PowerLink protocol message processing method and device, storage medium and program product

Abstract

The embodiment of the invention relates to the technical field of industrial network security, in particular to a PowerLink protocol message processing method and device, a storage medium and a program product. Comprising the following steps: receiving a PowerLink protocol message; deleting an Ethernet head byte and an Ethernet tail byte; obtaining a byte value of a service type byte in the deleted PowerLink protocol message, wherein the offset between the byte value and the message header of the service type byte is a first preset number of bytes; determining a function code type of the service type; decoding the function code type to obtain decoding information; obtaining a byte value of an address node in the message, wherein the offset between the address node and the message header is a second preset number of bytes; according to the method, the PowerLink protocol message is processed according to the load length, the decoding information and the byte value of the address node, the PowerLink protocol message processing efficiency is improved, a better processing effect is obtained, the message is deeply analyzed, and the message detection accuracy is improved.

Description

Technical Field

[0001] The present application relates to the technical field of industrial network security, and specifically to a method, device, storage medium and program product for processing PowerLink protocol messages. Background Art

[0002] As a product of the deep integration of new-generation information technology and manufacturing, the Industrial Internet is leading the global manufacturing industry towards a new height of digital and intelligent transformation. With the widespread application of the Industrial Internet, the frequency of data exchange and remote control has increased significantly, and industrial network security issues have become increasingly prominent. In the era of intelligent manufacturing, industrial control systems face a variety of threats from both inside and outside, such as malware attacks, unauthorized access, data leakage, etc., which may have a serious impact on production safety, operational efficiency and even national security. Therefore, how to protect industrial networks, especially to protect industrial equipment from external hazards, is a topic that is receiving increasing attention at home and abroad.

[0003] Protocol analysis is one of the important means to prevent industrial networks from being attacked. PowerLink is a real-time Ethernet communication protocol designed specifically for the field of industrial automation. It has been widely used in high-precision and high-demand industrial scenarios such as CNC machine tools and robot control due to its high real-time performance, low latency and strong synchronization. However, with the increasing complexity of the network environment and the continuous evolution of attack methods, the PowerLink protocol is also facing the risk of malicious exploitation. In order to ensure the safe and stable operation of the PowerLink network, it is particularly important to effectively detect and protect it.

[0004] At present, the detection and protection of the PowerLink protocol often rely on network context information and network status. There is a lack of in-depth analysis of the PowerLink protocol, and it is impossible to identify problems within the PowerLink protocol, which affects the accuracy of PowerLink protocol detection and protection. Summary of the invention

[0005] The purpose of the embodiments of the present application is to provide a method, device, storage medium and program product for processing PowerLink protocol messages, so as to solve the problems of poor protection effect and inaccurate detection of the PowerLink protocol in the prior art.

[0006] In order to achieve the above-mentioned purpose, the first aspect of the present application provides a method for processing a PowerLink protocol message, the processing method comprising:

[0007] Receive PowerLink protocol messages;

[0008] Deleting the Ethernet header byte and the Ethernet tail byte in the PowerLink protocol message to obtain a deleted PowerLink protocol message;

[0009] Obtaining a byte value of a service type byte in the pruned PowerLink protocol message, the offset from the message header of the pruned PowerLink protocol message being a first preset number of bytes;

[0010] Determine the function code type of the service type of the deleted PowerLink protocol message according to the byte value of the service type byte;

[0011] Decode the function code type to obtain decoding information;

[0012] Obtaining the byte value of the address node in the deleted PowerLink protocol message whose offset from the message header is a second preset number of bytes;

[0013] The PowerLink protocol message is processed according to the payload length, the decoding information and the byte value of the address node, wherein the payload length is the number of bytes of the pruned PowerLink protocol message.

[0014] In an embodiment of the present application, the second preset number of bytes includes a first sub-number of bytes and a second sub-number of bytes, the address node includes a target address node and a source address node, and obtaining the byte value of the address node in the pruned PowerLink protocol message whose offset from the message header is the second preset number of bytes includes: obtaining the byte value of the target address node in the pruned PowerLink protocol message whose offset from the message header is the first sub-number of bytes; obtaining the byte value of the source address node in the pruned PowerLink protocol message whose offset from the message header is the second sub-number of bytes.

[0015] In an embodiment of the present application, the function code type is decoded to obtain decoding information including: when the function code type is a SoC function code, obtaining a byte in the deleted PowerLink protocol message with an offset of a third preset number of bytes from the source address node, and taking the characteristics and byte values ​​of the fourth preset number of bytes backward on the basis of the byte as the characteristic type and characteristic value of the SoC function code respectively; using the triplet constructed by the characteristic type and characteristic value of the SoC function code as the decoding information of the SoC function code; when the function code type is a PReq function code, obtaining a byte in the deleted PowerLink protocol message with an offset of a fifth preset number of bytes from the source address node, and taking the characteristics and byte value of the next byte of the byte as the characteristic type and characteristic value of the PReq function code; using the triplet constructed by the characteristic type and characteristic value of the PReq function code as the decoding information of the PReq function code; when the function code type is a PRes function code, obtaining The offset from the source address node in the deleted PowerLink protocol message is the sixth preset number of bytes, and the characteristics and byte value of the byte after the byte are used as the characteristic type and characteristic value of the PRes function code; the triplet constructed by the characteristic type and characteristic value of the PRes function code is used as the decoding information of the PRes function code; when the function code type is the SoA function code, the offset from the source address node in the deleted PowerLink protocol message is obtained as the seventh preset number of bytes, and the characteristics and byte value of the byte after the byte are used as the characteristic type and characteristic value of the SoA function code; the triplet constructed by the characteristic type and characteristic value of the SoA function code is used as the decoding information of the SoA function code; when the function code type is the ASnd function code, the characteristics and byte value of the byte after the source address node are used as the characteristic type and characteristic value of the ASnd function code; the triplet constructed by the characteristic type and characteristic value of the ASnd function code is used as the decoding information of the ASnd function code.

