PLC safety assessment method, device and equipment and storage medium

Abstract

The embodiment of the invention discloses a PLC safety assessment method and device, equipment and a storage medium, and the method comprises the steps: obtaining to-be-detected information of a target PLC; wherein the to-be-detected information is parameter information for performing safety evaluation on the target PLC; for each to-be-detected hierarchy, according to the to-be-detected information of the target PLC, determining a plurality of hierarchy evaluation results corresponding to the to-be-detected hierarchy; wherein the to-be-detected hierarchy comprises at least one of a network layer, an application layer, a device layer and a host layer; and determining a target safety assessment result corresponding to the target PLC according to the hierarchy assessment results corresponding to the plurality of to-be-detected hierarchies. According to the technical scheme, the problems that in an existing PLC safety detection technology, safety protection of a single level is often concerned, and the safety evaluation effect is poor are solved, safety verification can be comprehensively carried out on the PLC from the perspective of multiple levels, various potential safety threats are effectively recognized, and the overall safety protection capacity of a PLC system is remarkably improved.

Description

Technical Field

[0001] Embodiments of the present invention relate to the technical field of controller safety management, and in particular to a PLC safety assessment method, device, equipment and storage medium. Background Art

[0002] In the field of modern industrial automation, programmable logic controllers (PLCs) are core control devices that undertake key industrial process management and equipment control tasks. With the advancement of Industry 4.0 and the popularization of intelligent manufacturing, the functions of PLC systems are becoming increasingly complex, and their application scope is constantly expanding, covering multiple fields. However, the networking and intelligence of PLC systems have brought unprecedented security challenges. The network security threats of PLC systems mainly come from multiple levels such as communication protocols, firmware security, applications and operating systems.

[0003] There are currently some security detection tools and technologies for PLC systems, but these solutions often focus on a single level of security protection and are unable to provide a comprehensive and integrated security assessment. This one-sided security assessment method cannot effectively respond to complex security threats, nor can it meet the needs of modern industrial environments for high-level security assurance. Summary of the invention

[0004] The embodiments of the present invention provide a PLC security assessment method, device, equipment and storage medium, which can comprehensively verify the security of PLC from multiple levels, effectively identify various potential security threats, and significantly improve the overall security protection capability of the PLC system.

[0005] In a first aspect, an embodiment of the present invention provides a PLC safety assessment method, the method comprising:

[0006] Obtain information to be detected of a target PLC; wherein the information to be detected is parameter information based on which a security assessment of the target PLC is performed; for each level to be detected, determine multiple level assessment results corresponding to the levels to be detected based on the information to be detected of the target PLC; wherein the levels to be detected include: at least one of a network layer, an application layer, a device layer, and a host layer; determine a target security assessment result corresponding to the target PLC based on the level assessment results corresponding to the multiple levels to be detected.

[0007] In a second aspect, an embodiment of the present invention provides a PLC safety assessment device, the device comprising:

[0008] A module for acquiring information to be detected, used for acquiring information to be detected of a target PLC; wherein the information to be detected is parameter information based on which a security assessment of the target PLC is performed; a layer assessment module, used for determining, for each layer to be detected, layer assessment results corresponding to multiple layers to be detected according to the information to be detected of the target PLC; wherein the layers to be detected include: at least one of a network layer, an application layer, a device layer and a host layer; a security assessment determination module, used for determining a target security assessment result corresponding to the target PLC according to the layer assessment results corresponding to multiple layers to be detected.

[0009] In a third aspect, an embodiment of the present invention provides a computer device, the computer device comprising:

[0010] one or more processors;

[0011] A memory for storing one or more programs;

[0012] When the one or more programs are executed by the one or more processors, the one or more processors implement the PLC safety assessment method described in any embodiment.

[0013] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the PLC safety assessment method described in any embodiment.

[0014] The technical solution provided by the embodiment of the present invention obtains the information to be detected of the target PLC; wherein the information to be detected is parameter information based on which the security assessment of the target PLC is performed; for each level to be detected, according to the information to be detected of the target PLC, a plurality of level assessment results corresponding to the levels to be detected are determined; wherein the levels to be detected include: at least one of the network layer, the application layer, the device layer and the host layer; according to the level assessment results corresponding to the plurality of levels to be detected, the target security assessment result corresponding to the target PLC is determined. The technical solution of the embodiment of the present invention solves the problem that the existing PLC security detection technology often focuses on the security protection of a single level and has poor security assessment effect. It can comprehensively verify the security of the PLC from the perspective of multiple levels, effectively identify various potential security threats, and significantly improve the overall security protection capability of the PLC system. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 is a flow chart of a PLC safety assessment method provided by an embodiment of the present invention;

[0016] Figure 2 It is a flow chart of another PLC safety assessment method provided by an embodiment of the present invention;

[0017] Figure 3 This is a working framework diagram for PLC safety assessment provided by an embodiment of the present invention;

[0018] Figure 4 It is a structural schematic diagram of a PLC safety assessment device provided by an embodiment of the present invention;

[0019] Figure 5 It is a structural schematic diagram of a computer device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] Figure 1 It is a flow chart of a PLC safety assessment method provided by an embodiment of the present invention. The embodiment of the present invention can be applied to the scenario of performing safety verification on PLC. The method can be executed by a PLC safety assessment device, which can be implemented by software and / or hardware.

