Industrial control white list updating method and device, electronic equipment and storage medium

Abstract

The invention provides an industrial control white list updating method and device, electronic equipment and a storage medium, and relates to the technical field of network security, and the method comprises the steps: when a DHCP message is captured, analyzing the DHCP message, and obtaining an MAC address of a DHCP client and a first IP address allocated to the DHCP client by a DHCP server; according to the MAC address, the first IP address and a first mapping relation, whether the first IP address is a redistributed or newly distributed IP address is judged, and the first mapping relation is used for recording the corresponding relation between the MAC address and the IP address; and under the condition that the first IP address is the redistributed or newly distributed IP address, updating the IP address in the industrial control white list according to the first IP address. According to the invention, the industrial control white list can be linked and updated according to the change of the IP address, and the accuracy of service security management and control is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an industrial control whitelist updating method, device, electronic device and storage medium. Background Art

[0002] In the industrial intelligent manufacturing industry, industrial control network communication whitelist technology is a common method. By learning the industrial control whitelist in the production network for a period of time, and then applying this whitelist, it blocks the services that do not match the whitelist.

[0003] In practice, due to the difficulty of managing fixed network addresses for customer-site device terminals, Dynamic Host Configuration Protocol (DHCP) is often used to manage large numbers of devices. However, the frequently changing Internet Protocol (IP) addresses result in poor accuracy in business security management. Summary of the Invention

[0004] In view of the problems existing in the prior art, the present invention provides an industrial control whitelist updating method, device, electronic device and storage medium.

[0005] The present invention provides an industrial control whitelist updating method, comprising:

[0006] When a Dynamic Host Configuration Protocol (DHCP) message is captured, the DHCP message is parsed to obtain a Media Access Control (MAC) address of the DHCP client and a first IP address assigned to the DHCP client by the DHCP server;

[0007] Determining whether the first IP address is a reallocated or newly allocated IP address based on the MAC address, the first IP address, and a first mapping relationship, wherein the first mapping relationship is used to record a correspondence between a MAC address and an IP address;

[0008] In the case that the first IP address is a reallocated or newly allocated IP address, the IP addresses in the industrial control whitelist are updated according to the first IP address.

[0009] According to a method for updating an industrial control whitelist provided by the present invention, determining whether the first IP address is a reallocated or newly allocated IP address based on the MAC address, the first IP address, and the first mapping relationship includes:

[0010] Searching for the MAC address and / or the first IP address in the first mapping relationship to obtain a query result;

[0011] According to the query result, it is determined whether the first IP address is a reallocated or newly allocated IP address.

[0012] According to a method for updating an industrial control whitelist provided by the present invention, determining whether the first IP address is a reallocated or newly allocated IP address based on the query result includes:

[0013] When the query result indicates that the first mapping relationship includes the MAC address and the second IP address corresponding to the MAC address, determining that the first IP address is a reallocated IP address;

[0014] Alternatively, when the query result is that the first mapping relationship includes the first IP address but does not include the MAC address, or the first mapping relationship does not include the MAC address and the first IP address, it is determined that the first IP address is a newly allocated IP address.

[0015] According to a method for updating an industrial control whitelist provided by the present invention, when the first IP address is a reallocated or newly allocated IP address, updating the IP address in the industrial control whitelist according to the first IP address includes:

[0016] In the case where the first IP address is a reallocated IP address, updating the second IP address in the industrial control whitelist to the first IP address;

[0017] Alternatively, when the first IP address is a newly allocated IP address, a whitelist entry corresponding to the first IP address is added to the industrial control whitelist.

[0018] According to a method for updating an industrial control whitelist provided by the present invention, the method further includes:

[0019] Delete the historical whitelist entry corresponding to the first IP address from the industrial control whitelist.

[0020] According to a method for updating an industrial control whitelist provided by the present invention, the method further includes:

[0021] When the first IP address is a reallocated IP address, updating the second IP address corresponding to the MAC address in the first mapping relationship to the first IP address;

[0022] Alternatively, when the first IP address is a newly allocated IP address, the correspondence between the MAC address and the first IP address is added to the first mapping relationship.

