A vulnerability assessment and verification method and system for IEC 104 protocol

Abstract

The present application discloses a vulnerability assessment and verification method and system for the IEC 104 protocol. The method first scans and detects devices that support the IEC 104 protocol in the network; secondly, simulates the master station sending a general call command to blast the public address; then, determines the remote control type of the device through remote control blasting; then, sends preset instructions to the remote control address in turn to obtain the correspondence between the remote control and telesignaling addresses; finally, uses the acquired information to construct a specific data packet to simulate attacks or control of remote substation equipment to verify the vulnerability of the protocol. The present application aims to discover and exploit potential vulnerabilities in the protocol, thereby evaluating and improving the security of the system. By implementing this method, the security risks of the IEC 104 protocol in practical applications can be effectively identified, providing a strong guarantee for the safe and stable operation of the power system.

Description

Technical Field

[0001] The present invention relates to the technical field of electric power monitoring, and in particular to a vulnerability assessment and verification method and system for IEC 104 protocol. Background Art

[0002] With the widespread application of information and communication technology in power monitoring systems, the risk of power monitoring systems being attacked by cyber attacks continues to increase. The IEC60870-5-104 (IEC 104 for short) protocol is widely used in the power industry for communication between master stations and substations to achieve the transmission of telemetry and telesignaling data and the issuance of remote control and remote adjustment instructions. The IEC 60870-5-104 protocol itself lacks effective identity authentication and access control. When the network is accessible, the protocol can be used to remotely control remote devices and gain control of the entire plant. At the same time, the protocol involves many assets in the power monitoring system. Once the loopholes are exploited, the losses caused are immeasurable.

[0003] For example, viruses such as Industroyer discovered in 2017 used the industrial communication protocol of IEC 60870-104 to issue commands to the telecontrol system. They have the ability to launch network attacks through IEC60870-5-104 and cause large-scale power outages. The threat is real.

[0004] COSMICENERGY, a malware discovered in December 2021, interacts with IEC 60870-104 devices (such as remote terminal units RTUs), allowing attackers to send remote commands to affect the activation of power line switches and circuit breakers, causing power outages.

[0005] In April 2022, a variant of the Industroyer malware, Industroyer2, was discovered. Unlike its predecessor, Industroyer2 is an independent executable file consisting of a backdoor, a loader, and several payload modules. It can disrupt the operation of transmission substations through the IEC60870-5-104 protocol, causing power outages.

[0006] In many attack and defense exercises of power monitoring systems in recent years, it was found that many power industrial control equipment had protocol loopholes. Among them, the protocol loophole in IEC60870-5-104 protocol involves many substation assets. Once the protocol loophole is exploited, the impact on assets is huge and the losses caused are immeasurable.

[0007] Although the IEC60870-5-104 protocol has been widely used in power monitoring systems, the protocol itself is designed mainly for business needs. It usually only emphasizes the real-time and availability of communication, and generally does not take security into consideration. It lacks consideration of security aspects such as the availability, integrity and confidentiality of messages, resulting in the following vulnerabilities:

[0008] 1) Lack of authentication mechanism: Since the IEC60870-5-104 protocol has no authentication mechanism and lacks message integrity verification, attackers can impersonate legitimate addresses or legitimate identities to establish illegal communication sessions and then send malicious control commands to the device, thereby interfering with and destroying the operation of the power monitoring system, or even completely controlling the entire monitoring system.

[0009] 2) Lack of authorization mechanism: The IEC60870-5-104 protocol lacks an access control mechanism for users and does not restrict the operation permissions of each user. Attackers can impersonate legitimate users to perform various operations, leading to attacks.

[0010] 3) Information is transmitted in plain text: IEC60870-5-104 messages are transmitted in plain text. When an attacker breaks through the physical isolation and enters the intranet, it will cause two risks. First, the business information such as telemetry, telesignaling, remote control, and remote adjustment can be completely eavesdropped. Second, after intercepting the message, the attacker can parse and tamper with it, and then re-inject it into the communication link to send illegal instructions to the underlying physical equipment, resulting in serious consequences. Summary of the invention

[0011] Based on this, the embodiment of the present application provides a vulnerability assessment and verification method and system for the IEC 104 protocol. By constructing a dedicated protocol data packet, it automatically detects and discovers the devices that support the IEC60870-5-104 protocol in the network, obtains information about the IEC 104 protocol devices, and sorts out the relevant attack surfaces, thereby realizing vulnerability assessment and verification for the IEC 104 protocol.

