A security protection method, system and device based on deep analysis of OPCUA protocol

Abstract

The application relates to a security protection method, system and equipment based on deep analysis of an OPCUA protocol, and the method comprises the following steps: obtaining an application data packet, the application data packet comprising an information type and a data packet size; judging whether the information type is correct according to a preset session judgment rule and the information type; if yes, judging whether the data packet size is equal to a preset size preset value; if the data packet size is equal to the preset size preset value, establishing a communication session; if not, intercepting the application data packet and outputting first alarm information. The application improves the problem of security loopholes of equipment when the equipment communicates by using the OPCUA protocol, and has the effect of intercepting abnormal data packets when the equipment communicates by using the OPCUA protocol.

Description

Technical Field

[0001] This application relates to the technical field of industrial control network security, and in particular to a security protection method, system and device based on deep parsing of the OPCUA protocol. Background Technology

[0002] OPCUA (OLE for Process Control Unified Architecture) is a next-generation OPC technology proposed by the OPC Foundation. Compared to the traditional OPC protocol, OPCUA does not require the configuration of DCOM distributed objects, but achieves flexible and convenient data transmission through a unified interface framework.

[0003] OPCUA communication can be divided into encrypted communication and unencrypted communication. Encrypted communication involves certificate exchange and authentication, and communication transmission is achieved using encrypted communication methods. Unencrypted communication does not have an identity authentication process and cannot negotiate keys, so unencrypted communication data is transmitted in plaintext.

[0004] Currently, the overall security of OPCUA communication mainly relies on certificate authentication, data encryption, and user access control. However, security vulnerabilities still exist: it cannot cope with DoS attacks targeting OPCUA server resources, leading to server resource exhaustion and inability to provide normal services; it cannot cope with abnormal message attacks targeting the OPCUA server protocol stack, leading to abnormal server operation.

[0005] There is a security vulnerability when devices use OPCUA for communication. Summary of the Invention

[0006] To address the security vulnerabilities that arise when using OPCUA communication, this application provides a security protection method, system, and device based on deep parsing of the OPCUA protocol.

[0007] In a first aspect of this application, a security protection method based on deep parsing of the OPCUA protocol is provided. This method is applied to the OPCUA protocol and includes:

[0008] Obtain the application data packet, which includes information type and data packet size;

[0009] Based on the preset session judgment rules and the information type, determine whether the information type is correct;

[0010] If so, determine whether the size of the data packet is equal to a preset size value;

[0011] If the size of the data packet is equal to a preset size value, then a communication session is established;

[0012] If not, the application data packet is intercepted and a first alarm message is output.

[0013] As can be seen from the above technical solutions, by acquiring application data packets and judging the information type and size of the application data packets according to the session judgment rules, the application data packets will be intercepted when they do not conform to the rules. This reduces the security vulnerabilities caused to the device by receiving non-compliant application data packets and improves the security vulnerability problem when using OPCUA communication to a certain extent.

[0014] In one possible implementation, determining whether the information type is correct based on preset session judgment rules and the information type includes:

[0015] The information types include HEL, ACK, OPN, MSG, and CLO;

[0016] The sequential order of the information types is HEL, ACK, OPN, MSG, and CLO;

[0017] The information type is correct when the order of the information types in the application data packet is the same as the sequential sequence.

[0018] In one possible implementation, the method further includes:

[0019] When the information type is OPN, obtain the security header information of the application data packet;

[0020] The security header information includes data authentication information, encryption policy information, and security certificate information;

[0021] The application data packet is parsed according to the preset data parsing rules and the security header information.

[0022] In one possible implementation, the method further includes:

[0023] The application data packet includes request data packets and response data packets;

[0024] Obtain the sequence code data of the application data packet, wherein the sequence code data includes the data packet sequence number and the data packet counter code;

[0025] When the data packet count code is discontinuous, a packet loss warning message is output;

[0026] When the sequence number of the request packet and the sequence number of the response packet are different, a server error message is output.

[0027] In one possible implementation, the method further includes:

[0028] When the information type is MSG, the application data packet includes a function code;

[0029] Determine whether the function code is in a preset whitelist;

[0030] If not, the application data packet is intercepted and a second alarm message is output.