[0023] According to a method for updating an industrial control whitelist provided by the present invention, updating the IP address in the industrial control whitelist according to the first IP address includes:

[0024] In a case where the DHCP message is a DHCP offer message, adding a whitelist entry corresponding to the first IP address to the industrial control whitelist;

[0025] When a DHCP confirmation ACK message is received, deleting the historical whitelist entry corresponding to the first IP address in the industrial control whitelist;

[0026] Alternatively, after the whitelist entry corresponding to the first IP address is added to the industrial control whitelist, a deletion timer is started; if no DHCP OFFER message is received after the deletion timer times out, the historical whitelist entry corresponding to the first IP address is deleted from the industrial control whitelist.

[0027] The present invention also provides an industrial control whitelist updating device, comprising:

[0028] a parsing module configured to parse a Dynamic Host Configuration Protocol (DHCP) message when it is captured, and obtain a Media Access Control (MAC) address of the DHCP client and a first IP address assigned to the DHCP client by the DHCP server;

[0029] a determination module, configured to determine whether the first IP address is a reallocated or newly allocated IP address based on the MAC address, the first IP address, and a first mapping relationship, wherein the first mapping relationship is used to record a correspondence between a MAC address and an IP address;

[0030] An updating module is used to update the IP addresses in the industrial control whitelist according to the first IP address when the first IP address is a reallocated or newly allocated IP address.

[0031] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, any of the above-described industrial control whitelist updating methods is implemented.

[0032] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the industrial control whitelist updating method described in any one of the above is implemented.

[0033] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the above-mentioned industrial control whitelist updating methods.

[0034] The industrial control whitelist updating method, device, electronic device and storage medium provided by the present invention parse the DHCP message when a DHCP message is captured to obtain the MAC address of the DHCP client and the first IP address assigned to the DHCP client by the DHCP server; determine whether the first IP address is a reallocated or newly allocated IP address based on the MAC address, the first IP address and a first mapping relationship, wherein the first mapping relationship is used to record the correspondence between the MAC address and the IP address; and when the first IP address is a reallocated or newly allocated IP address, update the IP address in the industrial control whitelist based on the first IP address, thereby realizing the linkage update of the industrial control whitelist according to the IP address change, and improving the accuracy of business security management and control. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0036] Figure 1 This is one of the flow charts of the industrial control whitelist updating method provided by the present invention;

[0037] Figure 2 This is the second flow chart of the industrial control whitelist updating method provided by the present invention;

[0038] Figure 3 This is a schematic diagram of the deployment of the industrial control whitelist updating device provided by the present invention;

[0039] Figure 4 It is a structural diagram of the industrial control whitelist updating device provided by the present invention;

[0040] Figure 5 It is a schematic diagram of the physical structure of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0041] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0042] In order to facilitate a clearer understanding of the technical solutions provided by the embodiments of the present invention, some relevant knowledge is first introduced as follows.

[0043] 1. Industrial Control Whitelist:

[0044] Generally, it includes the following data items: IP address, Media Access Control (MAC) address, function code, and other parameters (parameter 1, parameter 2, parameter 3, ...). When used, it strictly matches this whitelist. If it matches, it is passed; otherwise, it is blocked.

[0045] In the present invention, only three-layer protocol devices are analyzed, and the typical whitelist strategy format of the three-layer protocol is: IP address, function code, and other parameters (parameter 1, parameter 2, parameter 3, ...).

[0046] 2. For the existing three-layer industrial control protocol scenarios, a strict whitelist control method is adopted. This is a strict control method based on IP, function code, and parameters. If it matches, it will be passed; if it does not match, it will be blocked.

[0047] Technical flaw: This feature fails to adapt to factory usage. After learning the whitelist and entering protection mode, the factory may encounter the following scenario: The factory may use DHCP deployment, and the device IP address changes each time. This can cause the whitelist match to fail after the device's IP address is reassigned, disrupting normal service.

[0048] Other possible solutions and drawbacks are as follows:

[0049] 1. Use static IP address allocation to manage all devices.

[0050] In industrial control scenarios, there are tens of thousands of programmable logic controllers (PLCs) and other devices, and the management workload is enormous.

[0051] 2. Use asset profiling method.

