ModbusTcp instruction protection method, device, terminal and storage medium

Abstract

The present application discloses a protection method, device, terminal and storage medium for ModbusTcp instructions. The method includes: a zero-trust gateway client receives an initial ModbusTcp instruction transmitted by a master device, encrypts the initial ModbusTcp instruction, and uses a TCP communication tunnel to send the encrypted initial ModbusTcp instruction to a zero-trust gateway. The present invention encrypts the initial ModbusTcp instruction and authenticates, authorizes, and monitors dangers, and protects the initial ModbusTcp instruction from multiple angles such as ModbusTcp communication link security, access behavior authentication, access authorization, continuous data packet authentication, and ModbusTcp instruction control, thereby protecting the IoT system based on ModbusTcp and effectively preventing third parties from attacking the IoT system from multiple angles such as physical networks, IoT application systems, network identities, and traffic attacks.

Description

Technical Field

[0001] The present application relates to the technical field of Internet of Things, and in particular to a protection method, device, terminal and storage medium for ModbusTcp instructions. Background Art

[0002] Modbus communication is an application layer message transmission protocol invented by Modicon (now a brand of Schneider Electric) in 1979 and mainly used in the industrial field. It has become one of the most popular communication protocols in the IoT field due to its openness, stability, efficiency, and low cost. However, in the process of ModbusTcp protocol communication, how to effectively protect ModbusTcp instructions has become an urgent problem to be solved.

[0003] At present, in the ModbusTcp protocol communication process, the Internet of Things application system regularly sends ModbusTcp instructions to the slave device (ModbusTcp Slave) through the master device (ModbusTcpMaster) to realize the four remote functions (telemetry, telesignaling, remote control, and remote adjustment) in the traditional control field. Among them, the instructions include writing registers, reading registers, writing coils, reading coils, etc.

[0004] However, during the ModbusTcp protocol communication process, the ModbusTcp instructions transmitted between the master and slave devices lack an effective protection mechanism. Summary of the invention

[0005] The main purpose of the present application is to provide a protection method, device, terminal and storage medium for ModbusTcp instructions to solve the problem of lack of effective protection mechanism for ModbusTcp instructions in related technologies.

[0006] In order to achieve the above objectives, in a first aspect, the present application provides a ModbusTcp instruction protection method, comprising:

[0007] The zero-trust gateway client receives the initial ModbusTcp command transmitted by the main device, encrypts the initial ModbusTcp command, and uses the TCP communication tunnel to send the encrypted initial ModbusTcp command to the zero-trust gateway;

[0008] The zero-trust gateway performs identity authentication, decryption, and risk monitoring on the encrypted initial ModbusTcp command in sequence. If the initial ModbusTcp command is a non-dangerous command, the initial ModbusTcp command is forwarded to the slave device according to the preset strategy.

[0009] In one possible implementation, the zero-trust gateway performs identity authentication, decryption, and risk monitoring on the encrypted initial ModbusTcp command in sequence, including:

[0010] Identify the first identity corresponding to the encrypted initial ModbusTcp instruction;

[0011] If the first identity identifier satisfies the first preset condition, decrypting the encrypted initial ModbusTcp instruction to obtain the initial ModbusTcp instruction;

[0012] The initial ModbusTcp instruction is compared with all dangerous instructions in a preset dangerous instruction library to determine whether the initial ModbusTcp instruction is a dangerous instruction.

[0013] In a possible implementation manner, if the identity identifier satisfies the first preset condition, the method further includes:

[0014] Authorize the encrypted initial ModbusTcp command.

[0015] In a possible implementation, after determining whether the initial ModbusTcp instruction is a dangerous instruction, the method further includes:

[0016] If the initial ModbusTcp instruction is a dangerous instruction, the initial ModbusTcp instruction is sent to the alarm server for processing.