[0022] like Figure 1 As shown, the PLC safety assessment method includes the following steps:

[0023] S110, obtaining the information to be detected of the target PLC.

[0024] Among them, the target PLC may be a PLC that needs to be security verified. The information to be detected may be parameter information based on which the security assessment of the target PLC is performed. Specifically, parameter information of a preset type may be used as the information to be detected, and the preset type of information may be set manually. Furthermore, the hierarchical verification result may be a security verification result of a single hierarchical level of the target PLC. Specifically, the hierarchical levels that need to be security verified in the embodiments of the present invention include: network layer, application layer, device layer, and host layer.

[0025] S120. For each level to be detected, determine the level evaluation results corresponding to the multiple levels to be detected according to the information to be detected of the target PLC.

[0026] The layer to be detected includes at least one of a network layer, an application layer, a device layer, and a host layer. The layer verification result may be a security verification result of a single layer of the target PLC. Specifically, the technical solution of the embodiment of the present invention may perform security verification on multiple layers to be detected according to the information to be detected of the target PLC, and obtain layer evaluation results corresponding to the multiple layers to be detected.

[0027] S130. Determine a target safety assessment result corresponding to the target PLC according to the level assessment results corresponding to the multiple levels to be detected.

[0028] The target safety assessment result may be a safety verification result of the target PLC. Specifically, the level assessment results corresponding to multiple levels to be detected may be combined to obtain the target safety assessment result.

[0029] The technical solution provided by the embodiment of the present invention obtains the information to be detected of the target PLC; wherein the information to be detected is the parameter information based on which the security assessment of the target PLC is performed; for each level to be detected, according to the information to be detected of the target PLC, the level assessment results corresponding to the multiple levels to be detected are determined; wherein the levels to be detected include: at least one of the network layer, the application layer, the device layer and the host layer; according to the level assessment results corresponding to the multiple levels to be detected, the target security assessment result corresponding to the target PLC is determined. The technical solution of the embodiment of the present invention solves the problem that the existing PLC security detection technology often focuses on the security protection of a single level and has poor security assessment effect. It can comprehensively verify the security of the PLC from the perspective of multiple levels, effectively identify various potential security threats, and significantly improve the overall security protection capability of the PLC system.

[0030] Figure 2 It is another PLC safety assessment method flow chart provided by an embodiment of the present invention. The embodiment of the present invention can be applied to the scenario of performing safety verification on PLC. Based on the above embodiment, this embodiment further illustrates how to determine the level assessment result corresponding to the level to be detected. The device can be implemented by software and / or hardware and integrated in a computer device with application development function.

[0031] like Figure 2 As shown, the PLC safety assessment method includes the following steps:

[0032] S210, obtaining the information to be detected of the target PLC; and determining the level evaluation result corresponding to the network layer according to the information to be detected of the target PLC.

[0033] Among them, the target PLC can be a PLC that needs to be security-verified. The information to be detected can be parameter information based on which the security assessment of the target PLC is performed. Specifically, parameter information of a preset type can be used as the information to be detected, and the preset type of information can be set manually. Furthermore, the hierarchical verification result can be a security verification result of a single hierarchical level of the target PLC. Specifically, the hierarchical levels that need to be security-verified in the embodiments of the present invention include: network layer, application layer, device layer, and host layer.

[0034] Optionally, when the layer to be detected is the network layer, identify the network services of the open ports in the target PLC, verify the necessity and security of the network services, and determine the port service verification result; perform a simulated attack test on the communication protocol of the target PLC based on a preset protocol testing tool to determine the communication protocol test result; verify the encryption mechanism and authentication mechanism in the target PLC device channel based on a preset communication testing tool to determine the mechanism verification result; identify the IP address segment of the target PLC, compare the IP address segment with the preset address segment, and determine the network verification result; determine the level assessment result corresponding to the network layer based on the port service verification result, the communication protocol test result, the mechanism verification result and the network verification result.

[0035] Among them, for each network service, on the one hand, it can be determined whether the network service has corresponding business needs or technical purposes. If there are none, it can be determined as a non-essential network service; if there are, it can be determined as a necessary network service; on the other hand, it can be detected whether there are known vulnerabilities in the network service, and finally the port service verification result can be determined based on the detection results of the two aspects. Furthermore, based on the preset protocol testing tool, various communication protocols can be simulated and attacked to test the processing capabilities of the PLC communication protocol when facing abnormal data packets, illegal commands and forged data, and the communication protocol detection results can be determined based on the processing capabilities.