[0052] The identification is not accurate and cannot be broken down to a specific device.

[0053] 3. Use coarse-grained control method.

[0054] This will sacrifice some accuracy and reduce the whitelist security monitoring capabilities.

[0055] 4. Use Lightweight Directory Access Protocol (LDAP) and Active Directory (AD) domain management.

[0056] LDAP and AD programs are not supported for non-PC terminals, such as a large number of PLCs and Supervisory Control And Data Acquisition (SCADA) devices in industrial Internet scenarios.

[0057] 5. Other DHCP tracking technologies.

[0058] The disadvantage of recording the information allocated by DHCP by extending the DHCP program is that it is not real-time. In addition, the DHCP extension programming is not universal, and different DHCP servers operate in different ways.

[0059] The following combination Figures 1 to 5 The present invention describes an industrial control whitelist updating method, device, electronic device and storage medium.

[0060] Figure 1 This is one of the flow charts of the industrial control whitelist update method provided by the present invention, such as Figure 1 As shown, the method includes steps 101 to 103, wherein:

[0061] Step 101: When a DHCP message is captured, the DHCP message is parsed to obtain the MAC address of the DHCP client and the first IP address assigned to the DHCP client by the DHCP server.

[0062] It should be noted that the industrial control whitelist update method provided by the present invention can be applied to the field of industrial network security. For example, it can be applied to scenarios where industrial control whitelist technology is used to perform business security management and control of dynamic IP devices in DHCP scenarios. In industrial scenarios, industrial control devices such as PLCs are often connected via DHCP. The execution entity of this method can be an industrial control whitelist update device or update engine, such as an industrial control device, electronic device, server, or a control module within a server that executes the industrial control whitelist update method provided by the present invention.

[0063] First, capture and perform preliminary analysis of DHCP messages.

[0064] Specifically, for DHCP messages, the network data packets can be captured by using the well-known promiscuous mode, Packet Capture Library (Libpcap), etc., targeting the User Datagram Protocol (UDP) port numbers 67 and 68.

[0065] The captured DHCP packet is deeply parsed to analyze its content and fields to obtain the MAC address of the DHCP client (such as industrial control equipment) and the first IP address assigned to the DHCP client by the DHCP server.

[0066] For example, obtain the DHCP OP information and then analyze the IP change status. In the DHCP protocol, the DHCP message is DHCPACK (OP=5)

[0067] For the above part, two pieces of information are obtained from the network packet data according to the DHCP standard format requirements:

[0068] (1) yiaddr, which is the IP address assigned by the DHCP server to the client. It is displayed only in the DHCP offer (Offer) message and DHCP confirmation (ACK) message sent by the DHCP server. It is displayed as 0 in other messages.

[0069] (2) chaddr, which is the MAC address of the DHCP client. The MAC address of the corresponding DHCP client will be displayed in each message.

[0070] Step 102: Determine whether the first IP address is a reallocated or newly allocated IP address based on the MAC address, the first IP address, and a first mapping relationship, wherein the first mapping relationship is used to record the correspondence between the MAC address and the IP address.

[0071] Optionally, the first mapping relationship is used to record the correspondence between the MAC address and the IP address. The first mapping relationship can be presented in the form of an information table. The information table, such as the terminal IP information dynamic status table shown in Table 1, uses the MAC address of the DHCP client and the IP address assigned to the DHCP client by the DHCP server as key values ​​to maintain a terminal IP information dynamic status table. Mac (chaddr) is the MAC address of the DHCP client, and the corresponding DHCP client MAC address will be displayed in each message. IP (yiaddr) is the IP address assigned to the client by the DHCP server. IP (yiaddr) is only displayed in the Offer and DHCP ACK messages sent by the DHCP server, and is displayed as 0 in other messages.

[0072] Table 1 Terminal IP information dynamic status table

[0073] Mac (chaddr) IP(yiaddr) 0fe0-aaaa-bbb1 192.168.1.23 0fe0-aaaa-bbb2 192.168.1.24 0fe0-aaaa-bbb3 192.168.1.25

[0074] Optionally, in step 102, determining whether the first IP address is a reallocated or newly allocated IP address based on the MAC address, the first IP address, and the first mapping relationship may include the following steps:

[0075] Step a: searching the first mapping relationship for the MAC address and / or the first IP address to obtain a query result;

[0076] Step b: Based on the query result, determine whether the first IP address is a reallocated or newly allocated IP address.

