Safety protection method, device and equipment of programmable logic controller and medium

Abstract

The application is suitable for the technical field of industrial control, and provides a safety protection method, device, equipment and medium of a programmable logic controller, wherein the safety protection method of the programmable logic controller comprises the following steps: if target programmable logic controller obtains operation information, verifying the operation information according to authentication information pre-stored in a trusted execution environment, the trusted execution environment being established in the target programmable logic controller; when the operation information fails to pass the verification, not executing the operation information. The application can protect various attacks on the programmable logic controller, and improve the safety of the programmable logic controller.

Description

Technical Field

[0001] This application belongs to the field of industrial control technology, and in particular relates to a safety protection method, device, equipment and medium for a programmable logic controller. Background Technology

[0002] Programmable Logic Controllers (PLCs) are widely used embedded devices in industrial control environments, requiring real-time logic control of one or more I / O nodes. Errors in control or attacks can cause physical damage to industrial processes. Currently, attacks against PLCs can generally be categorized into three types: firmware modification attacks, configuration manipulation attacks, and control flow attacks. While defenses against these attacks can be implemented from different angles, all three types contain vulnerabilities that can be exploited by attackers, making programmable logic controllers relatively insecure. Summary of the Invention

[0003] This application provides a method, apparatus, device, and medium for the security protection of programmable logic controllers, which can solve the problem of poor security of programmable logic controllers in the prior art.

[0004] The first aspect of this application provides a security protection method for a programmable logic controller, including:

[0005] If the target programmable logic controller obtains the operation information, it verifies the operation information based on the authentication information pre-stored in the trusted execution environment, which is established in the target programmable logic controller.

[0006] If the operation information verification fails, the operation information will not be executed.

[0007] Optionally, the operation information includes receiving the replacement firmware, and the authentication information includes the target hash value of the target replacement firmware;

[0008] The step of not executing the operation information when the operation information verification fails includes:

[0009] If the hash value of the replacement firmware is different from the target hash value, the replacement firmware will not be received.

[0010] Optionally, the operation information includes modifying the configuration file, and the authentication information includes the target configuration file;

[0011] The step of not executing the operation information when the operation information verification fails includes:

[0012] If the configuration file is the same as the target configuration file, no modification to the configuration file will be performed.

[0013] Optionally, the operation information includes receiving execution logic, and the authentication information includes a security logic verification algorithm;

[0014] The step of not executing the operation information when the operation information verification fails includes:

[0015] If the execution logic is found to contain illegal logic according to the security logic verification algorithm, the execution logic will not be executed.

[0016] Optionally, the operation information includes the modification logic return address, and the authentication information includes the target logic return address;

[0017] The step of not executing the operation information when the operation information verification fails includes:

[0018] If the logical return address is the same as the target logical return address, the logical return address will not be modified.

[0019] Optionally, the operation information includes modifying the interrupt return main function address, and the authentication information includes the target interrupt return main function address;

[0020] The step of not executing the operation information when the operation information verification fails includes:

[0021] If the address of the interrupt return main function is the same as the address of the target interrupt return main function, the modification of the interrupt return main function address will not be performed.

[0022] Optionally, the operation information receives input / output interface data, and the authentication information includes a preset input / output interface data range;

[0023] The step of not executing the operation information when the operation information verification fails includes:

[0024] If the input / output interface data does not fall within the preset input / output interface data range, the receiving of the input / output interface data will not be performed.

[0025] A second aspect of this application provides a security protection device for a programmable logic controller, comprising:

[0026] An operation verification module is used to verify the operation information based on authentication information pre-stored in a trusted execution environment if the target programmable logic controller obtains the operation information. The trusted execution environment is established in the target programmable logic controller.

[0027] The operation rejection module is used to prevent the execution of the operation information when the operation information verification fails.

[0028] Optionally, the operation information includes receiving replacement firmware, and the authentication information includes a target hash value of the target replacement firmware; the operation rejection module is specifically used to not receive the replacement firmware when the hash value of the replacement firmware is different from the target hash value.

[0029] Optionally, the operation information includes modifying the configuration file, and the authentication information includes the target configuration file; the operation rejection module is specifically used to prevent modifying the configuration file when the configuration file is the same as the target configuration file.

[0030] Optionally, the operation information includes receiving execution logic, and the authentication information includes a security logic verification algorithm; the operation rejection module is specifically used to refuse to receive the execution logic when the execution logic is found to contain illegal logic according to the security logic verification algorithm.

