A gateway security filtering method, electronic device, storage medium and program product

Abstract

The application provides a gateway security filtering method, an electronic device, a storage medium and a program product. The method comprises the following steps: receiving a to-be-processed packet; performing packet content analysis on the to-be-processed packet according to an OPC DA protocol format to obtain packet analysis data; determining a predetermined action of a strategy corresponding to the to-be-processed packet when the packet analysis data hits a preset OPC DA protocol security strategy matching item; constructing an ACK response packet when the predetermined action of the strategy is a blocking action; replying to the ACK response packet to a source address corresponding to the to-be-processed packet; and recording a transmission layer bearing data length corresponding to the to-be-processed packet into a diff_seq field of current industrial gateway device connection information, and discarding the to-be-processed packet. The method can guarantee that a TCP connection will not be disconnected on the basis of realizing an OPC DA protocol security filtering function, thereby ensuring real-time performance and reliability of the OPC DA protocol.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication security, in particular to a gateway security filtering method, an electronic device, a storage medium and a program product. BACKGROUND

[0002] At present, in the field of industrial automation, in order to protect network communication security, an OPC (OLE for Process Control) security gateway is usually deployed between enterprise information network and industrial control network. In the prior art, if the content of the OPC DA protocol message does not conform to the security policy of the industrial gateway device, the current message will be discarded and the OPC DA protocol communication connection will be disconnected. This practice causes the OPC DA protocol client to be unable to obtain and read and write data on the server in real time, which seriously violates the real-time and effectiveness emphasized by the OPC DA protocol. SUMMARY

[0003] The purpose of the present application is to provide a gateway security filtering method, an electronic device, a storage medium and a program product, which can ensure that the message forwarding of the message hitting the security policy is blocked, and the TCP connection is not disconnected, on the basis of realizing the OPC DA protocol security filtering function, and guarantee the real-time and reliability requirements of the OPC DA protocol.

[0004] The first aspect of the present application provides a gateway security filtering method, comprising:

[0005] receiving a to-be-processed message;

[0006] performing message content analysis on the to-be-processed message according to the OPC DA protocol format to obtain message analysis data;

[0007] when the message analysis data hits a preset OPC DA protocol security policy matching item, determining a policy predetermined action corresponding to the to-be-processed message;

[0008] when the policy predetermined action is a blocking action, constructing an ACK response message;

[0009] replying the ACK response message to a source address corresponding to the to-be-processed message;

[0010] recording a transmission layer bearing data length corresponding to the to-be-processed message into a diff_seq field of current industrial gateway device connection information, and performing a discarding operation on the to-be-processed message.

[0011] In the implementation process, the method receives the to-be-processed message preferentially, so as to ensure that the industrial gateway device can receive the message from the OPC DA client or server, and further provide a data basis for subsequent steps such as analysis, policy matching, and action execution. Then, the method performs message content analysis on the to-be-processed message according to the OPC DA protocol format to obtain message analysis data. As can be seen, this step can extract key information such as function code, data length, source address, and destination address from the message by analyzing the message content, so as to facilitate the execution of subsequent policy matching and action execution steps. At the same time, the analysis according to the OPC DA protocol format can ensure the accuracy and consistency of the analysis. Secondly, when the message analysis data hits the preset OPC DA protocol security policy matching item, the method determines the policy pre-determined action corresponding to the to-be-processed message. As can be seen, the method can perform security check and filtering on the received message through the preset security policy matching item, so as to protect the network from security threats such as malicious attacks and data leakage. Then, when the policy pre-determined action is a blocking action, the method constructs an ACK response message and replies the ACK response message to the source address corresponding to the to-be-processed message. As can be seen, when the message is blocked, the method can construct an ACK response message and reply to the source address, so as to simulate the state that the message has been successfully received, thereby avoiding the OPC DA client or server initiating retransmission or closing the connection due to not receiving the confirmation reply, and thereby helping to maintain the stability and continuity of the communication. Finally, the method records the transport layer bearer data length corresponding to the to-be-processed message in the diff_seq field of the current industrial gateway device connection information, and discards the to-be-processed message. As can be seen, the method can record the transport layer bearer data length of the to-be-processed message in the diff_seq field, thereby providing an important reference for the normal forwarding of subsequent messages. Specifically, when a subsequent message arrives, the industrial gateway device can adjust the TCP sequence number according to the record in the diff_seq field, so as to ensure that the server can correctly receive and process the message. At the same time, discarding the to-be-processed message can also ensure that the message that does not meet the security policy will not be forwarded to the network, thereby protecting the security of the network.

[0012] Further, the method further comprises:

[0013] When the message analysis data does not hit the OPC DA protocol security policy matching item, the to-be-processed message is determined as a to-be-forwarded message;

[0014] Obtaining the diff_seq field value of the connection cache corresponding to the to-be-forwarded message;

[0015] When the diff_seq field value is greater than 0, obtaining the current message sequence number and the current TCP protocol checksum of the to-be-forwarded message;

[0016] calculating a sequence number value according to the current packet sequence number and the diff_seq field value;

[0017] replacing the current packet sequence number of the to-be-forwarded packet with the sequence number value to obtain a replaced packet;

[0018] calculating a TCP checksum according to the replaced packet to obtain a checksum value;

[0019] replacing the current TCP protocol checksum of the replaced packet with the checksum value to obtain a to-be-sent packet;

[0020] performing a forwarding operation on the to-be-forwarded packet.

[0021] In the implementation process, the method can prevent malicious packets or illegal data from entering an industrial network, thereby improving the security of the entire communication system; and before forwarding the packet, the diff_seq field value of the connection cache corresponding to the to-be-forwarded packet is obtained, and a sequence number value and a TCP checksum are calculated according to the value, so that the sequence number and the checksum of the forwarded packet remain consistent with those of the original packet, which helps the receiving end to correctly identify and process the packet and avoids data disorder or loss.

[0022] Further, the calculating a sequence number value according to the current packet sequence number and the diff_seq field value comprises:

[0023] when the to-be-forwarded packet is a packet sent by a client, performing subtraction calculation on the current packet sequence number and the diff_seq field value to obtain a sequence number value;

[0024] when the to-be-forwarded packet is a packet sent by a server, performing addition calculation on the current packet sequence number and the diff_seq field value to obtain a sequence number value.

[0025] In the implementation process, the method can select a suitable calculation method (subtraction or addition) according to the sender (client or server) of the packet, so that the sequence number of the forwarded packet remains consistent with that of the original packet in relative position.

[0026] Further, the constructing an ACK response packet comprises:

[0027] determining a transport layer bearer data length of the to-be-processed packet according to the packet analysis data;

[0028] According to the message analysis data, control information of the to-be-processed message is acquired; wherein the control information at least includes a destination MAC address, a source MAC address, a destination IP address, a source IP address, a TCP protocol destination port number, a TCP protocol source port number, a TCP protocol sequence number and a TCP protocol acknowledgement number;

[0029] According to the transport layer bearing data length and the control information, an ACK response message is constructed.