[0016] In an embodiment of the present application, processing a PowerLink protocol message according to the load length, decoding information, and byte values ​​of an address node includes: determining whether the PowerLink protocol message is a malformed message according to the load length, decoding information, the byte value of a target address node, and the byte value of a source address node; if the PowerLink protocol message is a malformed message, blocking the PowerLink protocol message; if the PowerLink protocol message is not a malformed message, comparing the load length, decoding information, the byte value of a target address node, and the byte value of a source address node with a preset security policy to obtain a comparison result; if the comparison result satisfies the preset security policy, releasing the PowerLink protocol message; if the comparison result does not satisfy the preset security policy, blocking the PowerLink protocol message.

[0017] In the embodiment of the present application, the processing method further includes: sending an alarm prompt when the PowerLink protocol message is blocked.

[0018] In an embodiment of the present application, determining whether a PowerLink protocol message is a malformed message based on the load length, decoding information, the byte value of the target address node, and the byte value of the source address node includes: obtaining a malformation condition corresponding to the function code type; when the load length, decoding information, the byte value of the target address node, and the byte value of the source address node meet the malformation condition, determining that the PowerLink protocol message is a malformed message; when the load length, decoding information, the byte value of the target address node, and the byte value of the source address node do not meet the malformation condition, determining that the PowerLink protocol message is not a malformed message.

[0019] In an embodiment of the present application, the function code types include SoC function code, PReq function code, PRes function code, SoA function code and ASnd function code; when the function code type is SoC function code, the deformity condition is that the decoding information reaches the preset decoding information, the load length is less than the first preset length, the byte value of the source address node is not equal to the first preset byte value, and the byte value of the target address node is not equal to the second preset byte value; when the function code type is PReq function code, the deformity condition is that the load length is less than the second preset length, the byte value of the source address node is not equal to the first preset byte value, and the byte value of the target address node is less than the third preset length. preset byte value or greater than the fourth preset byte value; when the function code type is the PRes function code, the malformation condition is that the load length is less than the second preset length, the byte value of the source address node is less than the third preset byte value or greater than the fourth preset byte value, and the byte value of the target address node is not equal to the second preset byte value; when the function code type is the SoA function code, the malformation condition is that the load length is less than the second preset length, the byte value of the source address node is not equal to the first preset byte value, and the byte value of the target address node is not equal to the second preset byte value; when the function code type is the ASnd function code, the malformation condition is that the load length is less than the third preset length.

[0020] A second aspect of the present application provides a PowerLink protocol message processing device, including:

[0021] a memory configured to store instructions;

[0022] The processor is configured to call instructions from the memory and implement the above-mentioned PowerLink protocol message processing method when executing the instructions.

[0023] A third aspect of the present application provides a machine-readable storage medium having instructions stored thereon, the instructions being used to enable a machine to execute the above-mentioned PowerLink protocol message processing method.

[0024] A fourth aspect of the present application provides a computer program product, including a computer program, which implements the above-mentioned PowerLink protocol message processing method when executed by a processor.

[0025] Through the above technical scheme, the Ethernet header bytes and Ethernet tail bytes in the PowerLink protocol message can be deleted; and the byte value of the service type byte in the deleted PowerLink protocol message, whose offset from the message header of the deleted PowerLink protocol message is a first preset number of bytes, is obtained; then the function code type of the service type of the deleted PowerLink protocol message is determined according to the byte value of the service type byte; and the function code type is decoded to obtain decoding information; the byte value of the address node in the deleted PowerLink protocol message, whose offset from the message header is a second preset number of bytes, is obtained; and the PowerLink protocol message is processed according to the load length, decoding information and the byte value of the address node, wherein the load length is the number of bytes of the deleted PowerLink protocol message, so as to improve the processing efficiency of the PowerLink protocol message, obtain better processing effect, and conduct in-depth analysis on the PowerLink protocol message to improve the accuracy of PowerLink protocol message detection.

