A message processing method, device, electronic device and storage medium

Abstract

The embodiment of the present invention discloses a message processing method, device, electronic device and storage medium. The method comprises: classifying messages to be processed to obtain message classification results; performing a first filtering operation on the message classification results to obtain a corresponding first filtering result; performing a second filtering operation on the first filtering result according to a firewall filtering mechanism to obtain a corresponding second filtering result. By classifying messages to be processed and performing a first filtering operation and a second filtering operation on the message classification results, the method can effectively identify and filter out illegal messages in messages to be processed, so as to avoid a large number of illegal messages occupying computing resources, thereby improving the efficiency and reliability of message processing, and ensuring that the secondary equipment of the substation can operate normally and reliably when facing a large-flow network storm.

Description

Technical Field

[0001] Embodiments of the present invention relate to the technical field of power systems, and in particular to a message processing method, device, electronic device, and storage medium. Background Art

[0002] During operation, substation secondary equipment may face various network storms and network attacks, such as SYNFlood attack, UDP Flood attack and ICMP Flood attack, etc. Network storms may generate a large number of storm messages, and the availability of substation secondary equipment services is the primary goal of information security. Therefore, when encountering various network storms and network attacks, it is necessary to ensure that the business is not interrupted as much as possible.

[0003] At present, the processing power of the central processing unit (CPU) inside the secondary equipment of the substation is relatively weak. When facing a large-traffic network storm, it may freeze, restart, interface freeze or business interruption. Therefore, how to make the secondary equipment of the substation run normally and reliably when facing a large-traffic network storm is a technical problem that needs to be solved urgently. Summary of the invention

[0004] The embodiments of the present invention provide a message processing method, device, electronic device and storage medium to filter out irrelevant messages and improve the efficiency and reliability of message processing.

[0005] In a first aspect, an embodiment of the present invention provides a message processing method, including:

[0006] Classify the messages to be processed and obtain the message classification results;

[0007] Performing a first filtering operation on the message classification result to obtain a corresponding first filtering result;

[0008] A second filtering operation is performed on the first filtering result according to the firewall filtering mechanism to obtain a corresponding second filtering result.

[0009] In a second aspect, an embodiment of the present invention further provides a message processing device, including:

[0010] A classification module is used to classify the messages to be processed and obtain the message classification results;

[0011] A first filtering module, used to perform a first filtering operation on the message classification result to obtain a corresponding first filtering result;

[0012] The second filtering module is used to perform a second filtering operation on the first filtering result according to the firewall filtering mechanism to obtain a corresponding second filtering result.

[0013] In a third aspect, an embodiment of the present invention further provides an electronic device, including:

[0014] one or more processors;

[0015] A storage device for storing one or more programs;

[0016] The one or more programs are executed by the one or more processors, so that the one or more processors implement the message processing method provided in the embodiment of the present invention.

[0017] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the message processing method provided by an embodiment of the present invention.

[0018] The embodiment of the present invention provides a message processing method, device, electronic device and storage medium, which first classifies the messages to be processed to obtain the message classification result; then performs a first filtering operation on the message classification result to obtain the corresponding first filtering result; finally performs a second filtering operation on the first filtering result according to the firewall filtering mechanism to obtain the corresponding second filtering result. The method can effectively identify and filter out illegal messages in the messages to be processed by classifying the messages to be processed and performing the first filtering operation and the second filtering operation on the message classification result, so as to avoid a large number of illegal messages occupying computing resources, thereby improving the efficiency and reliability of message processing, and ensuring that the secondary equipment of the substation can operate normally and reliably when facing a network storm with large traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A schematic diagram of a flow chart of a message processing method provided in Embodiment 1 of the present invention;

[0020] Figure 2 A schematic diagram of a flow chart of a message processing method provided in Embodiment 2 of the present invention;

[0021] Figure 3 A schematic diagram of a message processing framework provided in Embodiment 2 of the present invention;

[0022] Figure 4 A schematic diagram of implementing message processing based on FPGA provided in the second embodiment of the present invention;

[0023] Figure 5 A schematic diagram of the result of message processing based on FPGA provided in the second embodiment of the present invention;

[0024] Figure 6 A schematic diagram of the structure of a message processing device provided in Embodiment 3 of the present invention;

[0025] Figure 7 A schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. DETAILED DESCRIPTION

[0026] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0027] It should be mentioned before discussing exemplary embodiments in more detail that some exemplary embodiments are described as processes or methods depicted as flow charts. Although the flow charts describe various operations (or steps) as sequential processes, many operations therein can be implemented in parallel, concurrently or simultaneously. In addition, the order of various operations can be rearranged. The process can be terminated when its operation is completed, but can also have additional steps not included in the accompanying drawings. The process can correspond to methods, functions, procedures, subroutines, subprograms, etc. In addition, the embodiments in the present invention and the features in the embodiments can be combined with each other without conflict.