[0012] In a first aspect, a vulnerability assessment and verification method for IEC 104 protocol is provided, the method comprising:

[0013] S1, scan the target address, identify the device that supports the IEC60870-5-104 protocol, and record the device's IP address list and open ports;

[0014] S2, traverse the public address range specified by the IEC104 protocol, for each address, send a general call command and check the response, if the response is as expected, save the public address as a valid address, repeat this process until all addresses are tested;

[0015] S3, performing remote control mode blasting according to the saved valid address, and confirming the remote control mode of the device corresponding to the valid address according to the response; wherein the remote control mode includes single-point remote control and dual-point remote control;

[0016] S4, according to the determined remote control mode, sending a preset instruction to the target address, and establishing a corresponding relationship between the remote control address and the remote signaling address according to the returned remote signaling value;

[0017] S5, constructs a data packet based on the information obtained in S1 to S4, sends the data packet to the target device, performs switch-level operations to monitor the response and state changes of the device, and verifies the vulnerability of the IEC 104 protocol.

[0018] Optionally, S1 scans the target address, identifies devices supporting the IEC60870-5-104 protocol, and records the IP address list and open ports of the devices, and also includes: sending a request packet to the target address according to the IP address range and port number to obtain a list of devices supporting the IEC 104 protocol.

[0019] Optionally, S3 performs remote control blasting on the saved valid address, specifically including:

[0020] Send the preset flip command of the dual-point remote control in sequence for the saved valid addresses; when a confirmation response is received, send the preset cancellation command and mark the device corresponding to the current valid address as a dual-point remote control; if the dual-point remote control fails, try to send the preset flip command of the single-point remote control; based on the response, confirm the remote control method of the device.

[0021] When all remote control methods fail, the blasting is deemed to have failed.

[0022] Optionally, in S4, a corresponding relationship between the remote control address and the remote signaling address is established according to the returned remote signaling value, including:

[0023] If the preset fails, check whether all remote control addresses have been tried; if not, continue to use the next remote control address; if the preset is successful, send the remote control execution command and wait for the telesignal value to be returned; according to the returned telesignal value, establish the corresponding relationship between the remote control address and the telesignal address; repeat this process until all remote control addresses are tested or all telesignal addresses have corresponding remote control addresses.

[0024] Optionally, S5, constructing a data packet based on the information obtained in S1 to S4, including:

[0025] A data packet constructed based on a list of IP addresses, open ports, public addresses, remote control methods, remote control addresses, and remote signaling addresses.

[0026] Optionally, performing switch-level operations in S5 to monitor the response and state change of the device includes:

[0027] Send data packets to the target device to perform opening, closing, and state flipping operations; monitor the device's response and state changes to verify the vulnerability of the protocol.

[0028] In a second aspect, a vulnerability assessment and verification system for IEC 104 protocol is provided, the system comprising:

[0029] Scanning and detection module, used to scan the target address, identify the device that supports IEC60870-5-104 protocol, and record the IP address list and open port of the device;

[0030] The address blasting module is used to traverse the public address range specified by the IEC104 protocol. For each address, a general call command is sent and the response is checked. If the response is as expected, the public address is saved as a valid address. This process is repeated until all addresses are tested.

[0031] The remote control blasting module performs remote control blasting according to the saved valid address, and confirms the remote control mode of the device corresponding to the valid address according to the response; wherein the remote control mode includes single-point remote control and dual-point remote control;

[0032] The remote control address blasting module sends a preset instruction to the target address according to the determined remote control mode, and establishes the corresponding relationship between the remote control address and the remote signaling address according to the returned remote signaling value;

[0033] The device control module constructs a data packet based on the information obtained in S1 to S4, sends the data packet to the target device, and performs switch-level operations to monitor the response and state changes of the device to verify the vulnerability of the IEC 104 protocol.

[0034] In a third aspect, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the vulnerability assessment and verification method for the IEC 104 protocol described in any one of the first aspects is implemented.