[0036] Furthermore, it is possible to detect whether the target PLC uses an encryption mechanism and whether the authentication mechanism has defects, and finally obtain the mechanism verification result by combining the detection results of the two aspects. Exemplarily, to test whether the PLC communication protocol uses an encryption mechanism, the communication traffic can be captured by the wireshark packet capture tool to check whether the data is transmitted in plain text. If it is transmitted in plain text, the encryption mechanism is not used. To test whether the PLC communication protocol authentication mechanism has defects, communication can be established with the PLC and an operation instruction can be sent. If the instruction is successfully executed, it means that the PLC device receives the instruction without authentication and the authentication mechanism has defects.

[0037] Further, the preset address segment can be a known IP address segment of a device associated with the target PLC. Exemplarily, the IP address segments of the upper and lower computers corresponding to the target PLC can be used as preset address segments. By comparing the IP address segment with the preset address segment, it can be determined whether the network where the target PLC is located adopts a segmentation and isolation design, and then the network verification result is obtained. Exemplarily, when the IP address segment of the target PLC is different from the preset address segment, it can be determined that the network where the target PLC is located adopts a segmentation and isolation design, and the network verification result is indeed normal; if there is an identical address segment, it can be determined that the network where the target PLC is located does not adopt a segmentation and isolation design, and the network verification result is indeed abnormal. Finally, the port service verification results, communication protocol test results, mechanism verification results and network verification results can be combined to obtain the hierarchical evaluation results corresponding to the network layer.

[0038] For example, the network layer involves the communication network security between the PLC device and other devices. The security assessment content is as follows:

[0039] Port scanning: Use network scanning tools (such as Nmap) to perform port scanning on PLC devices to identify open ports and their corresponding network services. Analyze the security configuration of these ports to confirm whether there are unnecessary or insecure service exposures. Evaluate the security of services exposed by open ports and check whether each service has a clear business need or technical purpose. If a service is no longer used or is not necessary, consider disabling it. Use the CVE database to query whether the service and its version have known vulnerabilities. If so, patch or upgrade the service in a timely manner. Ensure that only necessary services are open.

[0040] Communication protocol testing: Detailed analysis of the communication protocols used by PLC devices (such as Modbus, Profibus, S7, etc.) to evaluate whether there are security vulnerabilities or design flaws in the implementation of these protocols. By using penetration testing frameworks such as Smod and ISF, simulated attack tests are performed on various communication protocols to test the processing capabilities of PLC communication protocols in the face of abnormal data packets, illegal commands, and forged data, in order to comprehensively evaluate the security of the protocol.

[0041] Man-in-the-middle attack: Simulate man-in-the-middle attack to test whether there are defects in the encryption and authentication mechanisms in PLC device communication, which can effectively prevent attackers from inserting malicious data or tampering with data in the communication link. For example, the Modbus protocol is particularly vulnerable to man-in-the-middle attacks due to its lack of encryption and authentication mechanisms. Specifically, the Modbus protocol address and command are transmitted in plain text, which can be easily captured and parsed. The Modbus protocol only needs to use a legal Modbus address and a legal function code to establish a Modbus session.

[0042] Evaluate whether the communication between the PLC and other devices uses encryption mechanisms, test the encryption strength, and confirm whether the encryption protocol can resist man-in-the-middle attacks. Check whether the devices in the communication link have been properly authenticated to ensure that the source of the data packet is credible. Test whether attackers can insert or modify communication data by impersonating legitimate devices or exploiting authentication vulnerabilities, thereby achieving unauthorized access or operation.

[0043] Network isolation: Evaluate the overall architecture of the network where the PLC device is located and check whether the segmentation and isolation design is adopted. You can determine whether the network has been divided into multiple subnets or virtual LANs by comparing the IP address segments. Ensure that there is clear network isolation between the critical control network and other networks to prevent cross-segment attacks. Check the access control policies of network devices such as firewalls, routers, and horizontal isolation devices to ensure that only authorized devices and users can access the PLC network. Evaluate whether there are unauthorized access paths or unsafe connections in the network.

[0044] S220. Determine a level evaluation result corresponding to the application layer according to the information to be detected of the target PLC.

[0045] Optionally, when the layer to be detected is the application layer, perform a security check on the authentication system of the target PLC to determine the authentication check result; test the input processing logic of the target PLC's application to determine the input verification result; verify the security of the configuration file of the target PLC's application to determine the configuration verification result; and determine the level assessment result corresponding to the application layer based on the authentication check result, the input verification result and the configuration verification result.

