Modbus TCP replay attack detection control method based on industrial control gatekeeper

Abstract

The embodiment of the invention provides a Modbus TCP replay attack detection control method based on an industrial control gatekeeper, and relates to the field of network security. The method comprises the following steps: when the time when a client sends a data packet is within a preset effective time range, the data packet is released or discarded by comparing a source IP address of the data packet with a cached legal address; if the time for the client to send the data packet is not within the preset effective time range, judging the type of the data packet; if the data packet is a TCP handshake packet, releasing the data packet; if the data packet is the request packet, a first response packet corresponding to the data packet is sent to the client, and the client generates a second response packet according to the first response packet; and according to the type of the second response packet, blocking communication by using the corresponding blocking packet and resetting the preset effective time range so as to detect the data packet sent by the client next time or release the data packet. Therefore, the replay attack is accurately identified, the false detection rate is reduced, and the security of equipment using Modbus TCP communication and the stability of an industrial intranet are improved.

Description

Technical Field

[0001] The present disclosure relates to the field of network security, and in particular to a Modbus TCP replay attack detection and control method based on an industrial control network gate. Background Art

[0002] When the Modbus TCP protocol was first designed, it was believed that its communication environment belonged to the industrial intranet and there would be no mixed traffic. Therefore, the protocol removed the verification information and had no authentication or authorization. This made it very vulnerable to attacks such as data replay and illegal tampering, which could cause device abnormalities. Therefore, it is necessary to detect and control these attacks to avoid device abnormalities.

[0003] Common detection methods for replay attack behavior generally include function code verification, MAC / IP binding verification, rough verification based on time difference and communication encryption control, and verification methods based on serial numbers and responses. However, these methods still have a high false detection rate. For example, when the terminal device traffic passes through switching devices such as routers, the terminal MAC address will be replaced by the switching device MAC address. At this time, the MAC / IP binding function fails; rough verification using only the average time difference of the request will have obvious anomalies when the network fluctuates, and the cost of adding timestamps or random values ​​is very high, which is not suitable for large-scale field environments; since the protocol itself does not support encryption and the cost of modification is too high, communication encryption control is not applicable in field environments; when using compliant data packets for replay, when the server is stable enough, the replay traffic can basically proceed normally, and the verification method based on serial numbers and responses fails. Summary of the invention

[0004] The present invention discloses a Modbus TCP replay attack detection and control method based on an industrial control network gate, a device, equipment and a storage medium.

[0005] According to a first aspect of the present disclosure, a Modbus TCP replay attack detection and control method based on an industrial control network gate is provided. The method comprises: When the client sends a data packet within the preset valid time range, the data packet is released or discarded by comparing the source IP address of the data packet with the cached legal address.

[0006] When the time when the client sends a data packet is not within the preset effective time range, the type of the data packet is determined; if the data packet is a TCP handshake packet, the data packet is released; if the data packet is a request packet, the first response packet corresponding to the constructed data packet is sent to the client, so that the client can generate a second response packet based on the first response packet.

[0007] According to the type of the second response packet, the blocking packet corresponding to the data packet is used to block the communication and reset the preset effective time range so as to detect the data packet sent by the client next time, or release the data packet.

[0008] In some implementations of the first aspect, by comparing the source IP address of the data packet with the cached legal address, allowing or discarding the data packet includes: If the source IP address of the data packet is a legal address, the data packet is allowed to pass.

[0009] If the source IP address of the data packet is an illegal address, the data packet will be discarded.

[0010] In some implementations of the first aspect, if the data packet is a request packet, before / after / simultaneously sending a first response packet corresponding to the constructed data packet to the client includes: Extract the transaction ID from the packet.

[0011] The transaction ID of the first response packet is set according to the transaction ID in the data packet.

[0012] In some implementations of the first aspect, according to the type of the second response packet, using a blocking packet corresponding to the data packet to block communication and resetting a preset effective time range so as to detect the data packet sent by the client next time, or releasing the data packet, includes: If the second response packet is a request packet, compare the transaction ID of the second response packet with the transaction ID of the first response packet; if the transaction ID of the second response packet is equal to the transaction ID of the first response packet, use the blocking packet corresponding to the data packet to block the communication and reset the preset effective time range.

[0013] If the second response packet is an error prompt packet or a connection termination packet, a blocking packet corresponding to the data packet is used to block the communication and reset the preset effective time range.