[0026] Other features and advantages of the embodiments of the present application will be described in detail in the subsequent specific implementation section. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present application, but do not constitute a limitation on the embodiments of the present application. In the accompanying drawings:

[0028] Figure 1 A schematic diagram of a process of a method for processing a PowerLink protocol message according to an embodiment of the present application is schematically shown;

[0029] Figure 2 Another flowchart of a method for processing a PowerLink protocol message according to an embodiment of the present application is schematically shown;

[0030] Figure 3 The internal structure of a computer device according to an embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the specific implementation methods described herein are only used to illustrate and explain the embodiments of the present application, and are not used to limit the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0032] It should be noted that if the embodiments of the present application involve directional indications (such as up, down, left, right, front, back...), the directional indications are only used to explain the relative position relationship, movement status, etc. between the components under a certain specific posture (as shown in the accompanying drawings). If the specific posture changes, the directional indication will also change accordingly.

[0033] In addition, if there are descriptions involving "first", "second", etc. in the embodiments of the present application, the descriptions of "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or suggesting their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0034] Figure 1 A schematic diagram of a process flow of a method for processing a PowerLink protocol message according to an embodiment of the present application is shown. Figure 1 As shown, an embodiment of the present application provides a method for processing a PowerLink protocol message, and the processing method may include the following steps.

[0035] Step 101: Receive a PowerLink protocol message.

[0036] Step 102: Delete the Ethernet header byte and the Ethernet tail byte in the PowerLink protocol message to obtain a deleted PowerLink protocol message.

[0037] Step 103: Obtain the byte value of the service type byte in the pruned PowerLink protocol message, the offset of which from the message header of the pruned PowerLink protocol message is a first preset number of bytes.

[0038] Step 104: Determine the function code type of the service type of the deleted PowerLink protocol message according to the byte value of the service type byte.

[0039] Step 105: Decode the function code type to obtain decoding information.

[0040] Step 106: Obtain the byte value of the address node in the deleted PowerLink protocol message whose offset from the message header is a second preset number of bytes.

[0041] The PowerLink protocol message is a real-time Ethernet communication protocol designed for the field of industrial automation. The processor can receive the PowerLink protocol message. After receiving the PowerLink protocol message, the processor can delete the Ethernet header byte and the Ethernet tail byte in the PowerLink protocol message to obtain the abridged PowerLink protocol message. Among them, the Ethernet header byte is a standard 14-byte structure, which is a 6-byte destination address, a 6-byte source address, and a 2-byte Ethernet layer TYPE (type). The Ethernet tail byte is 4 bytes. After obtaining the abridged PowerLink protocol message, the processor can obtain the byte value of the service type byte (ServerIdentity, SID) in the abridged PowerLink protocol message, which is offset by the first preset number of bytes from the message header of the abridged PowerLink protocol message. Among them, the first preset number of bytes can be 1 byte, and the message header of the abridged PowerLink protocol message can refer to the data link layer of the PowerLink protocol message. After obtaining the byte value of the service type byte, the processor can determine the function code type of the service type of the abridged PowerLink protocol message according to the byte value of the service type byte. The function code type is decoded to obtain decoding information. The processor can obtain the byte value of the address node in the deleted PowerLink protocol message whose offset from the message header is a second preset number of bytes. The second preset number of bytes can be 2 bytes or 3 bytes.

[0042] In an embodiment of the present application, the second preset number of bytes includes a first sub-number of bytes and a second sub-number of bytes, the address node includes a target address node and a source address node, and obtaining the byte value of the address node in the pruned PowerLink protocol message whose offset from the message header is the second preset number of bytes includes: obtaining the byte value of the target address node in the pruned PowerLink protocol message whose offset from the message header is the first sub-number of bytes; obtaining the byte value of the source address node in the pruned PowerLink protocol message whose offset from the message header is the second sub-number of bytes.

[0043] The second preset number of bytes includes a first sub-number of bytes and a second sub-number of bytes. The address node may include a target address node and a source address node. The processor may obtain the byte value of the address node in the deleted PowerLink protocol message whose offset from the message header is the second preset number of bytes. Specifically, the processor may obtain the byte value of the target address node (DA, Destination Address) in the deleted PowerLink protocol message whose offset from the message header is the first sub-number of bytes. The first sub-number of bytes may be 2 bytes, i.e., one byte is read back based on the service type byte. The processor may obtain the byte value of the source address node (SA, Source Address) in the deleted PowerLink protocol message whose offset from the message header is the second sub-number of bytes. The second sub-number of bytes may be 3 bytes, i.e., one byte is read back based on the target address node.

[0044] In an embodiment of the present application, the function code type is decoded to obtain decoding information including: when the function code type is a SoC function code, obtaining a byte in the deleted PowerLink protocol message with an offset of a third preset number of bytes from the source address node, and taking the characteristics and byte values ​​of the fourth preset number of bytes backward on the basis of the byte as the characteristic type and characteristic value of the SoC function code respectively; using the triplet constructed by the characteristic type and characteristic value of the SoC function code as the decoding information of the SoC function code; when the function code type is a PReq function code, obtaining a byte in the deleted PowerLink protocol message with an offset of a fifth preset number of bytes from the source address node, and taking the characteristics and byte value of the next byte of the byte as the characteristic type and characteristic value of the PReq function code; using the triplet constructed by the characteristic type and characteristic value of the PReq function code as the decoding information of the PReq function code; when the function code type is a PRes function code, obtaining The offset from the source address node in the deleted PowerLink protocol message is the sixth preset number of bytes, and the characteristics and byte value of the byte after the byte are used as the characteristic type and characteristic value of the PRes function code; the triplet constructed by the characteristic type and characteristic value of the PRes function code is used as the decoding information of the PRes function code; when the function code type is the SoA function code, the offset from the source address node in the deleted PowerLink protocol message is obtained as the seventh preset number of bytes, and the characteristics and byte value of the byte after the byte are used as the characteristic type and characteristic value of the SoA function code; the triplet constructed by the characteristic type and characteristic value of the SoA function code is used as the decoding information of the SoA function code; when the function code type is the ASnd function code, the characteristics and byte value of the byte after the source address node are used as the characteristic type and characteristic value of the ASnd function code; the triplet constructed by the characteristic type and characteristic value of the ASnd function code is used as the decoding information of the ASnd function code.