[0028] The term “including” and its variations used in the present invention are open inclusions, that is, “including but not limited to.” The term “based on” means “based at least in part on.” The term “one embodiment” means “at least one embodiment.”

[0029] It should be noted that the concepts such as "first" and "second" mentioned in the present invention are only used to distinguish the corresponding contents, and are not used to limit the order or interdependence.

[0030] It should be noted that the modifications of "one" and "plurality" mentioned in the present invention are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0031] Embodiment 1

[0032] Figure 1 A flow chart of a message processing method provided in Embodiment 1 of the present invention is applicable to the case where storm messages contained in messages to be processed are filtered and processed. The method can be executed by a message processing device, wherein the device can be implemented by software and / or hardware and is generally integrated on an electronic device. In this embodiment, the electronic device includes but is not limited to: desktop computers, laptop computers, servers and other devices.

[0033] like Figure 1 As shown, a message processing method provided in Embodiment 1 of the present invention includes the following steps:

[0034] S110: Classify the messages to be processed and obtain message classification results.

[0035] In this embodiment, a message may refer to a data unit exchanged and transmitted in a network, that is, a data block to be sent by a site at one time, wherein the message contains complete data information to be sent. A pending message may refer to a message waiting to be processed that is transmitted after an application connection. For example, assuming that the secondary equipment of a substation is a server and the equipment in other sites is a client, the application connection can be understood as a network connection between the application layer in the server and the application layer in other clients, wherein the application layer can be understood as application software running on the device, etc.; on this basis, after the application connection is realized between the secondary equipment of the substation and the equipment in other sites, the data transmitted between them can be understood as a message. Since the transmitted message may contain messages related to network storms and network attacks, in order to ensure the normal and reliable operation of the secondary equipment of the substation, all transmitted messages need to be processed, and these messages are pending messages.

[0036] In one embodiment, before determining the message to be processed, the application connection can be authenticated legally through the identity authentication mechanism pre-set in the application layer of the substation secondary equipment (which can be understood as identifying and authenticating the legal client), disconnecting the application connection authenticated as illegal (that is, disconnecting the application connection between the server and the client authenticated as illegal), and using the message transmitted in the authenticated legal application connection as the message to be processed. Among them, the identity authentication mechanism pre-set in the application layer of the substation secondary equipment can be an identity authentication mechanism such as the CMS61850 communication protocol standard and the IEC103 communication protocol standard, which is not limited here.

[0037] In one embodiment, a field programmable gate array (FPGA) can be connected to a secondary device of a substation through a network port. On this basis, the FPGA is used to classify the messages to be processed to obtain corresponding message classification results. In the process of classifying the messages to be processed, there is no limitation on how to classify the messages to be processed, and it can be flexibly set according to actual needs. For example, the messages to be processed can be classified according to the message category, such as network diagnostic tool messages (i.e., Ping messages), network time protocol (NTP) messages, address resolution protocol (ARP) messages, and transmission control protocol (TCP) messages.

[0038] In this embodiment, the messages to be processed are classified, so that messages of different categories do not affect each other during the subsequent processing of the message classification results.

[0039] S120: Perform a first filtering operation on the message classification result to obtain a corresponding first filtering result.

[0040] In this embodiment, the first filtering operation can be performed on the obtained message classification results through FPGA, the message classification results that do not meet the filtering conditions are discarded, and the message classification results that meet the filtering conditions are retained as the first filtering results.

[0041] Exemplarily, the specific process of performing the first filtering operation on the obtained message classification result through FPGA can be that first, all connection information corresponding to the legal application connection can be obtained through the application layer of the substation secondary equipment, and the obtained connection information is sent to the FPGA. The connection information may include the source Internet Protocol (Internet Protocol, IP) address, source port number and source Media Access Control (Media Access Control, MAC) address of the source device, and the destination IP address, destination port number and destination MAC address of the target device. It can be understood that each message contains corresponding connection information. Among them, the source device can be understood as a device in other sites, and the destination device can be understood as a substation secondary device. The port can refer to a port used to uniquely identify the message communication transmission process, and one process corresponds to one port; the source port can be understood as a process used to identify the process that initiates the message communication transmission, and the destination port can be understood as a process used to identify the process that receives the message sent by the corresponding source port; the source port can include a source port number, and the destination port can include a destination port number. On this basis, the corresponding destination port number is selected according to the source port number to send the message of the source port to the corresponding destination port for reception. It should be noted that the specific process of obtaining the connection information corresponding to the legal application connection through the application layer of the substation secondary equipment is that, through the application layer of the substation secondary equipment, all the connection information in the corresponding legal application connection can be determined according to the message header information in the legal application connection, and all the connection information can be obtained. Before the obtained connection information is sent to the FPGA through the application layer of the substation secondary equipment, the corresponding connection information can be selected from all the obtained connection information and sent to the FPGA according to whether the source device in the legal application connection (the source device can be understood as the opposite device of the substation secondary equipment in the legal application connection) is a local device or a remote device. In other words, the corresponding connection information sent to the FPGA is different for the legal application connection whose source device is a local device and the legal application connection whose source device is a remote device.