[0030] In the implementation process, the method can use the control information (such as the destination MAC address, the source MAC address, the destination IP address, the source IP address, the TCP protocol destination port number, the TCP protocol source port number, etc.) parsed from the to-be-processed message to accurately construct the ACK response message, thereby ensuring the stability and reliability of the TCP connection by correctly including the information in the ACK response message.

[0031] Further, the construction of the ACK response message according to the transport layer bearing data length and the control information includes:

[0032] An original ACK message is constructed.

[0033] The destination MAC address is filled into a source MAC address of the original ACK message to obtain a first processed message.

[0034] The source MAC address is filled into a destination MAC address of the first processed message to obtain a second processed message.

[0035] The destination IP address is filled into a source IP address of the second processed message to obtain a third processed message.

[0036] The source IP address is filled into a destination IP address of the third processed message to obtain a fourth processed message.

[0037] An ACK identification of the TCP protocol in the fourth processed message is set to 1 to obtain a fifth processed message.

[0038] The TCP protocol destination port number is filled into a TCP protocol source port number field of the fifth processed message to obtain a sixth processed message.

[0039] The TCP protocol source port number is filled into a TCP protocol destination port number field of the sixth processed message to obtain a seventh processed message.

[0040] The TCP protocol acknowledgement number is filled into a TCP protocol sequence number field of the seventh processed message to obtain an eighth processed message.

[0041] According to the TCP protocol sequence number and the transport layer data length, a TCP protocol new acknowledgement number is calculated;

[0042] The TCP protocol new acknowledgement number is filled into a TCP protocol acknowledgement number field of the eighth processed packet to obtain a ninth processed packet;

[0043] The TCP protocol load data length of the ninth processed packet is set to 0 to obtain an ACK response packet.

[0044] In the implementation process, the method can ensure that the generated ACK response packet is logically consistent with the original request packet through a series of accurate address and port number filling steps and correct setting of the TCP protocol sequence number and the TCP protocol acknowledgement number, thereby guaranteeing the stability and reliability of the TCP connection.

[0045] Further, the OPC DA protocol security policy matching item includes one or more of a function code, an address policy, and a value policy, and the policy predetermined action includes a release action or a blocking action.

[0046] In the implementation process, the design of the OPC DA protocol security policy matching item has remarkable beneficial effects in improving communication security, improving system flexibility, simplifying security management, and supporting various security policies.

[0047] Further, the recording of the transport layer data length corresponding to the to-be-processed packet into a diff_seq field of current industrial gateway device connection information includes:

[0048] The transport layer data length corresponding to the to-be-processed packet is obtained.

[0049] When the number of to-be-processed packets to be discarded in the same connection is multiple, the diff_seq field value corresponding to each transport layer data length is determined, wherein the multiple to-be-processed packets to be discarded correspond to different time instants, respectively.

[0050] An accumulation operation is performed on all the diff_seq field values to obtain a to-be-recorded field value.

[0051] The to-be-recorded field value is recorded into a diff_seq field of current industrial gateway device connection information.

[0052] In the implementation process, the method can accumulate the transport layer bearer data length of multiple discarded messages of a connection when multiple messages of the connection need to be discarded, so as to ensure that the application layer data length / transport layer bearer data length of each message is correctly recorded and tracked, thereby helping to optimize the data processing flow and improve the accuracy and efficiency of data processing.

[0053] The second aspect of the application provides a gateway security filtering device, the gateway security filtering device comprises:

[0054] A receiving unit is configured to receive a to-be-processed message.

[0055] An analysis unit is configured to analyze the content of the to-be-processed message according to an OPC DA protocol format to obtain message analysis data.

[0056] A determination unit is configured to determine a predetermined action of a policy corresponding to the to-be-processed message when the message analysis data hits a preset OPC DA protocol security policy matching item.

[0057] A construction unit is configured to construct an ACK response message when the predetermined action of the policy is a blocking action.

[0058] A reply unit is configured to reply to the ACK response message to a source address corresponding to the to-be-processed message.

[0059] A recording unit is configured to record the transport layer bearer data length corresponding to the to-be-processed message in a diff_seq field of current industrial gateway device connection information.

[0060] A discarding unit is configured to discard the to-be-processed message.

[0061] Further, the gateway security filtering device further comprises:

[0062] A determination unit is configured to determine the to-be-processed message as a to-be-forwarded message when the message analysis data does not hit the OPC DA protocol security policy matching item.

[0063] An acquisition unit is configured to acquire a diff_seq field value of a connection cache corresponding to the to-be-forwarded message.

[0064] The acquisition unit is further configured to acquire a current message sequence number and a current TCP protocol checksum of the to-be-forwarded message when the diff_seq field value is greater than 0.

[0065] A calculation unit is configured to calculate a sequence number value according to the current message sequence number and the diff_seq field value.

[0066] A replacing unit, configured to replace a current message sequence number of the to-be-forwarded message with the sequence number value to obtain a replaced message;

[0067] The computing unit is further configured to calculate a TCP checksum according to the replaced message to obtain a checksum value;

[0068] The replacing unit is further configured to replace a current TCP protocol checksum of the replaced message with the checksum value to obtain a to-be-sent message;

[0069] A forwarding unit, configured to perform a forwarding operation on the to-be-forwarded message.

[0070] Further, the computing unit is specifically configured to, when the to-be-forwarded message is a message sent by a client, perform subtraction calculation on the current message sequence number and the diff_seq field value to obtain the sequence number value;

[0071] The computing unit is specifically further configured to, when the to-be-forwarded message is a message sent by a server, perform addition calculation on the current message sequence number and the diff_seq field value to obtain the sequence number value.

[0072] Further, the constructing unit comprises:

[0073] A first determining sub-unit, configured to determine a transport layer bearer data length of the to-be-processed message according to the message parsing data;

[0074] A first obtaining sub-unit, configured to obtain control information of the to-be-processed message according to the message parsing data; wherein the control information at least comprises a destination MAC address, a source MAC address, a destination IP address, a source IP address, a TCP protocol destination port number, a TCP protocol source port number, a TCP protocol sequence number and a TCP protocol acknowledgement number;

[0075] A constructing sub-unit, configured to construct an ACK response message according to the transport layer bearer data length and the control information.

[0076] Further, the constructing sub-unit comprises:

[0077] A constructing module, configured to construct an original ACK message;

[0078] A filling module, configured to fill the destination MAC address into a source MAC address of the original ACK message to obtain a first processed message;

[0079] The filling module is further configured to fill the source MAC address into a destination MAC address of the first processed message to obtain a second processed message;

[0080] The filling module is further configured to fill the destination IP address into a source IP address of the second processing packet to obtain a third processing packet.

