Security protection method, device, equipment and readable storage medium

Abstract

The present application discloses a security protection method, device, equipment and readable storage medium. The present application can query the access rights of each PLC controller in the industrial network; if the access rights of any PLC controller are lower than the preset conditions, the communication data received by the PLC controller is obtained in real time; and the preset security protection rules are used to detect whether there is attack data in the communication data; if so, the PLC controller is prevented from responding to the communication data, and the identification information, communication data and attack behavior of the PLC controller are recorded to provide security protection for the PLC controller. This solution can detect abnormal traffic in a timely manner, intercept and record relevant abnormal information, and ensure the security of equipment and industrial networks. Accordingly, the security protection device, equipment and readable storage medium provided by the present application also have the above-mentioned technical effects.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a security protection method, apparatus, device, and readable storage medium. Background Art

[0002] Currently, hackers typically target PLC controllers with lower-level access permissions, as higher-level access permissions increase the difficulty of attack. If a hacker compromises a PLC controller, they could potentially modify access permissions, preventing normal user access. They could even modify user programs running on the device, resulting in serious consequences. A PLC controller stands for Programmable Logic Controller.

[0003] Therefore, how to provide safety protection for PLC controllers is a problem that needs to be solved by those skilled in the art. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a security protection method, device, equipment and readable storage medium to provide security protection for PLC controllers. The specific solution is as follows:

[0005] In a first aspect, the present application provides a safety protection method, which is applied to safety protection equipment, comprising:

[0006] Query the access rights of each PLC controller in the industrial network;

[0007] If the access rights of any PLC controller are lower than the preset conditions, the communication data received by the PLC controller is obtained in real time;

[0008] Detecting whether attack data exists in the communication data using preset security protection rules;

[0009] If so, the PLC controller is prevented from responding to the communication data, and the identification information of the PLC controller, the communication data, and the attack behavior are recorded.

[0010] Preferably, the querying of access rights of each PLC controller in the industrial network includes:

[0011] Use preset scripts to query the access rights of each PLC controller in the industrial network.

[0012] Preferably, the querying of access rights of each PLC controller in the industrial network by using a preset script includes:

[0013] Use the preset script to send query messages to each PLC controller through the s7_comm protocol;

[0014] Utilize the preset script to receive the response message fed back by each PLC controller, and analyze the response message to obtain the access rights of each PLC controller.

[0015] Preferably, after querying the access rights of each PLC controller in the industrial network, the method further includes:

[0016] Visualize the access rights of each PLC controller.

[0017] Preferably, the access permission is full permission, read permission, minimum permission or no upload allowed.

[0018] Preferably, it also includes:

[0019] If the access rights of any PLC controller are lower than the preset conditions, the user will be prompted to modify the access rights of the PLC controller.

[0020] Preferably, the detecting whether attack data exists in the communication data by using preset security protection rules includes:

[0021] extracting operational behavior data from the communication data;

[0022] If the operation behavior data matches the attack feature preset in the security protection rule, it is determined that the attack data exists in the communication data; otherwise, it is determined that the attack data does not exist in the communication data.

[0023] In a second aspect, the present application provides a safety protection device, which is applied to safety protection equipment, including:

[0024] Query module, used to query the access rights of each PLC controller in the industrial network;

[0025] An acquisition module is used to acquire the communication data received by any PLC controller in real time if the access authority of the PLC controller is lower than a preset condition;

[0026] A detection module, configured to detect whether attack data exists in the communication data using preset security protection rules;

[0027] The protection module is used to, if so, prevent the PLC controller from responding to the communication data and record the identification information of the PLC controller, the communication data and the attack behavior.

[0028] In a third aspect, the present application provides a safety protection device, comprising:

[0029] Memory for storing computer programs;

[0030] A processor is used to execute the computer program to implement the aforementioned security protection method disclosed above.

[0031] In a fourth aspect, the present application provides a readable storage medium for storing a computer program, wherein the computer program implements the aforementioned disclosed security protection method when executed by a processor.

[0032] From the above scheme, it can be seen that the present application provides a security protection method, which is applied to security protection equipment, including: querying the access rights of each PLC controller in the industrial network; if the access rights of any PLC controller are lower than the preset conditions, obtaining the communication data received by the PLC controller in real time; using preset security protection rules to detect whether there is attack data in the communication data; if so, making the PLC controller not respond to the communication data, and recording the identification information of the PLC controller, the communication data and the attack behavior.

