Packet filtering method and device, electronic equipment and computer readable storage medium

Abstract

The application belongs to the technical field of communication, and discloses a message filtering method and device, electronic equipment and computer readable storage medium. The method comprises the following steps: when it is determined that a transmission message is received, acquiring first industrial control asset information of a sending device and second industrial control asset information of a destination device; obtaining a sending filtering condition corresponding to the sending device according to the first industrial control asset information; obtaining a receiving filtering condition corresponding to the destination device according to the second industrial control asset information; at least one of the sending device and the destination device is an industrial control device in an industrial control system, and each industrial control device in the industrial control system is respectively provided with the sending filtering condition and the receiving filtering condition; if it is determined that the transmission message meets the sending filtering condition and the receiving filtering condition, the transmission message is sent to the destination device. In this way, when the message filtering is performed on a complex industrial control network environment, the accuracy of the message filtering can be improved, and the configuration operation is simplified.

Description

Technical Field

[0001] This application relates to the field of communication technology, and more specifically, to methods, apparatus, electronic devices, and computer-readable storage media for message filtering. Background Technology

[0002] In industrial control network environments, to ensure the security of the industrial control network, gateway devices are typically used to filter transmitted messages.

[0003] Under current technology, it is usually necessary to set filtering rules for the protocol connections of device combinations. However, this approach makes it difficult to accurately filter packets in complex industrial control network environments, and the rule configuration is quite complicated. Summary of the Invention

[0004] The purpose of this application is to provide a method, apparatus, electronic device, and computer-readable storage medium for message filtering, so as to improve the accuracy of message filtering and simplify configuration operations when performing message filtering in complex industrial control network environments.

[0005] On the one hand, a message filtering method is provided, applied to gateway devices included in industrial control systems, comprising:

[0006] Upon receiving a transmission message, obtain the first industrial control asset information of the sending device and the second industrial control asset information of the destination device;

[0007] Based on the first industrial control asset information, obtain the corresponding transmission filtering conditions set for the transmitting device;

[0008] Based on the second industrial control asset information, obtain the receiving filtering conditions set for the target device; at least one of the sending device and the target device is an industrial control device in the industrial control system, and each industrial control device in the industrial control system is set with sending filtering conditions and receiving filtering conditions respectively.

[0009] If it is determined that the transmitted message meets both the sending and receiving filtering conditions, then the transmitted message will be sent to the destination device.

[0010] In one implementation, before determining that a transmission message has been received, the method further includes:

[0011] During the process of establishing a protocol connection between the sending device and the destination device, the protocol messages used for the protocol connection between the sending device and the destination device are obtained.

[0012] According to the protocol message, the first device network information of the sending device and the second device network information of the destination device are obtained respectively.

[0013] Based on the network information of the first device, obtain the first industrial control asset information matching the sending device;

[0014] Based on the network information of the second device, obtain the second industrial control asset information that matches the target device;

[0015] The system displays the first industrial control asset information and the second industrial control asset information. The industrial control asset information for non-industrial control equipment is the information of the designated equipment. The first industrial control asset information includes the first equipment location information of the sending equipment, and the second industrial control asset information includes the second equipment location information of the destination equipment.

[0016] In one embodiment, the first device network information includes first network address information and sending device type, and the second device network information includes second network address information and destination device type;

[0017] According to the protocol message, the first device network information of the sending device and the second device network information of the destination device are obtained respectively, including:

[0018] The protocol message is parsed to obtain the protocol type, the first network address information of the sending device, and the second network address information of the destination device;

[0019] Based on the initiator in the sending device and the destination device, determine the sending device type of the sending device and the destination device type of the destination device.

[0020] In one implementation, if it is determined that the transmitted message meets both the sending and receiving filtering conditions, then the transmitted message is sent to the destination device, including:

[0021] The transmitted message is parsed and its fields are extracted to obtain the first message field set and the second message field set;

[0022] If the message fields in the first message field set meet the sending filter conditions, and the message fields in the second message field set meet the receiving filter conditions, then the message is sent to the destination device.

[0023] In one embodiment, the method further includes:

[0024] When any industrial control device in the industrial control system successfully establishes a protocol connection, the connection count is incremented by one. The initial value of the connection count is 0.

