Methods, devices, storage media, and software products for processing PowerLink protocol messages

Abstract

This application relates to the field of industrial network security technology, and in particular to a method, apparatus, storage medium, and program product for processing PowerLink protocol messages. The method includes: receiving a PowerLink protocol message; deleting its Ethernet header and trailer bytes; obtaining the byte value of the service type byte in the deleted PowerLink protocol message at an offset of a first preset number of bytes from its header; determining the function code type of the service type; decoding the function code type to obtain decoding information; obtaining the byte value of the address node in the message at an offset of a second preset number of bytes from its header; and processing the PowerLink protocol message based on the payload length, decoding information, and the address node byte value, thereby improving the efficiency of PowerLink protocol message processing, achieving better processing results, and performing in-depth message analysis to improve the accuracy of message detection.

Description

Technical Field

[0001] This application relates to the field of industrial network security technology, specifically to a method, apparatus, storage medium, and program product for processing PowerLink protocol messages. Background Technology

[0002] As a product of the deep integration of next-generation information technology and manufacturing, the Industrial Internet is leading global manufacturing towards a new level of digital and intelligent transformation. With the widespread application of the Industrial Internet, the frequency of data exchange and remote control has increased significantly, highlighting the growing importance of industrial cybersecurity. In the era of intelligent manufacturing, industrial control systems face various threats from both internal and external sources, such as malware attacks, unauthorized access, and data breaches, all of which can seriously impact production safety, operational efficiency, and even national security. Therefore, how to protect industrial networks, especially industrial equipment, from external harm, is an increasingly important issue both domestically and internationally.

[0003] Protocol analysis is a crucial method for preventing attacks on industrial networks. PowerLink is a real-time Ethernet communication protocol designed specifically for industrial automation. Its high real-time performance, low latency, and strong synchronization capabilities have led to its widespread application in high-precision, high-requirement industrial scenarios such as CNC machine tools and robot control. However, with the increasing complexity of network environments and the continuous evolution of attack methods, the PowerLink protocol also faces the risk of malicious exploitation. Therefore, effective detection and protection of PowerLink networks are essential to ensure their secure and stable operation.

[0004] Currently, the detection and protection of the PowerLink protocol often rely on network context information and network status, lacking in-depth analysis of the PowerLink protocol, making it impossible to identify internal problems of the PowerLink protocol, thus affecting the accuracy of PowerLink protocol detection and protection. Summary of the Invention

[0005] The purpose of this application is to provide a method, apparatus, storage medium, and program product for processing PowerLink protocol messages, in order to solve the problems of poor protection effect and inaccurate detection of PowerLink protocol in the prior art.

[0006] To achieve the above objectives, the first aspect of this application provides a method for processing PowerLink protocol messages, the method comprising:

[0007] Receive PowerLink protocol messages;

[0008] Remove the Ethernet header and Ethernet trailer bytes from the PowerLink protocol message to obtain the shortened PowerLink protocol message;

[0009] Obtain the byte value of the service type byte, which is offset from the header of the deleted PowerLink protocol message by a first preset number of bytes;

[0010] The function code type of the service type in the reduced PowerLink protocol message is determined based on the byte value of the service type byte.

[0011] Decode the function code type to obtain the decoded information;

[0012] Obtain the byte value of the address node in the PowerLink protocol message after deletion, whose offset from the message header is a second preset number of bytes;

[0013] PowerLink protocol messages are processed based on the payload length, decoding information, and address node byte values, where the payload length is the number of bytes in the shortened PowerLink protocol message.

[0014] In this embodiment, the second preset number of bytes includes a first sub-number of bytes and a second sub-number of bytes, and the address node includes a target address node and a source address node. Obtaining the byte value of the address node in the deleted PowerLink protocol message whose offset from the message header is the second preset number of bytes includes: obtaining the byte value of the target address node in the deleted PowerLink protocol message whose offset from the message header is the first sub-number of bytes; and obtaining the byte value of the source address node in the deleted PowerLink protocol message whose offset from the message header is the second sub-number of bytes.

