Policy storage method and device, message matching method and device, equipment and medium

Abstract

The embodiments of the present application provide a strategy storage method and apparatus, a message matching method and apparatus, a device and a medium, wherein the strategy storage method includes: obtaining an industrial control strategy; obtaining a maximum address and a minimum address in the industrial control strategy; obtaining an address difference value according to the maximum address and the minimum address; performing a hash operation according to the address difference value and the minimum address to obtain an index value of the industrial control strategy; and storing the industrial control strategy according to the index value. The implementation of the above embodiments can improve the strategy storage efficiency, deduplication efficiency and message matching efficiency.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a policy storage method and device, a message matching method and device, equipment and medium. Background Art

[0002] A firewall is a device that is set up between different networks to isolate and protect the internal network. Logically, it is a filter. Only when the firewall agrees can the external network access the internal network; if the firewall disagrees, it will block the access operation and issue a warning; it effectively monitors the activities between the internal network and the external network to ensure the security of the internal network.

[0003] In the process of security protection by the firewall, the firewall needs to be stored first. There are two methods in the prior art. The first is that when each industrial control policy is added, the function code, public body address, information body address, data type, and value field in the newly added policy are matched one by one with all the industrial control policies of the existing protocol to complete policy deduplication; the second is that when each message passes through the industrial control module detection, the function code, public body address, information body address, data type, and value field in the current message need to be matched one by one with all the industrial control policies to complete the message detection. In the first method, each time the administrator adds a new policy, all policies need to be matched one by one for deduplication. When the number of configured policies is large, the efficiency is low. When the number of configured policies is large and the communication traffic is large, there will be a large number of repeated matches for each detection of a data packet, which takes a long time and the detection efficiency is low. Summary of the invention

[0004] In view of this, the purpose of the embodiments of the present application is to provide a policy storage method and device, a message matching method and device, equipment and medium, which can improve the matching efficiency and deduplication efficiency.

[0005] In a first aspect, an embodiment of the present application provides a method, including:

[0006] Obtain industrial control strategies;

[0007] Obtaining the maximum address and the minimum address in the industrial control strategy;

[0008] Acquire an address difference according to the maximum address and the minimum address;

[0009] Performing a hash operation based on the address difference and the minimum address to obtain an index value of the industrial control strategy;

[0010] The industrial control strategy is stored according to the index value.

[0011] Furthermore, the step of performing a hash operation according to the address difference and the minimum address to obtain the index value of the industrial control policy includes:

[0012] Generate a hash algorithm input value according to the address difference and the minimum address;

[0013] A hash operation is performed according to the hash algorithm input value to obtain an index value of the industrial control strategy.

[0014] Further, the minimum address includes: the minimum common body address and the minimum information body address; the maximum address includes: the maximum common body address and the maximum information body address; the address difference includes: the common body address difference and the information body address difference;

[0015] The step of obtaining the address difference according to the maximum address and the minimum address comprises:

[0016] Acquire the public body address difference according to the maximum public body address and the minimum public body address;

[0017] Acquire the information body address difference according to the maximum information body address and the minimum information body address;

[0018] The step of generating a hash algorithm input value according to the address difference and the minimum address comprises:

[0019] The function code of the industrial control strategy, the minimum common body address, the common body address difference, the minimum information body address, and the information body address difference are subjected to a bitwise XOR operation to obtain the hash algorithm input value.

[0020] Furthermore, the step of performing a hash operation according to the hash algorithm input value to obtain the index value of the industrial control policy includes:

[0021] Convert the hash algorithm input value into integer data to obtain an integer hash input value;

[0022] The integer hash input value is processed according to the FNV-1a hash algorithm to obtain an index value of the industrial control policy.

[0023] Furthermore, the number of bits of the index value of the industrial control strategy is 32 bits; after the step of performing a hash operation according to the address difference and the minimum address to obtain the index value of the index value of the industrial control strategy, the method further includes:

[0024] The number of bits of the index value of the industrial control strategy is compressed.

