Memory security implementation method applied to intelligent electric meter protocol
By using the Rust language to perform memory security checks and boundary checks in the smart meter protocol, the memory security risks in traditional protocols are solved, the system security and reliability are improved, maintenance costs are reduced, and high performance is maintained.
Patent Information
- Application Number
- CN202411610504.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-12
- Publication Date
- 2025-02-14
AI Technical Summary
The implementation of the traditional DL/T 698.45 protocol has memory security risks, such as buffer overflow and memory leaks, which lead to system crashes or data tampering, affecting the security and reliability of the power grid.
Memory security checking is performed using Rust language, and through bounds checking and error capture processing mechanisms, ensuring the security of memory access, and using Rust's ownership mechanism to automatically manage the memory life cycle.
It improves the memory security and reliability of smart meters, reduces vulnerability repair costs, provides higher system stability and performance, and is suitable for progressive upgrades of embedded systems.
Smart Images
Figure CN119442252A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of smart meters, and in particular relates to a memory security implementation method applied to a smart meter protocol. Background Art
[0002] With the rapid development of smart grids, the memory security and stability of the system have become decisive factors. The market demand for safer, more stable and efficient embedded systems is growing, especially in the field of smart meters.
[0003] As the core data communication protocol of China's smart meters, the DL / T 698.45 protocol supports key operations such as meter reading, billing, and remote control. However, the traditional DL / T 698.45 protocol is mostly implemented based on the C language, which has many memory security risks, such as buffer overflow and memory leakage. These problems may be exploited to cause system crashes or data tampering, seriously affecting the security of the power grid. The main disadvantages of using C language are as follows: (1) Low memory security: The pointer operation and memory management mechanism of the C language make the program vulnerable to buffer overflow and memory leakage attacks. This low memory security will not only cause system crashes, but may also be exploited by attackers to tamper with meter data or conduct denial of service attacks (DoS). (2) Imperfect error handling mechanism: The C language implementation lacks comprehensive error handling, which causes the program to crash when encountering abnormal situations. This means that smart meters may not be able to recover effectively when facing network attacks or data anomalies, which in turn affects their reliability and data accuracy. (3) High maintenance cost: Due to the complexity of the C language, the maintenance and vulnerability repair costs of the program are high. Due to the existence of vulnerabilities, maintenance personnel need to constantly patch security vulnerabilities, which increases labor and time costs.
[0004] Go is a memory-safe programming language. Its automatic garbage collection function reduces the burden of manual memory management and simplifies resource management. However, Go's garbage collection mechanism may introduce uncontrollable delays in embedded systems, which is not suitable for devices such as smart meters that require stable response time. In addition, Go's memory control is not detailed enough to completely avoid data contention. Summary of the invention
[0005] In view of the above problems, the present invention provides a memory safety implementation method applied to the smart meter protocol, which is used to perform memory safety checks using the Rust language, and provides a safer, more stable and efficient DL / T 698.45 protocol implementation scheme to improve the reliability and maintenance efficiency of smart meters.
[0006] In order to solve the above technical problems, the present invention adopts the following technical solutions:
[0007] A memory safety implementation method for smart meter protocol is implemented using Rust language, including:
[0008] In the stage where the client requests meter data, when the client needs to perform a meter reading request operation, the meter reading request is encapsulated into a transmission frame request type DLPDU of the physical layer, and sent to the data link layer of the meter through any communication channel including RS485, infrared, and carrier. After the data link layer receives the transmission frame request type DLPDU of the physical layer, the transmission frame is checked in the form of a buffer according to the link layer protocol, including frame header check and frame check. After the check passes, the request type APDU data in the transmission frame request type DLPDU of the physical layer is extracted, and the RUST code performs a fixed offset read on the transmission frame memory to obtain the memory first address of the request type APDU data. If there is a vulnerability in the code itself when it is written, a memory out-of-bounds situation will occur. Rust is used for boundary checking. In the code compilation stage, the first boundary check is inserted into the request type DLPDU memory access code to check whether the code writing has a memory out-of-bounds vulnerability. If so, a compilation error is reported. After the application layer receives the request type APDU data parsed by the data link layer, it parses the request type APDU according to the DL / T 698.45 protocol, obtains the request type and object category, and sends the corresponding instruction to the meter to complete the client request.