[0077] Optionally, for step b, determining whether the first IP address is a reallocated or newly allocated IP address based on the query result may include:

[0078] Method 1) When the query result is that the first mapping relationship includes the MAC address and the second IP address corresponding to the MAC address, determine that the first IP address is a reallocated IP address.

[0079] or,

[0080] Method 2) When the query result is that the first mapping relationship includes the first IP address but does not include the MAC address, or the first mapping relationship does not include the MAC address and the first IP address, determine that the first IP address is a newly allocated IP address.

[0081] Optionally, when the first IP address is a reallocated IP address, updating the second IP address corresponding to the MAC address in the first mapping relationship to the first IP address;

[0082] Alternatively, when the first IP address is a newly allocated IP address, the correspondence between the MAC address and the first IP address is added to the first mapping relationship.

[0083] Taking the DHCP ACK message as an example, the MAC address and the first IP address carried in the DHCP ACK are queried in the terminal IP information dynamic status table to obtain a query result.

[0084] Based on the query result, determine whether the first IP address is a reallocated or newly allocated IP address, including the following situations:

[0085] Scenario 1: The MAC address is found in the terminal IP information dynamic status table, and the second IP address corresponding to the MAC address is the same as the first IP address.

[0086] For scenario 1, it means that the IP address of the industrial control device has not changed, the business of the industrial control device is normal, and the industrial control device is allowed to perform the corresponding business.

[0087] Scenario 2: The MAC address is found in the terminal IP information dynamic status table, but the second IP address corresponding to the MAC address is different from the first IP address.

[0088] For scenario 2, it indicates that the IP address of the industrial control device has changed, that is, the first IP address is determined to be a reallocated IP address. Then, the second IP address corresponding to the MAC address in the terminal IP information dynamic status table is updated to the first IP address.

[0089] Notify the whitelist policy to update and update the second IP address in the industrial control whitelist to the first IP address.

[0090] Specifically, in the security rules corresponding to the original IP (old), the corresponding IP is changed to IP (new) (ie, the first IP address).

[0091] For example, the original whitelist is as follows:

[0092] IP Function code Other parameters 192.168.1.23 Read 01

[0093] Update the IP address separately to IP(new), for example, 192.168.1.25.

[0094] IP Function code Other parameters 192.168.1.25 Read 01

[0095] Only the IP address is updated, and other information remains unchanged.

[0096] Scenario 3: The MAC address is not found in the terminal IP information dynamic status table, and the first IP address is found in the IP column.

[0097] For scenario 3, a device has gone offline, and a new device has come online, occupying the first IP address. The first IP address is determined to be a newly assigned IP address. The corresponding entry between the MAC address and the first IP address is added to the terminal IP information dynamic status table, and the original entry corresponding to the first IP address is deleted.

[0098] Notify the whitelist policy to update. Specifically, add the whitelist entry corresponding to the first IP address to the industrial control whitelist, and delete the historical whitelist entry corresponding to the first IP address from the industrial control whitelist. For example, 1) delete the whitelist entry corresponding to the original IP address; 2) separately study the entry content for the new IP address.

[0099] Scenario 4: The MAC address is not found in the terminal IP information dynamic status table, and the first IP address is not found in the IP column.

[0100] For scenario 4, it indicates that a new device has come online. The first IP address is determined to be a newly allocated IP address. Then, the correspondence between the MAC address and the first IP address is added to the terminal IP information dynamic status table.

[0101] Notify the whitelist policy to update. Specifically, notify the whitelist policy to update. Add a whitelist entry corresponding to the first IP address to the industrial control whitelist. For example, separately learn the entry content for the new IP address.

[0102] The above table is a status maintenance mechanism that can be used for subsequent whitelist entry IP maintenance and updates.

[0103] Step 103: When the first IP address is a reallocated or newly allocated IP address, update the IP addresses in the industrial control whitelist according to the first IP address.