[0015] In this embodiment, decoding the function code type to obtain decoding information includes: when the function code type is SoC function code, obtaining the byte in the abbreviated PowerLink protocol message with an offset of a third preset number of bytes from the source address node, and taking the features and byte values ​​of the fourth preset number of bytes after that byte as the feature type and feature value of the SoC function code; using the triple constructed from the feature type and feature value of the SoC function code as the decoding information of the SoC function code; when the function code type is PReq function code, obtaining the byte in the abbreviated PowerLink protocol message with an offset of a fifth preset number of bytes from the source address node, and taking the features and byte values ​​of the next byte of that byte as the feature type and feature value of the PReq function code; using the triple constructed from the feature type and feature value of the PReq function code as the decoding information of the PReq function code; when the function code type is PRes function code, obtaining... In the shortened PowerLink protocol message, the offset from the source address node is the sixth preset number of bytes. The characteristics and byte value of the next byte are used as the feature type and feature value of the PRES function code. The triple constructed from the feature type and feature value of the PRES function code is used as the decoding information of the PRES function code. In the case of the function code type SoA, the offset from the source address node in the shortened PowerLink protocol message is the seventh preset number of bytes. The characteristics and byte value of the next byte are used as the feature type and feature value of the SoA function code. The triple constructed from the feature type and feature value of the SoA function code is used as the decoding information of the SoA function code. In the case of the function code type ASnd, the characteristics and byte value of the next byte of the source address node are used as the feature type and feature value of the ASnd function code. The triple constructed from the feature type and feature value of the ASnd function code is used as the decoding information of the ASnd function code.

[0016] In this embodiment, processing PowerLink protocol messages based on payload length, decoding information, and address node byte values ​​includes: determining whether a PowerLink protocol message is a malformed message based on the payload length, decoding information, target address node byte value, and source address node byte value; blocking the PowerLink protocol message if it is a malformed message; comparing the payload length, decoding information, target address node byte value, and source address node byte value with a preset security policy to obtain a comparison result; allowing the PowerLink protocol message if the comparison result satisfies the preset security policy; and blocking the PowerLink protocol message if the comparison result does not satisfy the preset security policy.

[0017] In this embodiment of the application, the processing method further includes: sending an alarm prompt when blocking PowerLink protocol messages.

[0018] In this embodiment, determining whether a PowerLink protocol message is a malformed message based on the payload length, decoding information, the byte value of the target address node, and the byte value of the source address node includes: obtaining the malformation conditions corresponding to the function code type; determining that the PowerLink protocol message is a malformed message if the payload length, decoding information, the byte value of the target address node, and the byte value of the source address node meet the malformation conditions; and determining that the PowerLink protocol message is not a malformed message if the payload length, decoding information, the byte value of the target address node, and the byte value of the source address node do not meet the malformation conditions.

[0019] In this embodiment, the function code types include SoC function code, PReq function code, PRes function code, SoA function code, and ASnd function code. When the function code type is SoC function code, the abnormal conditions are: the decoded information reaches a preset decoded information value, the payload length is less than a first preset length, the byte value of the source address node is not equal to a first preset byte value, and the byte value of the target address node is not equal to a second preset byte value. When the function code type is PReq function code, the abnormal conditions are: the payload length is less than a second preset length, the byte value of the source address node is not equal to a first preset byte value, and the byte value of the target address node is less than a third preset byte value. The default byte value is greater than the fourth default byte value; when the function code type is PRes function code, the abnormal conditions are that the payload length is less than the second default length, the byte value of the source address node is less than the third default byte value or greater than the fourth default byte value, and the byte value of the destination address node is not equal to the second default byte value; when the function code type is SoA function code, the abnormal conditions are that the payload length is less than the second default length, the byte value of the source address node is not equal to the first default byte value, and the byte value of the destination address node is not equal to the second default byte value; when the function code type is ASnd function code, the abnormal condition is that the payload length is less than the third default length.

[0020] A second aspect of this application provides a PowerLink protocol message processing apparatus, comprising:

[0021] The memory is configured to store instructions;

[0022] The processor is configured to retrieve instructions from memory and, when executing instructions, to implement the aforementioned PowerLink protocol message processing method.

[0023] A third aspect of this application provides a machine-readable storage medium storing instructions that cause a machine to execute the aforementioned PowerLink protocol message processing method.

[0024] The fourth aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method for processing PowerLink protocol messages.

[0025] The above technical solution can remove the Ethernet header and trailer bytes from the PowerLink protocol message; obtain the byte value of the service type byte offset from the header of the removed PowerLink protocol message by a first preset number of bytes; then determine the function code type of the service type of the removed PowerLink protocol message based on the byte value of the service type byte; decode the function code type to obtain decoding information; obtain the byte value of the address node offset from the header of the removed PowerLink protocol message by a second preset number of bytes; and process the PowerLink protocol message according to the payload length, decoding information, and address node byte value, where the payload length is the number of bytes in the removed PowerLink protocol message, thereby improving the processing efficiency of the PowerLink protocol message, obtaining better processing results, and performing in-depth analysis of the PowerLink protocol message to improve the accuracy of PowerLink protocol message detection.