[0081] The filling module is further configured to fill the source IP address into a destination IP address of the third processing packet to obtain a fourth processing packet.

[0082] The setting module is configured to set an ACK identifier of a TCP protocol in the fourth processing packet to 1 to obtain a fifth processing packet.

[0083] The filling module is further configured to fill the destination port number of the TCP protocol into a source port number field of a TCP protocol of the fifth processing packet to obtain a sixth processing packet.

[0084] The filling module is further configured to fill the source port number of the TCP protocol into a destination port number field of a TCP protocol of the sixth processing packet to obtain a seventh processing packet.

[0085] The filling module is further configured to fill the acknowledgement number of the TCP protocol into a sequence number field of a TCP protocol of the seventh processing packet to obtain an eighth processing packet.

[0086] The calculation module is configured to calculate a new acknowledgement number of a TCP protocol according to the sequence number of the TCP protocol and the length of the transmission layer bearing data.

[0087] The filling module is further configured to fill the new acknowledgement number of the TCP protocol into an acknowledgement number field of a TCP protocol of the eighth processing packet to obtain a ninth processing packet.

[0088] The setting module is further configured to set a length of load data of the TCP protocol of the ninth processing packet to 0 to obtain an ACK response packet.

[0089] Further, the OPC DA protocol security policy matching item includes one or more of a function code, an address policy, and a value policy, and the policy predetermined action includes a release action or a blocking action.

[0090] Further, the recording unit includes:

[0091] The second acquisition sub-unit is configured to acquire a length of transmission layer bearing data corresponding to the to-be-processed packet.

[0092] The second determination sub-unit is configured to determine a diff_seq field value corresponding to each length of transmission layer bearing data when a number of the to-be-processed packets to be discarded in a same connection is multiple, wherein the multiple to-be-processed packets to be discarded correspond to different time instants respectively.

[0093] a calculating sub-unit configured to perform an accumulation operation on all the diff_seq field values to obtain a to-be-recorded field value;

[0094] a recording sub-unit configured to record the to-be-recorded field value into a diff_seq field of current industrial gateway device connection information.

[0095] The third aspect of the present application provides an electronic device, comprising a memory and a processor, the memory is used for storing a computer program, and the processor runs the computer program to make the electronic device execute the gateway security filtering method in any one of the first aspect of the present application.

[0096] The fourth aspect of the present application provides a readable storage medium, which stores computer program instructions, and the computer program instructions are read and run by a processor to execute the gateway security filtering method in any one of the first aspect of the present application.

[0097] The fifth aspect of the present application provides a computer program product, which comprises a computer program, and the computer program is run by a processor to execute the gateway security filtering method in any one of the first aspect of the present application. BRIEF DESCRIPTION OF DRAWINGS

[0098] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0099] Figure 1 A flowchart of a gateway security filtering method provided by the embodiments of the present application;

[0100] Figure 2 A flowchart of another gateway security filtering method provided by the embodiments of the present application;

[0101] Figure 3 A flowchart of still another gateway security filtering method provided by the embodiments of the present application;

[0102] Figure 4 An example flowchart of a gateway security filtering method provided by the embodiments of the present application;

[0103] Figure 5 A blocking flowchart of a to-be-processed packet provided by the embodiments of the present application;

[0104] Figure 6A structural schematic diagram of a gateway security filtering device provided in an embodiment of the present application is shown in the figure.

[0105] Figure 7 A structural schematic diagram of another gateway security filtering device provided in an embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0106] The technical solutions in the embodiments of the present application will be described below with reference to the accompanying drawings in the embodiments of the present application.

[0107] It should be noted that similar reference numerals and letters refer to similar items in the accompanying drawings, and thus, once an item is defined in one drawing, it need not be further defined and explained in subsequent drawings. Meanwhile, in the description of the present application, the terms "first", "second", and the like are merely used to distinguish descriptions, and cannot be understood as indicating or implying relative importance.

[0108] Embodiment 1

[0109] Please refer to Figure 1 , Figure 1 A flowchart of a gateway security filtering method provided in the embodiment is shown in the figure. The gateway security filtering method includes the following steps.

[0110] S101, receiving a to-be-processed message.

[0111] S102, performing message content analysis on the to-be-processed message according to an OPC DA protocol format to obtain message analysis data.

[0112] In the embodiment, the method can analyze the message content according to the OPC DA protocol format, for example, analyze the function code in the message as IOXIDResolver::ResolveOxid.

[0113] S103, determining a policy predetermined action corresponding to the to-be-processed message when the message analysis data hits a preset OPC DA protocol security policy matching item.

[0114] In the embodiment, the OPC DA protocol security policy matching item includes one or more of a function code, an address policy, and a value policy, and the policy predetermined action includes a pass action or a block action.

[0115] In the embodiment, the method can match the function code in the message analysis data with the OPC DA protocol security policy matching item (function code: IOXIDResolver::ResolveOxid) on the industrial gateway device after the message analysis data is obtained.

[0116] In the embodiment, the message content is parsed according to the OPC DA protocol format, and then compared with the matching item content set by the security policy, and if the same, it is regarded as a hit. The important parameters and examples are shown as follows.

[0117] The OPC DA protocol security policy is a means for security filtering of the protocol content, and is used to prevent the client from illegally reading and modifying the data of a specified address (the address is optional, and details are shown below). The specific content of the security policy is described as follows.

[0118] (1) Matching item:

[0119] Function code: can be understood as an operation code, that is, a read operation or a write operation.

[0120] Address strategy: can be understood as a read operation or a write operation on a specified “string address”.

[0121] Value strategy: can be understood as writing a value range (maximum value, minimum value) and a data type (8 bits, 16 bits, 32 bits; signed, unsigned; single precision, double precision) to a specified “string address”.

[0122] (2) Action:

[0123] Accept: can be released

[0124] Drop: cannot be released, that is, cannot be forwarded.

[0125] Among them, the function code, address strategy and value strategy in the OPC DA protocol security policy matching item can be freely combined (that is, any one or any multiple), and the policy action needs to hit the matching item to be executed.

[0126] S104, when the policy predetermined action is a blocking action, an ACK response message is constructed.

[0127] S105, an ACK response message is replied to the source address corresponding to the to-be-processed message.

[0128] S106, the transmission layer bearing data length corresponding to the to-be-processed message is recorded in the diff_seq field of the current industrial gateway device connection information, and the to-be-processed message is discarded.

[0129] In the embodiment, when the policy hit needs to execute the policy predetermined action of blocking, the transmission layer bearing data length (that is, the application layer message length) of the current message to be discarded (that is, the to-be-processed message) is recorded in the industrial gateway device connection information.

[0130] In the embodiment, the data cache record in the industrial gateway device connection information can ensure that the subsequent messages are normally forwarded without breaking the TCP connection.

[0131] In the embodiment, the execution subject of the method can be an industrial gateway device, which can be a computer, a server, or other computing devices, and the embodiment does not make any limitation.