[0046] Among them, it is possible to detect whether the authentication system of the target PLC has a preset authentication mechanism, and then obtain the authentication verification result. Further, it is possible to detect whether there are known input verification vulnerabilities in the input processing logic, and then obtain the input verification result. Further, it is possible to determine the location of all configuration files used by the target PLC application, whether they are stored in the corresponding location, and if so, determine that the configuration verification result is that there is no abnormality in the configuration verification; otherwise, determine that the configuration verification result is a configuration verification abnormality, and mark the configuration file with the wrong storage location. Finally, the authentication verification result, input verification result and configuration verification result can be combined to determine the hierarchical evaluation result corresponding to the application layer.

[0047] For example, the application layer mainly involves the security of software and applications in the PLC system. The security assessment content is as follows:

[0048] Authentication: Evaluate the authentication system of the PLC management interface, including the authentication mechanism of the login page and background management. Check for weak passwords, default passwords, or authentication bypass vulnerabilities. Collect common password dictionaries for PLCs, which usually contain default passwords, common passwords, and known weak passwords, and use brute force tools to verify whether the system has weak passwords. Access the system's application page or developer console to check whether two-factor authentication (2FA) is configured and its effectiveness to prevent a single authentication method from being breached.

[0049] Input validation: Test the input processing logic of the application, and fill all illegal test cases of common attack payloads in all locations in the application that may receive user input, including form fields, URL parameters, cookies, HTTP Headers, etc. Focus on checking whether there are common input validation vulnerabilities, such as SQL injection, command injection, and cross-site scripting (XSS) attacks, to ensure that all input data is strictly validated and filtered.

[0050] Configuration management: Check the configuration files of the PLC application, evaluate their security, and determine the location of all configuration files used by the PLC application. Typically, these files are contained in the storage of the PLC device or in the installation directory of the related software. Ensure that the configuration files do not contain passwords, keys, or other sensitive information stored in plain text, and should be encrypted when necessary. For example, sensitive information such as usernames and passwords were leaked in the path " / * / CONF / SYS / DUOUSERS" of a PLC.

[0051] Logging: Evaluate the system's logging mechanism to ensure that key operations and abnormal activities are recorded in detail in the log. Ensure that the logging mechanism is enabled and that key operations and abnormal activities are recorded in detail, including timestamps, executed commands, operating users, source IP addresses, affected resources, etc. This facilitates subsequent audits and analysis. Focus on checking whether authentication failures, permission changes, and other security events are recorded.

[0052] S230. Determine a level evaluation result corresponding to a device layer according to the information to be detected of the target PLC.

[0053] Optionally, when the layer to be detected is the device layer, determine the firmware code about the target PLC in the information to be detected, identify code vulnerabilities and backdoor code fragments in the firmware code, and determine the firmware analysis results based on the identification results; detect the interface protection mechanism corresponding to the preset hardware interface in the target PLC, and determine the interface analysis results based on the detection results; verify the security startup mechanism of the device layer, and determine the security verification results based on the verification results; determine the level assessment results corresponding to the device layer based on the firmware analysis results, the interface analysis results and the security verification results.

[0054] Among them, the firmware code can be a code associated with the firmware in the target PLC. The firmware analysis result can be a security analysis result of the code in the firmware. Exemplarily, it is possible to detect whether there are preset types of vulnerability codes and backdoor code fragments in the firmware code for identification, and finally the detected vulnerability code and backdoor code fragments can be used as the firmware analysis result. Further, it is possible to detect whether there is a preset interface protection mechanism for the preset hardware interface in the target PLC, and use the detection result as the interface analysis result. Further, it is possible to verify whether there is a preset secure boot mechanism at the device layer. For example, it is possible to verify whether there is a digital signature mechanism or a hash value verification mechanism, and use the verification result as the security verification result. Finally, the firmware analysis result, the interface analysis result and the security verification result can be combined to obtain the hierarchical evaluation result corresponding to the device layer.

[0055] Optionally, the secure boot mechanism of the device layer is verified, and the security verification result is determined based on the verification result, including: determining a first hash value corresponding to the firmware file of the device layer, and determining a second hash value of the firmware file when loading and / or updating; comparing the first hash value and the second hash value, and determining the security verification result based on the comparison result.

[0056] The first hash value may be a hash value corresponding to the firmware file before it is processed. The second hash value may be a hash value corresponding to the firmware file after it is processed. Furthermore, the first hash value and the second hash value may be compared. If the two hash values ​​are the same, it can be determined that there is no abnormality in the security check; if they are different, there is an abnormality.

[0057] For example, the device layer mainly involves the firmware security of the PLC device itself, including the integrity of the firmware. The security assessment content is as follows:

[0058] Firmware analysis: Reverse engineer the PLC firmware, analyze the firmware code and structure, and identify potential security vulnerabilities or hidden backdoors. This process involves firmware extraction, disassembly, and decompilation to discover security risks. Use the IDAPro tool to decompile the firmware binary code into high-level language code, or disassemble it into assembly code. Check key functions, variables, and control flow structures, focusing on code modules related to permission management, communication protocol processing, and encryption functions to find possible vulnerabilities or backdoor code snippets.