[0017] In a possible implementation, after forwarding the initial ModbusTcp instruction to the slave device according to a preset strategy, the method further includes:

[0018] The zero trust gateway receives the execution receipt transmitted from the device;

[0019] The execution receipt is encrypted and sent to the zero-trust gateway client using the TCP communication tunnel.

[0020] In a possible implementation, after the execution receipt is encrypted and the encrypted execution receipt is sent to the zero-trust gateway client using a TCP communication tunnel, the following is also included:

[0021] The Zero Trust Gateway client authenticates the encrypted execution receipt;

[0022] If the identity authentication is successful, the encrypted execution receipt is decrypted and sent to the master device.

[0023] In one possible implementation, the zero trust gateway client authenticates the encrypted execution receipt, including:

[0024] The zero-trust gateway client identifies the second identity identifier corresponding to the encrypted execution receipt.

[0025] In a second aspect, an embodiment of the present invention provides a protection device for a ModbusTcp instruction, comprising:

[0026] The instruction encryption module is used for the zero-trust gateway client to receive the initial ModbusTcp instruction transmitted by the main device, encrypt the initial ModbusTcp instruction, and use the TCP communication tunnel to send the encrypted initial ModbusTcp instruction to the zero-trust gateway;

[0027] The instruction control module is used for the zero-trust gateway to perform identity authentication, decryption and risk monitoring on the encrypted initial ModbusTcp instruction in sequence. If the initial ModbusTcp instruction is a non-dangerous instruction, the initial ModbusTcp instruction is forwarded to the slave device according to the preset strategy.

[0028] In a third aspect, an embodiment of the present invention provides a terminal, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of the protection method of any one of the above ModbusTcp instructions are implemented.

[0029] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the protection method of any one of the above ModbusTcp instructions are implemented.

[0030] The embodiment of the present invention provides a protection method, device, terminal and storage medium for ModbusTcp instructions, including: a zero-trust gateway client receives an initial ModbusTcp instruction transmitted by a master device, encrypts the initial ModbusTcp instruction, and uses a TCP communication tunnel to send the encrypted initial ModbusTcp instruction to a zero-trust gateway, and then the zero-trust gateway sequentially performs identity authentication, decryption and danger monitoring on the encrypted initial ModbusTcp instruction, and if the initial ModbusTcp instruction is a non-dangerous instruction, the initial ModbusTcp instruction is forwarded to a slave device according to a preset strategy. The present invention encrypts and authenticates the initial ModbusTcp instruction, authorizes, and monitors danger, and protects the initial ModbusTcp instruction from multiple angles such as ModbusTcp communication link security, access behavior authentication, access authorization, continuous authentication of data packets, and ModbusTcp instruction control, so that the IoT system based on ModbusTcp is fully protected, and effectively prevents third parties from attacking the IoT system from multiple angles such as physical network, IoT application system, network identity, and traffic attack. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The drawings constituting a part of this application are used to provide a further understanding of this application, so that other features, purposes and advantages of this application become more obvious. The schematic embodiment drawings and their descriptions of this application are used to explain this application and do not constitute an improper limitation on this application. In the drawings:

[0032] Figure 1 It is a structural schematic diagram of a traditional ModbusTcp communication system provided by an embodiment of the present invention;

[0033] Figure 2 It is a structural schematic diagram of a protection device for ModbusTcp instructions provided by an embodiment of the present invention;

[0034] Figure 3 It is a flow chart of an implementation method of a ModbusTcp instruction protection method provided by an embodiment of the present invention;

[0035] Figure 4 It is a structural schematic diagram of a protection device for ModbusTcp instructions provided by another embodiment of the present invention;

[0036] Figure 5 is a schematic diagram of a terminal provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0037] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0038] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present invention and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in sequences other than those illustrated or described herein.

[0039] It should be understood that in various embodiments of the present invention, the size of the sequence number of each process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0040] It should be understood that in the present invention, "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products or apparatuses.

[0041] It should be understood that in the present invention, "plurality" refers to two or more than two. "And / or" is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "Contains A, B and C", "Contains A, B, C" means that A, B, and C are all included, "Contains A, B or C" means that one of A, B, and C is included, and "Contains A, B and / or C" means that any one, any two, or any three of A, B, and C are included.