[0132] In the embodiment, the execution subject of the method can also be a smart phone, a tablet computer, or other smart devices, and the embodiment does not make any limitation.

[0133] It can be seen that the gateway security filtering method described in the embodiment can decode the message content (i.e., the application layer content of the message received by the device is parsed according to the OPC DA protocol format), match the industrial gateway device security policy (a security filtering policy set for the OPC DA protocol, and the policy mainly includes matching items and policy actions), and execute the policy action when the policy matching item is hit. When the message content hits the security policy matching item, and the security policy action is blocking, the method can discard only the message that hits the security policy, without breaking the TCP connection, and the subsequent interactive messages can continue to be forwarded and filtered, thereby achieving the effect of ensuring that the industrial gateway device can be filtered according to the security policy, and meeting the requirements of real-time and reliable communication of the OPC DA protocol.

[0134] Embodiment 2

[0135] Please refer to Figure 2 , Figure 2 A flowchart of a gateway security filtering method provided in the embodiment is shown. The gateway security filtering method includes the following steps.

[0136] S201, receiving a to-be-processed message.

[0137] S202, parsing the message content of the to-be-processed message according to the OPC DA protocol format to obtain message parsing data.

[0138] S203, when the message parsing data hits a preset OPC DA protocol security policy matching item, determining a policy predetermined action corresponding to the to-be-processed message.

[0139] In the embodiment, the OPC DA protocol security policy matching item includes one or more of a function code, an address policy, and a value policy, and the policy predetermined action includes a pass action or a block action.

[0140] S204, when the policy predetermined action is a block action, determining the transport layer bearing data length of the to-be-processed message according to the message parsing data.

[0141] S205, obtaining control information of the to-be-processed packet according to the packet analysis data.

[0142] In this embodiment, the control information at least includes destination MAC address, source MAC address, destination IP address, source IP address, TCP protocol destination port number, TCP protocol source port number, TCP protocol sequence number and TCP protocol acknowledgement number.

[0143] S206, constructing an ACK response packet according to the transport layer carried data length and the control information.

[0144] As an optional implementation, constructing an ACK response packet according to the transport layer carried data length and the control information includes:

[0145] constructing an original ACK packet;

[0146] filling the destination MAC address into the source MAC address of the original ACK packet to obtain a first processed packet;

[0147] filling the source MAC address into the destination MAC address of the first processed packet to obtain a second processed packet;

[0148] filling the destination IP address into the source IP address of the second processed packet to obtain a third processed packet;

[0149] filling the source IP address into the destination IP address of the third processed packet to obtain a fourth processed packet;

[0150] setting the ACK identifier of the TCP protocol in the fourth processed packet to 1 to obtain a fifth processed packet;

[0151] filling the TCP protocol destination port number into the TCP protocol source port number field of the fifth processed packet to obtain a sixth processed packet;

[0152] filling the TCP protocol source port number into the TCP protocol destination port number field of the sixth processed packet to obtain a seventh processed packet;

[0153] filling the TCP protocol acknowledgement number into the TCP protocol sequence number field of the seventh processed packet to obtain an eighth processed packet;

[0154] calculating a new TCP protocol acknowledgement number according to the TCP protocol sequence number and the transport layer carried data length;

[0155] filling the new TCP protocol acknowledgement number into the TCP protocol acknowledgement number field of the eighth processed packet to obtain a ninth processed packet;

[0156] setting the TCP protocol payload data length of the ninth processed packet to 0 to obtain the ACK response packet.

[0157] In this embodiment, the new TCP protocol acknowledgement number refers to the calculated TCP protocol acknowledgement number.

[0158] S207, reply to the ACK response message to the source address corresponding to the to-be-processed message.

[0159] In this embodiment, since the OPC DA protocol is reliable, the client needs to receive the ACK message replied by the opposite end to confirm that the message has been received by the opposite end. However, when the industrial gateway device discards the message that hits the security policy, the OPC DA protocol server will not receive the current message and will not reply the ACK message, which will cause:

[0160] (1) The OPC DA protocol client continuously retransmits because it does not receive the confirmation reply message, which may lead to the blocked message being sent to the OPC DA server and failing to achieve the purpose of security filtering.

[0161] (2) The OPC DA protocol client actively closes the current connection after retransmitting for a certain time, causing communication abnormalities.

[0162] In order to solve the above problems, the method constructs an ACK message and replies an ACK response message to the source address (OPC DA protocol client address) of the blocked message, so that the client knows that the message content has been received, and at the same time, the ACK message confirms that how many bytes of data have been successfully received.

[0163] S208, obtain the transmission layer bearing data length corresponding to the to-be-processed message.

[0164] S209, when the number of to-be-processed messages to be discarded in the same connection is multiple, determine the diff_seq field value corresponding to each transmission layer bearing data length; wherein the multiple to-be-processed messages to be discarded correspond to different time instants.

[0165] In this embodiment, in the process of OPC DA client and server interaction, the messages at different time instants in the same connection may hit the security filtering policy multiple times and need to be blocked. Among them, in the repeated process, the number of to-be-processed messages will increase.

[0166] Among them, since only one message can be processed at a time for the same connection, when the message needs to be discarded, the message payload length and the connection cache diff_seq field value need to be calculated and recorded to the connection cache diff_seq field.

[0167] For example, the diff_seq of the connection cache corresponding to the to-be-forwarded packet is actually a field on the connection. When multiple discarded packets exist on the same connection (the connection and the packet are associated with quintuple information), the approximate accumulation process is as follows:

[0168] Discarded packet 1: diff_seq = the carrying data length of packet 1;

[0169] Discarded packet 2: diff_seq = the carrying data length of packet 1 + the carrying data length of packet 2;

[0170] Discarded packet 3: diff_seq = the carrying data length of packet 1 + the carrying data length of packet 2 + the carrying data length of packet 3.

[0171] S210, performing an accumulation operation on all diff_seq field values to obtain a to-be-recorded field value.

[0172] S211, recording the to-be-recorded field value in the diff_seq field of the current industrial gateway device connection information.

[0173] In this embodiment, the diff_seq field corresponds to the connection and is uniquely corresponding. That is, a link has only one diff_seq field, and the diff_seq field value described above only refers to a numerical value in the calculation process (and refers to the purpose of recording in the diff_seq field). It should be understood that the value recorded in the diff_seq field is only the to-be-recorded field value described above.

[0174] S212, performing a discarding operation on the to-be-processed packet.

[0175] In this embodiment, when discarding the current OPC DA protocol packet (i.e., the to-be-processed packet), it is necessary to ensure that the data cache for the OPC DA protocol packet and the sending of the ACK response packet have been completed, so as to ensure that discarding the current OPC DA protocol packet will not cause the OPC DA client to initiate retransmission or close the connection.