[0009] When the meter returns data to the client, the meter responds to the specific request sent by the application layer, builds a response APDU and passes it to the data link layer. The application layer applies for a piece of memory to build the response APDU data. According to the DL / T 698.45 protocol, the response APDU data format includes the application layer service type, object identifier and returned result, and offsets and assigns values to the memory according to the protocol format. Rust is used for boundary checking. During the code compilation stage, a second boundary check is inserted into the response APDU memory access code. If the code itself has a memory out-of-bounds vulnerability, the compilation will report an error. When the code is running, before each memory access, it verifies whether the index is within the legal range of the memory. If a memory out-of-bounds occurs, a panic is thrown. The code captures the panic through Rust's match...Err error handling mechanism and returns the bound The error code is returned to the client; and Rust's ownership mechanism automatically manages the life cycle of each memory application, and the compiler strictly tracks the life cycle of each variable; when the ownership of a variable is transferred or invalid, an error is reported during the compilation phase, prompting the developer that an attempt is being made to access a dangling pointer; and when a variable is invalid, the memory is automatically released; after the data link layer receives the response APDU data passed by the application layer, it constructs a response DLPDU transmission frame according to the DL / T 698.45 protocol, and then returns it to the client through any communication channel including RS485, infrared, and carrier.
[0010] In a possible implementation, in S10, the format of the transmission frame DLPDU includes a frame header, a specific request data APDU and a frame trailer, wherein the frame header includes a start character, a length field, a control field, an address field and a frame header check value, and the frame trailer includes a frame check and an end character.
[0011] In a possible implementation manner, the format of the specific request data APDU is: application layer service type and object identifier, wherein the application layer service type includes a read request / set request, and the object identifier includes an object category, power, and rate.
[0012] In one possible implementation, in S10, the frame header check is a CRC check of all bytes in the frame header except the start character and the frame header check value itself. In this process, the code involves offset reading and calculation operations on the memory. The Rust compiler inserts a boundary check into the memory access code during the compilation phase, and when the code is running, it verifies whether the index is within the legal range of the memory before each memory access. If a memory out-of-bounds error occurs, a panic is thrown. The code can capture the panic through Rust's match...Err error handling mechanism and return a bound error code to the client to let the client know the cause of the error.
[0013] In a possible implementation manner, the application layer service type in the response-type APDU data includes a read response / set response, the object identifier includes an object category, and the returned result Result includes data and an error code.
[0014] The present invention has the following beneficial effects:
[0015] (1) High security: The ownership mechanism automatically manages memory and can identify common memory security vulnerabilities such as dangling pointers, repeated memory releases, and null pointer references during the code compilation phase, reducing vulnerability repair costs.
[0016] (2) High reliability: Through boundary checking and error capture and handling mechanisms, illegal memory operations during code execution can be captured in a timely manner, providing an error handling mechanism to prevent the program from crashing or being in an unexpected state.
[0017] (3) High performance: It has no runtime and no garbage collection features, and its execution efficiency is close to that of C / C++.