[0031] Optionally, the operation information includes a modified logical return address, and the authentication information includes a target logical return address; the operation rejection module is specifically used to prevent the modification of the logical return address when the logical return address is the same as the target logical return address.

[0032] Optionally, the operation information includes modifying the interrupt return main function address, and the authentication information includes the target interrupt return main function address; the operation rejection module is specifically used to prevent modifying the interrupt return main function address when the interrupt return main function address is the same as the target interrupt return main function address.

[0033] Optionally, the operation information receives input / output interface data, and the authentication information includes a preset input / output interface data range; the operation rejection module is specifically used to prevent receiving the input / output interface data when the input / output interface data does not belong to the preset input / output interface data range.

[0034] A third aspect of this application provides a terminal device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the security protection method for a programmable logic controller as described above.

[0035] A fourth aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the security protection method for a programmable logic controller as described above.

[0036] The security protection method for a programmable logic controller provided in the first aspect of this application verifies the operation information based on authentication information pre-stored in a trusted execution environment when the target programmable logic controller obtains the operation information. If the operation information verification fails, the target programmable logic controller is prevented from executing the operation information. This method can protect against various attacks against the programmable logic controller and improve the security of the programmable logic controller.

[0037] It is understood that the beneficial effects of the second, third and fourth aspects mentioned above can be found in the relevant descriptions in the first aspect above, and will not be repeated here. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in the specific embodiments of this application or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0039] Figure 1 A flowchart illustrating the security protection method for a programmable logic controller provided in an embodiment of this application;

[0040] Figure 2 A schematic diagram of the structure of the safety protection device for the programmable logic controller provided in the embodiments of this application;

[0041] Figure 3 This is a schematic diagram of the structure of a terminal device provided in an embodiment of this application. Detailed Implementation

[0042] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, devices, circuits, and methods are omitted so as not to obscure the description of this application with unnecessary detail.

[0043] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0044] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0045] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0046] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0047] References to "one embodiment" or "some embodiments" in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized. "A plurality" means "two or more."

[0048] Example 1

[0049] Embodiment 1 of this application provides a security protection method for a programmable logic controller (PLC). This method can be executed by the processor of a terminal device when running a corresponding computer program. It is used to verify the operation information based on the authentication information pre-stored in a trusted execution environment when the target PLC obtains the operation information. If the operation information verification fails, the operation information is not executed, thereby improving the security of the PLC.

[0050] like Figure 1 As shown, the security protection method for a programmable logic controller provided in this embodiment includes:

[0051] S11. If the target programmable logic controller obtains the operation information, it verifies the operation information based on the authentication information pre-stored in the trusted execution environment. The trusted execution environment is established within the target programmable logic controller.

[0052] In applications, the aforementioned target programmable logic controller (PLC) can be loaded onto a real-time operating system to perform tasks in a predictable manner. The PLC can run runtime software responsible for compiling the control logic. The runtime software scans and stores the inputs from the I / O physical addresses in a memory variable table. Then, the control logic executes to produce corresponding outputs, and the runtime software returns these outputs to the corresponding I / O physical addresses for further execution of the control logic.

[0053] In applications, the target programmable logic controller (PLC) can adopt an ARM architecture, and the trusted execution environment (TEX) can be ARM's TrustZone. This provides a very small, isolated environment to protect critical system information. The trusted starting point originates from the root of trust during secure boot, such as using a secure ROM or an electronic fuse. The core of TrustZone lies in separating the secure world from the normal world through hardware means, specifically by adding an extra addressing bit to the chip. The secure world is the aforementioned TEX. Software in the normal world cannot access memory in the secure world; specific instructions are required to enter the secure world. Software within the secure world, however, can access all memory.

[0054] In application, the target programmable logic controller (PLC) can be divided into two phases based on whether it runs control logic: the communication and connection phase with the engineering software and the control logic execution phase. For the communication and connection phase, attacks against the target PLC mainly include firmware modification attacks and configuration operation attacks. For the logic execution phase, the main attacks are control flow attacks and interrupt-driven control system attacks. The operational information obtained by the target PLC can be used for firmware modification and configuration operation attacks during the communication and connection phase (such as modifying configuration files), control flow attacks during the logic execution phase (such as modifying logic return addresses), and interrupt-driven control system attacks.