[0059] Hardware interface security: Check the hardware interfaces of the PLC device (such as JTAG) to ensure that these interfaces are protected to prevent attackers from directly accessing the device or tampering with the system through these interfaces.

[0060] Secure boot mechanism: Evaluate whether the device has a secure boot mechanism to ensure that the device performs necessary security checks (such as firmware integrity check) during the boot process. Check the integrity of the firmware on the PLC device and verify whether the firmware has a digital signature or hash verification mechanism to confirm that the firmware has not been tampered with or damaged during the update or loading process. Use a cryptographic hash function (such as SHA-256) to hash the firmware file to be verified and generate a hash value of a fixed length. When the firmware is loaded or updated, recalculate its hash value. If the hash value matches, the integrity and authenticity of the firmware is confirmed, and the firmware can be safely loaded or used.

[0061] S240. Determine a level evaluation result corresponding to the host layer according to the information to be detected of the target PLC.

[0062] Optionally, when the layer to be detected is the host layer, security vulnerabilities in the operating system of the target PLC can be identified to determine the vulnerability identification results; the running processes and running services on the target PLC are determined, and security checks are performed on the running processes and running services to determine the operation verification results; the system log information in the information to be detected is obtained, and the system log information is checked for integrity and reliability to obtain the log verification results; based on the vulnerability identification results, the operation verification results and the operation verification results corresponding to the host layer are determined.

[0063] Among them, it is possible to identify whether there is a preset security vulnerability type in the operating system of the target PLC, and then the identified security vulnerability can be used as a vulnerability identification result. Furthermore, on the one hand, it is possible to detect whether there is a preset malicious process or backdoor program in the running process; on the other hand, it is possible to detect whether the running service is a preset necessary service type, and finally the detection results of the two aspects can be used as the operation verification result. The system log information can be the log information of the operating system of the target PLC during the historical operation process. Further, it is possible to identify whether the system log information contains complete logs of preset key events (such as user login, file modification, service startup, etc.), and then the identification result can be used as the log verification result. Finally, the vulnerability identification result, the operation verification result and the log verification result can be combined to obtain the hierarchical detection result corresponding to the host layer.

[0064] Optionally, perform security checks on running processes and running services to determine the operation verification results, including: identifying the network connections of the running processes, identifying abnormal connections and / or unauthorized connections in the network connections, and determining the process verification results; matching the running services with preset necessary services, and determining the service verification results based on the matching results; determining the operation verification results based on the process verification results and the service verification results.

[0065] Among them, the process verification result can be a security verification result of the running process in the target PLC. Specifically, it can be detected whether there is an abnormal connection or an unauthorized connection in the network connection of the running process. If not, it can be determined that the process verification result is normal. If it exists, the detected abnormal connection and unauthorized connection can be used as the process verification result. Further, the preset necessary service can be a service that the target PLC needs to run. Specifically, the preset necessary service can be preset manually. Exemplarily, the running service can be matched with the preset necessary service, and the running service that fails to match is used as the service verification result. Finally, the process verification result and the service verification result can be combined to obtain the operation verification result.

[0066] For example, the host security layer is an important part of the industrial control PLC system security assessment model, focusing on the security of the operating system and underlying software environment of the PLC system. The security assessment model of this layer includes the following three aspects:

[0067] Operating system vulnerabilities: Use automated vulnerability scanning tools to conduct a comprehensive scan of the operating system used by the PLC (such as VXWorks, Linux, Windows, etc.) to identify known security vulnerabilities. By reviewing system patches and update history, ensure that the operating system has applied the latest security fix patches.

[0068] Process and service management: Check all processes running on the PLC host, identify potential malicious processes or backdoor programs, check the network connection of the process through the netstat command to see if there are any abnormal or unauthorized connections, and detect possible abnormal activities or hidden threats by analyzing process behavior. Review the services enabled on the PLC system to ensure that only necessary services are running, such as PLC communication protocol services, system management services, etc., and shut down or remove unnecessary services (such as FTP, Telnet) to reduce the attack surface. Check whether the service configuration meets security requirements to prevent the service from being abused.

[0069] System log and event audit: Check the operating system's logging mechanism to ensure that key events (such as user login, file modification, service startup, etc.) are accurately recorded. Confirm the integrity and reliability of log records to provide support for post-event analysis and evidence collection. Regularly audit system logs to identify and analyze abnormal activities or potential threats. Ensure that log records can track the occurrence of security incidents and support rapid response to security incidents.

[0070] S250. Determine a target safety assessment result corresponding to the target PLC according to the level assessment results corresponding to the multiple levels to be detected.

[0071] The target safety assessment result may be a safety verification result of the target PLC. Specifically, the level assessment results corresponding to multiple levels to be detected may be combined to obtain the target safety assessment result.

