CMS protocol message security verification method and system
By introducing a message security verification mechanism into the CMS protocol, the insertion and comparison of verification bits are used to solve the problem of lack of security verification in the plaintext mode of the CMS protocol, the security of substation communication is improved, and malicious attacks are prevented.
Patent Information
- Application Number
- CN202411512006.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-28
- Publication Date
- 2025-02-07
AI Technical Summary
The existing CMS protocol lacks a message security verification mechanism in plaintext mode, resulting in insufficient communication security in substations and is vulnerable to threats from man-in-the-middle attacks.
By calculating the check bits in the sender of the CMS protocol message and filling them in the reserved bits of the protocol, the receiver extracts and compares them with the expected value, and controls them if they are inconsistent to ensure the security of the message.
It increases the security of the CMS protocol in plaintext mode, and can promptly discover whether the packet has been maliciously modified, reduces losses and time costs, and maintains the network security of the substation.
Smart Images
Figure CN119402572A_ABST
Abstract
Description
Technical Field
[0001] The invention relates to a method and system for security verification of CMS protocol messages, belonging to the field of power system network security. Background Art
[0002] As substation equipment and protocols gradually become autonomous and controllable, the original MMS (Manufacturing Message Specification) protocol has been replaced by the CMS protocol. At the same time, the security issues of substation networks have gradually emerged. Man-in-the-middle attacks, as a common attack method, may exploit loopholes in communication protocols to affect communication equipment within the station, and in serious cases may threaten the safety of power grid operation.
[0003] The existing CMS protocol is designed with two communication modes: plain text and cipher text. The cipher text mode has taken security into consideration, including encryption and authentication, but the plain text mode lacks a message security verification mechanism. The communication messages actually used on site are often mainly plain text, which poses a hidden danger to the safe operation of the substation.
[0004] To this end, the present invention proposes a method and system for security verification of CMS protocol messages. Summary of the invention
[0005] The purpose of this application is to provide a method and system for security verification of CMS protocol messages. Considering that there are still reserved bits in the existing CMS protocol, a method for security verification of CMS protocol messages is proposed. By calculating the check bits of the sent message, associating it with the previous frame of the sent message, and filling the final check result into the protocol reserved bit, the purpose of security verification of the message is achieved, the security of communication is improved, so as to solve the problem that the existing communication protocol lacks a security verification mechanism, and further improve the security of substation communication.
[0006] In order to achieve the above objectives, this application adopts the following technical solutions:
[0007] A first aspect of the present invention provides a method for CMS protocol message security verification, comprising the following steps:
[0008] For the sender of the message: insert the check bit into the bak bit in the control code of the message header;
[0009] For the receiver of the message: extract the bak bit in the message header control code and generate a comparison check bit; compare the comparison check bit with the bak bit in the extracted message header control code; if the comparison results are consistent, continue with the subsequent message parsing work, if not consistent, control.
[0010] A further preferred solution of the present invention is to insert a check bit into the bak bit in the control code of the sending message header, comprising:
[0011] Step 1: Set the bak position in the control code of the message header to be sent to 0 and calculate the check bit of the complete message of the CMS protocol to obtain a temporary check bit;
[0012] Step 2: Perform an XOR operation on the temporary check bit obtained in the previous step and the final check bit of the previous frame message to obtain the final check bit of the current frame message;
[0013] Step 3: Fill the final check bit of the current frame message obtained in the previous step into the bak bit in the message header control code to complete the check bit insertion.
[0014] A further preferred solution of the present invention is to extract the bak bit in the message header control code and generate a comparison check bit, which includes:
[0015] Step 1: Extract the bak bit in the message header control code and set it to 0;
[0016] Step 2: Calculate the check bits of the complete CMS protocol message to obtain temporary check bits;
[0017] Step 3: Perform an XOR operation on the temporary check bit and the bak bit in the control code of the previous frame message header to obtain the comparison check bit of the current frame message.
[0018] According to a further preferred embodiment of the present invention, the process of calculating the check bit of the complete CMS protocol message in the sender includes performing an XOR operation on each bit of each byte in the message APDU to obtain the check bit.