[0176] In this embodiment, the execution subject of the method can be a computer, a server, or the like. In this embodiment, no limitation is made thereto.

[0177] In this embodiment, the execution subject of the method can also be a smart phone, a tablet computer, or the like. In this embodiment, no limitation is made thereto.

[0178] It can be seen that the gateway security filtering method described in the embodiment can match the industrial gateway device security policy (a security filtering policy set for the OPC DA protocol, which mainly includes matching items and policy actions) by decoding the message content (i.e., parsing the application layer content of the received message of the device according to the OPC DA protocol format), and execute the policy action when the security policy matching item is hit. When the message content hits the security policy matching item, and the security policy action is blocking, the method can discard only the message that hits the security policy, without disconnecting the TCP connection, and the subsequent interactive message can continue to be forwarded and filtered, thereby realizing the effect of ensuring that the industrial gateway device can be filtered according to the security policy, and meeting the requirements of real-time and reliable communication of the OPC DA protocol.

[0179] Embodiment 3

[0180] Please refer to Figure 3 , Figure 3 A flowchart of a gateway security filtering method provided by the embodiment is shown. The gateway security filtering method includes the following steps.

[0181] S301, receiving a to-be-processed message.

[0182] S302, performing message content parsing on the to-be-processed message according to the OPC DA protocol format to obtain message parsing data.

[0183] S303, determining the to-be-processed message as a to-be-forwarded message when the message parsing data does not hit the OPC DA protocol security policy matching item.

[0184] In the embodiment, the OPC DA protocol security policy matching item includes one or more of a function code, an address policy, and a value policy, and the policy predetermined action includes a pass action or a block action.

[0185] In the embodiment, step S303 has existed multiple times of OPC DA protocol security policy matching item hits before being successfully executed.

[0186] For example, when step S303 is executed, the to-be-processed message with an application layer length of 72 bytes has been discarded.

[0187] In this example, because 72 bytes of the pending message have been discarded, the pending message that is forwarded needs to be adjusted to ensure that the OPC DA protocol connection is not closed. The OPC DA protocol server does not receive the discarded message, so the data maintained in the protocol stack of the host is still the sequence number of the last message (the message sent by the client to the server before the message discarded by the industrial gateway device). When the OPC DA client sends a new message (the message sent by the client to the server after the message discarded by the industrial gateway device), because the ACK message sent by the industrial gateway device is received and considered to be returned by the OPC DA server, the sequence number of the ACK message is used as the sequence number of the new message. If the industrial gateway device does not make corresponding modifications and directly forwards the message, the server receives the message, but the data maintained in the protocol stack of the host is inconsistent (72 bytes different), and the server continues to wait for reception, which causes the OPC DA protocol communication to be abnormal.

[0188] S304, obtaining a value of a diff_seq field of a connection cache corresponding to the pending message to be forwarded.

[0189] S305, when the value of the diff_seq field is greater than 0, obtaining a current message sequence number of the pending message to be forwarded and a current TCP protocol checksum.

[0190] Based on the above example, before the message sent by the OPC DA client is received and forwarding is completed, it is necessary to determine whether the value of the diff_seq field is greater than 0. If yes, the TCP sequence number needs to be recalculated, that is, the length of the message discarded by the industrial gateway device (here, 72 bytes) is subtracted, so that the data maintained in the protocol stack of the host is consistent with the message received by the server, and the normal reception and processing of the message are ensured.

[0191] S306, calculating a sequence number value according to the current message sequence number and the value of the diff_seq field.

[0192] As an optional implementation, calculating the sequence number value according to the current message sequence number and the value of the diff_seq field includes:

[0193] when the pending message to be forwarded is a message sent by the client, performing subtraction calculation on the current message sequence number and the value of the diff_seq field to obtain the sequence number value;

[0194] when the pending message to be forwarded is a message sent by the server, performing addition calculation on the current message sequence number and the value of the diff_seq field to obtain the sequence number value.

[0195] S307, replacing the current message sequence number of the pending message to be forwarded with the sequence number value to obtain a replaced message.

[0196] S308, calculating TCP checksum according to the replaced message, obtaining a checksum value.

[0197] S309, replacing the current TCP protocol checksum of the replaced message with the checksum value, obtaining a to-be-sent message.

[0198] In this embodiment, because the industrial gateway device modifies the content of the TCP message segment, the TCP checksum data calculated by the OPC DA client when sending the packet (the OPC DA protocol client calculates the checksum of the TCP message segment of the to-be-sent message, and then the server verifies the checksum of the received TCP message segment, the purpose being to find whether the TCP header and data are changed between the client and the server, if the server detects that the checksum is incorrect, the TCP message will be directly discarded) cannot be used any more, and it is necessary to recalculate the TCP checksum according to the modified content.

[0199] Therefore, the TCP protocol sequence number and the TCP checksum need to be recalculated before the OPC DA protocol message is forwarded.

[0200] S310, performing a forwarding operation on the to-be-forwarded message.

[0201] In this embodiment, the execution subject of the method can be a computer, a server, or the like, and the embodiment is not limited in this regard.

[0202] In this embodiment, the execution subject of the method can also be a smart phone, a tablet computer, or the like, and the embodiment is not limited in this regard.

[0203] It can be seen that by implementing the gateway security filtering method described in this embodiment, the message content can be decoded (i.e., the application layer content of the message received by the device is parsed according to the OPC DA protocol format), the industrial gateway device security policy (a security filtering policy set for the OPC DA protocol, the policy mainly being composed of a matching item and a policy action) can be matched, and the policy action can be executed when the matching item is hit. When the message content hits the security policy matching item and the security policy action is blocking, the method can discard only the message that hits the security policy, without breaking the TCP connection, and the subsequent interactive message can continue to be forwarded and filtered, thereby achieving the effect of ensuring that the industrial gateway device can be filtered according to the security policy, and meeting the requirements of real-time and reliable communication of the OPC DA protocol.

[0204] Embodiment 4

[0205] Please refer to Figure 4 , Figure 4An example flowchart of a gateway security filtering method provided in the embodiment is shown. The gateway security filtering method includes the following steps.

[0206] S401, parse the message content according to the OPC DA protocol format, match the OPC DA protocol security policy matching item on the industrial gateway device, and when the policy needs to be executed, the policy pre-determined action is blocked, and the industrial gateway device connection information needs to record the current message transmission layer bearing data length.

[0207] In the embodiment, the transmission layer bearing data length is the application layer message length.

[0208] In the embodiment, in order to ensure the normal forwarding of subsequent messages, the TCP connection is not disconnected, and data buffering is performed.

[0209] In the embodiment, the industrial gateway device needs to parse the forwarding OPC DA message content, and when the security policy function code, address policy, and policy of the industrial gateway device security engine are hit, the blocking is executed, and the current message TCP layer load message length, i.e. the application layer message length, is recorded to the diff_seq field of the current industrial gateway device connection information (the diff_seq field is the application layer message length or sequence number difference recorded by the industrial gateway device for the current connection discard), if multiple messages are discarded, the transmission layer bearing data length of the discarded messages is sequentially accumulated, and the accumulated result is recorded in the diff_seq of the connection.