[0072] For illustrative purposes, in order to better understand the technical solution provided by the present invention, specific embodiments are introduced below. Figure 3 This is a working framework diagram for PLC safety assessment provided by an embodiment of the present invention. Figure 3 As shown in the figure, based on the security assessment model of industrial control PLC, a multi-level security assessment framework can be constructed to conduct comprehensive security detection and analysis on the physical device layer, network communication layer, host operating system layer and application software layer of the PLC system. This model combines multiple technical means such as firmware analysis, protocol testing, port scanning, and permission control, and can accurately identify potential security risks at all levels, ensuring the overall security of the PLC system from the underlying hardware to the upper-level applications, and significantly improving the anti-attack capabilities of the PLC system.

[0073] The technical solution provided by the embodiment of the present invention obtains the information to be detected of the target PLC; determines the level evaluation result corresponding to the network layer according to the information to be detected of the target PLC; determines the level evaluation result corresponding to the application layer according to the information to be detected of the target PLC; determines the level evaluation result corresponding to the device layer according to the information to be detected of the target PLC; determines the level evaluation result corresponding to the host layer according to the information to be detected of the target PLC; determines the target security evaluation result corresponding to the target PLC according to the level evaluation results corresponding to multiple levels to be detected. The technical solution of the embodiment of the present invention solves the problem that the existing PLC security detection technology often focuses on the security protection of a single level and has poor security evaluation effect. It can comprehensively verify the security of the PLC from the perspective of multiple levels, effectively identify various potential security threats, and significantly improve the overall security protection capability of the PLC system.

[0074] Figure 4 It is a structural schematic diagram of a PLC safety assessment device provided by an embodiment of the present invention. The embodiment of the present invention can be applied to the scenario of performing safety verification on PLC. The device can be implemented by software and / or hardware and integrated into a computer device with application development function.

[0075] like Figure 4 As shown, the PLC safety assessment device includes: a to-be-detected information acquisition module 310 , a level assessment module 320 and a safety assessment determination module 330 .

[0076] Among them, the information to be detected acquisition module 310 is used to obtain the information to be detected of the target PLC; wherein the information to be detected is parameter information based on which the security assessment of the target PLC is based; the hierarchical assessment module 320 is used to determine, for each hierarchical level to be detected, multiple hierarchical assessment results corresponding to the hierarchical levels to be detected according to the information to be detected of the target PLC; wherein the hierarchical levels to be detected include: at least one of the network layer, application layer, device layer and host layer; the security assessment determination module 330 is used to determine the target security assessment result corresponding to the target PLC according to the hierarchical assessment results corresponding to multiple hierarchical levels to be detected.

[0077] The technical solution provided by the embodiment of the present invention obtains the information to be detected of the target PLC; wherein the information to be detected is parameter information based on which the security assessment of the target PLC is performed; for each level to be detected, according to the information to be detected of the target PLC, a plurality of level assessment results corresponding to the levels to be detected are determined; wherein the levels to be detected include: at least one of the network layer, the application layer, the device layer and the host layer; according to the level assessment results corresponding to the plurality of levels to be detected, the target security assessment result corresponding to the target PLC is determined. The technical solution of the embodiment of the present invention solves the problem that the existing PLC security detection technology often focuses on the security protection of a single level and has poor security assessment effect. It can comprehensively verify the security of the PLC from the perspective of multiple levels, effectively identify various potential security threats, and significantly improve the overall security protection capability of the PLC system.

[0078] In an optional embodiment, the hierarchical assessment module 320 includes: a device layer assessment unit, used to: when the layer to be detected is the device layer, determine the firmware code about the target PLC in the information to be detected, identify code vulnerabilities and backdoor code fragments in the firmware code, and determine the firmware analysis result based on the identification result; detect the interface protection mechanism corresponding to the preset hardware interface in the target PLC, and determine the interface analysis result based on the detection result; verify the security startup mechanism of the device layer, and determine the security verification result based on the verification result; determine the hierarchical assessment result corresponding to the device layer based on the firmware analysis result, the interface analysis result and the security verification result.

[0079] In an optional embodiment, the device layer evaluation unit includes: a secure boot mechanism verification subunit, used to: determine a first hash value corresponding to the firmware file of the device layer, and determine a second hash value of the firmware file when loading and / or updating; compare the first hash value with the second hash value, and determine the security verification result based on the comparison result.

[0080] In an optional embodiment, the hierarchical assessment module 320 includes: a host layer assessment unit, used to: when the hierarchical level to be detected is the host layer, identify security vulnerabilities in the operating system of the target PLC and determine vulnerability identification results; determine the running processes and running services on the target PLC, perform security verification on the running processes and the running services, and determine the running verification results; obtain system log information in the information to be detected, perform integrity verification and reliability verification on the system log information, and obtain log verification results; determine the hierarchical assessment result corresponding to the host layer based on the vulnerability identification results, the running verification results and the log verification results.