[0026] Other features and advantages of the embodiments of this application will be described in detail in the following detailed description section. Attached Figure Description

[0027] The accompanying drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the following detailed description to explain the embodiments of this application, but do not constitute a limitation on the embodiments of this application. In the drawings:

[0028] Figure 1 This illustration schematically shows a flowchart of a method for processing PowerLink protocol messages according to an embodiment of this application;

[0029] Figure 2 This illustration schematically shows another flowchart of a method for processing PowerLink protocol messages according to an embodiment of this application;

[0030] Figure 3 The diagram illustrates the internal structure of a computer device according to an embodiment of this application. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for illustration and explanation of the embodiments of this application and are not intended to limit the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0032] It should be noted that if the embodiments of this application involve directional indicators (such as up, down, left, right, front, back, etc.), the directional indicators are only used to explain the relative positional relationship and movement of the components in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicators will also change accordingly.

[0033] Furthermore, if the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0034] Figure 1 This illustration schematically depicts a flowchart of a PowerLink protocol message processing method according to an embodiment of this application. Figure 1 As shown in the figure, this application embodiment provides a method for processing PowerLink protocol messages, which may include the following steps.

[0035] Step 101: Receive PowerLink protocol messages.

[0036] Step 102: Delete the Ethernet header and Ethernet trailer bytes from the PowerLink protocol message to obtain the shortened PowerLink protocol message.

[0037] Step 103: Obtain the byte value of the service type byte, which is offset from the header of the deleted PowerLink protocol message by a first preset number of bytes.

[0038] Step 104: Determine the function code type of the service type of the PowerLink protocol message after deletion based on the byte value of the service type byte.

[0039] Step 105: Decode the function code type to obtain the decoded information.

[0040] Step 106: Obtain the byte value of the address node in the PowerLink protocol message after deletion, whose offset from the message header is the second preset number of bytes.

[0041] PowerLink is a real-time Ethernet communication protocol designed specifically for industrial automation. The processor can receive PowerLink messages. After receiving a PowerLink message, the processor can remove the Ethernet header and trailer bytes to obtain a shortened PowerLink message. The Ethernet header is a standard 14-byte structure, consisting of a 6-byte destination address, a 6-byte source address, and a 2-byte Ethernet layer TYPE. The Ethernet trailer is 4 bytes. After obtaining the shortened PowerLink message, the processor can obtain the value of the ServerIdentity (SID) byte, which is offset from the header of the shortened PowerLink message by a first preset number of bytes. This first preset number of bytes can be one byte, and the header of the shortened PowerLink message can refer to the data link layer of the PowerLink message. After obtaining the value of the SID byte, the processor can determine the function code type of the service type in the shortened PowerLink message based on this value. The processor decodes the function code type to obtain the decoded information. It can then retrieve the byte value of the address node in the abbreviated PowerLink protocol message, which has an offset from the message header of a second preset number of bytes. This second preset number of bytes can be 2 or 3 bytes.

[0042] In this embodiment, the second preset number of bytes includes a first sub-number of bytes and a second sub-number of bytes, and the address node includes a target address node and a source address node. Obtaining the byte value of the address node in the deleted PowerLink protocol message whose offset from the message header is the second preset number of bytes includes: obtaining the byte value of the target address node in the deleted PowerLink protocol message whose offset from the message header is the first sub-number of bytes; and obtaining the byte value of the source address node in the deleted PowerLink protocol message whose offset from the message header is the second sub-number of bytes.

[0043] The second preset number of bytes includes the first sub-number of bytes and the second sub-number of bytes. The address node can include a destination address node and a source address node. The processor can obtain the byte value of the address node in the pruned PowerLink protocol message whose offset from the message header is the second preset number of bytes. Specifically, the processor can obtain the byte value of the destination address node (DA) in the pruned PowerLink protocol message whose offset from the message header is the first sub-number of bytes. The first sub-number of bytes can be 2 bytes, that is, one byte read after the service type byte. The processor can obtain the byte value of the source address node (SA) in the pruned PowerLink protocol message whose offset from the message header is the second sub-number of bytes. The second sub-number of bytes can be 3 bytes, that is, one byte read after the destination address node.