[0210] S402, the industrial gateway device needs to create an ACK message, and reply an ACK response message to the source address (OPC DA protocol client address) of the blocked message, the purpose is to tell the client that the message content has been received, and through the ACK message, it is confirmed that how many bytes of data have been successfully received.

[0211] In the embodiment, the ACK message is constructed, and the following operations are performed:

[0212] (1) fill the destination MAC address of the current message into the source MAC address of the copied message;

[0213] (2) fill the source MAC address of the current message into the destination MAC address of the copied message;

[0214] (3) fill the destination IP address of the current message into the source IP address of the copied message;

[0215] (4) fill the source IP address of the current message into the destination IP address of the copied message;

[0216] (5) set the ACK identifier of the TCP protocol of the copied message to 1;

[0217] (6) Fill the TCP protocol destination port number of the current packet into the TCP protocol source port number field of the copied packet;

[0218] (7) Fill the TCP protocol source port number of the current packet into the TCP protocol destination port number field of the copied packet;

[0219] (8) Fill the TCP protocol sequence number of the current packet + "application layer memory length of the discarded packet" into the TCP protocol acknowledgement number of the copied packet;

[0220] (9) Fill the TCP protocol acknowledgement number of the current packet into the TCP protocol sequence number of the copied packet;

[0221] (10) Set the TCP protocol payload data length of the copied packet to 0;

[0222] (11) The industrial gateway device sends the created ACK packet to the source address device, i.e., the client device.

[0223] S403, in the case that the data buffering and ACK packet sending have been completed, the current OPC DA protocol packet is discarded, so as to ensure that the OPC DA client does not initiate retransmission or close the connection.

[0224] In the embodiment, the discarded mode is adopted because the industrial gateway device does not need to forward the current blocked OPC DA protocol packet.

[0225] S404, in the process of OPC DA client and server interaction, the packet may hit the security filtering strategy multiple times, needs to be blocked, and the steps S401-S403 are repeated.

[0226] In the embodiment, because the industrial gateway device is not allowed to forward due to the OPC DA protocol packet hitting the security strategy, and in order to keep the OPC DA protocol connection open, the industrial gateway device sends an acknowledgement packet to the OPC DA client. Therefore, at this time, there is a difference between the data recorded by the OPC DA client and the server protocol stack, and if the subsequent OPC DA protocol packet continues to be forwarded, the TCP protocol sequence number needs to be recalculated.

[0227] In the embodiment, the industrial gateway device discards the OPC DA protocol service packet, which has made the sequence numbers and acknowledgement numbers recorded by the protocol stacks at the two ends of the OPC DA protocol client and server inconsistent. In order to enable the subsequently forwarded packets of the same connection to communicate normally, the industrial gateway device must modify the TCP protocol sequence number and checksum in the packet by referring to the diff_seq content of the connection record, otherwise the protocol stack cannot normally accept and process.

[0228] Please refer to Figure 5 ,Figure 5 A blocking flowchart of a to-be-processed packet is shown. Wherein, Figure 5 A flowchart of a to-be-processed packet hitting a security policy, blocking the to-be-processed packet, and disconnecting is specifically shown.

[0229] S405, Before forwarding the packet, the industrial gateway device judges according to the diff_seq value recorded in the connection record. If it is 0, it does not need to be modified and is directly sent.

[0230] S406, If the diff_seq is greater than 0, the industrial gateway device needs to do the following processing before sending.

[0231] S407, If the packet is from the client direction, the current packet sequence number needs to be obtained and the diff_seq field value is subtracted, that is, the length of the packet is discarded. The obtained sequence number value covers the original sequence number of the current packet.

[0232] S408, If the packet is from the server direction, the current packet sequence number needs to be obtained and the diff_seq field value is added, that is, the length of the packet is discarded. The obtained sequence number value covers the original sequence number of the current packet.

[0233] In this embodiment, because the TCP protocol sequence number of the current packet has been modified, the TCP checksum needs to be recalculated and the TCP protocol checksum of the current packet is covered.

[0234] S409, The industrial gateway device forwards the OPC DA protocol packet.

[0235] In this embodiment, the execution subject of the method can be a computer, a server, and the like. In this embodiment, no limitation is made to this.

[0236] In this embodiment, the execution subject of the method can also be a smart phone, a tablet computer, and the like. In this embodiment, no limitation is made to this.

[0237] It can be seen that by implementing the gateway security filtering method described in this embodiment, the content of the packet can be decoded (that is, the application layer content received by the device is parsed according to the OPC DA protocol format), the industrial gateway device security policy (a security filtering policy set for the OPC DA protocol, the policy is mainly composed of a matching item and a policy action combination) is matched, and the policy action is executed when the policy matching item is hit. When the packet content hits the security policy matching item, and the security policy action is blocking, the method can discard only the packet that hits the security policy, and does not disconnect the TCP connection. The subsequent interactive packet can continue to be forwarded and filtered, thereby realizing the effect of ensuring that the industrial gateway device can be filtered according to the security policy, and meeting the requirements of real-time and reliable communication of the OPC DA protocol.

[0238] Embodiment 5

[0239] Referring to Figure 6 , Figure 6 A structural schematic diagram of a gateway security filtering device is provided in this embodiment. As shown in the figure, the gateway security filtering device comprises: Figure 6

[0240] A receiving unit 510 is configured to receive a to-be-processed packet;

[0241] An analyzing unit 520 is configured to analyze the content of the to-be-processed packet according to the OPC DA protocol format to obtain packet analysis data;

[0242] A determining unit 530 is configured to determine a policy predetermined action corresponding to the to-be-processed packet when the packet analysis data hits a preset OPC DA protocol security policy matching item;

[0243] A constructing unit 540 is configured to construct an ACK response packet when the policy predetermined action is a blocking action;

[0244] A replying unit 550 is configured to reply the ACK response packet to a source address corresponding to the to-be-processed packet;

[0245] A recording unit 560 is configured to record a transport layer bearer data length corresponding to the to-be-processed packet into a diff_seq field of current industrial gateway device connection information;

[0246] A discarding unit 570 is configured to discard the to-be-processed packet.

[0247] In this embodiment, the explanation and description of the gateway security filtering device can refer to the description in Embodiment 1, Embodiment 2, Embodiment 3 or Embodiment 4, and no more details are added in this embodiment.