[0081] In an optional embodiment, the host layer evaluation unit includes: an operation verification subunit, used to: identify the network connection of the running process, identify abnormal connections and / or unauthorized connections in the network connection, and determine the process verification result; match the running service with the preset necessary service, and determine the service verification result based on the matching result; determine the operation verification result based on the process verification result and the service verification result.

[0082] In an optional embodiment, the hierarchical assessment module 320 includes: a network layer assessment unit, used to: when the layer to be detected is the network layer, identify the network services of the open ports in the target PLC, verify the necessity and security of the network services, and determine the port service verification result; perform a simulated attack test on the communication protocol of the target PLC based on a preset protocol testing tool to determine the communication protocol test result; verify the encryption mechanism and authentication mechanism in the target PLC device channel based on a preset communication testing tool to determine the mechanism verification result; identify the IP address segment of the target PLC, compare the IP address segment with the preset address segment, and determine the network verification result; determine the hierarchical assessment result corresponding to the network layer according to the port service verification result, the communication protocol test result, the mechanism verification result and the network verification result.

[0083] In an optional embodiment, the hierarchical assessment module 320 includes: an application layer assessment unit, used to: when the layer to be detected is the application layer, perform a security check on the authentication system of the target PLC to determine an authentication check result; test the input processing logic of the application program of the target PLC to determine an input verification result; verify the security of the configuration file of the application program of the target PLC to determine a configuration verification result; and determine a hierarchical assessment result corresponding to the application layer based on the authentication check result, the input verification result and the configuration verification result.

[0084] The PLC safety assessment device provided in the embodiment of the present invention can execute the PLC safety assessment method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0085] Figure 5 A schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Figure 5 A block diagram of an exemplary computer device 12 suitable for use in implementing embodiments of the present invention is shown. Figure 5 The computer device 12 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention. The computer device 12 can be any terminal device with computing capability and can be configured in the PLC safety assessment device.

[0086] like Figure 5 As shown, the computer device 12 is in the form of a general-purpose computing device. The components of the computer device 12 may include, but are not limited to: one or more processors or processing units 16, a system memory 28, and a bus 18 that connects various system components (including the system memory 28 and the processing unit 16).

[0087] The bus 18 may be one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. For example, these architectures include, but are not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MAC) bus, an Enhanced ISA bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0088] The computer device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the computer device 12, including volatile and non-volatile media, removable and non-removable media.

[0089] The system memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache 32. The computer device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 34 may be used to read and write non-removable, non-volatile magnetic media ( Figure 5 not shown, usually called a "hard drive"). Although Figure 5 Not shown in the figure, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 18 via one or more data medium interfaces. The system memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present invention.

[0090] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in system memory 28, such program modules 42 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. Program modules 42 generally perform the functions and / or methods of the embodiments described herein.

[0091] The computer device 12 may also communicate with one or more external devices 14 (e.g., keyboards, pointing devices, displays 24, etc.), one or more devices that enable a user to interact with the computer device 12, and / or any device that enables the computer device 12 to communicate with one or more other computing devices (e.g., network cards, modems, etc.). Such communication may be performed through an input / output (I / O) interface 22. Furthermore, the computer device 12 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) through a network adapter 20. Figure 5 As shown, the network adapter 20 communicates with other modules of the computer device 12 via the bus 18. It should be understood that although Figure 5 Not shown, other hardware and / or software modules may be used in conjunction with computer device 12, including but not limited to microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0092] The processing unit 16 executes various functional applications and data processing by running the program stored in the system memory 28, for example, implementing the PLC safety assessment method provided by the embodiment of the present invention, the method comprising:

[0093] Obtain information to be detected of a target PLC; wherein the information to be detected is parameter information based on which a security assessment of the target PLC is performed; for each level to be detected, determine multiple level assessment results corresponding to the levels to be detected based on the information to be detected of the target PLC; wherein the levels to be detected include: at least one of a network layer, an application layer, a device layer, and a host layer; determine a target security assessment result corresponding to the target PLC based on the level assessment results corresponding to the multiple levels to be detected.

[0094] This embodiment provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the PLC safety assessment method provided by any embodiment of the present invention is implemented, including:

[0095] Obtain information to be detected of a target PLC; wherein the information to be detected is parameter information based on which a security assessment of the target PLC is performed; for each level to be detected, determine multiple level assessment results corresponding to the levels to be detected based on the information to be detected of the target PLC; wherein the levels to be detected include: at least one of a network layer, an application layer, a device layer, and a host layer; determine a target security assessment result corresponding to the target PLC based on the level assessment results corresponding to the multiple levels to be detected.