[0025] Perform status detection on each protocol connection in the industrial control system, and decrement the connection count by one when any protocol connection is disconnected;

[0026] Displays the number of connections.

[0027] On the one hand, a message filtering device is provided, applied to gateway devices included in industrial control systems, comprising:

[0028] The acquisition unit is used to acquire the first industrial control asset information of the sending device and the second industrial control asset information of the destination device when a transmission message is received.

[0029] The first obtaining unit is used to obtain the sending filtering conditions set by the sending device according to the first industrial control asset information;

[0030] The second obtaining unit is used to obtain the receiving filtering conditions set for the target device according to the second industrial control asset information; at least one of the sending device and the target device is an industrial control device in the industrial control system, and each industrial control device in the industrial control system is respectively set with sending filtering conditions and receiving filtering conditions.

[0031] The sending unit is used to send the transmission message to the destination device if it is determined that the transmission message meets both the sending and receiving filtering conditions.

[0032] In one embodiment, the acquisition unit is further configured to:

[0033] During the process of establishing a protocol connection between the sending device and the destination device, the protocol messages used for the protocol connection between the sending device and the destination device are obtained.

[0034] According to the protocol message, the first device network information of the sending device and the second device network information of the destination device are obtained respectively.

[0035] Based on the network information of the first device, obtain the first industrial control asset information matching the sending device;

[0036] Based on the network information of the second device, obtain the second industrial control asset information that matches the target device;

[0037] The system displays the first industrial control asset information and the second industrial control asset information. The industrial control asset information for non-industrial control equipment is the information of the designated equipment. The first industrial control asset information includes the first equipment location information of the sending equipment, and the second industrial control asset information includes the second equipment location information of the destination equipment.

[0038] In one embodiment, the first device network information includes first network address information and sending device type, and the second device network information includes second network address information and destination device type;

[0039] The acquisition unit is also used for:

[0040] The protocol message is parsed to obtain the protocol type, the first network address information of the sending device, and the second network address information of the destination device;

[0041] Based on the initiator in the sending device and the destination device, determine the sending device type of the sending device and the destination device type of the destination device.

[0042] In one embodiment, the transmitting unit is used to:

[0043] The transmitted message is parsed and its fields are extracted to obtain the first message field set and the second message field set;

[0044] If the message fields in the first message field set meet the sending filter conditions, and the message fields in the second message field set meet the receiving filter conditions, then the message is sent to the destination device.

[0045] In one embodiment, the transmitting unit is further configured to:

[0046] When any industrial control device in the industrial control system successfully establishes a protocol connection, the connection count is incremented by one. The initial value of the connection count is 0.

[0047] Perform status detection on each protocol connection in the industrial control system, and decrement the connection count by one when any protocol connection is disconnected;

[0048] Displays the number of connections.

[0049] On one hand, an electronic device is provided, including a processor and a memory storing computer-readable instructions that, when executed by the processor, perform the steps of the method provided in any of the alternative implementations of the above-described message filtering.

[0050] On the one hand, a computer-readable storage medium is provided on which a computer program is stored, which, when executed by a processor, performs the steps of the methods provided in various alternative implementations of any of the above-described message filtering methods.

[0051] On the one hand, a computer program product is provided that, when run on a computer, causes the computer to perform the steps of the methods provided in various alternative implementations of any of the above-described message filtering methods.

[0052] The message filtering method, apparatus, electronic device, and computer-readable storage medium provided in this application embodiment, upon determining that a transmission message has been received, acquires first industrial control asset information of the sending device and second industrial control asset information of the destination device; obtains the sending filtering conditions corresponding to the sending device based on the first industrial control asset information; obtains the receiving filtering conditions corresponding to the destination device based on the second industrial control asset information; at least one of the sending device and the destination device is an industrial control device in an industrial control system, and each industrial control device in the industrial control system is respectively configured with sending filtering conditions and receiving filtering conditions; if it is determined that the transmission message meets both the sending filtering conditions and the receiving filtering conditions, the transmission message is sent to the destination device. In this way, when performing message filtering in complex industrial control network environments, the accuracy of message filtering can be improved and the configuration operation simplified.