[0045] The processor can decode the function code type to obtain decoding information. Specifically, the function code type may include SoC (Start of Cyclic) function code, PReq (Poll Request) function code, PRes (Poll Response) function code, SoA (Start of Asynchronous) function code and ASnd (Asynchronous Send) function code. In the case where the function code type is a SoC function code, the processor can obtain the byte whose offset from the source address node is the third preset number of bytes in the deleted PowerLink protocol message, and take the characteristics and byte values ​​of the fourth preset number of bytes backward on the basis of the byte as the characteristic type and characteristic value of the SoC function code respectively. The third preset number of bytes can be 11 bytes, that is, 11 bytes offset from the source address node. The fourth preset number of bytes can be 8 bytes. The characteristic type can be RelativeTime (relative time), and the characteristic value can be the value of RelativeTime. After obtaining the characteristic type and characteristic value of the SoC function code, the processor may use the triple constructed by the characteristic type and characteristic value of the SoC function code as the decoding information of the SoC function code.

[0046] In the case where the function code type is a PReq function code, the processor can obtain the byte whose offset from the source address node is the fifth preset number of bytes in the deleted PowerLink protocol message, and use the feature and byte value of the next byte of the byte as the feature type and feature value of the PReq function code. After obtaining the feature type and feature value of the PReq function code, the processor can use the triple constructed by the feature type and feature value of the PReq function code as the decoding information of the PReq function code. The fifth preset number of bytes can be 1 byte, that is, offset by 1 byte from the source address node. The feature type can be Flags, and the feature value refers to the value of Flags.

[0047] In the case where the function code type is a PRes function code, the processor can obtain the sixth preset number of bytes in the deleted PowerLink protocol message with an offset from the source address node, and use the feature and byte value of the next byte of the byte as the feature type and feature value of the PRes function code. After obtaining the feature type and feature value of the PRes function code, the processor can use the triple constructed by the feature type and feature value of the PRes function code as the decoding information of the PRes function code. The sixth preset number of bytes can be 2 bytes, the feature type can be Flags, and the feature value refers to the value of Flags.

[0048] In the case where the function code type is an SoA function code, the processor can obtain the seventh preset number of bytes in the deleted PowerLink protocol message with an offset from the source address node, and use the feature and byte value of the next byte of the byte as the feature type and feature value of the SoA function code. After obtaining the feature type and feature value of the SoA function code, the processor can use the triple constructed by the feature type and feature value of the SoA function code as the decoding information of the SoA function code. The seventh preset number of bytes can be 3 bytes, the feature type can be RequsetID (request service identifier), and the feature value refers to the value of RequsetID.

[0049] When the function code type is an ASnd function code, the processor can use the feature and byte value of the last byte of the source address node as the feature type and feature value of the ASnd function code. After obtaining the feature type and feature value of the ASnd function code, the processor can use the triple constructed by the feature type and feature value of the ASnd function code as the decoding information of the ASnd function code. The feature type can be a ServiceID (service type identifier), and the feature value refers to the value of the ServiceID. In the above manner, it is possible to penetrate into the PowerLink protocol message, decode each valid byte of the PowerLink protocol message, and obtain more accurate information.

[0050] Step 107: Process the PowerLink protocol message according to the payload length, the decoding information and the byte value of the address node, wherein the payload length is the number of bytes of the pruned PowerLink protocol message.

[0051] After obtaining the decoding information and the byte value of the address node, the processor may process the PowerLink protocol message according to the payload length, the decoding information and the byte value of the address node, wherein the payload length is the number of bytes of the pruned PowerLink protocol message.

[0052] In an embodiment of the present application, processing a PowerLink protocol message according to the load length, decoding information, and byte values ​​of an address node includes: determining whether the PowerLink protocol message is a malformed message according to the load length, decoding information, the byte value of a target address node, and the byte value of a source address node; if the PowerLink protocol message is a malformed message, blocking the PowerLink protocol message; if the PowerLink protocol message is not a malformed message, comparing the load length, decoding information, the byte value of a target address node, and the byte value of a source address node with a preset security policy to obtain a comparison result; if the comparison result satisfies the preset security policy, releasing the PowerLink protocol message; if the comparison result does not satisfy the preset security policy, blocking the PowerLink protocol message.