[0096] The computer storage medium of the embodiment of the present invention can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to: an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0097] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0098] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0099] Computer program code for performing the operations of the present invention may be written in one or more programming languages ​​or combinations thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0100] It should be understood by those skilled in the art that the modules or steps of the present invention described above can be implemented by a general-purpose computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, optionally, they can be implemented by a program code executable by a computer device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0101] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A PLC safety assessment method, characterized in that: include: Acquire the information to be detected of the target PLC; wherein the information to be detected is parameter information based on which the safety assessment of the target PLC is performed; For each level to be detected, according to the information to be detected of the target PLC, determine the level evaluation results corresponding to the multiple levels to be detected; wherein the levels to be detected include: at least one of the network layer, the application layer, the device layer and the host layer; According to the hierarchical evaluation results corresponding to the multiple hierarchical levels to be detected, the target safety evaluation result corresponding to the target PLC is determined.

2. The method according to claim 1, characterized in that The step of determining, according to the information to be detected of the target PLC, level evaluation results corresponding to the multiple levels to be detected includes: In the case where the layer to be detected is the device layer, determining the firmware code of the target PLC in the information to be detected, identifying the code vulnerabilities and backdoor code fragments in the firmware code, and determining the firmware analysis result according to the identification result; Detecting an interface protection mechanism corresponding to a preset hardware interface in the target PLC, and determining an interface analysis result according to the detection result; Verifying the secure boot mechanism of the device layer, and determining a security verification result according to the verification result; According to the firmware analysis result, the interface analysis result and the security verification result, a level assessment result corresponding to the device layer is determined.

3. The method according to claim 2, characterized in that Verifying the secure boot mechanism of the device layer and determining the security verification result according to the verification result includes: Determine a first hash value corresponding to a firmware file of the device layer, and determine a second hash value of the firmware file when it is loaded and / or updated; The first Hash value and the second Hash value are compared, and the security verification result is determined according to the comparison result.

4. The method according to claim 1, characterized in that The step of determining, according to the information to be detected of the target PLC, level evaluation results corresponding to the multiple levels to be detected includes: In the case where the layer to be detected is a host layer, identifying security vulnerabilities in the operating system of the target PLC and determining vulnerability identification results; Determine the running process and the running service on the target PLC, perform a security check on the running process and the running service, and determine the running check result; Obtaining system log information from the information to be detected, performing integrity check and reliability check on the system log information, and obtaining a log check result; According to the vulnerability identification result, the operation verification result and the log verification result, the hierarchical assessment result corresponding to the host layer is determined.

5. The method according to claim 4, characterized in that The performing security verification on the running process and the running service and determining the running verification result includes: Identify the network connection of the running process, identify abnormal connections and / or unauthorized connections in the network connection, and determine the process verification result; Matching the running service with the preset necessary service, and determining the service verification result according to the matching result; The operation verification result is determined according to the process verification result and the service verification result.

6. The method according to claim 2, characterized in that The step of determining, according to the information to be detected of the target PLC, level evaluation results corresponding to the multiple levels to be detected includes: In the case where the layer to be detected is a network layer, identifying a network service of an open port in the target PLC, verifying the necessity and security of the network service, and determining a port service verification result; Perform a simulated attack test on the communication protocol of the target PLC based on a preset protocol test tool to determine a communication protocol test result; Verify the encryption mechanism and authentication mechanism in the target PLC device channel based on a preset communication test tool to determine the mechanism verification result; Identify the IP address segment of the target PLC, compare the IP address segment with a preset address segment, and determine a network verification result; According to the port service verification result, the communication protocol test result, the mechanism verification result and the network verification result, the level evaluation result corresponding to the network layer is determined.

7. The method according to claim 2, characterized in that The step of determining, according to the information to be detected of the target PLC, level evaluation results corresponding to the multiple levels to be detected includes: When the layer to be detected is the application layer, performing a security check on the authentication system of the target PLC and determining an authentication check result; Testing the input processing logic of the application program of the target PLC to determine the input verification result; Verify the security of the configuration file of the application program of the target PLC and determine the configuration verification result; According to the authentication verification result, the input verification result and the configuration verification result, a layer evaluation result corresponding to the application layer is determined.

8. A PLC safety assessment device, characterized in that: The device comprises: The module for acquiring information to be detected is used to acquire information to be detected of the target PLC; wherein the information to be detected is parameter information based on which the safety assessment of the target PLC is performed; A layer evaluation module is used to determine, for each layer to be detected, layer evaluation results corresponding to the multiple layers to be detected according to the information to be detected of the target PLC; wherein the layers to be detected include: at least one of a network layer, an application layer, a device layer and a host layer; The safety assessment determination module is used to determine the target safety assessment result corresponding to the target PLC according to the level assessment results corresponding to multiple levels to be detected.

9. A computer device, characterized in that: The computer device comprises: one or more processors; A memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the PLC safety assessment method as described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the PLC safety assessment method as described in any one of claims 1 to 7 is implemented.

Images