[0014] Otherwise, the packet is passed.

[0015] In some implementations of the first aspect, blocking communication using a blocking packet corresponding to the data packet includes: The source IP address of the data packet is recorded as an illegal address, and a blocking packet corresponding to the data packet is sent to the client to block communication.

[0016] In some implementations of the first aspect, the method further includes: The source IP address of the released data packet is recorded as a legal address.

[0017] According to a second aspect of the present disclosure, a Modbus TCP replay attack detection control module based on an industrial control network gate is provided. The module comprises: A diversion module, a replay attack detection module, and a packet packaging module are connected in sequence; wherein the replay attack detection module is also connected to the control module.

[0018] The traffic diversion module is used to receive data packets sent by the client and send the data packets to the replay detection module.

[0019] The replay attack detection module is used to receive data packets. When the time when the client sends the data packet is within the preset effective time range, the data packet is released or discarded according to the comparison result between the source IP address of the data packet and the cached legal address.

[0020] It is also used to determine the type of data packet when the time when the client sends the data packet is not within the preset effective time range; if the data packet is a TCP handshake packet, the data packet is released; if the data packet is a request packet, the first response packet corresponding to the constructed data packet is sent to the client, so that the client can generate a second response packet based on the first response packet.

[0021] It is also used to block communication using a blocking packet corresponding to the data packet and reset a preset effective time range according to the type of the second response packet so as to detect the data packet sent by the client next time, or to release the data packet.

[0022] The control module is used to compare the source IP address of the data packet with the cached legal address.

[0023] The packet module is used to construct a first response packet corresponding to a data packet; it is also used to construct a blocking packet.

[0024] In some implementations of the second aspect, the control module is further used to cache the source IP address of the data packet.

[0025] The packet packaging module is further used to extract the transaction ID in the data packet and set the transaction ID of the first response packet according to the transaction ID in the data packet.

[0026] According to a third aspect of the present disclosure, an electronic device is provided. The electronic device includes: at least one processor; and a memory connected to the at least one processor in communication; the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can perform the method described above.

[0027] According to a fourth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, where the computer instructions are used to cause a computer to execute the method as described above.

[0028] In the present disclosure, when the time when the client sends a data packet is within a preset effective time range, the data packet is released or discarded by comparing the source IP address of the data packet with the cached legal address; when the time when the client sends a data packet is not within the preset effective time range, the type of the data packet is determined; if the data packet is a TCP handshake packet, the data packet is released; if the data packet is a request packet, the first response packet corresponding to the constructed data packet is sent to the client, so that the client generates a second response packet based on the first response packet; according to the type of the second response packet, the blocking packet corresponding to the data packet is used to block the communication and reset the preset effective time range so that the data packet sent by the client can be detected next time, or the data packet is released. In this way, zero-trust replay attack detection is achieved, replay attacks that meet the replay rules can be accurately identified, the false detection rate can be reduced, and the security of equipment using Modbus TCP communication in an industrial control environment is improved, which is conducive to maintaining the stability of the industrial intranet.

[0029] It should be understood that the contents described in the summary of the invention are not intended to limit the key or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, among which: Figure 1 A flow chart of a Modbus TCP replay attack detection and control method based on an industrial control network gate provided by an embodiment of the present disclosure is shown.

[0031] Figure 2 A structural diagram of a Modbus TCP replay attack detection and control device based on an industrial control network gate provided in an embodiment of the present disclosure is shown.

[0032] Figure 3 A block diagram of an exemplary electronic device capable of implementing an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0034] In addition, the term "and / or" in this article is only a description of the association relationship between the associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0035] In response to the problems in the background technology, the disclosed embodiment provides a ModbusTCP replay attack detection and control method based on an industrial control network firewall. When the time when the client sends a data packet is within the preset effective time range, the data packet is released or discarded by comparing the source IP address of the data packet with the cached legal address; when the time when the client sends a data packet is not within the preset effective time range, the type of the data packet is determined; if the data packet is a TCP handshake packet, the data packet is released; if the data packet is a request packet, the first response packet corresponding to the constructed data packet is sent to the client, so that the client generates a second response packet according to the first response packet; according to the type of the second response packet, the blocking packet corresponding to the data packet is used to block the communication and reset the preset effective time range so that the data packet sent by the client can be detected next time, or the data packet is released. In this way, zero-trust replay attack detection is achieved, replay attacks that meet the replay rules can be accurately identified, the false detection rate can be reduced, and the security of equipment using Modbus TCP communication in the industrial control environment is improved, which is conducive to maintaining the stability of the industrial intranet.