[0104] Optionally, the industrial control whitelist includes at least one of the following: an IP address, a function code, and a target parameter.

[0105] Optionally, in step 103, when the first IP address is a reallocated or newly allocated IP address, updating the IP addresses in the industrial control whitelist according to the first IP address includes:

[0106] In the case where the first IP address is a reallocated IP address, updating the second IP address in the industrial control whitelist to the first IP address;

[0107] Alternatively, when the first IP address is a newly allocated IP address, a whitelist entry corresponding to the first IP address is added to the industrial control whitelist.

[0108] Optionally, a historical whitelist entry corresponding to the first IP address is deleted from the industrial control whitelist.

[0109] The industrial control whitelist updating method provided by the present invention parses the DHCP message when a DHCP message is captured to obtain the MAC address of the DHCP client and the first IP address assigned to the DHCP client by the DHCP server; determines whether the first IP address is a reallocated or newly allocated IP address based on the MAC address, the first IP address and a first mapping relationship, wherein the first mapping relationship is used to record the correspondence between the MAC address and the IP address; and when the first IP address is a reallocated or newly allocated IP address, updates the IP address in the industrial control whitelist based on the first IP address, thereby realizing the linkage update of the industrial control whitelist according to the IP address change, and improving the accuracy of business security management and control.

[0110] Optionally, the industrial control whitelist update method provided by the present invention senses and records changes in device IP addresses by capturing and analyzing DHCP interaction messages, and based on the analysis results, refreshes the IP address portion of the whitelist policy in real time to achieve precise control of IP devices across the entire network. Typical scenarios include:

[0111] A. The IP address of the online device has changed;

[0112] B. A device is offline and another device uses this address.

[0113] Figure 2 This is the second flow chart of the industrial control whitelist update method provided by the present invention, such as Figure 2 As shown, the method includes steps 201 to 210, wherein:

[0114] Step 201: Obtain an industrial control whitelist; the industrial control whitelist includes at least one of the following: an IP address, a function code, and a target parameter.

[0115] Step 202: Capture DHCP messages.

[0116] Step 203: Parse the DHCP message to obtain the MAC address of the DHCP client and the first IP address assigned to the DHCP client by the DHCP server.

[0117] Step 204: Look up the MAC address and the first IP address in the first mapping relationship, and determine whether the MAC exists and the IP is the same based on the query result; if not, go to step 205. If yes, the process ends.

[0118] Step 205: Determine whether the MAC address exists and the IP address is different; if so, go to step 206; if not, go to step 207.

[0119] Step 206: Update the industrial control whitelist, and then the process ends.

[0120] Step 207: Determine whether the MAC address does not exist and the IP address is the same; if so, go to step 208; if not, go to step 209.

[0121] Step 208: Add an IP entry, delete the original IP entry, and then the process ends.

[0122] Step 209: Determine whether the MAC address does not exist and the IP address is different; if so, go to step 210. If not, the process ends.

[0123] Step 210: Add an IP table entry.

[0124] It should be noted that, considering factors such as network delays and processing time, the whitelist may not be updated quickly after the IP address is updated, which may result in the services whose IP addresses have been changed being blocked by the whitelist policy. In view of this problem, the implementation method of updating the IP address in the industrial control whitelist based on the first IP address in step 103 may include:

[0125] Step 1: When the DHCP message is a DHCP OFFER message, add a whitelist entry corresponding to the first IP address to the industrial control whitelist;

[0126] In this case, when a DHCP OFFER is received, the previous entry is not updated or deleted directly, but retained. The previous entry is updated or deleted only when a DHCP ACK is received.

[0127] Step 2: When a DHCP ACK message is received, the historical whitelist entry corresponding to the first IP address is deleted from the industrial control whitelist; or, after the whitelist entry corresponding to the first IP address is added to the industrial control whitelist, a deletion timer is started. If no DHCP ACK message is received after the deletion timer times out, the historical whitelist entry corresponding to the first IP address is deleted from the industrial control whitelist.