[0031] In one possible implementation, the application data packet includes one or more data points and operation function codes and attribute information corresponding to the data points;

[0032] Based on the operation function code, the attribute information, the whitelist, and the preset operation judgment rules, determine in sequence whether the data point is in the whitelist;

[0033] If not, the data points are intercepted and a third alarm message is output.

[0034] In one possible implementation, the method further includes a method for determining the whitelist:

[0035] Get study time;

[0036] During the learning period, learning data packets are acquired, and these learning data packets are not intercepted.

[0037] Based on the learning data packet, obtain the target parameters corresponding to the learning data packet;

[0038] Based on the target parameters and whitelist determination rules, a whitelist to be confirmed is generated;

[0039] Obtain user instructions;

[0040] The whitelist is determined based on the user instructions and the whitelist to be confirmed.

[0041] In a second aspect of this application, a security protection system based on deep parsing of the OPCUA protocol is provided. The system includes:

[0042] The data acquisition module is used to acquire application data packets, which include information type and data packet size;

[0043] The first judgment module is used to determine whether the information type is correct based on the preset session judgment rules and the information type.

[0044] The second judgment module is used to determine whether the size of the data packet is equal to a preset size preset value when the information type is correct.

[0045] The session establishment module is used to establish a communication session when the size of the data packet is equal to a preset size value;

[0046] An alarm output module is used to intercept the application data packet and output a first alarm message when the information type is incorrect.

[0047] In a third aspect of this application, an electronic device is provided. The electronic device includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the program to implement the method described above.

[0048] In a fourth aspect of this application, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the method according to the first aspect of this application.

[0049] In summary, this application includes at least one of the following beneficial technical effects:

[0050] 1. Based on the session judgment rules, the information type and size of the obtained application data packets are judged. When the application data packet does not conform to the rules, the application data packet will be blocked, reducing the corresponding security vulnerabilities caused to the device by receiving non-compliant application data packets, and improving the security vulnerability problem when using OPCUA communication to a certain extent. Attached Figure Description

[0051] Figure 1 This is a flowchart illustrating the security protection method based on deep parsing of the OPCUA protocol provided in this application.

[0052] Figure 2 This is a schematic diagram of the security protection system based on deep parsing of the OPCUA protocol provided in this application.

[0053] Figure 3 This is a schematic diagram of the structure of the electronic device provided in this application.

[0054] In the diagram, 200 is a security protection system based on deep parsing of the OPCUA protocol; 201 is a data acquisition module; 202 is a first judgment module; 203 is a second judgment module; 204 is a session establishment module; 205 is an alarm output module; 301 is a CPU; 302 is a ROM; 303 is a RAM; 304 is an I / O interface; 305 is an input section; 306 is an output section; 307 is a storage section; 308 is a communication section; 309 is a driver; and 310 is a removable medium. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0056] Furthermore, the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article, unless otherwise specified, generally indicates that the preceding and following related objects have an "or" relationship.

[0057] The embodiments of this application will now be described in further detail with reference to the accompanying drawings.

[0058] This application provides a security protection method based on deep parsing of the OPCUA protocol. The main process of the above method is described as follows.

[0059] like Figure 1 As shown:

[0060] Step S101: Obtain the application data package.

[0061] Specifically, application data packets include two types: request data packets (sent by the client) and response data packets (sent by the server in response to the client's request data packets). Both types of application data packets include information type, data packet size, sequence number data, and function code. The information types include HEL, ACK, OPN, MSG, and CLO. The sequential sequence of these information types is HEL, ACK, OPN, MSG, and CLO. The sequence number data includes a data packet sequence number and a data packet counter. The data packet counter is counted independently for request and response data packets. By determining the continuity of the data packet counters sent by the client and server, the network status can be detected. The data packet sequence number identifies the client's request data packet. In this embodiment, the data packet sequence number is RequestId, and the data packet counter is SequenceNumber.

[0062] Step S102: Intercept application data packets according to preset session judgment rules, information type and data packet size.