[0053] The processor can process the PowerLink protocol message according to the load length, decoding information, and byte values ​​of the address node. Specifically, the processor can determine whether the PowerLink protocol message is a malformed message according to the load length, decoding information, byte values ​​of the target address node, and byte values ​​of the source address node. In the case where the PowerLink protocol message is a malformed message, the processor can block the PowerLink protocol message. In the case where the PowerLink protocol message is not a malformed message, the processor can compare the load length, decoding information, byte values ​​of the target address node, and byte values ​​of the source address node with the preset security policy to obtain a comparison result. In the case where the comparison result satisfies the preset security policy, the processor can release the PowerLink protocol message. In the case where the comparison result does not meet the preset security policy, the processor can block the PowerLink protocol message. The preset security policy can be determined by the user based on demand. In an embodiment of the present application, in the case of blocking the PowerLink protocol message, the processor can send an alarm prompt.

[0054] In an embodiment of the present application, determining whether a PowerLink protocol message is a malformed message based on the load length, decoding information, the byte value of the target address node, and the byte value of the source address node includes: obtaining a malformation condition corresponding to the function code type; when the load length, decoding information, the byte value of the target address node, and the byte value of the source address node meet the malformation condition, determining that the PowerLink protocol message is a malformed message; when the load length, decoding information, the byte value of the target address node, and the byte value of the source address node do not meet the malformation condition, determining that the PowerLink protocol message is not a malformed message.

[0055] The processor can determine whether the PowerLink protocol message is a malformed message based on the load length, decoding information, the byte value of the target address node, and the byte value of the source address node. Specifically, the processor can obtain the malformation condition corresponding to the function code type. When the load length, decoding information, the byte value of the target address node, and the byte value of the source address node meet the malformation condition, the processor can determine that the PowerLink protocol message is a malformed message. When the load length, decoding information, the byte value of the target address node, and the byte value of the source address node do not meet the malformation condition, the processor can determine that the PowerLink protocol message is not a malformed message.

[0056] In an embodiment of the present application, the function code types include SoC function code, PReq function code, PRes function code, SoA function code and ASnd function code; when the function code type is SoC function code, the deformity condition is that the decoding information reaches the preset decoding information, the load length is less than the first preset length, the byte value of the source address node is not equal to the first preset byte value, and the byte value of the target address node is not equal to the second preset byte value; when the function code type is PReq function code, the deformity condition is that the load length is less than the second preset length, the byte value of the source address node is not equal to the first preset byte value, and the byte value of the target address node is less than the third preset length. preset byte value or greater than the fourth preset byte value; when the function code type is the PRes function code, the malformation condition is that the load length is less than the second preset length, the byte value of the source address node is less than the third preset byte value or greater than the fourth preset byte value, and the byte value of the target address node is not equal to the second preset byte value; when the function code type is the SoA function code, the malformation condition is that the load length is less than the second preset length, the byte value of the source address node is not equal to the first preset byte value, and the byte value of the target address node is not equal to the second preset byte value; when the function code type is the ASnd function code, the malformation condition is that the load length is less than the third preset length.

[0057] The processor can obtain the deformity condition corresponding to the function code type. When the function code type is a SoC function code, the deformity condition is that the decoding information reaches the preset decoding information, the load length is less than the first preset length, the byte value of the source address node is not equal to the first preset byte value, and the byte value of the target address node is not equal to the second preset byte value. The preset decoding information can be that the difference between the characteristic value of the characteristic area "RelativeTime" and the characteristic value in the previous SoC is not equal to one cycle time, and the characteristic value in the first SoC is not 0. The first preset length can be 22. The first preset byte value can be 240. The second preset byte value can be 255. That is, the deformity condition can be that the source address node is not equal to 240, the destination address node is not equal to 255, the load length is less than 22, the characteristic value of the characteristic area "RelativeTime" and the characteristic value in the previous SoC are not equal to one cycle time, and the characteristic value in the first SoC is not 0.

[0058] When the function code type is a PReq function code, the malformation condition is that the load length is less than the second preset length, the byte value of the source address node is not equal to the first preset byte value, and the byte value of the target address node is less than the third preset byte value or greater than the fourth preset byte value. The second preset length is 10, the third preset byte value can be 1, and the fourth preset byte value can be 239. That is, the malformation condition can be that the source address node is not equal to 240, the destination address node is less than 1 or greater than 239, and the load length is less than 10.

[0059] When the function code type is a PRes function code, the malformation condition is that the load length is less than the second preset length, the byte value of the source address node is less than the third preset byte value or greater than the fourth preset byte value, and the byte value of the target address node is not equal to the second preset byte value. That is, the malformation condition can be that the source address node is less than 1 or greater than 239, the destination address node is not equal to 255, and the load length is less than 10.

[0060] When the function code type is SoA function code, the malformation condition is that the payload length is less than the second preset length, the byte value of the source address node is not equal to the first preset byte value, and the byte value of the target address node is not equal to the second preset byte value. That is, the malformation condition can be that the source address node is not equal to 240, the destination address node is not equal to 255, and the payload length is less than 10.

[0061] When the function code type is an ASnd function code, the malformation condition is that the payload length is less than a third preset length. The third preset length may be 5. That is, the malformation condition may be that the payload length is less than 5.