[0025] Furthermore, the step of compressing the number of bits of the index value of the industrial control strategy includes:

[0026] Shift the index value of the industrial control strategy to the right by 16 bits to obtain a shifted index value;

[0027] Perform an AND operation on the index value of the industrial control strategy and the hexadecimal value 65535 to obtain an index value after the operation;

[0028] A bitwise XOR operation is performed on the shifted index value and the calculated index value to obtain a compressed index value.

[0029] Furthermore, the step of storing the industrial control strategy according to the index value includes:

[0030] Determine a storage linked list corresponding to the index value of the industrial control strategy from a plurality of pre-established linked lists, each of the linked lists corresponds to one index value, and each node of the linked list is used to store one industrial control strategy;

[0031] Matching the industrial control strategy to be stored with the industrial control strategy in the storage linked list;

[0032] If there is an industrial control policy matching the industrial control policy to be stored in the storage linked list, the industrial control policy to be stored is discarded;

[0033] If there is no industrial control policy matching the industrial control policy to be stored in the storage linked list, the industrial control policy to be stored is stored in the storage linked list.

[0034] In a second aspect, an embodiment of the present application provides a message matching method, including:

[0035] Receive message:

[0036] Obtaining the maximum address and the minimum address in the message;

[0037] Acquire an address difference according to the maximum address and the minimum address;

[0038] Performing a hash operation according to the address difference and the minimum address to obtain an index value of the message;

[0039] The message is matched according to the index value.

[0040] In a third aspect, an embodiment of the present application provides an industrial control policy storage device, including:

[0041] The policy acquisition module is used to obtain the industrial control policies configured by the administrator;

[0042] A first address acquisition module, used to acquire the maximum address and the minimum address in the industrial control strategy;

[0043] A first address difference acquisition module, used for acquiring an address difference according to the maximum address and the minimum address;

[0044] A first hash operation module, used for performing a hash operation according to the address difference and the minimum address to obtain an index value of the industrial control policy;

[0045] A storage module is used to store the industrial control strategy according to the index value.

[0046] In a fourth aspect, an embodiment of the present application provides a message matching device, including:

[0047] A receiving module, used for receiving messages;

[0048] A second address acquisition module acquires the maximum address and the minimum address in the message;

[0049] A second address difference acquisition module, used for acquiring an address difference according to the maximum address and the minimum address;

[0050] A second hash operation module, used for performing a hash operation according to the address difference and the minimum address to obtain an index value of the message;

[0051] A matching module is used to match the message according to the index value.

[0052] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method described in any one of the first aspects when executing the computer program.

[0053] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, on which instructions are stored. When the instructions are executed on a computer, the computer executes the method as described in any one of the first aspects.

[0054] In the above implementation process, the hash value is used as the index value to store the industrial control policy. Since there are too many industrial control policies, different industrial control policies may target addresses that are partially the same or completely the same. In order to avoid different industrial control policies corresponding to the same index value, which leads to an increase in the number of times the industrial control policies need to be matched one by one, the embodiment of the present application proposes obtaining the maximum address and the minimum address in the industrial control policy, obtaining the address difference according to the maximum address and the minimum address; generating an index value according to the address difference and the minimum address; and storing the industrial control policy according to the index value. Based on the above implementation, the probability of different industrial control policies corresponding to the same index value can be reduced, thereby improving matching efficiency and deduplication efficiency.

[0055] Other features and advantages disclosed in the present application will be described in the following description, or some features and advantages can be inferred or determined without doubt from the description, or can be learned by implementing the above-mentioned technology disclosed in the present application.