[0053] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0054] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0055] Figure 1 A flowchart illustrating a message filtering method provided in this application embodiment;

[0056] Figure 2 A structural block diagram of a message filtering apparatus provided in an embodiment of this application;

[0057] Figure 3 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0058] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0059] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0060] In order to improve the accuracy of packet filtering in complex industrial control network environments, embodiments of this application provide a method, apparatus, electronic device, and computer-readable storage medium for packet filtering.

[0061] The execution entity in this application embodiment is a gateway device in an industrial control system. This industrial control system includes at least one industrial control device, and any industrial control device can transmit messages with other industrial control devices within the system, as well as with non-industrial control devices outside the system.

[0062] The following is combined Figure 1 The message filtering method provided in the embodiments of this application will be described in detail below. Figure 1 The diagram shown is a flowchart of a message filtering method provided in an embodiment of this application. The specific implementation process of this method is as follows:

[0063] Step 100: Upon receiving a transmission message, obtain the first industrial control asset information of the sending device and the second industrial control asset information of the destination device; Step 101: Based on the first industrial control asset information, obtain the sending filtering conditions set by the sending device; Step 102: Based on the second industrial control asset information, obtain the receiving filtering conditions set by the destination device; At least one of the sending device and the destination device is an industrial control device in the industrial control system, and each industrial control device in the industrial control system is configured with sending filtering conditions and receiving filtering conditions; Step 103: If it is determined that the transmission message meets both the sending filtering conditions and the receiving filtering conditions, then send the transmission message to the destination device.

[0064] In this embodiment of the application, in order to transmit messages between devices, it is usually necessary to establish a protocol connection between the devices before message transmission. In one implementation, different devices use a three-way handshake to establish a connection.

[0065] Furthermore, to implement message filtering, corresponding industrial control asset information is typically pre-configured for each industrial control device. This allows the determination of the industrial control asset information of any connected industrial control device when a protocol connection is established within the industrial control system. Specifically, the gateway device can monitor the connections of each industrial control device and obtain the corresponding industrial control asset information upon successful establishment of a protocol connection. For example, industrial control asset information may include device network information, device name, device description information, device location information, and message filtering conditions. Message filtering conditions may include sending filtering conditions and receiving filtering conditions.

[0066] In one implementation, taking the sending device and the destination device establishing the protocol connection as an example, the following steps can be used to determine the industrial control asset information:

[0067] S1001: During the process of establishing a protocol connection between the sending device and the destination device, obtain the protocol messages used for the protocol connection between the sending device and the destination device.

[0068] As an example, when it is determined that the sending device and the destination device are connecting using a three-way handshake, the protocol messages during the connection process are obtained.

[0069] S1002: According to the protocol message, obtain the first device network information of the sending device and the second device network information of the destination device respectively.

[0070] Specifically, the protocol message is parsed to obtain the protocol type, the first network address information of the sending device, and the second network address information of the destination device; based on the initiator in the sending device and the destination device, the sending device type of the sending device and the destination device type of the destination device are determined.

[0071] The first device network information includes a first network address and a sending device type, while the second device network information includes a second network address and a destination device type. Device types can include server and client types; the device type of the initiator of the protocol connection is client, and the other party is server.

[0072] Optionally, the network address information (i.e., the first network address information and the second network address information) may include the IP address and the physical address (Media Access Control Address, MAC).

[0073] S1003: Based on the network information of the first device, obtain the first industrial control asset information matching the sending device; based on the network information of the second device, obtain the second industrial control asset information matching the destination device.

[0074] Specifically, the system obtains the correspondence between pre-configured device network information and industrial control asset information, and based on this correspondence, obtains the first industrial control asset information that matches the first device network information, and the second industrial control asset information that matches the second device network information.

[0075] S1004: Displays information on the first and second industrial control assets.

[0076] Specifically, the first and second industrial control asset information are displayed as connection information in the display interface.

[0077] The first industrial control asset information includes the first device location information of the sending device, and the second industrial control asset information includes the second device location information of the destination device. This allows the location of any device to be determined using its location information when an anomaly is detected, enabling timely maintenance.