[0128] Specifically, each DHCP interaction involves a session. The xid field in the message uniquely identifies this session. DHCP begins with an offer and provides an IP address. The terminal sends a DHCP request based on this information, and the DHCP server then sends a DHCP acknowledgement for confirmation. In the present invention, when a DHCP offer message is received, a temporary whitelist policy for a new IP address (new) is generated, allowing the terminal to access the address. At this point, the whitelist policies for IP addresses (old) and (new) work simultaneously. Finally, when the session receives a DHCP acknowledgement, the old IP address (old) whitelist policy entry is deleted, leaving only the new IP address (new) whitelist policy entry. If there is no subsequent DHCP acknowledgement message in this session, a timeout is defined. When this time is exceeded, the whitelist policy for IP address (new) that was just generated is deleted, which is equivalent to a rollback process.

[0129] The industrial control whitelist update method provided by the present invention analyzes DHCP interaction messages in the network to obtain changes in the mapping relationship between terminal devices and IP addresses, and promptly links with the network security whitelist policy module to update IP addresses in a timely manner. In industrial Internet scenarios, the whitelist policy can be updated in conjunction with dynamic IP changes, improving the shortcomings of the original whitelist policy. In DHCP dynamic IP address management scenarios, it can address the shortcomings of existing whitelist fixed rules and greatly improve the adaptability of the whitelist policy.

[0130] Optionally, the execution entity of the above industrial control whitelist update method has the following deployment scheme:

[0131] (1) Network deployment.

[0132] Deployed in hardware, deployed in the path of DHCP messages, for example: the part connected to the DHCP network port, accessing the execution entity in a transparent manner, Figure 3 This is a schematic diagram of the deployment of the industrial control whitelist update device provided by the present invention; Figure 3 shown.

[0133] (2)Server deployment.

[0134] Deployed on the DHCP server in software mode, it captures and analyzes DHCP messages using software.

[0135] It should be noted that, whether it is a hardware or software method, communication interaction with the whitelist policy management module is achieved.

[0136] The industrial control whitelist update method provided by this invention addresses the DHCP scenarios and usage characteristics of industrial clients. Building on existing technologies, it proposes a linkage solution. By capturing DHCP messages in the network and analyzing DHCP interaction content, it tracks IP changes of network devices and links them to update IP entries in the whitelist policy table. By linking the DHCP process and whitelist policy, it enables IP-based whitelist control for dynamic IP devices in DHCP scenarios.

[0137] The industrial control whitelist updating device provided by the present invention is described below. The industrial control whitelist updating device described below and the industrial control whitelist updating method described above can be referenced to each other.

[0138] Figure 4 : is a structural diagram of the industrial control whitelist updating device provided by the present invention; the industrial control whitelist updating device 400 includes: a parsing module 401, a judgment module 402 and an updating module 403; wherein,

[0139] The parsing module 401 is configured to parse a Dynamic Host Configuration Protocol (DHCP) message when it is captured, and obtain a Media Access Control (MAC) address of the DHCP client and a first IP address assigned to the DHCP client by the DHCP server;

[0140] a determination module 402 configured to determine whether the first IP address is a reallocated or newly allocated IP address based on the MAC address, the first IP address, and a first mapping relationship, wherein the first mapping relationship is used to record a correspondence between a MAC address and an IP address;

[0141] The updating module 403 is configured to update the IP addresses in the industrial control whitelist according to the first IP address when the first IP address is a reallocated or newly allocated IP address.

[0142] The industrial control whitelist updating device provided by the present invention parses the DHCP message when a DHCP message is captured to obtain the MAC address of the DHCP client and the first IP address assigned to the DHCP client by the DHCP server; determines whether the first IP address is a reallocated or newly allocated IP address based on the MAC address, the first IP address and a first mapping relationship, and the first mapping relationship is used to record the correspondence between the MAC address and the IP address; and when the first IP address is a reallocated or newly allocated IP address, updates the IP address in the industrial control whitelist based on the first IP address, thereby realizing the linkage update of the industrial control whitelist according to the IP address change, and improving the accuracy of business security management and control.

[0143] Optionally, the judgment module 402 is specifically configured to:

[0144] Searching for the MAC address and / or the first IP address in the first mapping relationship to obtain a query result;

[0145] According to the query result, it is determined whether the first IP address is a reallocated or newly allocated IP address.