[0056] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0058] Figure 1 A schematic diagram of a process flow of a method for storing an industrial control strategy provided in an embodiment of the present application;

[0059] Figure 2 A flowchart of a message matching method provided in an embodiment of the present application;

[0060] Figure 3 A schematic diagram of the structure of a storage device for an industrial control strategy provided in an embodiment of the present application;

[0061] Figure 4 A schematic diagram of the structure of a message matching device provided in an embodiment of the present application;

[0062] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0063] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0064] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0065] Example 1

[0066] See also Figure 1 , the present application embodiment provides a method for storing an industrial control policy, including:

[0067] S101: Obtain industrial control strategy;

[0068] The industrial control policy is configured and added by the administrator. The industrial control policy includes: the protocol type corresponding to the industrial control policy (such as IEC104), protocol number, function code, public body address range, information body address range, data type, and value field.

[0069] S102: Obtain the maximum address and the minimum address in the industrial control strategy;

[0070] S103: Obtaining an address difference according to the maximum address and the minimum address;

[0071] S104: performing a hash operation according to the address difference and the minimum address to obtain an index value of the industrial control policy;

[0072] In a possible implementation, S104 includes: generating a hash algorithm input value according to the address difference and the minimum address; performing a hash operation according to the hash algorithm input value to obtain an index value of the industrial control policy.

[0073] Since the configuration address is a range, it is necessary to extract the hash input value to calculate the hash value. The prior art has the following methods: take the minimum address or the maximum address as the hash input value; take the sum of the minimum address and the maximum address, and then divide the result by 2 as the hash input value; Method 1 is not unique when the minimum address or the maximum address of multiple industrial control strategies are the same (for example: 4-10 and 4-20); Method 2 is not unique when multiple industrial control strategies also have different ranges but the same mean (for example: 10-30 and 15-25). Therefore, the embodiment of the present application proposes to perform a hash operation based on the address difference and the minimum address to obtain the index value of the industrial control strategy, which can uniquely identify an address range and minimize the situation where different industrial control strategies correspond to the same hash value, thereby improving the matching efficiency and deduplication efficiency.

[0074] In one possible implementation, the minimum address includes: the minimum common body address and the minimum information body address; the maximum address includes: the maximum common body address and the maximum information body address; the address difference includes: the common body address difference and the information body address difference; the step of obtaining the address difference according to the maximum address and the minimum address includes: obtaining the common body address difference according to the maximum common body address and the minimum common body address; obtaining the information body address difference according to the maximum information body address and the minimum information body address; the step of generating a hash algorithm input value according to the address difference and the minimum address includes: performing a bitwise XOR operation on the function code of the industrial control strategy, the minimum common body address, the common body address difference, the minimum information body address, and the information body address difference to obtain the hash algorithm input value.

[0075] In the above embodiment, a value is obtained by adding function code^common body address minimum value^common body address difference value^information body address minimum value^information body address difference value to obtain a hash input value.

[0076] In the above implementation process, since the protocol itself includes a public body and a message body, in order to further avoid different industrial control strategies from generating the same hash index value, the minimum public body address, the minimum information body address, the public body address difference, the information body address difference and the function code are used as variables to generate the hash input value.

[0077] In one possible implementation, the step of performing a hash operation according to a hash algorithm input value to obtain an index value of the industrial control policy includes: converting the hash algorithm input value into integer data to obtain an integer hash input value; processing the integer hash input value according to the FNV-1a hash algorithm to obtain the index value of the industrial control policy.

[0078] In the above embodiment, the hash input value is converted into an integer value, and the hash value is obtained by the FNV-1a hash algorithm. The FNV-1a hash algorithm has the characteristics of fast operation and low collision rate. The algorithm speed allows a large amount of data to be processed quickly while maintaining a reasonable collision rate. The high degree of dispersion of the FNV hash makes it very suitable for hashing almost identical strings. Since the address range, address difference and function code have certain similarities, the FNV-1a hash algorithm is suitable for generating the index value of the industrial control strategy mentioned in the embodiment of this application.

[0079] Since the hash value output by the FNV-1a hash algorithm is at least 32 bits, in order to reduce storage space and matching time. In a possible implementation, the number of bits of the index value of the industrial control policy is 32 bits; after performing a hash operation based on the address difference and the minimum address to obtain the index value of the industrial control policy, the step further includes: compressing the number of bits of the index value of the industrial control policy.