[0042] Then, a whitelist information can be set in advance on the FPGA, and the whitelist information can include list information corresponding to the IP addresses allowed to enter the substation secondary equipment. The whitelist information can be configured and generated by relevant technical personnel according to actual conditions.

[0043] Finally, FPGA can be used to filter out some illegal port numbers and illegal MAC addresses based on the port number and MAC address in the received connection information. For example, the source port number can be randomly generated in each communication transmission. Each device has only one unique MAC address. These legal connection information are difficult to guess from illegal messages, that is, illegal messages containing information such as illegal port numbers and illegal MAC addresses can be filtered out (which can be understood as filtering conditions). On this basis, for the remaining messages, FPGA is continued to be used to filter out the messages corresponding to the IP addresses that are not in the whitelist information according to the pre-set whitelist information (which can be understood as filtering conditions), and the remaining messages retained are the first filtering results.

[0044] It should be noted that some messages in the message classification results can be filtered only based on the whitelist information; some messages can be filtered only based on the connection information of legal application connections; and some messages can be filtered based on a combination of whitelist information and connection information of legal application connections. In the case of a combination of whitelist information and connection information of legal application connections, the order of filtering based on the whitelist information and filtering based on the connection information of legal application connections is not limited.

[0045] In one embodiment, after obtaining the first filtering result, considering the processing capacity of the central processing unit (CPU) in the substation secondary equipment, the transmission rate of the message in the first filtering result can also be set according to actual conditions to ensure that the total number of all messages that can pass does not exceed the processing capacity of the CPU.

[0046] S130: Perform a second filtering operation on the first filtering result according to the firewall filtering mechanism to obtain a corresponding second filtering result.

[0047] In this embodiment, the firewall filtering mechanism can be understood as a mechanism for filtering illegal messages by setting a firewall.

[0048] The firewall filtering mechanism can be deployed in the application layer of the substation secondary device. The firewall filtering mechanism can include a firewall filtering mechanism for filtering ports and a firewall filtering mechanism for filtering message status.

[0049] Exemplarily, the specific process of performing a second filtering operation on the first filtering result according to the firewall filtering mechanism to obtain the corresponding second filtering result may be to first adopt a firewall filtering mechanism for filtering ports to manage the ports contained in the message, for example, you can set which ports can be opened and which ports can be closed, you can receive messages corresponding to the open ports, and refuse to receive messages corresponding to the closed ports.

[0050] On this basis, a firewall filtering mechanism for filtering the message state can be further adopted to track each legal application connection, and the illegal messages with legal connection information can be identified and filtered out again (the specific identification method is not limited here), and the retained messages are the second filtering results. Among them, the firewall filtering mechanism for filtering the port can be a linux iptables firewall; the firewall filtering mechanism for filtering the message state can be a linux iptables state firewall; this is not limited here.

[0051] A message processing method provided in the first embodiment of the present invention first classifies messages to be processed to obtain message classification results; then performs a first filtering operation on the message classification results to obtain a corresponding first filtering result; finally performs a second filtering operation on the first filtering result according to a firewall filtering mechanism to obtain a corresponding second filtering result. By classifying messages to be processed and performing the first filtering operation and the second filtering operation on the message classification results, the method can effectively identify and filter out illegal messages in the messages to be processed, so as to avoid a large number of illegal messages occupying computing resources, thereby improving the efficiency and reliability of message processing, and ensuring that the secondary equipment of the substation can operate normally and reliably when facing a network storm with large traffic.

[0052] Embodiment 2

[0053] Figure 2 A flow chart of a message processing method provided in the second embodiment of the present invention is provided. The second embodiment is refined on the basis of the above embodiments. In this embodiment, a first filtering operation is performed on the message classification result to obtain a corresponding first filtering result; a second filtering operation is performed on the first filtering result according to the firewall filtering mechanism to obtain a corresponding second filtering result. It should be noted that the technical details not described in detail in this embodiment can be referred to any of the above embodiments.