[0042] It should be understood that in the present invention, "B corresponding to A", "B corresponding to A", "A corresponds to B" or "B corresponds to A" means that B is associated with A and B can be determined based on A. Determining B based on A does not mean determining B based only on A, but B can also be determined based on A and / or other information. A and B match when the similarity between A and B is greater than or equal to a preset threshold.

[0043] Depending on the context, "if" as used herein may be interpreted as "when" or "when" or "in response to determining" or "in response to detecting."

[0044] The technical solution of the present invention is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0045] In order to make the purpose, technical solutions and advantages of the present invention more clear, specific embodiments will be described below in conjunction with the accompanying drawings.

[0046] Figure 1 It is the traditional ModbusTcp master / slave architecture. The IoT application system sends instructions to the ModbusTcp Slave regularly through the ModbusTcp Master module, including writing registers, reading registers, writing coils, reading coils, etc., to realize the four remote functions (telemetry, remote communication, remote control, and remote adjustment) in the traditional control field.

[0047] The traditional ModbusTcp communication system has problems such as "no authentication", "no authorization", "no transmission security", and "no protection of instructions". Specifically, "no authentication" means that the Modbus protocol does not have any definition of authentication. As long as you can access the Modbus service site, you can use function codes to collect device information and send control instructions, thereby disrupting or destroying the operation of the entire system; "no authorization" means that Modbus has no user classification, no role control, and no division of visitor permissions, which means that visitors can perform any function; "no protection of instructions" means that there is no encryption mechanism, that is, the encryption mechanism of network communication ensures that the data of both parties in communication is not monitored and tampered by a third party. In the Modbus protocol communication process, instructions and addresses are sent completely in plain text, which can be easily parsed and modified by listeners.

[0048] Based on the above problems, the present invention provides a complete set of protection mechanisms, such as Figure 2 As shown, the security of ModbusTcp communication in the existing IoT system is fully protected.

[0049] Combination Figure 2 , compared with the existing technology ( Figure 1 ), the present invention adds 5 parts, namely: zero trust gateway client, zero trust gateway and three services: authentication service, authorization service, and dangerous instruction control policy service. The following is a description of each part, as follows:

[0050] (1) Zero Trust Gateway Client

[0051] All ModbusTcp traffic on the IoT application system server must pass through the zero-trust gateway client. The zero-trust gateway client obtains the device identity, which includes but is not limited to the device's hardware ID, device certificate, etc. The zero-trust gateway client also attaches identity information to all communication packages issued by the ModbusTcp Master. This identity information will be used for zero-trust gateway authentication (i.e., identity identification). Among them, the identity information is generated by the gateway client through the hardware characteristics of the ModbusTcpMaster server. The zero-trust gateway client encrypts the ModbusTcp traffic through mTLS and transmits it to the zero-trust gateway using tunnel technology.

[0052] (2) Zero Trust Gateway

[0053] The device identity of all requests (each communication packet) is verified through the authentication and authorization service. The device identity here includes the unique ID of the device. If the device identity authentication fails, the user will be directed to the authentication and authorization service to establish a session identifier (usually this happens when the device is connected for the first time). After the authentication and permission are passed, the received mTLS traffic will be restored to ModbusTcp traffic. If the control policy service determines that a certain communication traffic contains harmful instructions, it will be intercepted. Among them, the control policy service processes the external / internal route mapping according to the pre-defined strategy.

[0054] (3) Certification services

[0055] The device identity information in the data packet is verified as needed, and the OIDC (OpenId Connect) authentication token of the device identity session is established when the device accesses for the first time. The device identity OIDC token is stored in the data cache. When the device identity OIDC token expires, the token is updated using the static authentication method.

[0056] (4) Authorization Service

[0057] Grant permissions to each ModbusTcp Master service according to the policy, check the session permissions of all device identities, and guide the Zero Trust Gateway to start the device authentication process if necessary.