[0055] In applications, the aforementioned authentication information can be related to the firmware, configuration, control flow, and interrupts of the target programmable logic controller (PLC), such as firmware hash values, configuration files, logic return addresses, and interrupt return main function addresses that need to be protected. By storing the PLC's authentication information in the trusted execution environment, attackers are unable to access or modify any authentication information within the trusted execution environment when the PLC receives attacks from external sources.

[0056] S12. If the operation information verification fails, the operation information is not executed.

[0057] In application, when the target programmable logic controller receives any of the above-mentioned operation information from the outside, it can verify the operation information according to the authentication information corresponding to the operation information stored in the trusted execution environment. The verification method may be to compare whether the operation object of the operation information is the same as the authentication information, or whether the operation object of the operation information is within the scope of the authentication information, or to check whether the operation object of the operation information is safe according to the authentication information. If the verification fails, the target programmable logic controller will not execute the operation information.

[0058] The security protection method for programmable logic controllers provided in this application verifies the operation information based on authentication information pre-stored in a trusted execution environment when the target programmable logic controller obtains the operation information. If the operation information verification fails, the target programmable logic controller is prevented from executing the operation information. This method can protect against various attacks against programmable logic controllers and improve the security of programmable logic controllers.

[0059] Example 2

[0060] Embodiment 2 of this application provides a security protection method for a programmable logic controller based on Embodiment 1, which can be executed by the processor of a terminal device when running a corresponding computer program.

[0061] In one embodiment, the operation information includes receiving replacement firmware, and the authentication information includes a target hash value of the target replacement firmware; step S12 includes: if the hash value of the replacement firmware is different from the target hash value, receiving the replacement firmware is not performed.

[0062] In applications, firmware modification attacks targeting the aforementioned programmable logic controllers (PLCs) primarily involve using maliciously modified, compromised firmware during updates. Therefore, an algorithm for remote secure authentication with the vendor can be maintained within the Trusted Execution Environment (TEE). After the vendor establishes a secure connection with the target PLC, it first stores the target hash value of the firmware to be replaced (i.e., the target replacement firmware) in the TEE via a secure API, and then transmits the replacement firmware to the target PLC. The firmware update function within the TEE requires verification of the new firmware's integrity; therefore, it uses a secure API to trap into the TEE for firmware hash verification. If the hash value of the replacement firmware transmitted to the target PLC differs from the target hash value stored in the TEE, the target PLC will not accept the replacement firmware.

[0063] In one embodiment, the operation information includes modifying the configuration file, and the authentication information includes the target configuration file; step S12 includes: when the configuration file is the same as the target configuration file, not modifying the configuration file.

[0064] In applications, configuration attacks targeting the aforementioned programmable logic controllers (PLCs) primarily involve introducing executable malicious code into the code or data areas of the PLC. Traditional protection methods involve executable space protection, restricting memory space to be writable or executable only; for example, the code area could only be executed, and the data area could only be written to. This application uses a trusted execution environment to maintain the configuration file (i.e., the target configuration file) of the PLC, making it impossible to modify even from a hardware perspective. The authentication information in the target configuration file, such as the hash value of the login password, prevents attackers from maliciously overwriting the original password through write operations, ensuring a trusted connection between the engineering software and the target PLC.

[0065] In one embodiment, the operation information includes receiving execution logic, and the authentication information includes a security logic verification algorithm; step S12 includes: when the execution logic is found to contain illegal logic according to the security logic verification algorithm, the receiving execution logic is not executed.

[0066] In applications, the target programmable logic controller (PLC) may require modifications to its control logic. Viruses may modify the engineering software configuration, causing even securely connected engineering software to inject malicious logic into the target PLC. Therefore, the trusted execution environment (TEA) can also store a security logic verification algorithm. When infected engineering software downloads malicious execution logic to the target PLC, the TEA can perform a logic check on the received execution logic. If the execution logic contains security violations—for example, attempting to maliciously enter the TEA to access secure memory or secure I / O using non-specified secure APIs, or exhibiting significant logic jumps—a warning is issued, and the target PLC will not execute the received execution logic.

[0067] In one embodiment, the operation information includes modifying the logical return address, and the authentication information includes the target logical return address; step S12 includes: when the logical return address is the same as the target logical return address, the modification of the logical return address is not performed.