[0054] like Figure 2 As shown, a message processing method provided by Embodiment 2 of the present invention includes the following steps:

[0055] S210: Identify legitimate application connections according to a set identity authentication mechanism.

[0056] In this embodiment, the set identity authentication mechanism may refer to a pre-set identity authentication mechanism for determining whether an application connection is legitimate. Specifically, the set identity authentication mechanism in the application layer of the substation secondary device may be used to identify legitimate application connections among all application connections and disconnect illegitimate application connections.

[0057] S220: Acquire messages in the legitimate application connection as messages to be processed.

[0058] In this embodiment, the message in the legitimate application connection can be obtained through the FPGA as the message to be processed.

[0059] S230: Classify the messages to be processed and obtain message classification results.

[0060] In this embodiment, the messages to be processed may be classified by FPGA to obtain message classification results.

[0061] S240: Determine connection information corresponding to the legitimate application connection according to the message header information in the legitimate application connection.

[0062] In this embodiment, the message header information may refer to the information contained in each message header field. Specifically, through the application layer of the substation secondary device, all connection information corresponding to the legitimate application connection can be obtained from the message header information in the legitimate application connection.

[0063] S250: Determine target connection information according to the peer application type in the legitimate application connection and the connection information of the legitimate application connection.

[0064] In this embodiment, the peer in the legitimate application connection can be understood as the source device in the legitimate application connection, wherein the peer application type can be understood as the application type of the source device in the legitimate application connection, such as the application type can be a remote device or a local device. The remote device can be understood as a site device that is not inside a local area network. Correspondingly, the local device can be understood as a site device that is inside a local area network.

[0065] After determining the connection information corresponding to the legitimate application connection, the target connection information can be determined according to the peer application type in the legitimate application connection and all the connection information of the acquired legitimate application connection. The target connection information can be understood as the connection information sent to the FPGA through the application layer in the substation secondary equipment. Different peer application types in the legitimate application connection may correspond to different connection information sent to the FPGA (i.e., target connection information).

[0066] For example, if the peer application type in the legitimate application connection is a remote device, the source MAC address in the message may change due to forwarding through the router. When the message reaches the service end (i.e., the substation secondary device end), the source MAC address in the message is not the MAC address of the peer device, but the MAC address of the router; and the path of the message when forwarding through the router network may also change. In this case, the source MAC address may also change. Therefore, if the peer application type in the legitimate application connection is a remote device, the source MAC address may not be obtained to identify the application connection containing the remote device. That is, for the application connection containing the remote device, the target connection information sent to the FPGA by the application layer in the substation secondary device may include the source IP address, source port number, destination IP address, and destination port number (which does not include the source MAC address).

[0067] For example, if the peer application type in the legitimate application connection is a local device, then since the message is only forwarded through a switch and other devices, the source MAC address in the message does not change, and the source MAC address in the message can be the MAC address of the peer device, such as the source MAC address can be obtained through the Socket handle as a partial identifier of the client (i.e., the source device). For application connections involving local devices, the target connection information sent to the FPGA by the application layer in the substation secondary device may include the source IP address, source port number, source MAC address, destination IP, and destination port number.

[0068] S260: Perform a first filtering operation on the message classification result according to the set whitelist information and / or the target connection information to obtain a corresponding first filtering result.

[0069] In this embodiment, the set whitelist information can be understood as the list information of the messages corresponding to the IP addresses that are pre-set and allowed to enter the secondary equipment of the substation. Through the FPGA, the first filtering operation can be performed on the message classification result according to the set whitelist information and / or the target connection information to obtain the corresponding first filtering result. Among them, some messages in the message classification result only need to be filtered according to the set whitelist information, some messages only need to be filtered according to the target connection information, and some messages need to be filtered according to the combination of the target connection information and the set whitelist information.

[0070] For example, in the case where some messages need to be filtered based on a combination of target connection information and set whitelist information, through FPGA, a portion of illegal messages containing illegal port numbers and illegal MAC addresses can be filtered out based on the target connection information. On this basis, for the remaining messages, based on the set whitelist information, the messages whose IP addresses are not in the set whitelist information are filtered out, and the retained message classification result is the first filtering result.

[0071] Optionally, a first filtering operation is performed on the message classification results according to the set whitelist information and / or target connection information to obtain a corresponding first filtering result, including: according to the set whitelist information and / or target connection information, taking the message classification results in the message classification results that hit the set whitelist information and / or target connection information as the first filtering result, and discarding the message classification results that do not hit the set whitelist information and / or target connection information.