[0058] (5) Dangerous instruction control strategy service

[0059] Continuously monitor the ModbusTcp traffic passing through the zero-trust gateway and record the recent (usually 7 days) ModbusTcp Master to Slave instructions. Use the instruction security policy to determine whether the instructions sent to the Slave are harmful. If so, notify the zero-trust gateway to intercept. The security policy includes a dangerous instruction library (blacklist) and an instruction logic tree (an instruction execution order that should not appear), which are configured in the gateway policy by security operation and maintenance personnel; intercept the traffic that obviously exceeds the processing capacity of the industrial equipment where the ModbusTcp Slave is located to prevent traffic attacks.

[0060] Based on the above protection mechanisms, such as Figure 3 As shown, the present invention provides a protection method for ModbusTcp instructions, comprising the following steps:

[0061] Step S301: The zero-trust gateway client receives the initial ModbusTcp instruction transmitted by the master device, encrypts the initial ModbusTcp instruction, and uses the TCP communication tunnel to send the encrypted initial ModbusTcp instruction to the zero-trust gateway;

[0062] Step S302: The zero-trust gateway performs identity authentication, decryption and risk monitoring on the encrypted initial ModbusTcp instruction in sequence. If the initial ModbusTcp instruction is a non-dangerous instruction, the initial ModbusTcp instruction is forwarded to the slave device according to a preset strategy.

[0063] Specifically, encryption is to encrypt the initial ModbusTcp instruction through mTLS to obtain the encrypted initial ModbusTcp instruction, that is, the mTLS instruction. Decryption is the process of restoring the mTLS instruction, that is, restoring the mTLS instruction to the initial ModbusTcp instruction.

[0064] The embodiment of the present invention provides a protection method for ModbusTcp instructions, including: a zero-trust gateway client receives an initial ModbusTcp instruction transmitted by a master device, encrypts the initial ModbusTcp instruction, and uses a TCP communication tunnel to send the encrypted initial ModbusTcp instruction to a zero-trust gateway, and then the zero-trust gateway sequentially performs identity authentication, decryption and danger monitoring on the encrypted initial ModbusTcp instruction, and if the initial ModbusTcp instruction is a non-dangerous instruction, forwards the initial ModbusTcp instruction to a slave device according to a preset strategy. The present invention encrypts and authenticates the initial ModbusTcp instruction, authorizes, and monitors danger, and protects the initial ModbusTcp instruction from multiple angles such as ModbusTcp communication link security, access behavior authentication, access authorization, continuous authentication of data packets, and ModbusTcp instruction control, so that the IoT system based on ModbusTcp is fully protected, and effectively prevents third parties from attacking the IoT system from multiple angles such as physical network, IoT application system, network identity, and traffic attack.

[0065] In one embodiment, step S302 includes:

[0066] Step S401: Identify the first identity identifier corresponding to the encrypted initial ModbusTcp instruction;

[0067] Step S402: If the first identity identifier satisfies the first preset condition, decrypt the encrypted initial ModbusTcp instruction to obtain the initial ModbusTcp instruction;

[0068] Step S403: Compare the initial ModbusTcp instruction with all dangerous instructions in a preset dangerous instruction library to determine whether the initial ModbusTcp instruction is a dangerous instruction.

[0069] Specifically, the encrypted initial ModbusTcp instruction is authenticated, that is, the first identity identifier corresponding to the encrypted initial ModbusTcp instruction is first identified, and then it is determined whether the first identity identifier meets the first preset condition. If so, the encrypted initial ModbusTcp instruction is decrypted; if not, the encrypted initial ModbusTcp instruction is discarded. Wherein, if the first identity identifier meets the first preset condition, the encrypted initial ModbusTcp instruction is also authorized.