[0068] In applications, control flow attacks targeting the aforementioned programmable logic controllers (PLCs) typically employ executable code within the PLC itself. By exploiting vulnerabilities such as stack overflows, the return address of indirect call or other branch statements—the target logic's return address—is overwritten, thus modifying the logic's return address and redirecting the original control flow to the attacker's designated address, forming a Return-Oriented Programming (ROP) attack. The traditional solution is called Control Flow Integrity Check (CFI), which can be divided into forward and backward checks. Backward checks primarily employ two methods: one uses a canary, adding a flag before the return address; if this flag is altered, a ROP attack has occurred. The other method involves instrumentation, copying the return address to a secure shadow stack for protection; upon return, the change in the return address is compared to verify the absence of an attack.

[0069] In applications, since canaries and shadow stacks need to be stored in secure memory, previous methods often used memory management techniques to prevent the main program from accessing secure memory. This application uses a trusted execution environment (TEA) for protection, achieving hardware-level memory inaccessibility. Because the programmable logic controller (PLC) is a hard real-time system, directly redirecting all indirect calls to the TEA using commands like BL or SVC would inevitably introduce excessive system overhead, thus affecting the system's real-time performance. Therefore, a dynamic strategy can be adopted. Since each task of the PLC has its corresponding deadline, the CFI check determines whether to perform the check and what type of check to use based on the difference between the predicted task completion time and the corresponding deadline. That is, when the expected task completion time differs significantly from the deadline, the more expensive shadow stack approach can be used, while when the expected task completion time is similar to the deadline, the less expensive canary approach can be used.

[0070] In applications, since the logic of a programmable logic controller (PLC) executes periodically, the predicted task completion time can be obtained by observing each task in a learning mode. Therefore, the entire system is divided into two phases: a learning phase and a protection phase. During the learning phase, each task is monitored to obtain its expected completion time. To ensure real-time performance, the longest completion time for each task during the learning phase can be used as the expected completion time strategy. In the protection phase, the CFI (Continuous Functional Immunity) strategy is selected based on the expected completion time obtained during the learning phase.

[0071] In one embodiment, the operation information includes modifying the interrupt return main function address, and the authentication information includes the target interrupt return main function address; step S12 includes: when the interrupt return main function address is the same as the target interrupt return main function address, the interrupt return main function address is not modified.

[0072] In the application, the interrupts of the target programmable logic controller include interrupts caused by high-priority tasks of internal execution logic and external I / O interrupts. This application adds a custom vector before all interrupt vectors. Before entering the normal interrupt handler, the interrupt can be captured by the catcher set in the trusted execution environment. The check function in the trusted execution environment will first perform a security check, including checking whether the interrupt return main function address is the same as the target interrupt return main function address. This ensures that the interrupt handler function is not subject to address overwriting attacks when returning to the main function.

[0073] In applications, high-priority tasks within the target programmable logic controller (PLC) may be unable to execute due to low-priority tasks occupying computational or storage resources. These resources are set by the low-priority tasks to be released upon completion, leading to priority inversion. In this application, interruptions caused by high-priority tasks enter the aforementioned trusted execution environment. Therefore, a high-privilege instruction can be maintained within this trusted execution environment. When a priority inversion problem occurs, the resources occupied by the low-priority task are forcibly released, and the low-priority task is re-run after the high-priority task completes.

[0074] In one embodiment, the operation information receives input / output interface data, and the authentication information includes a preset input / output interface data range; step S12 includes: when the input / output interface data does not belong to the preset input / output interface data range, the receiving of the input / output interface data is not performed.

[0075] In applications, attackers may modify sensor data, causing errors in the data read by the target programmable logic controller's (PLC) I / O interface. This can affect the PLC's internal logic control and ultimately lead to physical damage to the output actuator. Therefore, an I / O monitor can be maintained within the trusted execution environment. During the learning phase, it learns the normal input range for I / O at each task stage, i.e., the preset input / output interface data range. During the protection phase, the input / output interface data received by the target PLC is compared with this preset range to determine if an attack has occurred.