[0035] In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the vulnerability assessment and verification method for the IEC 104 protocol described in any one of the first aspects is implemented.

[0036] In a fifth aspect, a computer program product is provided, including a computer program / instruction, which, when executed by a processor, implements the vulnerability assessment and verification method for the IEC 104 protocol as described in any one of the first aspects above.

[0037] The technical solution provided by the embodiment of the present application first scans the target address, identifies the device that supports the IEC60870-5-104 protocol, and records the IP address list and open port of the device. Then, according to the setting, a general call is sent to the default public address to see whether the telesignal value can be obtained. If the telesignal value is successfully obtained, it means that the public address is correct; otherwise, the public address will be cracked until the public address is successfully obtained. On the basis of obtaining the public address, the remote control method is further obtained. By sending preset instructions for dual-point remote control and single-point remote control to the device, the specific remote control method can be determined according to the return result. On the basis of obtaining the remote control method. Next, the system will crack the remote control address according to the remote control method to obtain the remote control address of each switch. Through the above steps, the system successfully realizes the acquisition of information such as the IP address, port, public address, telesignaling method, remote control method, remote control address, etc. of the IEC104 protocol device. On this basis, by constructing a specific data packet to simulate attacks or control of remote substation equipment in view of the vulnerability of the IEC104 protocol, the vulnerability of the protocol can be effectively verified. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the implementation methods of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the implementation methods or the description of the prior art. Obviously, the drawings in the following description are only exemplary, and for ordinary technicians in this field, other implementation drawings can be derived from the provided drawings without creative work.

[0039] Figure 1 A flowchart of a vulnerability assessment and verification method for the IEC 104 protocol provided in an embodiment of the present application;

[0040] Figure 2 An overall execution example diagram of the IEC60870-5-104 protocol simulation attack provided for an optional embodiment of the present application;

[0041] Figure 3 A block diagram of a vulnerability assessment and verification system for IEC 104 protocol provided in an embodiment of the present application;

[0042] Figure 4 A schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0044] In the description of the present invention, the terms "comprises", "has" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may also include other steps or units that are not explicitly listed but are inherent to these processes, methods, products or apparatuses, or steps or units added based on further optimization schemes conceived by the present invention.

[0045] This application proposes a rapid and comprehensive assessment method for the attack surface of the IEC60870-5-104 protocol. The core is to automatically detect and discover the devices that support the IEC60870-5-104 protocol in the network by constructing dedicated protocol data packets, and to obtain information such as the IP address, port, public address, remote signaling method, remote control method, and remote control address of the IEC104 protocol device, and sort out the relevant attack surface.

[0046] At the same time, this paper automatically verifies the vulnerability of the IEC60870-5-104 protocol. By constructing specific data packets and remotely controlling remote devices through the protocol, the device can be opened, closed, and state flipped, etc., to verify the vulnerability of the protocol.

[0047] Please refer to Figure 1 , which shows a flowchart of a vulnerability assessment and verification method for the IEC 104 protocol provided in an embodiment of the present application. The method may include the following steps:

[0048] S1, scan the target address, identify the devices that support the IEC60870-5-104 protocol, and record the IP address list and open ports of the devices.

[0049] In this step, scanning detection is implemented. Specifically, through large-scale detection of network addresses, devices that support the IEC60870-5-104 protocol in the network are automatically discovered and located. The detected information includes the device IP address list, open ports, etc.

[0050] S2, traverse the public address range specified by the IEC104 protocol, for each address, send a general call command and check the response, if the response is as expected, save the public address as a valid address, and repeat this process until all addresses are tested.

[0051] In this step, public address blasting is realized. According to the public address range (1-65535) specified by the IEC104 protocol, the master station will be simulated to send a general call command, and all public addresses will be automatically blasted. If the blasting is successful, the public address will be saved. Then, the system will send a general call command to the next public address until all addresses within the remote control range have been acquired.

[0052] Among them, "simulated master station" refers to the use of a simulated master station system to simulate the behavior of a real master station during the test or verification process. The master station is usually a central system used to monitor and control various stations in the power system. The "general call command" is a specific type of command in the IEC 104 protocol. It is used to request the slave station to send a complete report of its current status or configuration information. This usually includes the measurement values, control status, setting parameters, etc. of the slave station. By sending the general call command, the master station can obtain the latest information from the slave station, thereby realizing real-time monitoring and management of the entire power system.