[0078] It should be noted that since at least one of the sending device and the destination device is an industrial control device within an industrial control system, either the sending device or the destination device may be a non-industrial control device. Therefore, designated device information can be pre-set for non-industrial control devices. That is, if a device (sending device or destination device) is determined to be a non-industrial control device, then the industrial control asset information of that device is the designated device information. As an example, the designated device information can be empty.

[0079] In one implementation, if it is determined that there is no matching industrial control asset information for a certain device, then the specified device information is set as the industrial control asset information for that device.

[0080] This allows us to obtain industrial control asset information about the sending and destination devices for subsequent message filtering.

[0081] Furthermore, to facilitate users in viewing the number of connections in the industrial control system, the connection status of industrial control devices can be monitored and statistically analyzed to obtain and display the connection count. In one implementation, the following steps can be used to count and display the connection count: when any industrial control device in the industrial control system successfully establishes a protocol connection, the connection count is incremented by one, with an initial value of 0; the status of each protocol connection in the industrial control system is checked, and when any protocol connection is disconnected, the connection count is decremented by one; the connection count is then displayed.

[0082] As an example, the current number of connections for each industrial control device is obtained. When a new protocol connection is established, the current number of connections is incremented by 1. At the same time, the number of connections and connection information are displayed when the mouse is clicked.

[0083] The system checks each protocol connection in real-time or periodically whether it is sending maintenance messages or messages indicating connection termination. If a maintenance message is detected and no termination message is sent, the connection status of the corresponding protocol connection is displayed as normal. If neither a maintenance message nor a termination message is sent, the system waits for the connection maintenance time. If the maintenance time is exceeded, the connection status is displayed as abnormal. If a termination message is detected, the connection count is decremented by 1, and the connection status of the corresponding protocol connection is set to disconnected.

[0084] In this embodiment of the application, in order to perform accurate message filtering in complex industrial control environments, message filtering conditions are individually set for different industrial control devices. The implementation process of steps 101 and 102 may include:

[0085] The sending filtering conditions set for the sending device are obtained from the first industrial control asset information, and the receiving filtering conditions set for the destination device are obtained from the second industrial control asset information.

[0086] In this embodiment, to improve the accuracy of message filtering, message filtering is performed through various message fields in the message. In one implementation, step 103 may include:

[0087] The transmitted message is parsed and its fields are extracted to obtain a first set of message fields and a second set of message fields. If the message fields in the first set of message fields meet the sending filter conditions and the message fields in the second set of message fields meet the receiving filter conditions, then the transmitted message is sent to the destination device.

[0088] The first set of message fields includes at least one message field, and the second set of message fields also includes at least one message field. Users can select the message fields used for filtering and matching according to their actual application scenarios. For example, a message field can be an IP address or the length of the transmitted content.

[0089] As an example, both sending and receiving filter conditions are configured in the industrial control asset information in the form of file data. After obtaining the industrial control asset information corresponding to the sending device and the destination device, the sending filter conditions for the sending device and the receiving filter conditions for the destination device are obtained from the obtained industrial control asset information. Then, the message fields in the transmitted message can be matched with the sending filter conditions and the receiving filter conditions respectively. If a match is found to be unsuccessful, it means that the data in this transmitted message is not the data required by the receiving device, and the transmitted message is blocked; otherwise, the transmitted message is allowed to pass.

[0090] In this embodiment, corresponding sending and receiving filtering conditions are individually set for each industrial control device in the industrial control system, and filtering is performed based on message fields, which improves the accuracy of message filtering. This approach is applicable to more complex industrial control network environments and enables secure transmission of network data. Furthermore, by using industrial control assets (i.e., industrial control devices) in the industrial control system, the protocol connections of the devices in the industrial control system are monitored. This eliminates the need to configure the protocol connections of each group of devices separately, but rather configures each industrial control device individually. This allows for rapid configuration of industrial control asset information in complex industrial control network environments, as well as rapid troubleshooting of connection problems and rapid location of devices experiencing network or other anomalies, saving significant subsequent maintenance costs.

[0091] Based on the same inventive concept, this application also provides a message filtering device. Since the principle of the above device and equipment in solving the problem is similar to that of a message filtering method, the implementation of the above device can refer to the implementation of the method, and the repeated parts will not be described again.

