_seq field value of the connection cache corresponding to the message to be forwarded; When the diff_seq field value is greater than 0, the current message sequence number and the current TCP protocol checksum of the message to be forwarded are obtained; Calculate the sequence number value according to the current message sequence number and the diff_seq field value; Replacing the current message sequence number of the message to be forwarded with the sequence number value to obtain a replaced message; Calculate the TCP checksum according to the replacement message to obtain a checksum value; Replacing the current TCP protocol checksum of the replacement message with the checksum value to obtain a message to be sent; Perform a forwarding operation on the message to be forwarded.

3. The gateway security filtering method according to claim 2, characterized in that: The calculating the sequence number value according to the current message sequence number and the diff_seq field value includes: When the message to be forwarded is a message sent by the client, subtract the current message sequence number from the diff_seq field value to obtain a sequence number value; When the message to be forwarded is a message sent by the server, the current message sequence number and the diff_seq field value are added to obtain a sequence number value.

4. The gateway security filtering method according to claim 1, characterized in that: The constructing of the ACK response message includes: Determine the transport layer bearer data length of the message to be processed according to the message parsing data; Acquire control information of the message to be processed according to the message parsing data; wherein the control information at least includes a destination MAC address, a source MAC address, a destination IP address, a source IP address, a TCP protocol destination port number, a TCP protocol source port number, a TCP protocol sequence number, and a TCP protocol confirmation number; Construct an ACK response message according to the transport layer bearer data length and the control information.

5. The gateway security filtering method according to claim 4, characterized in that: The constructing an ACK response message according to the transport layer bearer data length and the control information includes: Construct the original ACK message; Filling the destination MAC address into the source MAC address of the original ACK message to obtain a first processed message; Filling the source MAC address into the destination MAC address of the first processed message to obtain a second processed message; Filling the destination IP address into the source IP address of the second processed message to obtain a third processed message; Filling the source IP address into the destination IP address of the third processed message to obtain a fourth processed message; Set the ACK flag of the TCP protocol in the fourth processed message to 1 to obtain a fifth processed message; Filling the TCP protocol destination port number into the TCP protocol source port number field of the fifth processing message to obtain a sixth processing message; Filling the TCP protocol source port number into the TCP protocol destination port number field of the sixth processing message to obtain a seventh processing message; Filling the TCP protocol confirmation number into the TCP protocol sequence number field of the seventh processing message to obtain an eighth processing message; Calculate a new TCP protocol confirmation number based on the TCP protocol sequence number and the transport layer bearer data length; Filling the TCP protocol new confirmation number into the TCP protocol confirmation number field of the eighth processing message to obtain a ninth processing message; The TCP protocol payload data length of the ninth processing message is set to 0 to obtain an ACK response message.

6. The gateway security filtering method according to claim 1, characterized in that: The OPC DA protocol security policy matching items include one or more of function codes, address policies, and value policies, and the policy predetermined actions include release actions or blocking actions.

7. The gateway security filtering method according to claim 1, characterized in that: The step of recording the transport layer bearer data length corresponding to the message to be processed into the diff_seq field of the current industrial gateway device connection information includes: Obtaining the transport layer bearer data length corresponding to the message to be processed; When there are multiple packets to be processed for discarding in the same connection, determine the diff_seq field value corresponding to the length of each transport layer bearer data; wherein the multiple packets to be processed for discarding correspond to different time periods respectively; Performing a cumulative operation on all the diff_seq field values ​​to obtain the field value to be recorded; The field value to be recorded is recorded in the diff_seq field of the current industrial gateway device connection information.

8. An electronic device, characterized in that: The electronic device comprises a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the gateway security filtering method according to any one of claims 1 to 7.

9. A readable storage medium, characterized in that: The readable storage medium stores computer program instructions, and when the computer program instructions are read and executed by a processor, the gateway security filtering method according to any one of claims 1 to 7 is executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the gateway security filtering method according to any one of claims 1 to 7 is executed.

Images