[0063] Specifically, based on the preset session judgment rules and the above information type, it is determined whether the above information type is correct. If it is correct, it is determined whether the above data packet size is equal to the preset size value. If it is not equal, it indicates that the application data packet has been lost, and a packet loss alarm message is output. If it is equal, it indicates that the information type of the application data packet is normal and there is no packet loss, and a communication session is established according to the communication establishment rules. If it is incorrect, the above application data packet is intercepted and the first alarm message is output.

[0064] In this embodiment, firstly, the client's transport layer sends a HEL message as the first data packet of the session; the server's transport layer responds with an ACK message based on the received HEL message; the client's secure channel layer sends an OPN message to prepare to start the session; the server's secure channel layer responds with an OPN message based on the client's OPN message; the client sends an MSG message to transmit OPCUA protocol service data; the server responds with an MSG message to transmit OPCUA protocol service data; when it is necessary to close the session, the client's secure channel layer sends a CLO message to close the OPCUA session. The above process is the entire process of establishing and closing a communication session, meaning that the establishment of a communication session must be performed according to the information type data of HEL, ACK, OPN, MSG, and CLO.

[0065] In one example, the client's transport layer sends a HEL message, and the server sends an OPN message. If the information type of the OPN message sent by the server is incorrect, the OPN message will be intercepted and the first alarm message will be output.

[0066] During the process of establishing a communication session according to the communication establishment rules:

[0067] When the aforementioned information type is OPN, the security header information of the application data packet is obtained. This security header information includes data authentication information, encryption policy information, and security certificate information. The application data packet is then parsed based on this security header information and preset data parsing rules. Parsing application data packets based on data authentication information, encryption policy information, and security certificate information is a well-known technique among those skilled in the art and will not be elaborated upon here. In this embodiment, the security header information obtained is the security policy string `SecurityPolicyUri`. Based on this security policy string, the data authentication and encryption policies used during communication are determined. Based on the security certificates and other information on both the client and server sides, encrypted messages can be parsed and their content analyzed.

[0068] When the aforementioned information type is MSG, the aforementioned application data packet includes a function code; it is determined whether the aforementioned function code is within a preset whitelist; if the aforementioned function code is not within the preset whitelist, the aforementioned application data packet is intercepted and a second alarm message is output. The aforementioned whitelist includes a function code whitelist. In this embodiment, the content of the MSG message is obtained, the function code is extracted, compared with the function code whitelist, and according to the allowed status configured for the corresponding function code in the function code whitelist, for function code data that is not allowed to be allowed, the corresponding application data packet is intercepted and a second alarm message is output.

[0069] The sequence number data of the application data packets is obtained. When the sequence number of the data packets is not continuous, a packet loss warning message is output. When the sequence number of the request data packet and the sequence number of the response data packet are different, a server exception message is output. In this embodiment, when there are discontinuous SequenceNumbers, a network instability application layer packet loss alarm, i.e., a packet loss warning message, is generated. For example, if a data packet contains 10 data packets with SequenceNumbers from 1 to 10, the data packets should be received in the order of 1 to 10. If the data packet with sequence number 5 is received, and then the data packet with sequence number 7 is received directly, then there are discontinuous SequenceNumbers. RequestId is the sequence number that identifies the client's request data packet. The RequestId of the response data packet sent by the server is the same as the RequestId in the request data packet sent by the client. By detecting the RequestId of the request data packet and the response data packet, the content of the request data packet and the response data packet can be effectively associated. If the request data packet does not receive a response, it indicates that the server is abnormal, and an alarm log for server abnormal service, i.e., server exception information, can be generated.

[0070] The aforementioned application data package includes one or more data points and the corresponding operation function codes and attribute information for the aforementioned data points; the aforementioned whitelist also includes a data point whitelist, an operation attribute whitelist, a standard data point value range whitelist, a calling method whitelist, a calling method parameter whitelist, and a baseline whitelist.

[0071] Based on the above operation function code, the above attribute information, the above whitelist and the preset operation judgment rules, it is determined in turn whether the above data point is in the above whitelist. If not, the above data point is intercepted and a third alarm message is output. If yes, the above data point is received.

[0072] Unlike other industrial protocols where data point reading and writing only refer to data values, OPCUA data points have various attributes. Read and write operations are operations on specific attributes of the data point. For example, when the attribute ID of a read operation for a data point is 14, it indicates that the data type of the data point is being read. When the attribute ID of a read and write operation for a data point is 13, it indicates that the Value attribute of the data point is being read and written.