[0053] In S2, the system simulates the master sending a general call command according to the public address range specified by the IEC 104 protocol. This means that the test system simulates the behavior of the master station and sends a general call command to all possible public addresses to see which addresses are active slaves and collect status information of these slaves. This is a common test method used to verify the connectivity and configuration correctness of the system.

[0054] S3, based on the saved valid address, perform remote control mode blasting, and confirm the remote control mode of the device corresponding to the valid address based on the response.

[0055] Among them, the remote control methods include single-point remote control and dual-point remote control.

[0056] In this step, remote control blasting is implemented. Remote control refers to the method used to operate and control remote equipment in a remote monitoring and control system. These methods mainly include single-point remote control and dual-point remote control. Considering the actual environment, there may be a single-point remote signal corresponding to dual-point remote control, a single-point remote signal corresponding to a single-point remote control, and a dual-point remote signal corresponding to a dual-point remote control. The preset flip command of the dual-point remote control can be sent to the target address in sequence. If the operation is successful, a preset cancellation command is sent to confirm that the device is a dual-point remote control. Otherwise, the preset flip command of the single-point remote control is sent to the addresses within the blasting range in sequence. If the operation is successful, a preset cancellation command is sent to confirm that the device is a single-point remote control. If both are unsuccessful, the blasting is judged to have failed.

[0057] S4, according to the determined remote control mode, a preset instruction is sent to the target address, and according to the returned remote signal value, a corresponding relationship between the remote control address and the remote signal address is established.

[0058] In this step, the remote control address blasting is realized. Specifically, based on the remote control mode obtained in the previous step, preset instructions are sent to the remote control address range in sequence. If the preset fails, check whether all remote control addresses are blasted. If not all have been tried, use the next default remote control address, otherwise the operation ends. If the preset is successful, send the remote control execution instruction, and obtain the correspondence between the remote control address and the remote signal address through the returned remote signal value. Then determine whether all default remote control addresses have been tried. If there is a remote control address that does not correspond to the remote signal address or the remote control address has not been blasted, use the next default remote control address, otherwise the operation ends.

[0059] Among them, the "remote control address" refers to the address used to identify and control a specific function point of a remote device or system. In the power system, these function points may include the opening or closing of a switch, the up and down gears of a transformer, etc. By sending commands to a specific remote control address, the master station can achieve precise control of the remote device. The remote control address is usually defined in the IEC 104 protocol as a specific identifier used to uniquely identify and control a specific device or function during the communication process.

[0060] "Telesignaling address" refers to the address used to identify the status information point of the remote device or system. This status information may include the switch status, fault indication, measurement value, etc. of the device. By reading the information on the telesignaling address, the master station can understand the operating status of the remote device and the overall situation of the power system in real time. The telesignaling address is also clearly defined in the IEC 104 protocol and is used to identify and transmit the status information of the device during the communication process.

[0061] In S4, by sending preset instructions to the remote control address range and obtaining the correspondence between the remote control address and the remote signaling address based on the returned remote signaling value, precise control and status monitoring of the remote device can be achieved. This step is an important part of verifying the vulnerability of the IEC 104 protocol. By simulating attacks or control operations, the security and reliability of the protocol in actual applications can be evaluated.

[0062] S5, constructs a data packet based on the information obtained in S1 to S4, sends the data packet to the target device, performs switch-level operations to monitor the response and state changes of the device, and verifies the vulnerability of the IEC 104 protocol.

[0063] Through the above steps, the system successfully achieved the acquisition of the IEC104 protocol attack surface, that is, the IP address, port, public address, telesignaling method, remote control method, remote control address and other information of the IEC104 protocol device, which is the basis for realizing device control.

[0064] In view of the vulnerability of the IEC104 protocol, by constructing specific data packets, switch-level opening, closing, state flipping and other operations can be performed on the remote substation, thereby simulating attacks or control on the remote substation equipment, which can effectively verify the vulnerability of the protocol.