[0070] In one embodiment, after determining whether the initial ModbusTcp instruction is a dangerous instruction, if the initial ModbusTcp instruction is a dangerous instruction, the initial ModbusTcp instruction is sent to the alarm server for processing; if the initial ModbusTcp instruction is a non-dangerous instruction, the initial ModbusTcp instruction is forwarded to the slave device according to a preset strategy.

[0071] When the slave device receives the initial ModbusTcp instruction, it will execute the corresponding behavior according to the initial ModbusTcp instruction. After the execution is completed, the execution receipt will be sent back to the zero-trust gateway. The zero-trust gateway will then encrypt the execution receipt through TLS and use the TCP communication tunnel to send the encrypted execution receipt to the zero-trust gateway client. The zero-trust gateway client authenticates the encrypted execution receipt. If the authentication is successful, the encrypted execution receipt is decrypted and sent to the master device. Among them, the zero-trust gateway client authenticates the encrypted execution receipt, that is, the zero-trust gateway client identifies the second identity identifier corresponding to the encrypted execution receipt. If the second identity identifier meets the second preset condition, it means that the identity authentication is successful. If the identity authentication fails, the encrypted execution receipt is discarded.

[0072] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0073] The following is an embodiment of the device of the present invention. For details not described in detail therein, reference may be made to the corresponding method embodiment described above.

[0074] Figure 4 A schematic diagram of the structure of a protection device for a ModbusTcp instruction provided by an embodiment of the present invention is shown. For ease of description, only the part related to the embodiment of the present invention is shown. A protection device for a ModbusTcp instruction includes an instruction encryption module 41 and an instruction control module 42, which are as follows:

[0075] The instruction encryption module 41 is used for the zero-trust gateway client to receive the initial ModbusTcp instruction transmitted by the main device, encrypt the initial ModbusTcp instruction, and use the TCP communication tunnel to send the encrypted initial ModbusTcp instruction to the zero-trust gateway;

[0076] The instruction control module 42 is used for the zero-trust gateway to perform identity authentication, decryption and risk monitoring on the encrypted initial ModbusTcp instruction in sequence. If the initial ModbusTcp instruction is a non-dangerous instruction, the initial ModbusTcp instruction is forwarded to the slave device according to a preset strategy.

[0077] In a possible implementation, the instruction control module 42 includes:

[0078] The instruction identity authentication submodule is used to identify the first identity identifier corresponding to the encrypted initial ModbusTcp instruction;

[0079] The instruction decryption submodule is used to decrypt the encrypted initial ModbusTcp instruction to obtain the initial ModbusTcp instruction if the first identity identifier meets the first preset condition;

[0080] The instruction identification submodule is used to compare the initial ModbusTcp instruction with all dangerous instructions in a preset dangerous instruction library to determine whether the initial ModbusTcp instruction is a dangerous instruction.

[0081] In a possible implementation, after the instruction decryption submodule, the following is further included:

[0082] The instruction authorization submodule is used to authorize the encrypted initial ModbusTcp instructions.

[0083] In a possible implementation, after the instruction identification submodule, the following is further included:

[0084] The alarm processing submodule is used to send the initial ModbusTcp instruction to the alarm server for processing if the initial ModbusTcp instruction is a dangerous instruction.

[0085] In a possible implementation, after the instruction control module 42, the following is further included:

[0086] The receipt receiving submodule is used for the zero-trust gateway to receive the execution receipt transmitted from the device;

[0087] The encryption submodule is used to encrypt the execution receipt and send the encrypted execution receipt to the zero-trust gateway client using the TCP communication tunnel.

[0088] In a possible implementation, after the encryption submodule, the following is further included:

[0089] The receipt verification submodule is used by the zero-trust gateway client to authenticate the encrypted execution receipt;

[0090] The receipt decryption submodule is used to decrypt the encrypted execution receipt if the identity authentication is passed, and send the execution receipt to the main device.

[0091] In a possible implementation, the receipt verification submodule includes:

[0092] The identification recognition unit is used for the zero-trust gateway client to identify the second identity corresponding to the encrypted execution receipt.