[0076] In applications, dynamic watermarking technology can be used to encrypt sensor data. A watermark verification algorithm is maintained within the trusted execution environment to statistically verify the input / output interface data received by the target programmable logic controller (PLC) to determine if the I / O data has been maliciously modified. Both of these methods introduce significant overhead, potentially impacting the system's real-time requirements. Furthermore, since a PLC can connect to and control thousands of I / O nodes, comparing each node's performance at each moment, or calculating watermark verification for each node, would incur enormous overhead and could even cause system crashes. Therefore, an asynchronous processing approach can be adopted, focusing on real-time recording rather than real-time checking, especially for anomaly detection algorithms like watermark verification. I / O values ​​are only recorded in a security log maintained within the trusted execution environment. Operators can view the security log at any time via a security API. When the system is idle, the security log is reviewed, and an alert is triggered if frequent or consecutive I / O value errors are detected.

[0077] The security protection method for programmable logic controllers provided in this application embodiment stores various authentication information in a trusted execution environment, verifies various operation information received by the target programmable logic controller based on the authentication information, and does not execute the operation information when the verification fails. This method can protect against various attacks against programmable logic controllers, has a wide range of protection, and improves the security of programmable logic controllers.

[0078] Example 3

[0079] like Figure 2 As shown, this embodiment also provides a security protection device for a programmable logic controller (PLC). The security protection device 200 for the PLC includes:

[0080] The operation verification module 201 is used to verify the operation information based on the authentication information pre-stored in the trusted execution environment if the target programmable logic controller obtains the operation information. The trusted execution environment is established in the target programmable logic controller.

[0081] The operation rejection module 202 is used to prevent the execution of the operation information when the operation information verification fails.

[0082] In one embodiment, the operation information includes receiving replacement firmware, and the authentication information includes a target hash value of the target replacement firmware; the operation rejection module is specifically configured to not receive the replacement firmware when the hash value of the replacement firmware is different from the target hash value.

[0083] In one embodiment, the operation information includes modifying a configuration file, and the authentication information includes a target configuration file; the operation rejection module is specifically used to prevent modifying the configuration file when the configuration file is the same as the target configuration file.

[0084] In one embodiment, the operation information includes receiving execution logic, and the authentication information includes a security logic verification algorithm; the operation rejection module is specifically used to refuse to execute receiving the execution logic when the execution logic is found to contain illegal logic according to the security logic verification algorithm.

[0085] In one embodiment, the operation information includes a modified logical return address, and the authentication information includes a target logical return address; the operation rejection module is specifically used to prevent the modification of the logical return address when the logical return address is the same as the target logical return address.

[0086] In one embodiment, the operation information includes modifying the interrupt return main function address, and the authentication information includes the target interrupt return main function address; the operation rejection module is specifically used to prevent modifying the interrupt return main function address when the interrupt return main function address is the same as the target interrupt return main function address.

[0087] In one embodiment, the operation information receives input / output interface data, and the authentication information includes a preset input / output interface data range; the operation rejection module is specifically used to prevent receiving the input / output interface data when the input / output interface data does not belong to the preset input / output interface data range.

[0088] It should be noted that the information interaction and execution process between the above modules / units are based on the same concept as the method embodiments of this application. For details on their specific functions and technical effects, please refer to the method embodiments section, and they will not be repeated here.

[0089] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0090] This application also provides a terminal device 300, such as... Figure 3 As shown, it includes a memory 301, a processor 302, and a computer program 303 stored in the memory 301 and executable on the processor 302. When the processor 302 executes the computer program 303, it implements the steps of the security protection method for the programmable logic controller provided in the first aspect.

[0091] In applications, terminal devices may include, but are not limited to, processors and memory. Figure 3 This is merely an example of a terminal device and does not constitute a limitation on the terminal device. It may include more or fewer components than illustrated, or a combination of certain components, or different components, such as input / output devices, network access devices, etc. Input / output devices may include cameras, audio capture / playback devices, displays, etc. Network access devices may include network modules for wireless network communication with external devices.

[0092] In applications, the processor can be a Central Processing Unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0093] In applications, the memory may be an internal storage unit of the terminal device in some embodiments, such as the hard drive or RAM of the terminal device. In other embodiments, the memory may be an external storage device of the terminal device, such as a plug-in hard drive, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card. The memory may also include both internal and external storage units of the terminal device. The memory is used to store the operating system, applications, boot loader, data, and other programs, such as the program code of computer programs. The memory can also be used to temporarily store data that has been output or will be output.

[0094] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, can implement the steps in the above-described method embodiments.