[0146] Optionally, the judgment module 402 is specifically configured to:

[0147] When the query result indicates that the first mapping relationship includes the MAC address and the second IP address corresponding to the MAC address, determining that the first IP address is a reallocated IP address;

[0148] Alternatively, when the query result is that the first mapping relationship includes the first IP address but does not include the MAC address, or the first mapping relationship does not include the MAC address and the first IP address, it is determined that the first IP address is a newly allocated IP address.

[0149] Optionally, the updating module 403 is specifically configured to:

[0150] In the case where the first IP address is a reallocated IP address, updating the second IP address in the industrial control whitelist to the first IP address;

[0151] Alternatively, when the first IP address is a newly allocated IP address, a whitelist entry corresponding to the first IP address is added to the industrial control whitelist.

[0152] Optionally, the device further comprises:

[0153] The deletion module is used to delete the historical whitelist entry corresponding to the first IP address in the industrial control whitelist.

[0154] Optionally, the device further comprises:

[0155] a processing module, configured to update the second IP address corresponding to the MAC address in the first mapping relationship to the first IP address when the first IP address is a reallocated IP address;

[0156] Alternatively, when the first IP address is a newly allocated IP address, the correspondence between the MAC address and the first IP address is added to the first mapping relationship.

[0157] Optionally, the updating module 403 is specifically configured to:

[0158] In a case where the DHCP message is a DHCP offer message, adding a whitelist entry corresponding to the first IP address to the industrial control whitelist;

[0159] When a DHCP confirmation ACK message is received, deleting the historical whitelist entry corresponding to the first IP address in the industrial control whitelist;

[0160] Alternatively, after the whitelist entry corresponding to the first IP address is added to the industrial control whitelist, a deletion timer is started; if no DHCP OFFER message is received after the deletion timer times out, the historical whitelist entry corresponding to the first IP address is deleted from the industrial control whitelist.

[0161] Figure 5 This is a schematic diagram of the physical structure of the electronic device provided by the present invention, such as Figure 5As shown, the electronic device may include: a processor 510, a communication interface 520, a memory 530, and a communication bus 540, wherein the processor 510, the communication interface 520, and the memory 530 communicate with each other via the communication bus 540. The processor 510 may call the logic instructions in the memory 530 to execute the industrial control whitelist update method, which includes:

[0162] When a Dynamic Host Configuration Protocol (DHCP) message is captured, the DHCP message is parsed to obtain a Media Access Control (MAC) address of the DHCP client and a first IP address assigned to the DHCP client by the DHCP server;

[0163] Determining whether the first IP address is a reallocated or newly allocated IP address based on the MAC address, the first IP address, and a first mapping relationship, wherein the first mapping relationship is used to record a correspondence between a MAC address and an IP address;

[0164] In the case that the first IP address is a reallocated or newly allocated IP address, the IP addresses in the industrial control whitelist are updated according to the first IP address.

[0165] In addition, the logic instructions in the above-mentioned memory 530 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0166] On the other hand, the present invention further provides a computer program product, comprising a computer program, which may be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can perform the industrial control whitelist update method provided by the above methods, which includes:

[0167] When a Dynamic Host Configuration Protocol (DHCP) message is captured, the DHCP message is parsed to obtain a Media Access Control (MAC) address of the DHCP client and a first IP address assigned to the DHCP client by the DHCP server;

[0168] Determining whether the first IP address is a reallocated or newly allocated IP address based on the MAC address, the first IP address, and a first mapping relationship, wherein the first mapping relationship is used to record a correspondence between a MAC address and an IP address;

[0169] In the case that the first IP address is a reallocated or newly allocated IP address, the IP addresses in the industrial control whitelist are updated according to the first IP address.

[0170] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method for updating the industrial control whitelist provided by the above methods is implemented, and the method includes:

[0171] When a Dynamic Host Configuration Protocol (DHCP) message is captured, the DHCP message is parsed to obtain a Media Access Control (MAC) address of the DHCP client and a first IP address assigned to the DHCP client by the DHCP server;

[0172] Determining whether the first IP address is a reallocated or newly allocated IP address based on the MAC address, the first IP address, and a first mapping relationship, wherein the first mapping relationship is used to record a correspondence between a MAC address and an IP address;

[0173] In the case that the first IP address is a reallocated or newly allocated IP address, the IP addresses in the industrial control whitelist are updated according to the first IP address.