[0072] Among them, hitting the set whitelist information can be understood as the IP address in the message is in the set whitelist information, and not hitting the set whitelist information can be understood as the IP address in the message is not in the set whitelist information. Hitting the target connection information can be understood as the port number and MAC address contained in the message are legal; not hitting the target connection information can be understood as the port number and MAC address contained in the message are illegal.

[0073] According to the set whitelist information and / or target connection information, the message classification results that hit the set whitelist information and / or target connection information are used as the first filtering results, and the message classification results that do not hit the set whitelist information and / or target connection information are discarded, i.e., filtered out.

[0074] Optionally, after performing a first filtering operation on the message classification result according to the set whitelist information and / or the target connection information to obtain a corresponding first filtering result, the method further includes: performing rate limiting processing on the first filtering result.

[0075] Among them, the speed limit processing may refer to limiting the transmission rate of the message. After performing the first filtering operation on the message classification result according to the set whitelist information and / or target connection information and obtaining the corresponding first filtering result, in order to prevent the message data flow passing through in sequence from being too large, so as to ensure the CPU processing capacity and load balancing of the substation secondary equipment, the first filtering result may be speed limited.

[0076] S270: intercept illegal ports in the first filtering result according to the port firewall filtering mechanism, and use the messages corresponding to the legal ports as the intermediate filtering results.

[0077] In this embodiment, the port firewall filtering mechanism may refer to a firewall filtering mechanism for filtering ports, that is, a filtering mechanism for filtering out illegal ports. Intercepting the illegal ports in the first filtering result may be understood as preventing the message corresponding to the illegal port in the first filtering result from passing. Specifically, the illegal port in the first filtering result is intercepted according to the port firewall filtering mechanism, and the message corresponding to the legal port is used as the intermediate filtering result.

[0078] S280: intercept illegal messages in the intermediate filtering result according to the stateful firewall filtering mechanism, and use the legal messages as the second filtering result.

[0079] In this embodiment, the stateful firewall filtering mechanism may refer to a firewall filtering mechanism that filters the legal state of a message, that is, it may be used to filter out messages in illegal states. Intercepting illegal messages in the intermediate filtering results may be understood as preventing illegal messages in the intermediate filtering results from passing through. Specifically, illegal messages in the intermediate filtering results are intercepted according to the stateful firewall filtering mechanism, and legal messages are used as the second filtering results.

[0080] A message processing method provided in the second embodiment of the present invention embodies the process of performing a first filtering operation on the message classification result to obtain a corresponding first filtering result; and performing a second filtering operation on the first filtering result according to a firewall filtering mechanism to obtain a corresponding second filtering result. The method can achieve the first filtering of illegal messages in the message classification result by setting whitelist information and / or target connection information. On this basis, the illegal messages in the first filtering result can be filtered again through the port firewall filtering mechanism and the state firewall filtering mechanism; after double filtering, the illegal messages in the messages to be processed can be effectively identified and filtered out to avoid a large number of illegal messages occupying computing resources, thereby improving the efficiency and reliability of message processing, and ensuring that the secondary equipment of the substation can operate normally and reliably when facing a large-flow network storm.

[0081] The embodiment of the present invention provides a specific implementation method based on the technical solutions of the above embodiments.

[0082] As a specific implementation method of this embodiment, a multi-level in-depth defense mechanism is formed in the secondary equipment of the substation, and the message traffic entering the secondary equipment of the substation is initially filtered on the FPGA according to the IP whitelist mechanism (i.e., setting the whitelist information), and the port management is performed through the Linux iptables firewall to intercept illegal ports, and the illegal messages leaking into the secondary equipment of the substation are further intercepted through the Linux iptables state firewall. Specifically, first, the legal application connection can be identified through the identity authentication mechanism of the application layer, and then the connection information of the application connection can be obtained, and the target connection information can be determined according to the peer type in the legal application connection, so as to send the target connection information to the FPGA, and the FPGA can perform more effective filtering based on the target connection information; the FPGA classifies and processes various types of messages allowed to pass, and performs a first filtering operation on the message classification result to obtain the corresponding first filtering result, and at the same time, performs corresponding speed limit processing on the first filtering result to ensure that the total number of all messages that can pass does not exceed the processing capacity of the CPU of the secondary equipment of the substation. Finally, the illegal messages leaking into the secondary equipment of the substation are further intercepted through the firewall filtering mechanism.