[0095] This application implements all or part of the processes in the methods of the above embodiments, which can be accomplished by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable file, or some intermediate form. The computer-readable medium can include at least: any entity or device capable of carrying the computer program code to a terminal device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium, such as a USB flash drive, a portable hard drive, a magnetic disk, or an optical disk.

[0096] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0097] Those skilled in the art will recognize that the device and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0098] In the embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interface, or the device may be indirectly coupled or communicated, and may be electrical, mechanical, or other forms.

[0099] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A security protection method for a programmable logic controller, characterized in that, include: If the target programmable logic controller (PLC) obtains the operation information, it verifies the operation information based on the authentication information pre-stored in the trusted execution environment (TEX). The TEX is established within the PLC and is separated by adding an extra address bit to the PLC chip. The target PLC uses an ARM architecture, and the TEX is ARM's TrustZone. The PLC executes tasks in a predictable manner, and each task of the PLC has its corresponding deadline. If the operation information verification fails, the operation information will not be executed; The method further includes: when the difference between the expected completion time and the deadline exceeds a threshold, a shadow stack is used; when the difference between the expected completion time and the deadline does not exceed the threshold, a canary stack is used. The canary stack and shadow stack are backward checking methods in control flow integrity checks, and the overhead of the shadow stack is greater than that of the canary stack. The expected completion time is obtained by observing each task in the system using a learning mode, including: monitoring each task and using the longest completion time of each task as the expected completion time.

2. The security protection method for a programmable logic controller as described in claim 1, characterized in that, The operation information includes receiving the replacement firmware, and the authentication information includes the target hash value of the target replacement firmware. The step of not executing the operation information when the operation information verification fails includes: If the hash value of the replacement firmware is different from the target hash value, the replacement firmware will not be received.

3. The security protection method for a programmable logic controller as described in claim 1, characterized in that, The operation information includes modifying the configuration file, and the authentication information includes the target configuration file; The step of not executing the operation information when the operation information verification fails includes: If the configuration file is the same as the target configuration file, no modification to the configuration file will be performed.

4. The security protection method for a programmable logic controller as described in claim 1, characterized in that, The operation information includes receiving execution logic, and the authentication information includes a security logic verification algorithm; The step of not executing the operation information when the operation information verification fails includes: If the execution logic is found to contain illegal logic according to the security logic verification algorithm, the execution logic will not be executed.

5. The security protection method for a programmable logic controller as described in claim 1, characterized in that, The operation information includes the modification logic return address, and the authentication information includes the target logic return address; The step of not executing the operation information when the operation information verification fails includes: If the logical return address is the same as the target logical return address, the logical return address will not be modified.

6. The security protection method for a programmable logic controller as described in claim 1, characterized in that, The operation information includes modifying the interrupt return main function address, and the authentication information includes the target interrupt return main function address; The step of not executing the operation information when the operation information verification fails includes: If the address of the interrupt return main function is the same as the address of the target interrupt return main function, the modification of the interrupt return main function address will not be performed.

7. The security protection method for a programmable logic controller as described in claim 1, characterized in that, The operation information receives input / output interface data, and the authentication information includes a preset input / output interface data range; The step of not executing the operation information when the operation information verification fails includes: If the input / output interface data does not fall within the preset input / output interface data range, the receiving of the input / output interface data will not be performed.

8. A safety protection device for a programmable logic controller, characterized in that, include: An operation verification module is used to verify the operation information obtained by the target programmable logic controller (PLC) based on authentication information pre-stored in a trusted execution environment. The trusted execution environment is established in the target PLC and is separated by adding an extra address bit to the chip of the PLC. The target PLC adopts an ARM architecture, the trusted execution environment is ARM's TrustZone, the PLC executes tasks in a predictable manner, and each task of the PLC has its corresponding deadline. An operation rejection module is used to prevent the execution of the operation information when the operation information verification fails. The device is further configured to: use a shadow stack when the difference between the expected completion time and the deadline exceeds a threshold, and use a canary stack when the difference between the expected completion time and the deadline does not exceed the threshold, wherein the canary stack and the shadow stack are backward checking methods in control flow integrity checks, and the overhead of the shadow stack is greater than the overhead of the canary stack; the expected completion time of the task is obtained by observing each task in the system through a learning mode, including: monitoring each task and using the longest completion time of each task as the expected completion time of the task.

9. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the security protection method for the programmable logic controller as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the security protection method for the programmable logic controller as described in any one of claims 1 to 7.

Images