[0080] An embodiment of the present application provides a method for compressing an index value, including: shifting the index value of the industrial control strategy to the right by 16 bits to obtain a shifted index value; performing an AND operation on the index value of the industrial control strategy and hexadecimal 65535 to obtain a calculated index value; performing a bitwise XOR operation on the shifted index value and the calculated index value to obtain a compressed index value.

[0081] In the above embodiment, the 32-bit hash value is subjected to the following calculation (hash input value>>16)^(hash input value&0xFFFF) to obtain a 16-bit hash value. Here, it is best to use a hash size of 2 to the power of n.

[0082] The modulo method can also be used to compress the number of digits of the index value. For example, if a hash size of 9999 is required, the following method is used to calculate the hash input value mod (9999+1).

[0083] S105: Store the industrial control policy according to the index value.

[0084] In a possible implementation, S105 includes: determining a storage linked list corresponding to an index value of the industrial control policy in a plurality of pre-established linked lists, each linked list corresponding to an index value, and each node of the linked list being used to store an industrial control policy; matching the industrial control policy to be stored with the industrial control policy in the storage linked list; if there is an industrial control policy in the storage linked list that matches the industrial control policy to be stored, discarding the industrial control policy to be stored; if there is no industrial control policy in the storage linked list that matches the industrial control policy to be stored, storing the industrial control policy to be stored in the storage linked list.

[0085] If there is no storage linked list corresponding to the index value of the industrial control strategy in the pre-established multiple linked lists, a linked list corresponding to the index value of the industrial control strategy to be stored is newly established, and the industrial control strategy to be stored is stored in the newly established linked list.

[0086] Exemplarily, before the industrial control policy is stored, a policy hash table array is pre-created and initialized, with the array index as the hash value, each array element contains a head pointer pointing to a policy linked list, and each node of the linked list is an industrial control policy.

[0087] When storing the policy, the function code, public address range, information address range, data type, and value field of the industrial control policy to be added are matched one by one with the function code, public address range, information address range, data type, and value field of all policies under the storage list. If there is a match, the policy is directly discarded. When the industrial control policy added by the administrator is to be stored, the index value corresponding to the industrial control policy to be stored is first obtained. If the index value of the industrial control policy to be stored does not exist in the array, a new linked list is created. The linked list corresponds to the index value of the industrial control policy to be stored. If there is an industrial control policy with the same index value, it is added to the newly created linked list. The linked list is bound to an initialization element in the array. The initialization element includes: the index value and the head pointer of the newly created linked list.

[0088] In the above embodiment, the policy storage and policy deduplication operations are completed. Since the comparison is based on an array, the hash value and the linked list address are stored in the array. In most cases, the comparison is based on the array elements and the hash value, which greatly reduces the policy storage time and deduplication time.

[0089] Example 2

[0090] See also Figure 2 Based on the above storage method, the embodiment of the present application provides a message matching method, including:

[0091] S201: Receive message:

[0092] S202: Obtain the maximum address and the minimum address in the message;

[0093] S203: Obtain the maximum address and the minimum address to obtain the address difference;

[0094] S204: performing a hash operation according to the address difference and the minimum address to obtain an index value of the message;

[0095] S205: Match the message according to the index value.

[0096] It should be noted that the method for generating the index value is the same as that in Example 1 and will not be repeated here.

[0097] In one possible implementation, S201 includes: determining a storage linked list corresponding to the index value of the message in a plurality of pre-established linked lists, each linked list corresponding to an index value, and each node of the linked list being used to store an industrial control policy; matching the message with the industrial control policy in the storage linked list; if there is an industrial control policy in the storage linked list that matches the message to be stored, executing a corresponding action on the industrial control policy; if there is no industrial control policy in the storage linked list that matches the message to be stored, releasing the message.

[0098] Exemplarily, S201 includes: receiving a message; establishing a connection according to the source IP, source port, destination IP, destination port and target client in the message; obtaining the first packet after the connection is established, the first packet including: port number, protocol feature field identification protocol. Identifying the message of the corresponding protocol according to the port number and protocol feature field.