[0083] It should be noted that due to the fast processing speed of FPGA, all messages allowed to pass can be forwarded quickly, and the effect of Quality of Service (Qos) Weighted Round Robin (WRR) can be achieved without implementing queues and queue scheduling algorithms, ensuring that business messages and ARP messages associated with business messages can pass first. Among them, Qos can refer to a network using various basic technologies to provide better service capabilities for specified network communications, and is widely used in network security scenarios. WRR can refer to a queue scheduling algorithm that can be used to weightedly cycle all business queue services and assign priority to higher priority queues.

[0084] Figure 3 A schematic diagram of a message processing framework provided in Embodiment 2 of the present invention. Figure 3 As shown, the message processing framework may include FPGA, firewall, and application layer with identity authentication mechanism. When a network storm or attack occurs, the key to ensuring the availability of business services of the secondary equipment of the substation is to identify business-related messages and filter out illegal messages. The IP whitelist information on the FPGA can be configured by relevant technical personnel, and the generation of connection information can be dynamically controlled by the application layer (the generation of connection information is dynamically controlled by the application layer, which can be understood as the application connection authenticated by the application layer generates the corresponding connection information. When the peer application of the application connection exits, the application layer of the secondary equipment of the substation can be notified to disconnect the application connection and delete the corresponding connection information).

[0085] The application layer can send the application connection information that passes the identity authentication mechanism to the FPGA to assist the FPGA in filtering illegal messages. Based on the Qos concept, the messages are first classified on the FPGA, and then the message classification results are filtered according to the IP whitelist information and / or application connection information. The Linux firewall (i.e., Linux iptables firewall) mechanism only allows messages from legal ports to pass through and discards messages from other illegal ports; at the same time, the Linux state firewall (i.e., Linux iptables state firewall) mechanism is turned on to track the communication of each legal application connection, strengthen the identification of illegal messages with some legal connection information and filter them out.

[0086] Figure 4 The following is a schematic diagram of implementing message processing based on FPGA provided in the second embodiment of the present invention. Figure 4 As shown in the figure, based on the QoS classification service concept, a method for processing messages based on the simple QoS concept is implemented. The messages entering the FPGA are first classified into TCP SYN messages, TCP data messages, Goose messages, ARP messages, Ping messages, and NTP messages. Different types of messages have different processing strategies (the processing strategy can be understood as speed limit processing). Classification processing can ensure that different types of messages do not affect each other.

[0087] It should be noted that some messages may not be filtered out based on IP whitelist information and connection rules due to their own characteristics. For example, Goose messages can be initially filtered based on the MAC address subscribed by Goose.

[0088] It should be noted that the TCP data packets that hit the connection rules (connection rules can be understood as rules for filtering packets based on connection information) are speed-limited, but the upper limit of the speed limit is large, much higher than the TCP data packets that do not hit the connection rules, which is equivalent to a larger bandwidth for the packet data. The purpose of the speed limit is to ensure the safety of the CPU of the substation secondary equipment to prevent the CPU usage rate from increasing significantly due to excessive packet receiving traffic. Among them, the TCP data packets that do not hit the connection rules are also released at a limited speed, but the bandwidth is not large. The purpose is to release the identity authentication message. The identity authentication message of the application is a TCP data message, and the connection information needs to be issued only after the identity authentication is passed.

[0089] The processing of ARP messages is a data link layer message, but the ARP payload contains IP address information. Here, the connection rule query is performed using the IP address in the payload. The connection rule query is also performed on ARP, mainly because during the interaction of TCP messages (i.e., TCP SYN messages, TCP data messages), ARP requests are periodically sent to each other. It is necessary to ensure that the request or response can be processed. Otherwise, the MAC address table entries of both communicating parties will age, which will cause the application connection to be interrupted, so the ARP request or response in the connection rule needs to be processed first.

[0090] Figure 5 This is a schematic diagram of the result of message processing based on FPGA provided by the second embodiment of the present invention. Figure 5 As shown, assuming that n messages are input, the obtained n messages are classified based on FPGA into multiple different categories of messages, including TCP SYN IP whitelist messages, TCP session data messages, TCP whitelist data messages, etc. After filtering, a WRR out-of-queue scheduling effect is formed, and the message required by the substation secondary equipment service (i.e., message 2) can be obtained.

[0091] In this embodiment, the message is classified and filtered through the application layer identity authentication mechanism, firewall and FPGA filtering linkage. The FPGA is used to filter out network storms and network attack related messages as much as possible, ensuring that business messages and related ARP messages can enjoy a larger bandwidth, effectively ensuring the service availability of the secondary equipment of the substation when it is attacked by the network.