[0033] As can be seen, this application can query the access rights of each PLC controller in an industrial network; if the access rights of any PLC controller are lower than the preset conditions, the communication data received by the PLC controller is obtained in real time; and the communication data is detected using preset security protection rules to determine whether there is attack data in the communication data; if so, the PLC controller is prevented from responding to the communication data, preventing the PLC controller from performing dangerous operations. At the same time, the PLC controller's identification information, communication data, and attack behavior are recorded to provide security protection for the PLC controller. This solution can promptly detect abnormal traffic, intercept and record related abnormal information, and ensure the security of equipment and industrial networks.

[0034] Correspondingly, the safety protection device, equipment and readable storage medium provided by this application also have the above-mentioned technical effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without any creative work.

[0036] Figure 1 A flow chart of a security protection method disclosed in this application;

[0037] Figure 2 A schematic diagram of a visual code for access rights disclosed in this application;

[0038] Figure 3 A flowchart of access rights query disclosed in this application;

[0039] Figure 4A schematic diagram of the script execution and results disclosed in this application;

[0040] Figure 5 A response message analysis flow chart disclosed in this application;

[0041] Figure 6 A schematic diagram of a safety protection device disclosed in this application;

[0042] Figure 7 This is a schematic diagram of a safety protection device disclosed in this application. DETAILED DESCRIPTION

[0043] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0044] Currently, hackers generally target PLC controllers with lower access permissions, as the higher the access permissions, the more difficult the attack. If a hacker compromises a PLC controller, they may modify the access permissions, preventing users from accessing the device normally. Even user programs running in the device may be modified, resulting in serious consequences. To this end, this application provides a security protection solution that can prevent the PLC controller from responding to communication data including attack data, preventing the PLC controller from performing dangerous operations, thereby providing security protection for the PLC controller and ensuring the security of the device and industrial network.

[0045] See also Figure 1 As shown, the embodiment of the present application discloses a safety protection method, which is applied to safety protection equipment, including:

[0046] S101. Query the access rights of each PLC controller in the industrial network.

[0047] In this embodiment, the security protection equipment can be connected to the same industrial network as each PLC controller. Common security protection equipment includes industrial firewalls, industrial security audit equipment, etc. Each PLC controller is of the same manufacturer and model, for example, all are Siemens S7-200smart series.

[0048] In one embodiment, querying the access rights of each PLC controller in the industrial network includes querying the access rights of each PLC controller in the industrial network using a preset script to improve query efficiency. The preset script can be a .py script required by the ISF framework, or other types of scripts.

[0049] In a specific embodiment, a preset script is used to query the access rights of each PLC controller in an industrial network, including: using the preset script to send a query message to each PLC controller through the s7_comm protocol; using the preset script to receive a response message fed back by each PLC controller, and analyzing the response message to obtain the access rights of each PLC controller.

[0050] Specifically, you can query the access rights of any PLC controller by sending the following code to the controller through the s7_comm protocol.

[0051] pp="0300001f02f080320100000004000e00000401120a100200020000030005d0".decode("hex")

[0052] sock.send(str(pp))

[0053] data = sock.recv(1024)

[0054] The hexadecimal string "pp" shown in the above code plays a decisive role in the query process. "03 00 00 1f" in "pp" is the TPKT portion of the s7_comm protocol, which defines the protocol version and payload length. "02 f0 80" is the COTP portion of the s7_comm protocol, which defines information such as the protocol PDU type. "32 01 00 00 00 04 00 0e 0000" is the header portion of the s7_comm protocol, which defines information such as the protocol identifier and the S7_COMM protocol payload length. "04 0112 0a 10 02 00 02 00 00 03 00 05 d0" is the parameter portion of the s7_comm protocol, which defines information such as the operation function code, parameter object type, data block sequence number, and address. The PLC controller includes data blocks, storage blocks, program blocks, etc., and the parameter object type refers to data, storage, or program, etc. The data block sequence number and address are: the sequence number and address of the data block, storage block, or program block.

[0055] The response message fed back by the PLC controller can be: 00 0c 29 3b 7a 40 e0 dc a0 c1 85 7b 0800 45 00 00 43 13 a6 00 00 1e 06 03 b6 c0 a8 02 01 c0 a8 02 08 00 66 e1 26 0004 a7 b9 f3 1 5 0f b4 50 18 20 00 d1 020 0 00 03 00 00 1b 02 f0 80 32 03 0000 00 04 00 02 00 06 00 00 04 01 ff 04 00 10 00 02, which is a hexadecimal string.