[0093] Figure 5 is a schematic diagram of a terminal provided by an embodiment of the present invention. Figure 5 As shown, the terminal 5 of this embodiment includes: a processor 50, a memory 51, and a computer program 52 stored in the memory 51 and executable on the processor 50. When the processor 50 executes the computer program 52, the steps in the above-mentioned protection method embodiments of each ModbusTcp instruction are implemented, for example Figure 3 Alternatively, when the processor 50 executes the computer program 52, the functions of each module / unit in the protection device embodiment of each ModbusTcp instruction are implemented, for example Figure 4 Functions of the modules / units 41 to 42 are shown.

[0094] The present invention also provides a readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, it is used to implement the methods provided in the above-mentioned various embodiments.

[0095] Among them, the readable storage medium can be a computer storage medium or a communication medium. The communication medium includes any medium that facilitates the transmission of a computer program from one place to another. The computer storage medium can be any available medium that can be accessed by a general-purpose or special-purpose computer. For example, a readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application-specific integrated circuit (Application Specific Integrated Circuits, abbreviated as: ASIC). In addition, the ASIC can be located in a user device. Of course, the processor and the readable storage medium can also exist in a communication device as discrete components. The readable storage medium can be a read-only memory (ROM), a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device, etc.

[0096] The present invention also provides a program product, which includes an execution instruction, which is stored in a readable storage medium. At least one processor of a device can read the execution instruction from the readable storage medium, and at least one processor executes the execution instruction so that the device implements the methods provided in the above various embodiments.

[0097] In the embodiments of the above-mentioned devices, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the present invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0098] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention.

Claims

1. A protection method for ModbusTcp instructions, characterized in that: include: The zero-trust gateway client receives the initial ModbusTcp instruction transmitted by the master device, encrypts the initial ModbusTcp instruction, and uses the TCP communication tunnel to send the encrypted initial ModbusTcp instruction to the zero-trust gateway; The zero-trust gateway sequentially performs identity authentication, decryption, and risk monitoring on the encrypted initial ModbusTcp instruction. If the initial ModbusTcp instruction is a non-risky instruction, the initial ModbusTcp instruction is forwarded to the slave device according to a preset strategy. The zero-trust gateway sequentially performs identity authentication, decryption and risk monitoring on the encrypted initial ModbusTcp instruction, including: Identify a first identity corresponding to the encrypted initial ModbusTcp instruction; If the first identity identifier satisfies a first preset condition, decrypting the encrypted initial ModbusTcp instruction to obtain the initial ModbusTcp instruction; Compare the initial ModbusTcp instruction with all dangerous instructions in a preset dangerous instruction library to determine whether the initial ModbusTcp instruction is a dangerous instruction; If the identity identifier satisfies the first preset condition, the method further includes: Authorizing the encrypted initial ModbusTcp instruction; After determining whether the initial ModbusTcp instruction is a dangerous instruction, the method further includes: If the initial ModbusTcp instruction is a dangerous instruction, the initial ModbusTcp instruction is sent to the alarm server for processing, and after the initial ModbusTcp instruction is forwarded to the slave device according to the preset strategy, the method further includes: The zero trust gateway receives the execution receipt transmitted from the device; The execution receipt is encrypted, and the encrypted execution receipt is sent to the zero-trust gateway client using a TCP communication tunnel. After the execution receipt is encrypted, and the encrypted execution receipt is sent to the zero-trust gateway client using a TCP communication tunnel, it also includes: The zero-trust gateway client authenticates the encrypted execution receipt; If the identity authentication is passed, the encrypted execution receipt is decrypted and sent to the master device, and the zero-trust gateway client authenticates the encrypted execution receipt, including: The zero-trust gateway client identifies a second identity identifier corresponding to the encrypted execution receipt.

2. A terminal comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the ModbusTcp instruction protection method as claimed in claim 1 are implemented.

3. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the ModbusTcp instruction protection method as claimed in claim 1 are implemented.

Images