[0019] According to a further preferred embodiment of the present invention, the final check bit of the previous frame message in the sender, when the current message is the first frame message sent, there is no previous frame message, and the value is 0 at this time.
[0020] According to a further preferred embodiment of the present invention, the bak bit in the control code of the previous frame message header in the receiver, when the current message is the first frame message received, there is no previous frame message, and the value is 0 at this time.
[0021] A further preferred solution of the present invention is that when the final comparison results in the receiving party are consistent, the subsequent message parsing work continues, which means that after receiving the message, the check code needs to be calculated first, and the message processing work continues after the comparison results are consistent.
[0022] According to a further preferred embodiment of the present invention, when the final comparison results in the receiving party are inconsistent, the management and control methods adopted include: interface alarm, syslog alarm, snmptrap alarm, sound and light alarm and communication blocking.
[0023] A further preferred solution of the present invention includes encryption protection of the message civil text, and assigning values to unused message frames in the message to achieve security protection.
[0024] A second aspect of the present invention provides a system for CMS protocol message security verification, and runs a method for CMS protocol message security verification, which is characterized by comprising:
[0025] Message sending module, message receiving module, message identification module, message control module;
[0026] A message sending module, used for inserting a check bit into the bak bit in the control code of the message header;
[0027] The message receiving module is used to extract the bak bit in the message header control code and generate a comparison check bit;
[0028] The message identification module is used to compare the comparison check bit with the bak bit in the extracted message header control code after the message receiving module generates the comparison check bit. If the comparison result is consistent, the subsequent message parsing work will continue;
[0029] The message control module is used to control by means of interface alarm, syslog alarm, snmptrap alarm, sound and light alarm and communication blocking when the message discrimination module judges that the comparison result is inconsistent. The beneficial effects of the present invention are: the present invention can be based on the CMS protocol, on the basis of sending unchanged plain text, add a security mechanism, strengthen the security of plain text communication, and promptly find out whether the message has been modified after being maliciously attacked, reduce subsequent losses and time costs, and maintain the network security of the substation. The present invention can strengthen the security of the CMS protocol in plain text mode, add a security verification mechanism, and can promptly find out after the message has been maliciously modified, thereby enhancing the security of communication. BRIEF DESCRIPTION OF THE DRAWINGS
[0030] Figure 1 This is a logic block diagram of a CMS protocol message security verification method provided in an embodiment of the present application.
[0031] Figure 2 It is the frame structure of the CMS protocol. DETAILED DESCRIPTION
[0032] In order to make the purpose, technical scheme and advantages of the present invention clearer, the technical scheme of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. The embodiments described in this application are only part of the embodiments of the present invention, not all of them. Based on the spirit of the present invention, other embodiments obtained by ordinary technicians in this field without creative work are all within the scope of protection of the present invention.
[0033] refer to Figure 1 to Figure 2 Embodiment 1 of the present invention provides a method for CMS protocol message security verification, comprising the following steps:
[0034] For the sender of the message:
[0035] Step 1: Set the bak position in the control code of the message header to be sent to 0 and calculate the check bit of the complete message of the CMS protocol to obtain a temporary check bit;
[0036] Step 2: At this time, the sender has completed the encapsulation of the CMS message and is preparing to send the message. Since the bak bit in the message header control code is a reserved bit, in order to prevent the private definition of the communicating parties, this bit needs to be set to 0 for security verification of the message;
[0037] Step 3: Calculate the check bit of the complete CMS protocol message, and perform an XOR operation on each bit of each byte in the message APDU (Application Protocol Data Unit), that is, the application protocol data unit, to obtain a temporary check bit; if the message is represented in hexadecimal as 01 (CC) 01 (SC) 00 04 (FL) 00 01 (ReqID) aa bb (service data), the calculation process is to perform an XOR operation on each bit of the above 8 bytes, and finally obtain a temporary check bit of 0;
[0038] Step 4: Perform an XOR operation on the temporary check bit obtained in the previous step and the final check bit of the previous frame message to obtain the final check bit of the current frame message;
[0039] Step 5: The temporary check bit obtained in the previous step is 0. When this message is the first frame message sent, there is no previous frame message, then the final check bit of the previous frame message is 0, and the final check bit of this frame message is 0; when this message is not the first frame message sent, if the final check bit of the previous frame message is 0, then the final check bit of this frame message is 0; if the final check bit of the previous frame message is 1, then the final check bit of this frame message is 1; at this time, "the first frame message sent" refers to the first frame message sent by the sender after the communicating parties establish a TCP link, and for the communicating parties (such as A and B communication), the calculation of the check bits is independent of each other, that is, A calculates the check of the message it sends, and checks the message sent by B at the same time; B calculates the check of the message it sends, and checks the message sent by A at the same time;
[0040] Step 6: Fill the final check bit of the current frame message obtained in the previous step into the bak bit in the message header control code to complete the check bit insertion; after the check bit insertion is completed, the message can be sent;
[0041] For the recipient of the message:
[0042] Step 1: Extract the bak bit in the control code of the message header and set it to 0. For example, if the control code of the received message, that is, the first byte of the message is 0x11, then its bak bit is 1. Save the information in the memory (such as variable X is assigned 1) and set it to 0. After setting it to 0, the control code of the message becomes 0x01.