[0062] In the embodiments of the present application, Figure 2As shown, the industrial control firewall (i.e., the processor) can receive the protocol message sent by the host computer or the network node from the message data entrance. After receiving the protocol message sent by the host computer or the network node, the industrial control firewall will perform a layer 2 header analysis and identification to determine whether the protocol message is a PowerLink protocol message. Specifically, the industrial control firewall can detect whether the value of the TYPE of the Ethernet header is 0x88ab. When the value of the TYPE of the Ethernet header is detected to be 0x88ab, the industrial control firewall can determine that the protocol message is a PowerLink protocol message. After obtaining the PowerLink protocol message, the industrial control firewall can exclude the 14-byte Ethernet header and the tail CRC, and determine the remaining current number of bytes as the load length of the deleted PowerLink protocol message. The industrial control firewall can parse the PowerLink protocol message header, that is, parse the SID (Server Identity, service type), DA (destination address node) and SA (source address node), and record the decoded information obtained by each analysis in a triple, wherein the triple can be {function code; feature type; feature value}.

[0063] Specifically, SID can be different types of function codes such as SoC, PReq, PRes, SoA, Asnd, etc. Different decoding operations are performed for different types of function codes. The working condition firewall can record the decoded value in a triplet format. And compare the decoded triplet information with the corresponding deformed message condition to determine whether the PowerLink protocol message is a deformed message. Different types of function codes correspond to different deformed message condition detections. If it is determined that it is not a deformed message, the working condition firewall can compare the triplet information with the preset security policy, which is determined by the user based on demand. If it meets the preset security policy, the working condition firewall can release the PowerLink protocol message. If it meets the preset security policy or is a deformed message, the working condition firewall can block the PowerLink protocol message, return the message filtering result, report the log, and issue an alarm.

[0064] Through the above technical solution, the efficiency of processing PowerLink protocol messages is improved, better processing effects are obtained, and in-depth analysis of PowerLink protocol messages is performed to improve the accuracy of PowerLink protocol message detection.

[0065] Figure 1 and Figure 2 FIG. 1 is a flow chart of a method for processing PowerLink protocol messages in one embodiment. It should be understood that although Figure 1 and Figure 2The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 1 and Figure 2 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0066] The embodiment of the present application also provides a device for processing a PowerLink protocol message, including:

[0067] a memory configured to store instructions;

[0068] The processor is configured to call instructions from the memory and implement the above-mentioned PowerLink protocol message processing method when executing the instructions.

[0069] An embodiment of the present application also provides a machine-readable storage medium, on which instructions are stored, and the instructions are used to enable a machine to execute the above-mentioned PowerLink protocol message processing method.

[0070] The embodiment of the present application also provides a computer program product, including a computer program, which implements the above-mentioned PowerLink protocol message processing method when executed by a processor.

[0071] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 3As shown. The computer device includes a processor A01, a network interface A02, a memory (not shown in the figure) and a database (not shown in the figure) connected through a system bus. Among them, the processor A01 of the computer device is used to provide computing and control capabilities. The memory of the computer device includes an internal memory A03 and a non-volatile storage medium A04. The non-volatile storage medium A04 stores an operating system B01, a computer program B02 and a database (not shown in the figure). The internal memory A03 provides an environment for the operation of the operating system B01 and the computer program B02 in the non-volatile storage medium A04. The database of the computer device is used to store data such as PowerLink protocol messages, byte values ​​of service type bytes, decoding information and byte values ​​of address nodes. The network interface A02 of the computer device is used to communicate with an external terminal through a network connection. When the computer program B02 is executed by the processor A01, a method for processing PowerLink protocol messages is implemented.

[0072] Those skilled in the art will understand that Figure 3 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0073] An embodiment of the present application provides a device, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, the following steps are implemented: receiving a PowerLink protocol message; deleting the Ethernet header byte and the Ethernet tail byte in the PowerLink protocol message to obtain a deleted PowerLink protocol message; obtaining the byte value of a service type byte in the deleted PowerLink protocol message, which is offset by a first preset number of bytes from the message header of the deleted PowerLink protocol message; determining a function code type of the service type of the deleted PowerLink protocol message according to the byte value of the service type byte; decoding the function code type to obtain decoding information; obtaining the byte value of an address node in the deleted PowerLink protocol message, which is offset by a second preset number of bytes from the message header; processing the PowerLink protocol message according to the load length, the decoding information, and the byte value of the address node, wherein the load length is the number of bytes of the deleted PowerLink protocol message.

[0074] In one embodiment, the second preset number of bytes includes a first sub-number of bytes and a second sub-number of bytes, the address node includes a target address node and a source address node, and obtaining the byte value of the address node in the pruned PowerLink protocol message whose offset from the message header is the second preset number of bytes includes: obtaining the byte value of the target address node in the pruned PowerLink protocol message whose offset from the message header is the first sub-number of bytes; obtaining the byte value of the source address node in the pruned PowerLink protocol message whose offset from the message header is the second sub-number of bytes.