[0056] Among them, the 1st to 6th bytes are the destination MAC, the 7th to 12th bytes are the source MAC, the 13th to 14th bytes are the communication type Tpv4, the 15th to 34th bytes are the IP layer data, the 35th to 54th bytes are the TCP layer data, the 55th to 58th bytes are the s7 communication TPKT data, the 59th to 61st bytes are the COTP data, and the 62nd to 81st bytes are the application layer s7_comm protocol payload data.

[0057] In bytes 62-81, bytes 62-73 are the s7_comm protocol header, bytes 74-75 are the action executed by the s7_comm protocol, where the parameter is "read", bytes 76-81 are the read PLC data values (the content of the read operation), and bytes 80-81 (i.e., "0002") are the current access permission level value.

[0058] Therefore, as long as the s7_comm protocol, the control field "read", and the last two bytes "00 02" are filtered out based on the return packet, it can be determined that the access permission level is level 2 (or other levels).

[0059] In a specific embodiment, after querying the access rights of each PLC controller in the industrial network, the method further includes: visually displaying the access rights of each PLC controller. Figure 2 As shown, the queried access rights are set to print in the code for display.

[0060] S102: If the access authority of any PLC controller is lower than a preset condition, the communication data received by the PLC controller is acquired in real time.

[0061] In one embodiment, access rights are classified into full access (Level 1), read access (Level 2), minimal access (Level 3), or no upload allowed (Level 4), with access rights becoming increasingly stringent. Therefore, preset conditions can be set accordingly. For example, if the preset condition is set to Level 3, then if the PLC controller's access right is Level 1 or Level 2, its communication data will be checked using the preset security protection rules. For another example, if the preset condition is set to Level 4, then if the PLC controller's access right is Level 1, Level 2, or Level 3, its communication data will be checked using the preset security protection rules.

[0062] Of course, the preset conditions can also be set independently instead of the PLC controller's access level. For example, if the preset conditions are set to level 6, then regardless of the PLC controller's access level, its communication data will be checked using the preset security protection rules.

[0063] S103. Use preset security protection rules to detect whether there is attack data in the communication data; if so, execute S104; if not, do nothing.

[0064] S104: The PLC controller is prevented from responding to the communication data, and identification information, communication data, and attack behavior of the PLC controller are recorded.

[0065] In a specific embodiment, if the access rights of any PLC controller are lower than a preset condition, the user is prompted to modify the access rights of the PLC controller to improve the access rights of the PLC controller and ensure its security.

[0066] In one specific embodiment, using pre-set security protection rules to detect whether attack data exists in communication data includes: extracting operational behavior data from the communication data; if the operational behavior data matches the attack signature pre-set in the security protection rules, determining that attack data exists in the communication data; otherwise, determining that attack data does not exist in the communication data. The security protection rules can be pre-set in a rule library. The rule library includes multiple security protection rules and is located in the security protection device. New rules can be continuously added to the rule library based on hacker attack methods to achieve better detection results.

[0067] In a specific implementation, the security protection rule may be: alert s7comm any any->PLC's IPany(msg:"The attack has occurred!!"; content:“|04 01 12 0a 10 02 00 02 00 00 03 00 05 d0|”; sid:1000001; rev:1;).

[0068] Among them, alert is the "action" field, and "alert" means using the selected alarm method to generate alarm information and record data packets. s7comm is the "protocol" field, which specifies the protocol to be protected. The first any can be the "source IP" field. The second any can be the "source port number" field. The PLC's IP is the "IP of the protected PLC controller" field. The third any refers to the "destination port number (port number of the protected PLC controller)" field. msg refers to: the information content prompted when an attack occurs. content refers to: the attack feature field, as long as this field is detected, the rule action will be triggered. sid refers to: the ID number of the rule. rev refers to: the version identifier of the rule.

[0069] As can be seen, this embodiment can query the access rights of each PLC controller in an industrial network. If the access rights of any PLC controller are lower than the preset requirements, the communication data received by the PLC controller is obtained in real time. Pre-set security protection rules are then used to detect whether attack data exists in the communication data. If so, the PLC controller is prevented from responding to the communication data, preventing the PLC controller from performing dangerous operations. The PLC controller's identification information, communication data, and attack behavior are also recorded to provide security protection for the PLC controller. This solution can promptly detect abnormal traffic, intercept and record related abnormal information, and ensure the security of equipment and industrial networks.