[0099] Example 3

[0100] Lieutenant General Figure 3 , an embodiment of the present application provides an industrial control strategy storage device, including:

[0101] A policy acquisition module 31 is used to acquire the industrial control policy configured by the administrator;

[0102] A first address acquisition module 32, used to acquire the maximum address and the minimum address in the industrial control strategy;

[0103] A first address difference acquisition module 33, used to acquire an address difference according to a maximum address and a minimum address;

[0104] A first hash operation module 34 is used to perform a hash operation according to the address difference and the minimum address to obtain an index value of the industrial control strategy;

[0105] The storage module 35 is used to store the industrial control strategy according to the index value.

[0106] In a possible implementation, it is also used to generate a hash algorithm input value according to the address difference and the minimum address;

[0107] A hash operation is performed according to the input value of the hash algorithm to obtain the index value of the industrial control strategy.

[0108] In a possible implementation, the minimum address includes: the minimum common body address and the minimum information body address; the maximum address includes: the maximum common body address and the maximum information body address; the address difference includes: the common body address difference and the information body address difference; the address difference acquisition module 33 is further used to acquire the common body address difference according to the maximum common body address and the minimum common body address;

[0109] The information body address difference is obtained according to the maximum information body address and the minimum information body address; the address acquisition module 32 is also used to perform bitwise XOR operation on the function code of the industrial control strategy, the minimum common body address, the common body address difference, the minimum information body address, and the information body address difference to obtain the hash algorithm input value.

[0110] In a possible implementation manner, it is also used to convert a hash algorithm input value into integer data to obtain an integer hash input value;

[0111] The integer hash input value is processed according to the FNV-1a hash algorithm to obtain the index value of the industrial control policy.

[0112] In a possible implementation, the device further includes: a compression module, configured to compress the number of bits of the index value of the industrial control policy.

[0113] In a possible implementation, the compression module is further used to shift the index value of the industrial control strategy to the right by 16 bits to obtain a shifted index value;

[0114] Perform an AND operation on the index value of the industrial control strategy and the hexadecimal value 65535 to obtain the index value after the operation;

[0115] The shifted index value and the calculated index value are subjected to a bitwise XOR operation to obtain a compressed index value.

[0116] In a possible implementation, the storage module 35 is further used to determine a storage linked list corresponding to the index value of the industrial control strategy from a plurality of pre-established linked lists, each linked list corresponds to an index value, and each node of the linked list is used to store an industrial control strategy;

[0117] Matching the industrial control policy to be stored with the industrial control policy in the storage linked list;

[0118] If there is an industrial control policy matching the industrial control policy to be stored in the storage linked list, the industrial control policy to be stored is discarded;

[0119] If there is no industrial control policy matching the industrial control policy to be stored in the storage linked list, the industrial control policy to be stored is stored in the storage linked list.

[0120] Example 4

[0121] See also Figure 4 , an embodiment of the present application provides a message matching device, including:

[0122] Receiving module 41, used to receive messages

[0123] A second address acquisition module, used to acquire the maximum address and the minimum address in the message;

[0124] A second address difference acquisition module 42, used to acquire an address difference according to a maximum address and a minimum address;

[0125] A hash operation module 43, used for performing a hash operation according to the address difference and the minimum address to obtain an index value of the message;

[0126] The matching module 44 is used to match the message according to the index value.

[0127] This application also provides an electronic device, see Figure 5 , Figure 5 A block diagram of an electronic device provided in an embodiment of the present application. The electronic device may include a processor 51, a communication interface 52, a memory 55, and at least one communication bus 54. The communication bus 54 is used to realize direct connection and communication between these components. The communication interface 52 of the electronic device in the embodiment of the present application is used to communicate signaling or data with other node devices. The processor 51 may be an integrated circuit chip with signal processing capabilities.

[0128] The processor 51 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor 51 can also be any conventional processor, etc.