[0043] Step 2: Calculate the temporary check bit and perform an XOR operation with the bak bit in the control code of the previous frame header; perform the check bit calculation of the complete CMS protocol message, perform an XOR operation on each bit of each byte in the message APDU (Application Protocol Data Unit), that is, the application protocol data unit to obtain the temporary check bit, for example, save the calculated temporary check bit result in Y; the bak bit in the control code of the previous frame header needs to be saved in the memory by the receiver (such as saved in the variable Z), when this message is the first frame message received, there is no previous frame message, and Z=0 at this time; perform an XOR operation on Z and Y to obtain R;
[0044] Step 3: Finally, compare the calculation result of the previous step with the extracted bak bit. If the comparison results are consistent, continue with the subsequent message parsing work. If they are inconsistent, control is performed.
[0045] Step 4: Compare R and X. If the final comparison results are consistent, continue with the subsequent message parsing work. Note that after receiving the message, the check code needs to be calculated first. If the comparison results are consistent, continue with the message processing work; the priority calculation of the check code can prevent the waste of computing resources when the check code is incorrect;
[0046] Step 5: If the final comparison results are inconsistent, control is performed. The control methods used include but are not limited to interface alarms, syslog alarms, snmptrap alarms, sound and light alarms, and communication blocking.
[0047] The warning in the present invention will only be triggered when the verification fails, and there is no clear relationship between the control method involved and the verification result. The user can choose one or more control methods according to their own needs and configuration.
[0048] Embodiment 2 of the present invention provides a system for CMS protocol message security verification, which runs a method for CMS protocol message security verification as described in claim 1, and is characterized in that it includes: a message sending module, a message receiving module, a message identification module, and a message management and control module.
[0049] (1) Message sending module: The message sending module inserts a check bit into the bak position in the control code of the message header to be sent, specifically including setting the bak position in the control code of the message header to 0 and calculating the check bit of the complete message of the CMS protocol to obtain a temporary check bit; then performing an XOR operation on the temporary check bit obtained in the previous step and the final check bit of the previous frame message to obtain the final check bit of the current frame message; finally, filling the final check bit of the current frame message obtained in the previous step into the bak position in the message header control code to complete the check bit insertion.
[0050] (2) Message receiving module: The message receiving module is used to extract the bak bit in the message header control code and generate a comparison check bit, specifically including extracting the bak bit in the message header control code and setting it to 0; then calculating the check bit of the complete message of the CMS protocol to obtain a temporary check bit; finally, performing an XOR operation on the temporary check bit and the bak bit in the message header control code of the previous frame to obtain the comparison check bit of the current frame message.
[0051] (3) Message identification module: The message identification module is used to compare the comparison check bit with the bak bit in the extracted message header control code after the message receiving module generates the comparison check bit. If the comparison result is consistent, the subsequent message parsing work continues;
[0052] (4) Message control module: The message control module is used to control by means of interface alarm, syslog alarm, snmptrap alarm, sound and light alarm and communication blocking when the comparison results determined by the message discrimination module are inconsistent.