[0075] In one embodiment, decoding the function code type to obtain decoding information includes: when the function code type is a SoC function code, obtaining a byte in the deleted PowerLink protocol message with an offset of a third preset number of bytes from the source address node, and taking the characteristics and byte values ​​of the fourth preset number of bytes backward on the basis of the byte as the characteristic type and characteristic value of the SoC function code respectively; using the triplet constructed by the characteristic type and characteristic value of the SoC function code as the decoding information of the SoC function code; when the function code type is a PReq function code, obtaining a byte in the deleted PowerLink protocol message with an offset of a fifth preset number of bytes from the source address node, and taking the characteristics and byte value of the next byte of the byte as the characteristic type and characteristic value of the PReq function code; using the triplet constructed by the characteristic type and characteristic value of the PReq function code as the decoding information of the PReq function code; when the function code type is a PRes function code, obtaining the deleted The offset from the source address node in the reduced PowerLink protocol message is the sixth preset number of bytes, and the feature and byte value of the byte after the byte are used as the feature type and feature value of the PRes function code; the triplet constructed by the feature type and feature value of the PRes function code is used as the decoding information of the PRes function code; when the function code type is the SoA function code, the offset from the source address node in the reduced PowerLink protocol message is obtained as the seventh preset number of bytes, and the feature and byte value of the byte after the byte are used as the feature type and feature value of the SoA function code; the triplet constructed by the feature type and feature value of the SoA function code is used as the decoding information of the SoA function code; when the function code type is the ASnd function code, the feature and byte value of the byte after the source address node are used as the feature type and feature value of the ASnd function code; the triplet constructed by the feature type and feature value of the ASnd function code is used as the decoding information of the ASnd function code.

[0076] In one embodiment, processing a PowerLink protocol message according to the load length, decoding information, and byte values ​​of an address node includes: determining whether the PowerLink protocol message is a malformed message according to the load length, decoding information, the byte value of a target address node, and the byte value of a source address node; if the PowerLink protocol message is a malformed message, blocking the PowerLink protocol message; if the PowerLink protocol message is not a malformed message, comparing the load length, decoding information, the byte value of a target address node, and the byte value of a source address node with a preset security policy to obtain a comparison result; if the comparison result satisfies the preset security policy, releasing the PowerLink protocol message; if the comparison result does not satisfy the preset security policy, blocking the PowerLink protocol message.

[0077] In one embodiment, the processing method further includes: sending an alarm prompt when the PowerLink protocol message is blocked.

[0078] In one embodiment, determining whether a PowerLink protocol message is a malformed message based on the load length, decoding information, the byte value of the target address node, and the byte value of the source address node includes: obtaining a malformation condition corresponding to the function code type; when the load length, decoding information, the byte value of the target address node, and the byte value of the source address node meet the malformation condition, determining that the PowerLink protocol message is a malformed message; when the load length, decoding information, the byte value of the target address node, and the byte value of the source address node do not meet the malformation condition, determining that the PowerLink protocol message is not a malformed message.

[0079] In one embodiment, the function code type includes SoC function code, PReq function code, PRes function code, SoA function code and ASnd function code; when the function code type is SoC function code, the deformity condition is that the decoding information reaches the preset decoding information, the load length is less than the first preset length, the byte value of the source address node is not equal to the first preset byte value, and the byte value of the target address node is not equal to the second preset byte value; when the function code type is PReq function code, the deformity condition is that the load length is less than the second preset length, the byte value of the source address node is not equal to the first preset byte value, and the byte value of the target address node is less than the third preset length. preset byte value or greater than the fourth preset byte value; when the function code type is the PRes function code, the malformation condition is that the load length is less than the second preset length, the byte value of the source address node is less than the third preset byte value or greater than the fourth preset byte value, and the byte value of the target address node is not equal to the second preset byte value; when the function code type is the SoA function code, the malformation condition is that the load length is less than the second preset length, the byte value of the source address node is not equal to the first preset byte value, and the byte value of the target address node is not equal to the second preset byte value; when the function code type is the ASnd function code, the malformation condition is that the load length is less than the third preset length.

[0080] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing the program of the processing method steps of initializing PowerLink protocol messages.

[0081] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0082] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0083] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0084] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0085] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0086] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0087] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0088] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0089] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for processing PowerLink protocol messages, characterized in that: The processing method comprises: Receive PowerLink protocol messages; Deleting the Ethernet header byte and the Ethernet tail byte in the PowerLink protocol message to obtain a deleted PowerLink protocol message; Obtaining a byte value of a service type byte in the pruned PowerLink protocol message, the offset from the message header of the pruned PowerLink protocol message being a first preset number of bytes; Determine the function code type of the service type of the deleted PowerLink protocol message according to the byte value of the service type byte; Decoding the function code type to obtain decoding information; Obtaining the byte value of the address node in the deleted PowerLink protocol message whose offset from the message header is a second preset number of bytes; The PowerLink protocol message is processed according to the load length, the decoding information and the byte value of the address node, wherein the load length is the number of bytes of the pruned PowerLink protocol message.

2. The method for processing PowerLink protocol messages according to claim 1, characterized in that: The second preset number of bytes includes a first sub-number of bytes and a second sub-number of bytes, the address node includes a target address node and a source address node, and the step of obtaining the byte value of the address node in the deleted PowerLink protocol message whose offset from the message header is the second preset number of bytes includes: Obtaining the byte value of the target address node in the pruned PowerLink protocol message whose offset from the message header is the first sub-number of bytes; Obtain the byte value of the source address node in the pruned PowerLink protocol message, the byte value of the source address node having an offset from the message header by a second sub-number of bytes.