[0065] like Figure 2 The overall execution example diagram of the simulated attack is given. The overall execution process of the protocol simulation attack is as follows: First, according to the IP address range and port number, a request packet is sent to the target to obtain a list of devices that support the IEC104 protocol. Next, according to the settings, a general call is sent to the default public address to see if the telesignaling value can be obtained. If the telesignaling value is successfully obtained, it means that the public address is correct; otherwise, a blasting attempt will be made to the public address until the public address is successfully obtained. On the basis of obtaining the public address, the remote control method is further obtained. By sending preset instructions for dual-point remote control and single-point remote control to the device, the specific remote control method can be determined according to the return result. On the basis of obtaining the remote control method. Next, the system will blast the remote control address according to the remote control method to obtain the remote control address of each switch. Through the above steps, the system successfully realizes the acquisition of information such as the IP address, port, public address, telesignaling method, remote control method, and remote control address of the IEC104 protocol device. On this basis, by constructing specific data packets to simulate attacks or control remote substation equipment in view of the vulnerability of the IEC104 protocol, the vulnerability of the protocol can be effectively verified.

[0066] From the above, it can be seen that national-level network security counterattacks are more professional and customized, and are more inclined to exploit protocol vulnerabilities to launch business-level attacks. Through this system, the equipment involved in the IEC 104 protocol in the target network can be automatically discovered, the attack surface of the protocol can be quickly and comprehensively evaluated, and simulated attacks can be carried out to achieve controllable IEC 104 protocol vulnerability verification. This method not only improves the ability to identify potential security risks, but also provides security managers with detailed IEC 104 protocol attack surface data support, assisting in timely convergence of the attack surface, thereby improving the overall security level in the fields of power, automation, etc.

[0067] Please refer to Figure 3 , which shows a block diagram of a vulnerability assessment and verification system for IEC 104 protocol provided by an embodiment of the present application. Figure 3 As shown, the system may include:

[0068] Scanning and detection module, used to scan the target address, identify the device that supports IEC60870-5-104 protocol, and record the IP address list and open port of the device;

[0069] The address blasting module is used to traverse the public address range specified by the IEC104 protocol. For each address, a general call command is sent and the response is checked. If the response is as expected, the public address is saved as a valid address. This process is repeated until all addresses are tested.

[0070] The remote control blasting module performs remote control blasting according to the saved valid address, and confirms the remote control mode of the device corresponding to the valid address according to the response; wherein the remote control mode includes single-point remote control and dual-point remote control;

[0071] The remote control address blasting module sends a preset instruction to the target address according to the determined remote control mode, and establishes the corresponding relationship between the remote control address and the remote signaling address according to the returned remote signaling value;

[0072] The device control module constructs a data packet based on the information obtained in S1 to S4, sends the data packet to the target device, and performs switch-level operations to monitor the response and state changes of the device to verify the vulnerability of the IEC 104 protocol.

[0073] For the specific definition of the vulnerability assessment and verification system for the IEC 104 protocol, please refer to the definition of the vulnerability assessment and verification method for the IEC 104 protocol above, which will not be repeated here. Each module in the above-mentioned vulnerability assessment and verification system for the IEC 104 protocol can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0074] In one embodiment, an electronic device is provided. The electronic device may be a computer, and its internal structure diagram may be as follows: Figure 4 As shown. The electronic device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the device is used to provide computing and control capabilities. The memory of the device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used for vulnerability assessment verification data for the IEC104 protocol. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a vulnerability assessment verification method for the IEC 104 protocol is implemented.

[0075] Those skilled in the art will understand that Figure 4The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0076] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, which involves all or part of the processes in the above-mentioned embodiment method.

[0077] In one embodiment, a computer program product is also provided, including a computer program / instruction, which involves all or part of the process in the above embodiment method.

[0078] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing related hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in M ​​forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (SyMchliMk) DRAM (SLDRAM), memory bus (RaMbus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0079] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0080] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be construed as limiting the scope of the patent application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent application shall be subject to the attached claims.