[0073] For each data point, extract the operation function code and attribute information, determine whether the attribute operation corresponding to the attribute information is within the operation attribute whitelist, and for attributes not on the operation attribute whitelist, intercept the above application data packets and output the third alarm information.

[0074] For each data point in a read request operation, extract its basic information, including its address type, namespace, and address.

[0075] For data points in read response operations, associate them with the read requests mentioned above, analyze the return values ​​of each attribute of the data point, and compare them with the baseline whitelist. The baseline whitelist includes the fixed attributes of the data points and the attribute values ​​corresponding to the fixed attributes. For fixed attributes such as the DisplayName attribute, determine whether the attribute value of the fixed attribute has changed. If it has changed, output the third alarm information.

[0076] For data points that are read from the data value list, the system acquires the data value and a raw value detection flag. If the raw value detection flag is positive, a raw value check is required. The system directly determines whether the data value falls within the specified limits of the standard data point value range whitelist. If it does not fall within these limits, the data point is intercepted and a third alarm message is output. If the raw value detection flag is negative, an actual value check is required. The data value is then substituted into the actual value calculation formula: Actual Value = Raw Value * Coefficient + Offset. In this formula, the raw value is the data value. The system checks whether the actual value falls within the specified limits of the standard data point value range whitelist. If it does not meet these limits, the data point is intercepted and a third alarm message is output. The coefficient and offset differ for different business types in the actual value calculation formula. These coefficients and offsets are preset by staff based on the specific business type.

[0077] For a data point that is a write request operation, extract the address type, namespace, and address of the data point, determine whether the data point is in the data point whitelist, and for operations that are not in the data point whitelist, intercept the data point and output the third alarm information;

[0078] If the data point for the write request operation is in the data point whitelist, then extract the attribute information of that data point and determine whether the attribute information of the data point for the write request operation is in the operation attribute whitelist. For operations not in the operation attribute whitelist, intercept the data point and output a third alarm message. If the operation attribute is in the whitelist, determine whether it is a write data point value attribute operation. For write value attribute operations, extract the specific data value to be written, and determine whether it is in the standard data point value range whitelist based on the data type. For those that do not conform to the standard data point value range whitelist, intercept the data point and output a third alarm message.

[0079] For data points in the read historical data request operation, extract the address type, namespace, and address of the data point, and determine whether the data point is in the data point whitelist. For operations not in the data point whitelist, intercept the data point and output the third alarm information. For data points in the data point whitelist, determine whether the read historical data request Value attribute exists in the operation attribute whitelist. For data points that do not exist, intercept the data point and output the third alarm information.

[0080] For each data point in the "Create Monitoring Data Point Request" operation, extract the address type, namespace, and address of the data point corresponding to the "Create Monitoring Data Point Request" operation. Determine if the data point is in the data point whitelist. For operations not in the data point whitelist, intercept the data point and output a third alarm message. For data points in the data point whitelist, check if the "Create Monitoring Data Point Request Value" attribute exists in the operation attribute whitelist. For data points that do not exist, intercept the data point and output a third alarm message.

[0081] For each data point in a call request operation, extract the class address type, class namespace, class address, method address type, method namespace, and method address of the corresponding call request method. Confirm whether the call request method is in the call method whitelist. If it is not in the whitelist, intercept the data point and output a third alarm message. If it is in the call method whitelist, extract the call parameter information of the call method, including data type and data value. Determine whether the call parameter information is in the call method parameter whitelist. If it does not conform to the safe call value range of the call method parameter whitelist, intercept the data point and output a third alarm message.

[0082] Security protection methods based on deep parsing of the OPCUA protocol also include the methods for determining the whitelist mentioned above:

[0083] Obtain the learning time; within the learning time, obtain the learning data packet without intercepting it; based on the obtained learning data packet, obtain the target parameter corresponding to the learning data packet; based on the target parameter and the whitelist determination rule, generate a whitelist to be confirmed; obtain user instructions; based on the user instructions and the whitelist to be confirmed, determine the whitelist.