3. The method for processing PowerLink protocol messages according to claim 2, characterized in that: Decoding the function code type to obtain decoding information includes: In the case where the function code type is a SoC function code, obtaining a byte in the deleted PowerLink protocol message whose offset from the source address node is a third preset number of bytes, and taking a feature and a byte value of a fourth preset number of bytes backward on the basis of the byte as the feature type and feature value of the SoC function code respectively; Using a triplet constructed by a feature type and a feature value of the SoC function code as decoding information of the SoC function code; In the case where the function code type is a PReq function code, obtaining a byte in the deleted PowerLink protocol message whose offset from the source address node is a fifth preset number of bytes, and using the feature and byte value of the next byte of the byte as the feature type and feature value of the PReq function code; Using a triplet constructed by a feature type and a feature value of the PReq function code as decoding information of the PReq function code; In the case where the function code type is a PRes function code, obtaining a sixth preset number of bytes in the deleted PowerLink protocol message with an offset from the source address node, and using the feature and byte value of the next byte of the byte as the feature type and feature value of the PRes function code; Using a triplet constructed by a feature type and a feature value of the PRes function code as decoding information of the PRes function code; In the case where the function code type is an SoA function code, obtaining the seventh preset number of bytes in the deleted PowerLink protocol message with an offset from the source address node, and using the feature and byte value of the last byte of the byte as the feature type and feature value of the SoA function code; Using a triplet constructed by a feature type and a feature value of the SoA function code as decoding information of the SoA function code; When the function code type is an ASnd function code, the feature and byte value of the last byte of the source address node are used as the feature type and feature value of the ASnd function code; The triplet constructed by the characteristic type and characteristic value of the ASnd function code is used as the decoding information of the ASnd function code.

4. The method for processing PowerLink protocol messages according to claim 2, characterized in that: The processing of the PowerLink protocol message according to the load length, the decoding information, and the byte value of the address node includes: Determine whether the PowerLink protocol message is a malformed message according to the load length, the decoding information, the byte value of the target address node, and the byte value of the source address node; When the PowerLink protocol message is the deformed message, blocking the PowerLink protocol message; In the case where the PowerLink protocol message is not the deformed message, the payload length, the decoding information, the byte value of the target address node, and the byte value of the source address node are compared with a preset security policy to obtain a comparison result; If the comparison result satisfies the preset security policy, releasing the PowerLink protocol message; When the comparison result shows that the preset security policy is not satisfied, the PowerLink protocol message is blocked.

5. The method for processing PowerLink protocol messages according to claim 4, characterized in that: The processing method also includes: In the case of blocking the PowerLink protocol message, an alarm prompt is sent.

6. The method for processing PowerLink protocol messages according to claim 4, characterized in that: The determining whether the PowerLink protocol message is a malformed message according to the load length, the decoding information, the byte value of the target address node, and the byte value of the source address node comprises: Obtaining a deformity condition corresponding to the function code type; In the case where the payload length, the decoding information, the byte value of the target address node, and the byte value of the source address node meet the deformity condition, determining that the PowerLink protocol message is a deformed message; When the payload length, the decoding information, the byte value of the target address node, and the byte value of the source address node do not meet the deformity condition, it is determined that the PowerLink protocol message is not the deformed message.

7. The method for processing PowerLink protocol messages according to claim 6, characterized in that: The function code types include SoC function code, PReq function code, PRes function code, SoA function code and ASnd function code; In the case where the function code type is a SoC function code, the deformity condition is that the decoded information reaches the preset decoded information, the load length is less than the first preset length, the byte value of the source address node is not equal to the first preset byte value, and the byte value of the target address node is not equal to the second preset byte value; In the case where the function code type is a PReq function code, the deformity condition is that the load length is less than the second preset length, the byte value of the source address node is not equal to the first preset byte value, and the byte value of the target address node is less than the third preset byte value or greater than the fourth preset byte value; When the function code type is a PRes function code, the deformity condition is that the payload length is less than the second preset length, the byte value of the source address node is less than the third preset byte value or greater than the fourth preset byte value, and the byte value of the target address node is not equal to the second preset byte value; In the case where the function code type is an SoA function code, the deformity condition is that the payload length is less than a second preset length, the byte value of the source address node is not equal to the first preset byte value, and the byte value of the target address node is not equal to the second preset byte value; When the function code type is an ASnd function code, the deformity condition is that the payload length is less than a third preset length.

8. A device for processing PowerLink protocol messages, characterized in that: include: a memory configured to store instructions; A processor is configured to call the instruction from the memory and implement the method for processing the PowerLink protocol message according to any one of claims 1 to 7 when executing the instruction.

9. A machine-readable storage medium, characterized in that: The machine-readable storage medium stores instructions, which are used to enable a machine to execute the method for processing PowerLink protocol messages according to any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the method for processing the PowerLink protocol message according to any one of claims 1 to 7.

Images