[0036] The ModbusTCP replay attack detection and control method based on the industrial control network gate provided by the embodiment of the present disclosure is described in detail below with reference to the accompanying drawings through specific embodiments.

[0037] Figure 1 A flow chart of a Modbus TCP replay attack detection and control method based on an industrial control network gate provided by an embodiment of the present disclosure is shown. The method 100 includes the following steps: S110, when the time when the client sends the data packet is within the preset effective time range, the data packet is released or discarded by comparing the source IP address of the data packet with the cached legal address.

[0038] In some embodiments, the data packet is allowed to pass or discarded by comparing the source IP address of the data packet with the cached legitimate address, including: If the source IP address of the data packet is a legal address, the data packet is allowed to pass.

[0039] If the source IP address of the data packet is an illegal address, the data packet will be discarded.

[0040] S120, when the time when the client sends a data packet is not within the preset effective time range, determine the type of the data packet; if the data packet is a TCP handshake packet, release the data packet; if the data packet is a request packet, send the first response packet corresponding to the constructed data packet to the client, so that the client can generate a second response packet based on the first response packet.

[0041] In some embodiments, if the data packet is a request packet, before / after / simultaneously sending the first response packet corresponding to the constructed data packet to the client includes: Extract the transaction ID from the packet.

[0042] The transaction ID of the first response packet is set according to the transaction ID in the data packet.

[0043] In some embodiments, setting the transaction ID of the first response packet according to the transaction ID in the data packet includes: The transaction ID in the data packet is recorded as X, and the transaction ID of the first response packet is set to X+1.

[0044] S130, according to the type of the second response packet, using the blocking packet corresponding to the data packet to block the communication and re-set the preset effective time range so as to detect the data packet sent by the client next time, or release the data packet.

[0045] In some embodiments, according to the type of the second response packet, using the blocking packet corresponding to the data packet to block the communication and resetting the preset effective time range so as to detect the data packet sent by the client next time, or releasing the data packet, includes: If the second response packet is a request packet, compare the transaction ID of the second response packet with the transaction ID of the first response packet; if the transaction ID of the second response packet is equal to the transaction ID of the first response packet, it means that the data packet is replay attack data, so use the blocking packet corresponding to the data packet to block the communication and reset the preset effective time range.

[0046] If the second response packet is an error prompt packet or a connection termination packet, the data packet is considered to be replay attack data that complies with the replay rule, so a blocking packet corresponding to the data packet is used to block communication and reset the preset effective time range.

[0047] Otherwise, the packet is passed.

[0048] In some embodiments, blocking communication using a blocking packet corresponding to the data packet includes: The source IP address of the data packet is recorded as an illegal address, and a blocking packet corresponding to the data packet is sent to the client to block communication.

[0049] In some embodiments, the method 100 further includes: The source IP address of the released data packet is recorded as a legal address.

[0050] According to the embodiments of the present disclosure, when the time when the client sends a data packet is within the preset effective time range, the data packet is released or discarded by comparing the source IP address of the data packet with the cached legal address; when the time when the client sends a data packet is not within the preset effective time range, the type of the data packet is determined; if the data packet is a TCP handshake packet, the data packet is released; if the data packet is a request packet, the first response packet corresponding to the constructed data packet is sent to the client, so that the client generates a second response packet based on the first response packet; according to the type of the second response packet, the blocking packet corresponding to the data packet is used to block the communication and reset the preset effective time range so that the data packet sent by the client can be detected next time, or the data packet is released. In this way, zero-trust replay attack detection is achieved, replay attacks that meet the replay rules can be accurately identified, the false detection rate can be reduced, and the security of equipment using Modbus TCP communication in the industrial control environment is improved, which is conducive to maintaining the stability of the industrial intranet.

[0051] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the present disclosure is not limited by the order of the actions described, because according to the present disclosure, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present disclosure.

[0052] The above is an introduction to the method embodiment. The following is a further explanation of the scheme disclosed in the present invention through an apparatus embodiment.