[0084] Specifically, a learning mode can be set on the device. This mode indicates that all received data packets will not be intercepted. A learning period can also be set; during this period, received data packets will not be intercepted. Then, the device obtains the attributes corresponding to the data packets, including function codes, data points, operation attributes, value ranges, calling methods, and calling method parameters. Based on these different attributes, different whitelists (pending confirmation whitelists) are created. These pending confirmation whitelists are sent to the user. The user modifies or confirms these whitelists, and the device receives the corresponding user command. Based on the user command and the pending confirmation whitelists, the device determines the final whitelist. This final whitelist serves as the basis for intercepting data packets.

[0085] Security protection methods based on deep analysis of the OPCUA protocol also include methods for identifying aging devices:

[0086] Acquire normal data and aging data; determine the equipment aging data model based on the preset model determination rules, the above normal data and the above aging data; acquire the data to be identified, and output a prompt message when the above data to be identified is input into the above equipment aging data model.

[0087] Specifically, the aforementioned normal data refers to data generated by non-aging equipment under normal operating conditions, the aforementioned aging data refers to data generated by aging equipment under operating conditions, and the data to be identified represents data generated by equipment under operating conditions that needs to be identified as aging. The aforementioned equipment aging data model includes data point names, data units, normal range values, and aging range values. When the aforementioned data to be identified is input into the equipment aging data model, the corresponding aging range value is obtained based on the data point name of the data to be identified. It is then determined whether the data value of the data to be identified is within the aging range value. If it is, an equipment aging warning, i.e., a prompt message and an aging alarm log, is output. The prompt message is used to remind the administrator to inspect and replace the equipment, which can reduce production line stoppages caused by equipment aging, improve production efficiency, and also reduce production accidents caused by equipment aging. In this embodiment, normal data and aging data for different types of equipment are obtained separately, and the maximum and minimum values ​​of normal data and aging data for each type of equipment are obtained. The average of the maximum and minimum values ​​for the same type of equipment is then taken, and the corresponding average is the normal range value or aging range value. The above process constitutes the model determination rule. In other implementations, the model determination rules may also be other methods that can confirm the data model of device aging, such as neural network model training, and are not limited here.

[0088] This application provides a security protection system 200 based on deep parsing of the OPCUA protocol, referring to... Figure 2 The security protection system 200 based on deep parsing of the OPCUA protocol includes:

[0089] Data acquisition module 201 is used to acquire application data packets, the application data packets including information type and data packet size;

[0090] The first judgment module 202 is used to determine whether the information type is correct based on the preset session judgment rules and the information type.

[0091] The second judgment module 203 is used to determine whether the size of the data packet is equal to a preset size preset value when the information type is correct.

[0092] Session establishment module 204 is used to establish a communication session when the size of the data packet is equal to a preset size value;

[0093] The alarm output module 205 is used to intercept the application data packet and output the first alarm information when the information type is incorrect.

[0094] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the described module can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0095] This application discloses an electronic device. (Refer to...) Figure 3 The electronic device includes a central processing unit (CPU) 301, which can perform various appropriate actions and processes based on a program stored in a read-only memory (ROM) 302 or a program loaded from a storage section 307 into a random access memory (RAM) 303. The RAM 303 also stores various programs and data required for system operation. The CPU 301, ROM 302, and RAM 303 are interconnected via a bus. An input / output (I / O) interface 304 is also connected to the bus.

[0096] The following components are connected to I / O interface 304: an input section 305 including a keyboard, mouse, etc.; an output section 306 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 307 including a hard disk, etc.; and a communication section 308 including a network interface card such as a LAN card, modem, etc. The communication section 308 performs communication processing via a network such as the Internet. A drive 309 is also connected to I / O interface 304 as needed. A removable medium 310, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 309 as needed so that computer programs read from it can be installed into storage section 307 as needed.

[0097] Specifically, according to embodiments of this application, the flowchart above refers to... Figure 1 The described process can be implemented as a computer software program. For example, embodiments of this application include a computer program product comprising a computer program carried on a machine-readable medium, the computer program containing program code for performing the methods shown in the flowchart. In such embodiments, the computer program can be downloaded and installed from a network via communication section 308, and / or installed from removable medium 310. When the computer program is executed by central processing unit (CPU) 301, it performs the functions defined in the apparatus of this application.