[0070] This embodiment provides a solution for querying the access rights of a PLC controller. Taking the S7-200 SmartPLC controller as an example, this solution obtains feedback data (i.e., response message) from the S7-200 Smart PLC controller by sending a fixed message, analyzes each field in the feedback data, and identifies the access right level based on the specific value of the parameter field that identifies the access right level.

[0071] See Figure 3 The specific process implementation includes:

[0072] 1. Write a Python script (preset script) under the ISF framework based on the payload. Of course, you can also write a script directly in Python or other languages without using the ISF framework, as long as the script can query access rights.

[0073] The communication protocol used by the S7-200 Smart PLC controller is s7_comm, and the communication port number is 102. Therefore, sending a data packet to the device generally requires: establishing a connection, establishing communication, and designing and sending a payload.

[0074] (1) Establish a connection.

[0075] Perform a three-way handshake with the PLC controller and establish a connection via Socket. This connection is a standard TCP connection method and is automatically completed by Socket. The key code for "establishing a connection" in the Python script is as follows:

[0076] sock = socket.socket()

[0077] sock.connect((self.target, self.port))

[0078] pp="0300001611e00000000100c0010ac1020100c2020101".decode("hex")

[0079] sock.send(str(pp))

[0080] data = sock.recv(1024)

[0081] (2) Establish communication.

[0082] Send COTP (Connection Oriented Transport Protocol) and s7_comm messages to the PLC. The messages include the PLC's CPU rack number and slot number, specifying which PLC to send data and communication requests to. The corresponding key code in the Python script is as follows:

[0083] pp="0300001902f08032010000662100080000f0000001000101e0".decode("hex")

[0084] sock.send(str(pp))

[0085] data = sock.recv(1024)

[0086] time.sleep(0.1)

[0087] (3) Design and send payload application data.

[0088] Regardless of the payload, steps (1) and (2) need to be executed. However, the specific operation to be performed is closely related to the payload content. In this embodiment, the action to be executed is to query the current access permission level of the PLC. The corresponding key code in the Python script is as follows:

[0089] pp="0300001f02f000320100000004000e00000401120a100200020000030005d0".decode("hex")

[0090] sock.send(str(pp))

[0091] data = sock.recv(1024)

[0092] The hexadecimal string "pp" shown in this code plays a decisive role in the query process. "03 00 00 1f" in "pp" is the TPKT portion of the s7_comm protocol, which defines the protocol version and payload length. "02 f0 80" is the COTP portion of the s7_comm protocol, which defines information such as the protocol PDU type. "32 01 00 00 00 04 00 0e 0000" is the header portion of the s7_comm protocol, which defines information such as the protocol identifier and the S7_COMM protocol payload length. "04 0112 0a 10 02 00 02 00 00 03 00 05 d0" is the parameter portion of the s7_comm protocol, which defines information such as the operation function code, parameter object type, data block sequence number, and address. The PLC controller includes data blocks, storage blocks, program blocks, etc., and the parameter object type refers to data, storage, or program, etc. The data block sequence number and address are: the sequence number and address of the data block, storage block, or program block.

[0093] 2. Place the script in the specified directory of the ISF framework.

[0094] The installation of the ISF framework relies on many libraries. After installing them one by one, enter python isf.py in the terminal to open the ISF interface and put the py script written in "1" into the specified directory.

[0095] Assuming the script name is "s7_200_password_check.py", enter the command "cp s7_200_password_check.Py icssploit / modules / exploits / plcs / siemens / " in the terminal to copy the script to the specified directory.

[0096] 3. Execute the script to obtain PLC feedback data to identify the current access permission level of the PLC.

[0097] Enter commands in the command line of the ISF interface to execute the Py script. First, enter "use exploits / plcs / siemens / s7_200_password_check.py" to call the .py script file, then enter "set target192.168.2.1" to set the IP address of the PLC, and finally enter "run" to run the .py script. For the script execution and analysis results, please refer to Figure 4 ,like Figure 4 As shown in the figure, the access permission of the PLC is "read-only". It can be seen that the script can parse the PLC feedback data to obtain access permissions such as "full read", "read-only", "minimum permission" or "no upload allowed", and can also visualize the access permissions, such as Figure 4 As shown, you will see the result of "Read Only" in the terminal.