[0018] (4) Compatibility: It can be seamlessly compatible with C language through the external function interface (FFI), and only the data link layer and application layer are replaced by the Rust language. It not only improves memory security but also maintains the stability of the existing system, which is especially suitable for gradual upgrades in embedded systems. BRIEF DESCRIPTION OF THE DRAWINGS
[0019] Figure 1 A schematic diagram of a DL / T698.45 protocol communication framework in a memory security implementation method applied to a smart meter protocol according to an embodiment of the present invention;
[0020] Figure 2 The present invention is a flowchart of the steps of a method for implementing memory security applied to a smart meter protocol according to an embodiment of the present invention. DETAILED DESCRIPTION
[0021] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0022] See also Figure 1 and Figure 2 ,in Figure 1 A schematic diagram of a DL / T 698.45 protocol communication framework in a memory security implementation method applied to a smart meter protocol according to an embodiment of the present invention; Figure 2 This is a flowchart of a memory safety implementation method for a smart meter protocol according to an embodiment of the present invention based on the DL / T698.45 protocol communication framework, which is implemented in Rust language, including:
[0023] S10, in the stage where the client requests meter data, when the client needs to perform a meter reading request operation, the meter reading request is encapsulated into a transmission frame request type DLPDU of the physical layer, and sent to the data link layer of the meter through any communication channel including RS485, infrared, and carrier; after the data link layer receives the transmission frame request type DLPDU of the physical layer, the transmission frame is checked in the form of a Buffer according to the link layer protocol, including frame header check and frame check; after the check is passed, the request type APDU data in the transmission frame request type DLPDU of the physical layer is extracted, and the RUST code performs a fixed offset on the transmission frame memory Read the first memory address of the request-type APDU data. If the code itself has a vulnerability when it is written (for example, the offset address exceeds the memory size), there may be a memory out-of-bounds situation. Use Rust for boundary checking. In the code compilation stage, insert the first boundary check into the request-type DLPDU memory access code to check whether the code has a memory out-of-bounds vulnerability. If so, compile and report an error. After obtaining the first address of the APDU data, get the content of the APDU according to the length of the APDU. This length depends on the object category in the request (power, rate, etc.), which is dynamic and cannot be discovered when the code is compiled. If it is attacked externally, the length variable is modified and may exceed the memory size, which will also cause a memory out-of-bounds situation. Relying on Rust's boundary checking feature, when the code is running, it will verify whether the index is within the legal memory range before each memory access. If a memory out-of-bounds situation occurs, a panic will be thrown. The code can capture the panic through Rust's match...Err error handling mechanism, and return the bound error error code to the client, so that the client knows the cause of the error, and performs corresponding risk avoidance to avoid system crashes. After receiving the request APDU data parsed by the data link layer, the application layer parses the request APDU according to the DL / T 698.45 protocol, obtains the request type and object category, and sends the corresponding command to the meter to complete the client request;
[0024] S20, the stage where the electric meter returns data to the client. The electric meter responds to the specific request sent by the application layer, builds a response APDU and passes it to the data link layer. The application layer applies for a piece of memory to build the response APDU data. According to the DL / T 698.45 protocol, the response APDU data format includes the application layer service type, object identifier and returned result, and the memory is offset, calculated (CRC check of frame header and frame), and assigned according to the protocol format. During this process, if there is a vulnerability in the code itself, such as the code does not perform a reliability check during the memory offset operation, incorrect data will be obtained, which will cause the CRC check value to be incorrect. Then, after the client receives the response data, it will fail the check; similarly, if this process is attacked externally, such as a buffer overflow attack, causing the excess buffer to overwrite other data in the program memory, the electric meter will be reset or other unpredictable errors will occur. After reconstruction with Rust language, the data buffer is controlled by Rust, and Rust is used for boundary checking. In the code compilation stage, a second boundary check is inserted into the response APDU memory access code. If the code itself has a memory out-of-bounds vulnerability, the compilation will report an error; and when the code is running, before each memory access, it is verified whether the index is within the legal memory range. If a memory out-of-bounds occurs, a panic is thrown, and the code captures the panic through Rust's match...Err error handling mechanism, and returns the bound error code to the client; and Rust's ownership mechanism is set to automatically manage the life cycle of each memory application, and the compiler strictly tracks the life cycle of each variable; when the ownership of the variable is transferred or invalid, an error is reported in the compilation stage, prompting the developer that an attempt is being made to access a dangling pointer; and when the variable is invalid, the memory is automatically released; after the data link layer receives the response APDU data transmitted by the application layer, it constructs a response DLPDU transmission frame according to the DL / T 698.45 protocol, and then returns it to the client through any communication channel including RS485, infrared, and carrier.