[0053] The beneficial effects of the present invention are as follows: the present invention can increase the security mechanism based on the CMS protocol, send the plain text unchanged, strengthen the security of plain text communication, and timely find out whether the message has been modified after being maliciously attacked, thereby reducing subsequent losses and time costs and maintaining the network security of the substation. The present invention can strengthen the security of the CMS protocol in plain text mode, increase the security verification mechanism, and timely find out when the message has been maliciously modified, thereby enhancing the security of communication.
[0054] In order to make the purpose, technical scheme and advantages of the present invention clearer, the technical scheme of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. The embodiments described in this application are only part of the embodiments of the present invention, not all of them. Based on the spirit of the present invention, other embodiments obtained by ordinary technicians in this field without creative work are all within the scope of protection of the present invention.
Claims
1. A method for security verification of CMS protocol messages, characterized in that: The following steps are involved: For the sender of the message: insert the check bit into the bak bit in the control code of the message header; For the receiver of the message: extract the bak bit in the message header control code and generate a comparison check bit; compare the comparison check bit with the bak bit in the extracted message header control code; if the comparison results are consistent, continue with the subsequent message parsing work, if not consistent, control.
2. The method for security verification of CMS protocol messages according to claim 1, characterized in that: Inserting the check bit in the bak bit of the control code of the sending message header includes: Step 1: Set the bak position in the control code of the message header to be sent to 0 and calculate the check bit of the complete message of the CMS protocol to obtain the temporary check bit; Step 2: Then perform an XOR operation on the temporary check bit obtained in the previous step and the final check bit of the previous frame message to obtain the final check bit of the current frame message; Step 3: Finally, fill the final check bit of the current frame message obtained in the previous step into the bak bit in the message header control code to complete the check bit insertion.
3. The method for security verification of CMS protocol messages according to claim 1, characterized in that: Extracting the bak bit in the message header control code and generating comparison check bits include: Step 1: Extract the bak bit in the message header control code and set it to 0; Step 2: Calculate the check bits of the complete CMS protocol message to obtain temporary check bits; Step 3: Perform an XOR operation on the temporary check bit and the bak bit in the control code of the previous frame message header to obtain the comparison check bit of the current frame message.
4. A method for security verification of CMS protocol messages according to claim 3, characterized in that: The process of calculating the check bit of the complete CMS protocol message in the sender includes performing an XOR operation on each bit of each byte in the message APDU to obtain the check bit.
5. A method for security verification of CMS protocol messages according to claim 4, characterized in that: The final check bit of the previous frame message in the sender. When this message is the first frame message sent, there is no previous frame message, and the value is 0.
6. A method for security verification of CMS protocol messages according to claim 5, characterized in that: The bak bit in the control code of the previous frame message header in the receiver, when this message is the first frame message received, there is no previous frame message, and the value is 0 at this time.
7. A method for security verification of CMS protocol messages according to claim 6, characterized in that: When the final comparison result in the receiving party is consistent, the subsequent message parsing work continues, which means that after receiving the message, the check code needs to be calculated first, and the message processing work continues after the comparison result is consistent.
8. A method for security verification of CMS protocol messages according to claim 7, characterized in that: When the final comparison results on the receiving end are inconsistent, the management and control methods used include: interface alarm, syslog alarm, snmptrap alarm, sound and light alarm and communication blocking.
9. A method for security verification of CMS protocol messages according to claim 8, characterized in that: It includes encryption protection of the message civil text, and assigning values to unused message frames in the message to achieve security protection.
10. A system for CMS protocol message security verification, running a CMS protocol message security verification method as claimed in any one of claims 1 to 9, characterized in that: include: Message sending module, message receiving module, message identification module, message control module; A message sending module, used for inserting a check bit into the bak bit in the control code of the message header; The message receiving module is used to extract the bak bit in the message header control code and generate a comparison check bit; The message identification module is used to compare the comparison check bit with the bak bit in the extracted message header control code after the message receiving module generates the comparison check bit. If the comparison result is consistent, the subsequent message parsing work will continue; The message control module is used to control when the message identification module judges that the comparison results are inconsistent, using interface alarms, syslog alarms, snmptrap alarms, sound and light alarms, and communication blocking.