Claims

1. A vulnerability assessment and verification method for IEC 104 protocol, characterized in that: The method comprises: S1, scan the target address, identify the device that supports the IEC60870-5-104 protocol, and record the device's IP address list and open ports; S2, traverse the public address range specified by the IEC104 protocol, for each address, send a general call command and check the response, if the response is as expected, save the public address as a valid address, repeat this process until all addresses are tested; S3, performing remote control mode blasting according to the saved valid address, and confirming the remote control mode of the device corresponding to the valid address according to the response; wherein the remote control mode includes single-point remote control and dual-point remote control; S4, according to the determined remote control mode, sending a preset instruction to the target address, and establishing a corresponding relationship between the remote control address and the remote signaling address according to the returned remote signaling value; S5, constructing a data packet based on the information obtained in S1 to S4, sending the data packet to the target device, performing switch-level operations, and monitoring the response and state changes of the device to verify the vulnerability of the IEC 104 protocol; S3, remotely blast the saved valid addresses, including: Send the preset flip command of the dual-point remote control to the saved valid addresses in sequence; when receiving a confirmation response, send the preset cancellation command and mark the device corresponding to the current valid address as dual-point remote control; if the dual-point remote control fails, try to send the preset flip command of the single-point remote control; according to the response, confirm the remote control method of the device; among them, when all remote control methods fail, it is determined that the blasting has failed; In S4, the corresponding relationship between the remote control address and the remote signaling address is established according to the returned remote signaling value, including: If the preset fails, check whether all remote control addresses have been tried; if not, continue to use the next remote control address; if the preset is successful, send the remote control execution command and wait for the telesignal value to be returned; according to the returned telesignal value, establish the corresponding relationship between the remote control address and the telesignal address; repeat this process until all remote control addresses are tested or all telesignal addresses have corresponding remote control addresses.

2. The vulnerability assessment verification method according to claim 1, characterized in that: S1, scans the target address, identifies the device that supports the IEC60870-5-104 protocol, and records the device's IP address list and open ports, including: According to the IP address range and port number, a request packet is sent to the target address to obtain a list of devices supporting the IEC 104 protocol.

3. The vulnerability assessment verification method according to claim 1, characterized in that: S5, constructing a data packet based on the information obtained in S1 to S4, including: A data packet constructed based on a list of IP addresses, open ports, public addresses, remote control methods, remote control addresses, and remote signaling addresses.

4. The vulnerability assessment verification method according to claim 1, characterized in that: S5 performs switch-level operations to monitor device responses and status changes, including: Send data packets to the target device to perform opening, closing, and state flipping operations; monitor the device's response and state changes to verify the vulnerability of the protocol.

5. A vulnerability assessment and verification system for IEC 104 protocol, characterized in that: The system comprises: Scanning and detection module, used to scan the target address, identify the device that supports IEC60870-5-104 protocol, and record the IP address list and open port of the device; The address blasting module is used to traverse the public address range specified by the IEC104 protocol. For each address, a general call command is sent and the response is checked. If the response is as expected, the public address is saved as a valid address. This process is repeated until all addresses are tested. The remote control blasting module performs remote control blasting according to the saved valid address, and confirms the remote control mode of the device corresponding to the valid address according to the response; wherein the remote control mode includes single-point remote control and dual-point remote control; The remote control address blasting module sends a preset instruction to the target address according to the determined remote control mode, and establishes the corresponding relationship between the remote control address and the remote signaling address according to the returned remote signaling value; The device control module constructs a data packet based on the information obtained, sends the data packet to the target device, and performs switch-level operations to monitor the device's response and state changes to verify the vulnerability of the IEC 104 protocol; For the saved valid addresses, remote blasting is performed, including: Send the preset flip command of the dual-point remote control to the saved valid addresses in sequence; when receiving a confirmation response, send the preset cancellation command and mark the device corresponding to the current valid address as dual-point remote control; if the dual-point remote control fails, try to send the preset flip command of the single-point remote control; according to the response, confirm the remote control method of the device; among them, when all remote control methods fail, it is determined that the blasting has failed; According to the returned remote signal value, the corresponding relationship between the remote control address and the remote signal address is established, including: If the preset fails, check whether all remote control addresses have been tried; if not, continue to use the next remote control address; if the preset is successful, send the remote control execution command and wait for the telesignal value to be returned; according to the returned telesignal value, establish the corresponding relationship between the remote control address and the telesignal address; repeat this process until all remote control addresses are tested or all telesignal addresses have corresponding remote control addresses.

6. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of the method according to any one of claims 1 to 4 are implemented.

7. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

8. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images