[0092] like Figure 2The diagram shown is a structural block diagram of a message filtering apparatus provided in an embodiment of this application, comprising:

[0093] The acquisition unit 201 is used to acquire the first industrial control asset information of the sending device and the second industrial control asset information of the destination device when a transmission message is received.

[0094] The first obtaining unit 202 is used to obtain the sending filtering conditions set by the sending device according to the first industrial control asset information;

[0095] The second obtaining unit 203 is used to obtain the receiving filtering conditions set for the target device according to the second industrial control asset information; at least one of the sending device and the target device is an industrial control device in the industrial control system, and each industrial control device in the industrial control system is respectively set with sending filtering conditions and receiving filtering conditions.

[0096] The sending unit 204 is used to send the transmission message to the destination device if it is determined that the transmission message meets the sending filter conditions and the receiving filter conditions.

[0097] In one embodiment, the acquisition unit 201 is further configured to:

[0098] During the process of establishing a protocol connection between the sending device and the destination device, the protocol messages used for the protocol connection between the sending device and the destination device are obtained.

[0099] According to the protocol message, the first device network information of the sending device and the second device network information of the destination device are obtained respectively.

[0100] Based on the network information of the first device, obtain the first industrial control asset information matching the sending device;

[0101] Based on the network information of the second device, obtain the second industrial control asset information that matches the target device;

[0102] The system displays the first industrial control asset information and the second industrial control asset information. The industrial control asset information for non-industrial control equipment is the information of the designated equipment. The first industrial control asset information includes the first equipment location information of the sending equipment, and the second industrial control asset information includes the second equipment location information of the destination equipment.

[0103] In one embodiment, the first device network information includes first network address information and sending device type, and the second device network information includes second network address information and destination device type;

[0104] The acquisition unit 201 is also used for:

[0105] The protocol message is parsed to obtain the protocol type, the first network address information of the sending device, and the second network address information of the destination device;

[0106] Based on the initiator in the sending device and the destination device, determine the sending device type of the sending device and the destination device type of the destination device.

[0107] In one embodiment, the transmitting unit 204 is used to:

[0108] The transmitted message is parsed and its fields are extracted to obtain the first message field set and the second message field set;

[0109] If the message fields in the first message field set meet the sending filter conditions, and the message fields in the second message field set meet the receiving filter conditions, then the message is sent to the destination device.

[0110] In one embodiment, the sending unit 204 is further configured to:

[0111] When any industrial control device in the industrial control system successfully establishes a protocol connection, the connection count is incremented by one. The initial value of the connection count is 0.

[0112] Perform status detection on each protocol connection in the industrial control system, and decrement the connection count by one when any protocol connection is disconnected;

[0113] Displays the number of connections.

[0114] The message filtering method, apparatus, electronic device, and computer-readable storage medium provided in this application embodiment, upon determining that a transmission message has been received, acquires first industrial control asset information of the sending device and second industrial control asset information of the destination device; obtains the sending filtering conditions corresponding to the sending device based on the first industrial control asset information; obtains the receiving filtering conditions corresponding to the destination device based on the second industrial control asset information; at least one of the sending device and the destination device is an industrial control device in an industrial control system, and each industrial control device in the industrial control system is respectively configured with sending filtering conditions and receiving filtering conditions; if it is determined that the transmission message meets both the sending filtering conditions and the receiving filtering conditions, the transmission message is sent to the destination device. In this way, when performing message filtering in complex industrial control network environments, the accuracy of message filtering can be improved and the configuration operation simplified.

[0115] Figure 3 A schematic diagram of the structure of an electronic device 3000 is shown. (See attached diagram.) Figure 3 As shown, the electronic device 3000 includes a processor 3010 and a memory 3020, and optionally may also include a power supply 3030, a display unit 3040, and an input unit 3050.

[0116] The processor 3010 is the control center of the electronic device 3000. It connects various components through various interfaces and lines, and performs various functions of the electronic device 3000 by running or executing software programs and / or data stored in the memory 3020, thereby performing overall monitoring of the electronic device 3000.

[0117] In this embodiment, when the processor 3010 calls the computer program stored in the memory 3020, it executes the steps in the above embodiments.

[0118] Optionally, the processor 3010 may include one or more processing units; preferably, the processor 3010 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into the processor 3010. In some embodiments, the processor and memory may be implemented on a single chip; in some embodiments, they may also be implemented separately on independent chips.