[0092] Embodiment 3

[0093] Figure 6 This is a schematic diagram of the structure of a message processing device provided in Embodiment 3 of the present invention, which can be implemented by software and / or hardware. Figure 6 As shown, the device includes: a classification module 310, a first filtering module 320 and a second filtering module 330;

[0094] The classification module 310 is used to classify the messages to be processed and obtain the message classification results;

[0095] A first filtering module 320, configured to perform a first filtering operation on the message classification result to obtain a corresponding first filtering result;

[0096] The second filtering module 330 is used to perform a second filtering operation on the first filtering result according to the firewall filtering mechanism to obtain a corresponding second filtering result.

[0097] In this embodiment, the device first classifies the messages to be processed through the classification module to obtain the message classification result; then, through the first filtering module, the first filtering operation is performed on the message classification result to obtain the corresponding first filtering result; finally, through the second filtering module, the second filtering operation is performed on the first filtering result according to the firewall filtering mechanism to obtain the corresponding second filtering result. By classifying the messages to be processed and performing the first filtering operation and the second filtering operation on the message classification result, the device can effectively identify and filter out illegal messages in the messages to be processed, so as to avoid a large number of illegal messages occupying computing resources, thereby improving the efficiency and reliability of message processing, and ensuring that the secondary equipment of the substation can operate normally and reliably when facing a large-flow network storm.

[0098] Optionally, the device further comprises:

[0099] An identification module, used to identify legitimate application connections according to a set identity authentication mechanism before classifying the messages to be processed;

[0100] The acquisition module is used to acquire the message in the legal application connection as the message to be processed.

[0101] Optionally, the first filtering module 320 specifically includes:

[0102] A connection information acquisition unit, configured to determine target connection information according to the peer application type in the legitimate application connection and the connection information of the legitimate application connection;

[0103] The first filtering unit is used to perform a first filtering operation on the message classification result according to the set whitelist information and / or the target connection information to obtain a corresponding first filtering result.

[0104] Optionally, the first filtering module 320 further includes:

[0105] The connection information generating unit is used to determine the connection information corresponding to the legitimate application connection according to the message header information in the legitimate application connection before determining the target connection information according to the peer application type in the legitimate application connection and the connection information of the legitimate application connection.

[0106] Optionally, the first filtering unit is specifically used for:

[0107] According to the set whitelist information and / or the target connection information, the message classification results that hit the set whitelist information and / or the target connection information in the message classification results are used as the first filtering results, and the message classification results that do not hit the set whitelist information and / or the target connection information are discarded.

[0108] Optionally, the device further comprises:

[0109] The rate limit processing module is used to perform a first filtering operation on the message classification result according to the set whitelist information and / or the target connection information, and after obtaining a corresponding first filtering result, perform rate limit processing on the first filtering result.

[0110] Optionally, the firewall filtering mechanism includes a port firewall filtering mechanism and a state firewall filtering mechanism;

[0111] The second filtering module 330 specifically includes:

[0112] A first interception unit, configured to intercept illegal ports in the first filtering result according to the port firewall filtering mechanism, and use the message corresponding to the legal port as the intermediate filtering result;

[0113] The second interception unit is used to intercept illegal messages in the intermediate filtering result according to the stateful firewall filtering mechanism, and use legal messages as the second filtering result.

[0114] The above-mentioned message processing device can execute the message processing method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0115] Embodiment 4

[0116] Figure 7 This is a schematic diagram of the structure of an electronic device provided by Embodiment 4 of the present invention. Figure 7 As shown, the electronic device provided by the fourth embodiment of the present invention includes: a storage device 42 and one or more processors 41; the processor 41 in the electronic device may be one or more, Figure 7 A processor 41 is taken as an example; the storage device 42 is used to store one or more programs; the one or more programs are executed by the one or more processors 41, so that the one or more processors 41 implement the message processing method as described in any one of the embodiments of the present invention.

[0117] The electronic device may further include: a communication device 43 , an input device 44 and an output device 45 .

[0118] The processor 41, storage device 42, communication device 43, input device 44 and output device 45 in the electronic device may be connected via a bus or other means. Figure 7 The example of connecting through bus is taken in the following.

[0119] The storage device 42 in the electronic device is a computer-readable storage medium, which can be used to store one or more programs, and the program can be a software program, a computer executable program, and a module, such as the program instructions / modules corresponding to the message processing method provided in the first or second embodiment of the present invention (for example, the attached Figure 6 The modules in the message processing device shown include: a classification module 310, a first filtering module 320 and a second filtering module 330). The processor 41 executes various functional applications and data processing of the electronic device by running the software programs, instructions and modules stored in the storage device 42, that is, the message processing method in the above method embodiment is implemented.