[0025] In the implementation process of S10 and S20, memory allocation and release are involved. Due to the different capabilities of each coder, the code may have problems such as memory leaks and dangling pointer access. This is a very easy security risk in the C language implementation. Relying on Rust's ownership mechanism, the compiler strictly tracks the life cycle of each variable. When the ownership of the variable is transferred or invalid, an error can be reported during the compilation phase, prompting the developer that an attempt is being made to access a dangling pointer; and when the variable is invalid, the memory is automatically released, without the need to manually release the memory as in the C language, avoiding hidden dangers such as memory leaks. In addition, there is no need for a garbage collector at runtime, and the collection is completely automatic, so there is no additional performance loss at runtime, and the code execution efficiency is comparable to that of the C language.
[0026] In a specific application example, in S10, the format of the physical layer transmission frame request type DLPDU includes a frame header, a specific request data APDU and a frame tail, wherein the frame header includes a start character, a length field, a control field, an address field and a frame header check value, and the frame tail includes a frame check and an end character. The format of the specific request data APDU is: application layer service type and object identifier, wherein the application layer service type includes a read request / set request, and the object identifier includes the object category, power, and rate. In the DLPDU transmission frame, the offset address for storing the APDU is fixed (buffer offset frame header size), and the data length of the APDU is not fixed (the data length is different depending on the object category).
[0027] In a specific application example, in S10, the frame header check is a CRC check of all bytes in the frame header except the start character and the frame header check value itself. In this process, the code involves offset reading and calculation operations on the memory. For example, the length domain data (Buffer[1], length is 2Byte) is read from the address of the buffer offset address 1 (skipping the start character, length is 1Byte), and the control domain data (Buffer[3], length is 1Byte) is read from the address of the buffer offset address 3. And so on, read other data in the frame header, and then perform CRC check. In this process, if there is a vulnerability in the code itself, such as the code does not perform reliability check during memory offset operation, wrong data will be obtained, which will cause the CRC check comparison to fail; similarly, if this process is attacked externally, such as a buffer overflow attack, causing the excess buffer to overwrite other data in the program memory, it will cause the meter to reset or other unpredictable errors. For smart meter scenarios, this may cause the meter to be unable to recognize or process the client's request, which in turn causes service interruption, and cannot respond to user queries or operation requests in a timely manner, affecting user experience or causing billing errors. After reconstruction with Rust language, the data buffer is controlled by Rust. Relying on Rust's bounds checking feature, when reading memory offsets, it can automatically detect whether the memory access is out of bounds to prevent buffer overflow. The Rust compiler inserts bounds checks into the memory access code during the compilation phase, and verifies whether the index is within the legal memory range before each memory access when the code is running. If a memory out of bounds occurs, a panic is thrown. The code can capture the panic through Rust's match...Err error handling mechanism and return the bound error code to the client, so that the client knows the cause of the error and performs corresponding risk avoidance to avoid system crashes.
[0028] In a specific application example, in S20, the application layer service type in the response APDU data includes read response / set response, the object identifier includes the object category, and the returned result Result includes data and error code. The error code can be, for example, 1 for hardware failure and 3 for read / write rejection. If successful, the response data will be filled into Result[1], such as power data and rate data, where the length of the data depends on the type of response, for example, the length of power data is 8Byte (unit: kWh); the length of rate data is 8Byte (unit: yuan / kWh).
[0029] In a specific application example, after receiving the APDU data parsed by the data link layer, the application layer sends the corresponding instruction to the meter to complete the request. For example, the request type 05 represents a read operation, and 06 represents a setting operation; the object category is 2031, which represents the monthly power consumption; the object category is 201A, which represents the rate. Therefore, the APDU data for reading the power is 052031, and the APDU data for reading the rate is 05201A; the setting is similar, followed by specific setting data (the power data length is 8Bytes, unit kWh; the rate data length is 8Bytes, unit: yuan / kWh).
[0030] It should be understood that the exemplary embodiments described herein are illustrative rather than restrictive. Although one or more embodiments of the present invention have been described in conjunction with the accompanying drawings, it should be understood by those skilled in the art that various changes in form and detail may be made without departing from the spirit and scope of the present invention as defined by the appended claims.