[0119] The memory 3020 may primarily include a program storage area and a data storage area. The program storage area may store the operating system, various applications, etc.; the data storage area may store data created based on the use of the electronic device 3000, etc. In addition, the memory 3020 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device, etc.

[0120] Electronic device 3000 also includes a power supply 3030 (such as a battery) that supplies power to various components. The power supply can be logically connected to processor 3010 through a power management system, thereby enabling the management of charging, discharging, and power consumption.

[0121] The display unit 3040 can be used to display information input by the user or information provided to the user, as well as various menus of the electronic device 3000. In this embodiment of the invention, it is mainly used to display the display interfaces of various applications in the electronic device 3000, as well as text, images, and other objects displayed on the display interfaces. The display unit 3040 may include a display panel 3041. The display panel 3041 may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like.

[0122] The input unit 3050 can be used to receive information such as numbers or characters input by the user. The input unit 3050 may include a touch panel 3051 and other input devices 3052. The touch panel 3051, also known as a touch screen, can collect touch operations on or near the user (such as operations performed by the user using a finger, stylus, or any suitable object or accessory on or near the touch panel 3051).

[0123] Specifically, the touch panel 3051 can detect user touch operations and the signals generated by these operations, convert them into touch point coordinates, send them to the processor 3010, and receive and execute commands from the processor 3010. Furthermore, the touch panel 3051 can be implemented using various types of sensors, including resistive, capacitive, infrared, and surface acoustic wave sensors. Other input devices 3052 can include, but are not limited to, one or more of the following: physical keyboard, function keys (such as volume control buttons, power buttons, etc.), trackball, mouse, joystick, etc.

[0124] Of course, the touch panel 3051 can cover the display panel 3041. When the touch panel 3051 detects a touch operation on or near it, it transmits the information to the processor 3010 to determine the type of touch event. Subsequently, the processor 3010 provides corresponding visual output on the display panel 3041 according to the type of touch event. Although in Figure 3 In this embodiment, the touch panel 3051 and the display panel 3041 are two separate components to realize the input and output functions of the electronic device 3000. However, in some embodiments, the touch panel 3051 and the display panel 3041 can be integrated to realize the input and output functions of the electronic device 3000.

[0125] The electronic device 3000 may also include one or more sensors, such as a pressure sensor, a gravity acceleration sensor, a proximity sensor, etc. Of course, depending on the specific application, the electronic device 3000 may also include other components such as a camera. Since these components are not the focus of this application's embodiments, therefore... Figure 3 It is not shown in the text and will not be described in detail here.

[0126] Those skilled in the art will understand that Figure 3 This is merely an example of an electronic device and does not constitute a limitation on the electronic device. It may include more or fewer components than shown, or a combination of certain components, or different components.

[0127] In this embodiment of the application, a computer-readable storage medium stores a computer program thereon. When the computer program is executed by a processor, it enables a communication device to perform the various steps in the above embodiments.

[0128] For ease of description, the above sections are divided into modules (or units) according to their functions and described separately. Of course, in implementing this application, the functions of each module (or unit) can be implemented in one or more software or hardware components.

[0129] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0130] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0131] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0132] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0133] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0134] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A message filtering method, characterized in that, Gateway devices used in industrial control systems include: Upon receiving a transmission message, obtain the first industrial control asset information of the sending device and the second industrial control asset information of the destination device; Based on the first industrial control asset information, obtain the transmission filtering conditions set for the transmitting device; Based on the second industrial control asset information, the receiving filtering conditions set for the target device are obtained; at least one of the sending device and the target device is an industrial control device of the industrial control system, and each industrial control device in the industrial control system is respectively set with sending filtering conditions and receiving filtering conditions; If it is determined that the transmitted message meets both the sending and receiving filtering conditions, then the transmitted message is sent to the destination device. Before determining that a transmission message has been received, the method further includes: During the process of establishing a protocol connection between the sending device and the destination device, the protocol messages used for the protocol connection between the sending device and the destination device are acquired; According to the protocol message, the first device network information of the sending device and the second device network information of the destination device are obtained respectively. Based on the network information of the first device, obtain the first industrial control asset information matching the sending device; Based on the network information of the second device, obtain the second industrial control asset information matching the target device; The first industrial control asset information and the second industrial control asset information are displayed. The industrial control asset information of non-industrial control equipment is designated equipment information. The first industrial control asset information includes the first equipment location information of the sending equipment, and the second industrial control asset information includes the second equipment location information of the destination equipment.