[0098] Specifically, the process of script analysis of PLC feedback data can be referred to Figure 5 .like Figure 5 As shown, the script first determines whether the feedback data complies with the s7_comm protocol; if so, it checks whether the control field corresponds to the read operation in the query message; if so, it checks whether the parameter field corresponds to the data block number and address and other parameters in the query message; if so, it determines that the feedback data is a response to the query message, then obtains the 80th to 81st bytes of the feedback data and compares them with the preset level values of each permission to determine the current access permission of the PLC.

[0099] It can be seen that this embodiment can write scripts to deeply analyze the key fields of the response data. When it is known that the current access permission level of the PLC is low, it means that the PLC is in a high-risk state and is easily attacked by hackers. The level should be modified as soon as possible to improve the security of the controller.

[0100] This embodiment provides a solution for protecting PLC controllers. This solution uses Snort rules to define security protection rules. When an external device sends a payload intended to attack the PLC controller, an alert is issued: "Attack has occurred!" The payload can be customized, such as features related to write operations and query access rights.

[0101] For example, the security protection rule is: alert s7comm any any->PLC's IP any(msg:"The attack has occurred!!"; content:“|04 01 12 0a 10 02 00 02 00 00 03 00 05 d0|”; sid:1000001; rev:1;).

[0102] Among them, alert is the "action" field, and "alert" means using the selected alarm method to generate alarm information and record data packets. s7comm is the "protocol" field, which specifies the protocol to be protected. The first any can be the "source IP" field. The second any can be the "source port number" field. The PLC's IP is the "IP of the protected PLC controller" field. The third any refers to the "destination port number (port number of the protected PLC controller)" field. msg refers to: the information content prompted when an attack occurs. content refers to: the attack feature field, as long as this field is detected, the rule action will be triggered. sid refers to: the ID number of the rule. rev refers to: the version identifier of the rule.

[0103] By installing this security protection rule on the industrial firewall, the industrial firewall can provide security protection for each PLC controller in the intranet. When an external network device sends a payload to attack the PLC controller, an alarm will be issued: "Attack has occurred!!"

[0104] It can be seen that this embodiment can utilize snort rules to perform security protection on the PLC controller. Based on this embodiment, a snort rule base can be constructed to improve security protection capabilities and enhance the security of the industrial control system.

[0105] The following introduces a safety protection device provided in an embodiment of the present application. The safety protection device described below and the safety protection method described above can be referenced with each other.

[0106] See also Figure 6 As shown, the embodiment of the present application discloses a safety protection device, which is applied to safety protection equipment, including:

[0107] Query module 601, used to query the access rights of each PLC controller in the industrial network;

[0108] An acquisition module 602 is configured to acquire communication data received by any PLC controller in real time if the access authority of the PLC controller is lower than a preset condition;

[0109] Detection module 603, used to detect whether there is attack data in the communication data using preset security protection rules;

[0110] The protection module 604 is configured to, if yes, prevent the PLC controller from responding to the communication data and record the identification information, communication data and attack behavior of the PLC controller.

[0111] In a specific implementation, the query module is specifically configured to:

[0112] Use preset scripts to query the access rights of each PLC controller in the industrial network.

[0113] In a specific implementation, the query module is specifically configured to:

[0114] Use the preset script to send query messages to each PLC controller through the s7_comm protocol;

[0115] The preset script is used to receive the response message fed back by each PLC controller, and the response message is analyzed to obtain the access rights of each PLC controller.

[0116] In a specific embodiment, it also includes:

[0117] The display module is used to visually display the access rights of each PLC controller.

[0118] In a specific implementation, the access permission is full permission, read permission, minimum permission, or no upload allowed.

[0119] In a specific embodiment, it also includes:

[0120] The prompt module is used to prompt the user to modify the access rights of any PLC controller if the access rights of the PLC controller are lower than the preset conditions.

[0121] In a specific embodiment, the detection module is specifically used to:

[0122] Operation behavior data is extracted from the communication data; if the operation behavior data matches the attack signature preset in the security protection rule, it is determined that attack data exists in the communication data; otherwise, it is determined that attack data does not exist in the communication data.

[0123] Among them, for more specific working processes of each module and unit in this embodiment, reference can be made to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0124] It can be seen that this embodiment provides a security protection device that can detect abnormal traffic in a timely manner, intercept and record related abnormal information, and ensure the security of equipment and industrial networks.