[0053] Figure 2 The structure diagram of a Modbus TCP replay attack detection and control device based on an industrial control network gate provided by an embodiment of the present disclosure is shown. Module 200 includes: The diversion module 210 , the replay attack detection module 220 , and the packetization module 240 are connected in sequence; wherein the replay attack detection module is also connected to the control module 230 .

[0054] The traffic diversion module 210 is used to receive data packets sent by the client and send the data packets to the replay detection module 220.

[0055] In some embodiments, the drainage module 210 is specifically used to: The data packet sent by the client is sent to the replay detection module 220 through the Modbus TCP communication port.

[0056] The replay attack detection module 220 is used to receive data packets, and when the time when the client sends the data packet is within a preset effective time range, the data packet is released or discarded according to the comparison result between the source IP address of the data packet and the cached legal address.

[0057] It is also used to determine the type of data packet when the time when the client sends the data packet is not within the preset effective time range; if the data packet is a TCP handshake packet, the data packet is released; if the data packet is a request packet, the first response packet corresponding to the constructed data packet is sent to the client, so that the client can generate a second response packet based on the first response packet.

[0058] It is also used to block communication using a blocking packet corresponding to the data packet and reset a preset effective time range according to the type of the second response packet so as to detect the data packet sent by the client next time, or to release the data packet.

[0059] In some embodiments, the replay attack detection module 220 is specifically used to: According to the type of the second response packet, using the blocking packet corresponding to the data packet to block the communication and resetting the preset effective time range so as to detect the data packet sent by the client next time, or releasing the data packet, including:

[0060] If the second response packet is a request packet, compare the transaction ID of the second response packet with the transaction ID of the first response packet; if the transaction ID of the second response packet is equal to the transaction ID of the first response packet, use the blocking packet corresponding to the data packet to block the communication and reset the preset effective time range.

[0061] If the second response packet is an error prompt packet or a connection termination packet, a blocking packet corresponding to the data packet is used to block the communication and reset the preset effective time range.

[0062] Otherwise, the packet is passed.

[0063] Further, using a blocking packet corresponding to the data packet to block communication includes: The source IP address of the data packet is recorded as an illegal address, and a blocking packet corresponding to the data packet is sent to the client to block communication; specifically, the source IP address of the data packet is recorded as an illegal address, and the recorded illegal address is cached to the packet module, and a blocking packet corresponding to the data packet is sent to the client to block communication.

[0064] The control module 230 is used to compare the source IP address of the data packet with the cached legal address.

[0065] In some embodiments, the control module 230 is further configured to cache the source IP address of the data packet.

[0066] Specifically, the control module 230 is further used to cache the source IP addresses of data packets recorded as legal addresses and / or illegal addresses.

[0067] The packetization module 240 is used to construct a first response packet corresponding to the data packet; and is also used to construct a blocking packet.

[0068] In some embodiments, the packaging module 240 is further configured to: Extract the transaction ID in the data packet, and set the transaction ID of the first response packet according to the transaction ID in the data packet.

[0069] Specifically, if the data packet is a request packet, before / after / simultaneously sending the first response packet corresponding to the constructed data packet to the client, includes: Extract the transaction ID from the packet.

[0070] The transaction ID of the first response packet is set according to the transaction ID in the data packet.

[0071] Understandably, Figure 2 Each module / unit in the illustrated module 200 has the function of implementing each step in the method 100 provided in the embodiment of the present disclosure and can achieve its corresponding technical effect, which will not be described in detail here for the sake of brevity.

[0072] Figure 3 A block diagram of an exemplary electronic device capable of implementing an embodiment of the present disclosure is shown. The electronic device 300 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device 300 may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0073] like Figure 3 As shown, the electronic device 300 includes a computing unit 301, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 302 or a computer program loaded from a storage unit 308 to a random access memory (RAM) 303. In the RAM 303, various programs and data required for the operation of the electronic device 300 can also be stored. The computing unit 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An I / O interface 305 is also connected to the bus 304.

[0074] A number of components in the electronic device 300 are connected to the I / O interface 305, including: an input unit 306, such as a keyboard, a mouse, etc.; an output unit 307, such as various types of displays, speakers, etc.; a storage unit 308, such as a disk, an optical disk, etc.; and a communication unit 309, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 309 allows the electronic device 300 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0075] The computing unit 301 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 301 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 301 performs the various methods and processes described above, such as method 100. For example, in some embodiments, the method 100 may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 308. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 300 via the ROM 302 and / or the communication unit 309. When the computer program is loaded into the RAM 303 and executed by the computing unit 301, one or more steps of the method 100 described above may be performed. Alternatively, in other embodiments, the computing unit 301 may be configured to perform the method 100 in any other appropriate manner (e.g., by means of firmware).