[0098] It should be noted that the computer-readable medium shown in this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0099] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the foregoing application concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions claimed in this application.

Claims

1. A security protection method based on deep parsing of the OPCUA protocol, characterized in that, Applied to the OPCUA protocol, including: Obtain the application data packet, which includes information type and data packet size; Based on the preset session judgment rules and the information type, determine whether the information type is correct; If so, determine whether the size of the data packet is equal to a preset size value; If the size of the data packet is equal to a preset size value, then a communication session is established; If not, the application data packet is intercepted and a first alarm message is output; The step of determining whether the information type is correct based on the preset session judgment rules and the information type includes: the information type includes HEL, ACK, OPN, MSG, and CLO; the order sequence of the information types is HEL, ACK, OPN, MSG, and CLO; when the order of the information types in the application data packet is the same as the order sequence, the information type is correct. When the information type is MSG, the application data packet includes a function code; determine whether the function code is in a preset whitelist; if not, intercept the application data packet and output a second alarm message; The application data package includes one or more data points and operation function codes and attribute information corresponding to the data points; based on the operation function codes, the attribute information, the whitelist and the preset operation judgment rules, it is sequentially determined whether the data point is in the whitelist, the whitelist includes a data point whitelist, an operation attribute whitelist, a standard data point value range whitelist, a calling method whitelist, a calling method parameter whitelist and a baseline whitelist; If not, the data points are intercepted and a third alarm message is output.

2. The security protection method based on deep parsing of the OPCUA protocol according to claim 1, characterized in that, The method also includes: When the information type is OPN, obtain the security header information of the application data packet; The security header information includes data authentication information, encryption policy information, and security certificate information; The application data packet is parsed according to the preset data parsing rules and the security header information.

3. The security protection method based on deep parsing of the OPCUA protocol according to claim 1, characterized in that, The method also includes: The application data packet includes request data packets and response data packets; Obtain the sequence code data of the application data packet, wherein the sequence code data includes the data packet sequence number and the data packet counter code; When the data packet count code is discontinuous, a packet loss warning message is output; When the sequence number of the request packet and the sequence number of the response packet are different, a server error message is output.

4. The security protection method based on deep parsing of the OPCUA protocol according to claim 1, characterized in that, The method also includes a method for determining the whitelist: Get study time; During the learning period, learning data packets are acquired, and these learning data packets are not intercepted. Based on the learning data packet, obtain the target parameters corresponding to the learning data packet; Based on the target parameters and whitelist determination rules, a whitelist to be confirmed is generated; Obtain user instructions; The whitelist is determined based on the user instructions and the whitelist to be confirmed.

5. A security protection system based on deep parsing of the OPCUA protocol, characterized in that, Applied to the OPCUA protocol, including: The data acquisition module (201) is used to acquire application data packets, the application data packets including information type and data packet size; The first judgment module (202) is used to determine whether the information type is correct according to the preset session judgment rules and the information type; The second judgment module (203) is used to determine whether the size of the data packet is equal to a preset size preset value when the information type is correct. The session establishment module (204) is used to establish a communication session when the size of the data packet is equal to a preset size value; An alarm output module (205) is used to intercept the application data packet and output a first alarm message when the information type is incorrect. The step of determining whether the information type is correct based on the preset session judgment rules and the information type includes: the information type includes HEL, ACK, OPN, MSG, and CLO; the order sequence of the information types is HEL, ACK, OPN, MSG, and CLO; when the order of the information types in the application data packet is the same as the order sequence, the information type is correct. When the information type is MSG, the application data packet includes a function code; determine whether the function code is in a preset whitelist; if not, intercept the application data packet and output a second alarm message; The application data package includes one or more data points and operation function codes and attribute information corresponding to the data points; based on the operation function codes, the attribute information, the whitelist and the preset operation judgment rules, it is sequentially determined whether the data point is in the whitelist, the whitelist includes a data point whitelist, an operation attribute whitelist, a standard data point value range whitelist, a calling method whitelist, a calling method parameter whitelist and a baseline whitelist; If not, the data points are intercepted and a third alarm message is output.

6. An electronic device, characterized in that, It includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the program to implement the method as described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the method as described in any one of claims 1 to 4.

Images