[0125] The following introduces a safety protection device provided in an embodiment of the present application. The safety protection device described below and the safety protection method and device described above can be referenced to each other.

[0126] See also Figure 7 As shown, the embodiment of the present application discloses a safety protection device, including:

[0127] Memory 701, used for storing computer programs;

[0128] The processor 702 is configured to execute the computer program to implement the method disclosed in any of the above embodiments.

[0129] The following introduces a readable storage medium provided in an embodiment of the present application. The readable storage medium described below and the security protection method, device and equipment described above can be referenced to each other.

[0130] A readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the security protection method disclosed in the aforementioned embodiment. The specific steps of the method can be referred to the corresponding contents disclosed in the aforementioned embodiment and will not be repeated here.

[0131] References to "first," "second," "third," "fourth," and the like (if any) herein are intended to distinguish similar objects and are not necessarily intended to describe a particular order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having," as well as any variations thereof, are intended to cover non-exclusive inclusions, e.g., a process, method, or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such processes, methods, or apparatus.

[0132] It should be noted that the descriptions of "first", "second", etc. in this application are for descriptive purposes only and should not be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" or "second" may explicitly or implicitly include at least one of such features. In addition, the technical solutions between the various embodiments can be combined with each other, but this must be based on the fact that they can be implemented by ordinary technicians in this field. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0133] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0134] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of readable storage medium known in the art.

[0135] This document uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. At the same time, for those skilled in the art, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. A safety protection method, characterized in that: Used in safety protection equipment, including: Query the access rights of each PLC controller in the industrial network; If the access rights of any PLC controller are lower than the preset conditions, the communication data received by the PLC controller is obtained in real time; Utilize preset security protection rules to detect whether attack data exists in the communication data; wherein the security protection rules are set with Snort rules, including: action field, protocol field, source IP, source port number, IP of the protected PLC controller, port number of the protected PLC controller, information content prompted when the attack occurs, attack feature field, rule ID number and rule version identifier; If so, the PLC controller is prevented from responding to the communication data, and the identification information of the PLC controller, the communication data, and the attack behavior are recorded; The detecting whether attack data exists in the communication data by using preset security protection rules includes: extracting operational behavior data from the communication data; If the operation behavior data matches the attack feature preset in the security protection rule, it is determined that the attack data exists in the communication data; otherwise, it is determined that the attack data does not exist in the communication data.

2. The method according to claim 1, characterized in that The query of access rights of each PLC controller in the industrial network includes: Use preset scripts to query the access rights of each PLC controller in the industrial network.

3. The method according to claim 2, characterized in that The method of using a preset script to query the access rights of each PLC controller in the industrial network includes: Use the preset script to send query messages to each PLC controller through the s7_comm protocol; Utilize the preset script to receive the response message fed back by each PLC controller, and analyze the response message to obtain the access rights of each PLC controller.

4. The method according to claim 1, wherein After querying the access rights of each PLC controller in the industrial network, the method further includes: Visualize the access rights of each PLC controller.

5. The method according to claim 4, characterized in that The access rights are full permission, read permission, minimum permission or no upload allowed.

6. The method according to any one of claims 1 to 5, characterized in that Also includes: If the access rights of any PLC controller are lower than the preset conditions, the user will be prompted to modify the access rights of the PLC controller.

7. A safety protection device, characterized in that: Used in safety protection equipment, including: Query module, used to query the access rights of each PLC controller in the industrial network; An acquisition module is used to acquire the communication data received by any PLC controller in real time if the access authority of the PLC controller is lower than a preset condition; A detection module is used to detect whether there is attack data in the communication data using preset security protection rules; wherein the security protection rules are set with Snort rules, including: an action field, a protocol field, a source IP address, a source port number, an IP address of a protected PLC controller, a port number of a protected PLC controller, information content prompted when an attack occurs, an attack feature field, a rule ID number, and a rule version identifier; a protection module, configured to, if yes, prevent the PLC controller from responding to the communication data, and record identification information of the PLC controller, the communication data, and the attack behavior; The detection module is specifically used for: extracting operational behavior data from the communication data; If the operation behavior data matches the attack feature preset in the security protection rule, it is determined that the attack data exists in the communication data; otherwise, it is determined that the attack data does not exist in the communication data.

8. A safety protection device, characterized in that: include: memory for storing computer programs; A processor, configured to execute the computer program to implement the method according to any one of claims 1 to 6.

9. A readable storage medium, characterized in that Used to store a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images