2. The method as described in claim 1, characterized in that, The first device network information includes first network address information and sending device type; the second device network information includes second network address information and destination device type. The step of obtaining the first device network information of the sending device and the second device network information of the destination device according to the protocol message includes: The protocol message is parsed to obtain the protocol type, the first network address information of the sending device, and the second network address information of the destination device; Based on the initiator in the sending device and the destination device, determine the sending device type of the sending device and the destination device type of the destination device.

3. The method as described in claim 1 or 2, characterized in that, If it is determined that the transmitted message meets both the sending and receiving filtering conditions, then sending the transmitted message to the destination device includes: The transmitted message is parsed and fields are extracted to obtain a first message field set and a second message field set; If the message fields in the first message field set meet the sending filter conditions, and the message fields in the second message field set meet the receiving filter conditions, then the message is sent to the destination device.

4. The method as described in claim 1 or 2, characterized in that, The method further includes: When any industrial control device in the industrial control system successfully establishes a protocol connection, the connection count is incremented by one, and the initial value of the connection count is 0. The status of each protocol connection in the industrial control system is detected, and when any protocol connection is found to be disconnected, the number of connections is reduced by one. Displays the number of connections.

5. A message filtering device, characterized in that, Gateway devices used in industrial control systems include: The acquisition unit is used to acquire the first industrial control asset information of the sending device and the second industrial control asset information of the destination device when a transmission message is received. The first obtaining unit is used to obtain the sending filtering conditions set by the sending device according to the first industrial control asset information; The second obtaining unit is used to obtain the receiving filtering conditions set for the target device according to the second industrial control asset information; at least one of the sending device and the target device is an industrial control device of the industrial control system, and each industrial control device in the industrial control system is respectively set with sending filtering conditions and receiving filtering conditions. A sending unit is configured to send the transmission message to the destination device if it is determined that the transmission message meets the sending filtering conditions and the receiving filtering conditions. The acquisition unit is also used for: During the process of establishing a protocol connection between the sending device and the destination device, the protocol messages used for the protocol connection between the sending device and the destination device are acquired; According to the protocol message, the first device network information of the sending device and the second device network information of the destination device are obtained respectively. Based on the network information of the first device, obtain the first industrial control asset information matching the sending device; Based on the network information of the second device, obtain the second industrial control asset information matching the target device; The first industrial control asset information and the second industrial control asset information are displayed. The industrial control asset information of non-industrial control equipment is designated equipment information. The first industrial control asset information includes the first equipment location information of the sending equipment, and the second industrial control asset information includes the second equipment location information of the destination equipment.

6. The apparatus as claimed in claim 5, characterized in that, The first device network information includes first network address information and sending device type; the second device network information includes second network address information and destination device type. The acquisition unit is also used for: The protocol message is parsed to obtain the protocol type, the first network address information of the sending device, and the second network address information of the destination device; Based on the initiator in the sending device and the destination device, determine the sending device type of the sending device and the destination device type of the destination device.

7. The apparatus as described in claim 5 or 6, characterized in that, The sending unit is used for: The transmitted message is parsed and fields are extracted to obtain a first message field set and a second message field set; If the message fields in the first message field set meet the sending filter conditions, and the message fields in the second message field set meet the receiving filter conditions, then the message is sent to the destination device.

8. The apparatus as described in claim 5 or 6, characterized in that, The transmitting unit is further configured to: When any industrial control device in the industrial control system successfully establishes a protocol connection, the connection count is incremented by one, and the initial value of the connection count is 0. The status of each protocol connection in the industrial control system is detected, and when any protocol connection is found to be disconnected, the number of connections is reduced by one. Displays the number of connections.

9. An electronic device, characterized in that, It includes a processor and a memory, the memory storing computer-readable instructions that, when executed by the processor, perform the method as described in any one of claims 1-4.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it performs the method as described in any one of claims 1-4.

Images