[0129] The memory 55 may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), etc. The memory 55 stores computer-readable instructions, and when the computer-readable instructions are executed by the processor 51, the electronic device may execute the various steps involved in the above method embodiment.

[0130] Optionally, the electronic device may further include a storage controller and an input / output unit.

[0131] The memory 55, storage controller, processor 51, peripheral interface, input and output unit components are directly or indirectly electrically connected to each other to achieve data transmission or interaction. For example, these components can be electrically connected to each other via one or more communication buses 54. The processor 51 is used to execute executable modules stored in the memory 55, such as software function modules or computer programs included in the electronic device.

[0132] The input and output unit is used to provide users with the task creation and to create an optional time period or preset execution time for the task to enable interaction between the user and the server. The input and output unit can be, but is not limited to, a mouse and a keyboard.

[0133] Understandably, Figure 5 The structure shown is for illustration only. The electronic device may also include Figure 5 More or fewer components as shown, or with Figure 5 Different configurations are shown. Figure 5 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0134] The embodiment of the present application also provides a computer-readable storage medium, on which instructions are stored. When the instructions are run on a computer, the method of the method embodiment is implemented when the computer program is executed by the processor. To avoid repetition, it will not be described here.

[0135] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and a part of the module, program segment or code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0136] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0137] If the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., and other media that can store program codes.

[0138] The above are only embodiments of the present application and are not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0139] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0140] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A method for storing industrial control strategies, characterized in that: include: Obtain industrial control strategies; Obtaining the maximum address and the minimum address in the industrial control strategy; Acquire an address difference according to the maximum address and the minimum address; Performing a hash operation based on the address difference and the minimum address to obtain an index value of the industrial control strategy; Storing the industrial control strategy according to the index value; The step of performing a hash operation according to the address difference and the minimum address to obtain the index value of the industrial control policy includes: Generate a hash algorithm input value according to the address difference and the minimum address; Performing a hash operation according to the hash algorithm input value to obtain an index value of the industrial control strategy; Wherein, the minimum address includes: the minimum common body address and the minimum information body address; the maximum address includes: the maximum common body address and the maximum information body address; the address difference includes: the common body address difference and the information body address difference; The step of obtaining the address difference according to the maximum address and the minimum address comprises: Acquire the public body address difference according to the maximum public body address and the minimum public body address; Acquire the information body address difference according to the maximum information body address and the minimum information body address; The step of generating a hash algorithm input value according to the address difference and the minimum address comprises: Performing a bitwise XOR operation on the function code of the industrial control strategy, the minimum common body address, the common body address difference, the minimum information body address, and the information body address difference to obtain the hash algorithm input value; Wherein, the step of storing the industrial control strategy according to the index value includes: Determine a storage linked list corresponding to the index value of the industrial control strategy from a plurality of pre-established linked lists, each of the linked lists corresponds to one index value, and each node of the linked list is used to store one industrial control strategy; Matching the industrial control strategy to be stored with the industrial control strategy in the storage linked list; If there is an industrial control policy matching the industrial control policy to be stored in the storage linked list, the industrial control policy to be stored is discarded; If there is no industrial control policy matching the industrial control policy to be stored in the storage linked list, the industrial control policy to be stored is stored in the storage linked list.

2. The industrial control strategy storage method according to claim 1, characterized in that: The step of performing a hash operation according to the hash algorithm input value to obtain the index value of the industrial control policy includes: Convert the hash algorithm input value into integer data to obtain an integer hash input value; The integer hash input value is processed according to the FNV-1a hash algorithm to obtain an index value of the industrial control policy.

3. The industrial control strategy storage method according to claim 2, characterized in that: The number of bits of the index value of the industrial control strategy is 32 bits; after the step of performing a hash operation according to the address difference and the minimum address to obtain the index value of the industrial control strategy, the step further includes: The number of bits of the index value of the industrial control strategy is compressed.