[0248] It can be seen that the gateway security filtering device described in this embodiment can decode the content of the packet (i.e. analyze the application layer content of the packet received by the device according to the OPC DA protocol format), match the industrial gateway device security policy (a security filtering policy set for the OPC DA protocol, the policy mainly comprises a matching item and a policy action), and execute the policy action when the policy matching item is hit. When the content of the packet hits the security policy matching item and the security policy action is blocking, this method can realize discarding only the packet hitting the security policy, without breaking the TCP connection, and the subsequent interactive packet can continue to be forwarded and filtered, so as to realize the effect of ensuring that the industrial gateway device can be filtered according to the security policy, and meet the requirements of real-time and reliable communication of the OPC DA protocol.

[0249] Embodiment 6​

[0250] Referring to Figure 7 , Figure 7 A structure diagram of a gateway security filtering device is provided in the embodiment. As shown in the figure, the gateway security filtering device comprises: Figure 7

[0251] A receiving unit 510 is configured to receive a to-be-processed packet;

[0252] An analyzing unit 520 is configured to analyze the content of the to-be-processed packet according to an OPC DA protocol format to obtain packet analysis data;

[0253] A determining unit 530 is configured to determine a predetermined action of a strategy corresponding to the to-be-processed packet when the packet analysis data hits a preset OPC DA protocol security strategy matching item;

[0254] A constructing unit 540 is configured to construct an ACK response packet when the predetermined action of the strategy is a blocking action;

[0255] A replying unit 550 is configured to reply the ACK response packet to a source address corresponding to the to-be-processed packet;

[0256] A recording unit 560 is configured to record a transport layer bearer data length corresponding to the to-be-processed packet into a diff_seq field of current industrial gateway device connection information;

[0257] A discarding unit 570 is configured to discard the to-be-processed packet.

[0258] As an optional implementation, the gateway security filtering device further comprises:

[0259] A determining unit 580 is configured to determine the to-be-processed packet as a to-be-forwarded packet when the packet analysis data does not hit the OPC DA protocol security strategy matching item;

[0260] An obtaining unit 590 is configured to obtain a diff_seq field value of a connection cache corresponding to the to-be-forwarded packet;

[0261] The obtaining unit 590 is further configured to obtain a current packet sequence number and a current TCP protocol checksum of the to-be-forwarded packet when the diff_seq field value is greater than 0;

[0262] A calculating unit 600 is configured to calculate a sequence number value according to the current packet sequence number and the diff_seq field value;

[0263] A replacing unit 610 is configured to replace the current packet sequence number of the to-be-forwarded packet with the sequence number value to obtain a replaced packet;

[0264] ​The computing unit 600 is further configured to calculate a TCP checksum according to the replacement message, and obtain a checksum value.

[0265] The replacing unit 610 is further configured to replace a current TCP protocol checksum of the replacement message with the checksum value, and obtain a to-be-sent message.

[0266] The forwarding unit 620 is configured to perform a forwarding operation on the to-be-forwarded message.

[0267] As an optional implementation, the computing unit 600 is specifically configured to, when the to-be-forwarded message is a message sent by a client, perform subtraction calculation on a current message sequence number and a diff_seq field value, and obtain a sequence number value.

[0268] The computing unit 600 is further configured to, when the to-be-forwarded message is a message sent by a server, perform addition calculation on a current message sequence number and a diff_seq field value, and obtain a sequence number value.

[0269] As an optional implementation, the constructing unit 540 comprises:

[0270] The first determining subunit 541 is configured to determine a transport layer bearer data length of the to-be-processed message according to the message analysis data.

[0271] The first obtaining subunit 542 is configured to obtain control information of the to-be-processed message according to the message analysis data, wherein the control information at least comprises a destination MAC address, a source MAC address, a destination IP address, a source IP address, a TCP protocol destination port number, a TCP protocol source port number, a TCP protocol sequence number and a TCP protocol acknowledgement number.

[0272] The constructing subunit 543 is configured to construct an ACK response message according to the transport layer bearer data length and the control information.

[0273] As an optional implementation, the constructing subunit 543 comprises:

[0274] The constructing module is configured to construct an original ACK message.

[0275] The padding module is configured to pad the destination MAC address to a source MAC address of the original ACK message, and obtain a first processed message.

[0276] The padding module is further configured to pad the source MAC address to a destination MAC address of the first processed message, and obtain a second processed message.

[0277] The padding module is further configured to pad the destination IP address to a source IP address of the second processed message, and obtain a third processed message.

[0278] The filling module is further configured to fill the source IP address into a destination IP address of the third processed packet to obtain a fourth processed packet.

[0279] The setting module is configured to set an ACK identifier of the TCP protocol in the fourth processed packet to 1 to obtain a fifth processed packet.

[0280] The filling module is further configured to fill a destination port number of the TCP protocol into a source port number field of the TCP protocol in the fifth processed packet to obtain a sixth processed packet.

[0281] The filling module is further configured to fill the source port number of the TCP protocol into the destination port number field of the TCP protocol in the sixth processed packet to obtain a seventh processed packet.

[0282] The filling module is further configured to fill a sequence number of the TCP protocol into a confirmation number field of the TCP protocol in the seventh processed packet to obtain an eighth processed packet.

[0283] The calculation module is configured to calculate a new confirmation number of the TCP protocol according to the sequence number of the TCP protocol and the length of the transmission layer bearing data.

[0284] The filling module is further configured to fill the new confirmation number of the TCP protocol into the confirmation number field of the TCP protocol in the eighth processed packet to obtain a ninth processed packet.

[0285] The setting module is further configured to set the length of the load data of the TCP protocol in the ninth processed packet to 0 to obtain an ACK response packet.

[0286] In this embodiment, the OPC DA protocol security policy matching item includes one or more of a function code, an address policy, and a value policy, and the policy predetermined action includes a release action or a blocking action.

[0287] As an optional implementation, the recording unit 560 includes:

[0288] The second acquisition sub-unit 561 is configured to acquire the length of the transmission layer bearing data corresponding to the to-be-processed packet.

[0289] The second determination sub-unit 562 is configured to determine a diff_seq field value corresponding to each length of the transmission layer bearing data when the number of to-be-processed packets to be discarded in the same connection is multiple; wherein the multiple to-be-processed packets to be discarded correspond to different time instants respectively.

[0290] The calculation sub-unit 563 is configured to perform an accumulation operation on all diff_seq field values to obtain a to-be-recorded field value.

[0291] The recording sub-unit 564 is configured to record the to-be-recorded field value into the diff_seq field of the current industrial gateway device connection information.

[0292] In this embodiment, the gateway security filtering device can be explained with reference to the description in Embodiment 1, Embodiment 2, Embodiment 3 or Embodiment 4, which will not be repeated herein.

[0293] It can be seen that the gateway security filtering device described in this embodiment can match the industrial gateway device security policy (a security filtering policy set for the OPC DA protocol, which mainly includes matching items and policy actions) by decoding the message content (i.e., applying the layer content of the message received by the device to the OPC DA protocol format for analysis), and execute the policy action when the matching item is hit. When the message content hits the security policy matching item, and the security policy action is to block, this method can discard only the message that hits the security policy, without disconnecting the TCP connection, and the subsequent interactive message can continue to be forwarded and filtered, thereby achieving the effect of ensuring that the industrial gateway device can be filtered according to the security policy, and meeting the requirements of real-time and reliable communication of the OPC DA protocol.