Claims
1. A memory security implementation method applied to a smart meter protocol, characterized in that: Use Rust language for code implementation, including: S10, in the stage where the client requests meter data, when the client needs to perform a meter reading request operation, the meter reading request is encapsulated into a transmission frame request type DLPDU of the physical layer, and sent to the data link layer of the meter through any communication channel including RS485, infrared, and carrier; after the data link layer receives the transmission frame request type DLPDU of the physical layer, the transmission frame is checked in the form of a Buffer according to the link layer protocol, including frame header check and frame check; after the check is passed, the request type APDU data in the transmission frame request type DLPDU of the physical layer is extracted, and the RUST code performs a fixed offset read on the transmission frame memory to obtain the memory first address of the request type APDU data. If the code itself has a vulnerability when it is written, a memory out-of-bounds situation will occur; Rust is used for boundary checking, and in the code compilation stage, the first boundary check is inserted into the memory access code for the request type DLPDU to check whether the code writing has a memory out-of-bounds vulnerability. If so, a compilation error is reported; after the application layer receives the request type APDU data parsed by the data link layer, it is checked according to the DL / T The 698.45 protocol parses the request APDU, obtains the request type and object category, and sends the corresponding command to the meter to complete the client request; S20, the stage where the meter returns data to the client. The meter responds to the specific request sent by the application layer, builds a response APDU and passes it to the data link layer. The application layer applies for a piece of memory to build the response APDU data. According to the DL / T 698.45 protocol, the response APDU data format includes the application layer service type, object identifier and returned result, and the memory is offset and assigned according to the protocol format. Rust is used for boundary checking. During the code compilation stage, a second boundary check is inserted into the response APDU memory access code. If the code itself has a memory out-of-bounds vulnerability, the compilation will report an error; and when the code is running, before each memory access, it verifies whether the index is within the legal range of the memory. If a memory out-of-bounds occurs, a panic is thrown. The code captures the panic through Rust's match...Err error handling mechanism and returns the bound The error code is returned to the client; and Rust's ownership mechanism automatically manages the life cycle of each memory application, and the compiler strictly tracks the life cycle of each variable; when the ownership of a variable is transferred or invalid, an error is reported during the compilation phase, prompting the developer that an attempt is being made to access a dangling pointer; and when a variable is invalid, the memory is automatically released; after the data link layer receives the response APDU data passed by the application layer, it constructs a response DLPDU transmission frame according to the DL / T 698.45 protocol, and then returns it to the client through any communication channel including RS485, infrared, and carrier.
2. The memory security implementation method applied to the smart meter protocol according to claim 1, characterized in that: In S10, the format of the transmission frame DLPDU includes a frame header, a specific request data APDU and a frame trailer, wherein the frame header includes a start character, a length field, a control field, an address field and a frame header check value, and the frame trailer includes a frame check and an end character.
3. The memory security implementation method applied to the smart meter protocol according to claim 2, characterized in that: The format of the specific request data APDU is: application layer service type and object identifier, wherein the application layer service type includes read request / set request, and the object identifier includes object category power and rate.
4. The memory security implementation method applied to the smart meter protocol according to claim 1, characterized in that: In S10, the frame header check is a CRC check of all bytes in the frame header except the start character and the frame header check value itself. In this process, the code involves offset reading and calculation operations on the memory. The Rust compiler inserts a boundary check into the memory access code during the compilation phase, and when the code is running, it verifies whether the index is within the legal range of the memory before each memory access. If a memory out-of-bounds error occurs, a panic is thrown. The code can capture the panic through Rust's match...Err error handling mechanism and return a bound error code to the client to let the client know the cause of the error.
5. The memory security implementation method applied to the smart meter protocol according to any one of claims 1 to 4, characterized in that: The application layer service type in the response-type APDU data includes a read response / set response, the object identifier includes an object category, and the returned result Result includes data and an error code.