4. The industrial control strategy storage method according to claim 3, characterized in that: The step of compressing the number of bits of the index value of the industrial control strategy includes: Shift the index value of the industrial control strategy to the right by 16 bits to obtain a shifted index value; Perform an AND operation on the index value of the industrial control strategy and the hexadecimal value 65535 to obtain an index value after the operation; A bitwise XOR operation is performed on the shifted index value and the calculated index value to obtain a compressed index value.

5. A message matching method, characterized in that: include: Receive message: Obtaining the maximum address and the minimum address in the message; Acquire an address difference according to the maximum address and the minimum address; Performing a hash operation according to the address difference and the minimum address to obtain an index value of the message; Matching the message according to the index value; The step of matching the message according to the index value includes: Determine a storage linked list corresponding to the index value from a plurality of pre-established linked lists; each linked list corresponds to an index value, and each node of the linked list is used to store an industrial control strategy; Matching the message with the industrial control strategy in the storage linked list; wherein the industrial control strategy is stored according to the method of claim 1; If there is an industrial control strategy matching the message in the storage linked list, the industrial control strategy executes a corresponding action; If there is no industrial control policy matching the message in the storage linked list, the message is released.

6. An industrial control strategy storage device, characterized in that: include: The policy acquisition module is used to obtain the industrial control policies configured by the administrator; A first address acquisition module, used to acquire the maximum address and the minimum address in the industrial control strategy; A first address difference acquisition module, used for acquiring an address difference according to the maximum address and the minimum address; A first hash operation module, used for performing a hash operation according to the address difference and the minimum address to obtain an index value of the industrial control policy; A storage module, used for storing the industrial control strategy according to the index value; The first hash operation module is specifically used to generate a hash algorithm input value according to the address difference and the minimum address; perform a hash operation according to the hash algorithm input value to obtain an index value of the industrial control strategy; Wherein, the minimum address includes: the minimum common body address and the minimum information body address; the maximum address includes: the maximum common body address and the maximum information body address; the address difference includes: the common body address difference and the information body address difference; The first address difference acquisition module is specifically used to acquire the common body address difference according to the maximum common body address and the minimum common body address; acquire the information body address difference according to the maximum information body address and the minimum information body address; The first hash operation module is specifically used to perform a bitwise XOR operation on the function code of the industrial control strategy, the minimum common body address, the common body address difference, the minimum information body address, and the information body address difference to obtain the hash algorithm input value; Among them, the storage module is specifically used to determine a storage linked list corresponding to the index value of the industrial control strategy in a plurality of pre-established linked lists, each of the linked lists corresponds to one index value, and each node of the linked list is used to store an industrial control strategy; the industrial control strategy to be stored is matched with the industrial control strategy in the storage linked list; if there is an industrial control strategy in the storage linked list that matches the industrial control strategy to be stored, the industrial control strategy to be stored is discarded; if there is no industrial control strategy in the storage linked list that matches the industrial control strategy to be stored, the industrial control strategy to be stored is stored in the storage linked list.

7. A message matching device, characterized in that: include: A receiving module, used for receiving messages; A second address acquisition module acquires the maximum address and the minimum address in the message; A second address difference acquisition module, used for acquiring an address difference according to the maximum address and the minimum address; A second hash operation module, used for performing a hash operation according to the address difference and the minimum address to obtain an index value of the message; A matching module, used for matching the message according to the index value; Among them, the matching module is specifically used to determine the storage linked list corresponding to the index value in a plurality of pre-established linked lists; each linked list corresponds to an index value, and each node of the linked list is used to store an industrial control strategy; the message is matched with the industrial control strategy in the storage linked list; if there is an industrial control strategy matching the message in the storage linked list, the industrial control strategy executes the corresponding action; if there is no industrial control strategy matching the message in the storage linked list, the message is released; wherein, the industrial control strategy is stored by the industrial control strategy storage device described in claim 6.

8. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method according to any one of claims 1 to 5 when executing the computer program.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed on a computer, the computer is enabled to execute the method according to any one of claims 1 to 5.

Images