[0294] The electronic device provided in the embodiments of the present application includes a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to make the electronic device execute the gateway security filtering method in Embodiment 1, Embodiment 2, Embodiment 3 or Embodiment 4 of the present application.

[0295] The computer readable storage medium provided in the embodiments of the present application stores computer program instructions, and when the computer program instructions are read and run by a processor, the gateway security filtering method in Embodiment 1, Embodiment 2, Embodiment 3 or Embodiment 4 of the present application is executed.

[0296] In several embodiments provided in the present application, it should be understood that the disclosed apparatus and method can also be implemented by other means. The apparatus embodiments described above are only illustrative, for example, the flowcharts and block diagrams in the drawings show the possible implementation architecture, function and operation of the apparatus, method and computer program product according to the embodiments of the present application. In this regard, each block in the flowchart or block diagram can represent a module, a program segment or a part of code, which contains one or more executable instructions for implementing the specified logic function. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in different order from that shown in the drawings. For example, two consecutive blocks can actually be executed substantially in parallel, and sometimes they can be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and the combination of blocks in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system for performing the specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0297] In addition, the functional modules in the embodiments of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0298] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various program code storage media.

[0299] The above merely provides an example of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, and thus, once an item is defined in one drawing, it need not be further defined and explained in subsequent drawings.

[0300] The above merely provides an example of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, and thus, once an item is defined in one drawing, it need not be further defined and explained in subsequent drawings.

[0301] It should be noted that the relational terms herein such as first and second and the like are used solely to distinguish one from another entity or action without necessarily requiring or implying any actual relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises... a" does not, without more constraints, exclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the element.

Claims

1. A gateway security filtering method, characterized by, The method comprises: receiving a to-be-processed packet; performing packet content analysis on the to-be-processed packet according to an OPC DA protocol format to obtain packet analysis data; when the packet analysis data hits a preset OPC DA protocol security policy matching item, determining a policy predetermined action corresponding to the to-be-processed packet; when the policy predetermined action is a blocking action, constructing an ACK response packet; replying the ACK response packet to a source address corresponding to the to-be-processed packet; recording a transmission layer bearing data length corresponding to the to-be-processed packet into a diff_seq field of current industrial gateway device connection information, and discarding the to-be-processed packet; wherein the method further comprises: when the packet analysis data does not hit the OPC DA protocol security policy matching item, determining the to-be-processed packet as a to-be-forwarded packet; obtaining a diff_seq field value of a connection cache corresponding to the to-be-forwarded packet; when the diff_seq field value is greater than 0, obtaining a current packet sequence number and a current TCP protocol checksum of the to-be-forwarded packet; calculating a sequence number value according to the current packet sequence number and the diff_seq field value; replacing the current packet sequence number of the to-be-forwarded packet with the sequence number value to obtain a replaced packet; calculating a TCP checksum according to the replaced packet to obtain a checksum value; replacing the current TCP protocol checksum of the replaced packet with the checksum value to obtain a to-be-sent packet; performing a forwarding operation on the to-be-forwarded packet.

2. The gateway security filtering method of claim 1, wherein, The calculation of the sequence number value according to the current packet sequence number and the diff_seq field value comprises: when the to-be-forwarded packet is a packet sent by a client, performing subtraction calculation on the current packet sequence number and the diff_seq field value to obtain a sequence number value; when the to-be-forwarded packet is a packet sent by a server, performing addition calculation on the current packet sequence number and the diff_seq field value to obtain a sequence number value.

3. The gateway security filtering method of claim 1, wherein, The construction of the ACK response packet comprises: determining a transmission layer bearing data length of the to-be-processed packet according to the packet analysis data; obtaining control information of the to-be-processed packet according to the packet analysis data; wherein the control information at least comprises a destination MAC address, a source MAC address, a destination IP address, a source IP address, a TCP protocol destination port number, a TCP protocol source port number, a TCP protocol sequence number, and a TCP protocol acknowledgement number; constructing an ACK response packet according to the transmission layer bearing data length and the control information.

4. The gateway security filtering method of claim 3, wherein, The construction of the ACK response packet according to the transmission layer bearing data length and the control information comprises: constructing an original ACK packet; filling the destination MAC address into a source MAC address of the original ACK packet to obtain a first processed packet; filling the source MAC address into a destination MAC address of the first processed packet to obtain a second processed packet; filling the destination IP address into a source IP address of the second processed packet to obtain a third processed packet; Filling the source IP address into the destination IP address of the third processed message to obtain a fourth processed message; Setting the ACK flag of the TCP protocol in the fourth processed message to 1 to obtain a fifth processed message; Filling the TCP protocol destination port number into the TCP protocol source port number field of the fifth processing message to obtain a sixth processing message; Filling the TCP protocol source port number into the TCP protocol destination port number field of the sixth processing message to obtain a seventh processing message; Filling the TCP protocol confirmation number into the TCP protocol sequence number field of the seventh processing message to obtain an eighth processing message; Calculate a new TCP protocol confirmation number based on the TCP protocol sequence number and the transport layer bearer data length; Filling the TCP protocol new confirmation number into the TCP protocol confirmation number field of the eighth processing message to obtain a ninth processing message; The TCP protocol payload data length of the ninth processing message is set to 0 to obtain an ACK response message.

5. The gateway security filtering method of claim 1, wherein, The OPC DA protocol security policy matching items include one or more of function code, address policy, and value policy, and the policy predetermined action includes a release action or a blocking action.

6. The gateway security filtering method of claim 1, wherein, The step of recording the transport layer bearer data length corresponding to the message to be processed into the diff_seq field of the current industrial gateway device connection information includes: Obtaining the transport layer bearer data length corresponding to the message to be processed; When there are multiple packets to be processed for discarding in the same connection, determining the diff_seq field value corresponding to the length of each transport layer bearer data; wherein the multiple packets to be processed for discarding correspond to different time periods; Performing a cumulative operation on all the diff_seq field values ​​to obtain the field value to be recorded; The field value to be recorded is recorded in the diff_seq field of the current industrial gateway device connection information.

7. An electronic device, comprising: The electronic device includes a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to perform the gateway security filtering method according to any one of claims 1 to 6.

8. A readable storage medium, characterized by, The readable storage medium stores computer program instructions, and when the computer program instructions are read and executed by a processor, the gateway security filtering method according to any one of claims 1 to 6 is executed.

9. A computer program product, characterised in that, The computer program product comprises a computer program, and when the computer program is executed by a processor, the gateway security filtering method according to any one of claims 1 to 6 is executed.

Images