[0120] The storage device 42 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and at least one application required for a function; the data storage area may store data created according to the use of the electronic device, etc. In addition, the storage device 42 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the storage device 42 may further include a memory remotely arranged relative to the processor 41, and these remote memories may be connected to the electronic device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0121] The communication device 43 may include a receiver and a transmitter. The communication device 43 is configured to perform information transmission and reception communication according to the control of the processor 41.

[0122] The input device 44 may be used to receive input digital or character information and generate key signal input related to user settings and function control of the electronic device. The output device 45 may include a display device such as a display screen.

[0123] Moreover, when one or more programs included in the above-mentioned electronic device are executed by the one or more processors 41, the program performs the following operations: classifying the messages to be processed to obtain message classification results; performing a first filtering operation on the message classification results to obtain corresponding first filtering results; performing a second filtering operation on the first filtering results according to the firewall filtering mechanism to obtain corresponding second filtering results.

[0124] Embodiment 5

[0125] Embodiment 5 of the present invention provides a computer-readable storage medium having a computer program stored thereon. When the program is executed by a processor, the program is used to execute a message processing method, the method comprising: classifying messages to be processed to obtain message classification results; performing a first filtering operation on the message classification results to obtain a corresponding first filtering result; performing a second filtering operation on the first filtering result according to a firewall filtering mechanism to obtain a corresponding second filtering result.

[0126] Optionally, when the program is executed by a processor, it can also be used to execute the message processing method provided by any embodiment of the present invention.

[0127] The computer storage medium of the embodiment of the present invention may adopt any combination of one or more computer-readable media. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable CD-ROM, an optical storage device, a magnetic storage device, or any suitable combination of the above. The computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, device or device.

[0128] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to: electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0129] The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, or radio frequency (RF), etc., or any suitable combination of the above.

[0130] Computer program code for performing the operation of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0131] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A message processing method, characterized in that: The method comprises: Identify legitimate application connections based on the set identity authentication mechanism; Acquire the message in the legitimate application connection as the message to be processed; Classifying the processed messages to obtain message classification results; Performing a first filtering operation on the message classification result to obtain a corresponding first filtering result; wherein the first filtering result is subjected to a rate limit process, and different types of messages have different rate limit processes; Performing a second filtering operation on the first filtering result according to the firewall filtering mechanism to obtain a corresponding second filtering result; The performing of a first filtering operation on the message classification result to obtain a corresponding first filtering result includes: determining target connection information based on a source device application type in a legitimate application connection and connection information of a legitimate application connection; and performing a first filtering operation on the message classification result based on set whitelist information and / or the target connection information to obtain a corresponding first filtering result.

2. The method according to claim 1, characterized in that: Before determining the target connection information according to the source device application type in the legitimate application connection and the connection information of the legitimate application connection, the method further includes: According to the message header information in the legitimate application connection, the connection information corresponding to the legitimate application connection is determined.

3. The method according to claim 1, characterized in that The performing a first filtering operation on the message classification result according to the set whitelist information and / or the target connection information to obtain a corresponding first filtering result includes: According to the set whitelist information and / or the target connection information, the message classification results that hit the set whitelist information and / or the target connection information in the message classification results are used as the first filtering results, and the message classification results that do not hit the set whitelist information and / or the target connection information are discarded.

4. The method according to claim 1, characterized in that The firewall filtering mechanism includes a port firewall filtering mechanism and a state firewall filtering mechanism; The performing a second filtering operation on the first filtering result according to the firewall filtering mechanism to obtain a corresponding second filtering result includes: Intercepting illegal ports in the first filtering result according to the port firewall filtering mechanism, and taking the messages corresponding to the legal ports as the intermediate filtering results; The illegal messages in the intermediate filtering result are intercepted according to the stateful firewall filtering mechanism, and the legal messages are used as the second filtering result.

5. A message processing device, characterized in that: The device comprises: A classification module is used to identify a legitimate application connection according to a set identity authentication mechanism; obtain a message in the legitimate application connection as a message to be processed; classify the message to be processed to obtain a message classification result; A first filtering module, used to perform a first filtering operation on the message classification result to obtain a corresponding first filtering result; The first filtering module includes: determining target connection information according to the source device application type in the legitimate application connection and the connection information of the legitimate application connection; performing a first filtering operation on the message classification result according to the set whitelist information and / or the target connection information to obtain a corresponding first filtering result; wherein the first filtering result is subjected to speed limit processing, and different types of messages have different speed limit processing; The second filtering module is used to perform a second filtering operation on the first filtering result according to the firewall filtering mechanism to obtain a corresponding second filtering result.

6. An electronic device, characterized in that: include: one or more processors; A storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the message processing method as described in any one of claims 1-4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the message processing method as described in any one of claims 1 to 4 is implemented.

Images