[0174] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0175] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0176] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for updating an industrial control whitelist, characterized in that: include: When a Dynamic Host Configuration Protocol (DHCP) message is captured, the DHCP message is parsed to obtain a Media Access Control (MAC) address of the DHCP client and a first IP address assigned to the DHCP client by the DHCP server; Determining whether the first IP address is a reallocated or newly allocated IP address based on the MAC address, the first IP address, and a first mapping relationship, wherein the first mapping relationship is used to record a correspondence between a MAC address and an IP address; In the case that the first IP address is a reallocated or newly allocated IP address, the IP addresses in the industrial control whitelist are updated according to the first IP address.

2. The industrial control whitelist updating method according to claim 1, characterized in that: The determining, based on the MAC address, the first IP address, and the first mapping relationship, whether the first IP address is a reallocated or newly allocated IP address includes: Searching for the MAC address and / or the first IP address in the first mapping relationship to obtain a query result; According to the query result, it is determined whether the first IP address is a reallocated or newly allocated IP address.

3. The industrial control whitelist updating method according to claim 2, characterized in that: The determining, based on the query result, whether the first IP address is a reallocated or newly allocated IP address includes: When the query result indicates that the first mapping relationship includes the MAC address and the second IP address corresponding to the MAC address, determining that the first IP address is a reallocated IP address; Alternatively, when the query result is that the first mapping relationship includes the first IP address but does not include the MAC address, or the first mapping relationship does not include the MAC address and the first IP address, it is determined that the first IP address is a newly allocated IP address.

4. The industrial control whitelist updating method according to claim 3, characterized in that: When the first IP address is a reallocated or newly allocated IP address, updating the IP addresses in the industrial control whitelist according to the first IP address includes: In the case where the first IP address is a reallocated IP address, updating the second IP address in the industrial control whitelist to the first IP address; Alternatively, when the first IP address is a newly allocated IP address, a whitelist entry corresponding to the first IP address is added to the industrial control whitelist.

5. The industrial control whitelist updating method according to claim 4, characterized in that: The method further comprises: Delete the historical whitelist entry corresponding to the first IP address from the industrial control whitelist.

6. The industrial control whitelist updating method according to claim 3, characterized in that: The method further comprises: When the first IP address is a reallocated IP address, updating the second IP address corresponding to the MAC address in the first mapping relationship to the first IP address; Alternatively, when the first IP address is a newly allocated IP address, the correspondence between the MAC address and the first IP address is added to the first mapping relationship.

7. The industrial control whitelist updating method according to claim 3, characterized in that: The updating of the IP address in the industrial control whitelist according to the first IP address includes: In a case where the DHCP message is a DHCP offer message, adding a whitelist entry corresponding to the first IP address to the industrial control whitelist; When a DHCP confirmation ACK message is received, deleting the historical whitelist entry corresponding to the first IP address in the industrial control whitelist; Alternatively, after the whitelist entry corresponding to the first IP address is added to the industrial control whitelist, a deletion timer is started; if no DHCP OFFER message is received after the deletion timer times out, the historical whitelist entry corresponding to the first IP address is deleted from the industrial control whitelist.

8. An industrial control whitelist updating device, characterized in that: include: a parsing module configured to parse a Dynamic Host Configuration Protocol (DHCP) message when it is captured, and obtain a Media Access Control (MAC) address of the DHCP client and a first IP address assigned to the DHCP client by the DHCP server; a determination module, configured to determine whether the first IP address is a reallocated or newly allocated IP address based on the MAC address, the first IP address, and a first mapping relationship, wherein the first mapping relationship is used to record a correspondence between a MAC address and an IP address; An updating module is used to update the IP addresses in the industrial control whitelist according to the first IP address when the first IP address is a reallocated or newly allocated IP address.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the industrial control whitelist updating method according to any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the industrial control whitelist updating method according to any one of claims 1 to 7 is implemented.

11. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the industrial control whitelist updating method according to any one of claims 1 to 7 is implemented.

Images