[0076] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0077] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0078] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0079] It should be noted that the present disclosure also provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable a computer to execute method 100 and achieve the corresponding technical effect achieved by executing the method in the embodiment of the present disclosure. For the sake of concise description, they are not repeated here.

[0080] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0081] The systems and techniques described herein can be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with the systems and techniques described herein.

[0082] The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0083] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0084] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0085] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A Modbus TCP replay attack detection and control method based on industrial control network gate, characterized in that: include: When the client sends a data packet within the preset valid time range, the source IP address of the data packet is compared with the cached legal address to release or discard the data packet; When the time when the client sends a data packet is not within the preset effective time range, determine the type of the data packet; If the data packet is a TCP handshake packet, the data packet is released; If the data packet is a request packet, a first response packet corresponding to the constructed data packet is sent to the client, so that the client generates a second response packet according to the first response packet; According to the type of the second response packet, the blocking packet corresponding to the data packet is used to block the communication and reset the preset effective time range so as to detect the data packet sent by the client next time, or release the data packet.

2. The method according to claim 1, characterized in that The method of comparing the source IP address of the data packet with the cached legal address and allowing or discarding the data packet includes: If the source IP address of the data packet is a legal address, the data packet is released; If the source IP address of the data packet is an illegal address, the data packet will be discarded.

3. The method according to claim 1, characterized in that If the data packet is a request packet, before / after / simultaneously sending the first response packet corresponding to the constructed data packet to the client, comprises: Extract the transaction ID from the data packet; The transaction ID of the first response packet is set according to the transaction ID in the data packet.

4. The method according to claim 3, characterized in that The method of blocking communication using a blocking packet corresponding to the data packet and resetting a preset effective time range according to the type of the second response packet so as to detect the data packet sent by the client next time, or releasing the data packet, includes: If the second response packet is a request packet, compare the transaction ID of the second response packet with the transaction ID of the first response packet; if the transaction ID of the second response packet is equal to the transaction ID of the first response packet, use the blocking packet corresponding to the data packet to block the communication and reset the preset effective time range; If the second response packet is an error prompt packet or a connection termination packet, the blocking packet corresponding to the data packet is used to block the communication and reset the preset effective time range; Otherwise, the packet is passed.

5. The method according to claim 4, characterized in that The blocking of communication using a blocking packet corresponding to the data packet includes: The source IP address of the data packet is recorded as an illegal address, and a blocking packet corresponding to the data packet is sent to the client to block communication.

6. The method according to claim 1, characterized in that The method further comprises: The source IP address of the released data packet is recorded as a legal address.

7. A Modbus TCP replay attack detection and control device based on an industrial control network gate, characterized in that: include: A diversion module, a replay attack detection module, and a packetization module are connected in sequence; wherein the replay attack detection module is also connected to the control module; A traffic diversion module, used for receiving data packets sent by the client and sending the data packets to the replay detection module; The replay attack detection module is used to receive data packets. When the time when the client sends the data packet is within the preset effective time range, the data packet is released or discarded according to the comparison result between the source IP address of the data packet and the cached legal address; It is also used to determine the type of data packet when the time when the client sends the data packet is not within the preset effective time range; if the data packet is a TCP handshake packet, the data packet is released; if the data packet is a request packet, the first response packet corresponding to the constructed data packet is sent to the client, so that the client generates a second response packet according to the first response packet; It is also used to block the communication using the blocking packet corresponding to the data packet and reset the preset effective time range to detect the data packet sent by the client next time, or release the data packet according to the type of the second response packet; A control module, used to compare the source IP address of the data packet with the cached legal address; The packet module is used to construct a first response packet corresponding to a data packet; it is also used to construct a blocking packet.

8. The device according to claim 7, characterized in that The control module is also used to cache the source IP address of the data packet; The packet packaging module is further used to extract the transaction ID in the data packet and set the transaction ID of the first response packet according to the transaction ID in the data packet.

9. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1 to 6.

10. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1 to 6.

Images