[0044] In this embodiment, decoding the function code type to obtain decoding information includes: when the function code type is SoC function code, obtaining the byte in the abbreviated PowerLink protocol message with an offset of a third preset number of bytes from the source address node, and taking the features and byte values ​​of the fourth preset number of bytes after that byte as the feature type and feature value of the SoC function code; using the triple constructed from the feature type and feature value of the SoC function code as the decoding information of the SoC function code; when the function code type is PReq function code, obtaining the byte in the abbreviated PowerLink protocol message with an offset of a fifth preset number of bytes from the source address node, and taking the features and byte values ​​of the next byte of that byte as the feature type and feature value of the PReq function code; using the triple constructed from the feature type and feature value of the PReq function code as the decoding information of the PReq function code; when the function code type is PRes function code, obtaining... In the shortened PowerLink protocol message, the offset from the source address node is the sixth preset number of bytes. The characteristics and byte value of the next byte are used as the feature type and feature value of the PRES function code. The triple constructed from the feature type and feature value of the PRES function code is used as the decoding information of the PRES function code. In the case of the function code type SoA, the offset from the source address node in the shortened PowerLink protocol message is the seventh preset number of bytes. The characteristics and byte value of the next byte are used as the feature type and feature value of the SoA function code. The triple constructed from the feature type and feature value of the SoA function code is used as the decoding information of the SoA function code. In the case of the function code type ASnd, the characteristics and byte value of the next byte of the source address node are used as the feature type and feature value of the ASnd function code. The triple constructed from the feature type and feature value of the ASnd function code is used as the decoding information of the ASnd function code.

[0045] The processor can decode the function code type to obtain decoded information. Specifically, the function code type can include SoC (Start of Cyclic) function code, PReq (Poll Request) function code, PRES (Poll Response) function code, SoA (Start of Asynchronous) function code, and ASnd (Asynchronous Send) function code. When the function code type is SoC, the processor can obtain the bytes in the abbreviated PowerLink protocol message with an offset of a third preset number of bytes from the source address node, and then take the characteristics and byte values ​​of a fourth preset number of bytes from that byte as the feature type and feature value of the SoC function code. The third preset number of bytes can be 11 bytes, i.e., offsetting 11 bytes from the source address node. The fourth preset number of bytes can be 8 bytes. The feature type can be RelativeTime, and the feature value can be the value of RelativeTime. After obtaining the feature type and feature value of the SoC function code, the processor can use the triple constructed from the feature type and feature value of the SoC function code as the decoding information of the SoC function code.

[0046] When the function code type is PReq, the processor can obtain the byte in the abbreviated PowerLink protocol message with an offset of the fifth preset number of bytes from the source address node, and use the characteristics and byte value of the next byte as the feature type and feature value of the PReq function code. After obtaining the feature type and feature value of the PReq function code, the processor can use the triple constructed from the feature type and feature value of the PReq function code as the decoding information of the PReq function code. The fifth preset number of bytes can be 1 byte, that is, offset by 1 byte from the source address node. The feature type can be Flags, and the feature value refers to the value of Flags.

[0047] When the function code type is PRES function code, the processor can obtain the offset from the source address node in the abbreviated PowerLink protocol message by a sixth preset number of bytes, and use the characteristics and byte value of the next byte as the feature type and feature value of the PRES function code. After obtaining the feature type and feature value of the PRES function code, the processor can use the triple constructed from the feature type and feature value of the PRES function code as the decoding information of the PRES function code. The sixth preset number of bytes can be 2 bytes, the feature type can be Flags, and the feature value refers to the value of Flags.

[0048] When the function code type is SoA, the processor can obtain the offset from the source address node in the abbreviated PowerLink protocol message by the seventh preset number of bytes, and use the characteristics and byte value of the next byte as the feature type and feature value of the SoA function code. After obtaining the feature type and feature value of the SoA function code, the processor can use the triple constructed from the feature type and feature value of the SoA function code as the decoding information of the SoA function code. The seventh preset number of bytes can be 3 bytes, the feature type can be RequestID (Request Service Identifier), and the feature value refers to the value of RequestID.

[0049] When the function code type is ASnd, the processor can use the characteristics and byte value of the last byte of the source address node as the characteristic type and characteristic value of the ASnd function code. After obtaining the characteristic type and characteristic value of the ASnd function code, the processor can use the triple constructed from the characteristic type and characteristic value as the decoding information of the ASnd function code. The characteristic type can be ServiceID (Service Type Identifier), and the characteristic value refers to the value of ServiceID. Through this method, it is possible to delve into the internal workings of the PowerLink protocol message, decode each valid byte of the PowerLink protocol message, and obtain more accurate information.

[0050] Step 107: Process the PowerLink protocol message based on the payload length, decoding information, and address node byte value, where the payload length is the number of bytes in the shortened PowerLink protocol message.

[0051] After obtaining the decoding information and the byte value of the address node, the processor can process the PowerLink protocol message according to the payload length, the decoding information, and the byte value of the address node, where the payload length is the number of bytes in the shortened PowerLink protocol message.

[0052] In this embodiment, processing PowerLink protocol messages based on payload length, decoding information, and address node byte values ​​includes: determining whether a PowerLink protocol message is a malformed message based on the payload length, decoding information, target address node byte value, and source address node byte value; blocking the PowerLink protocol message if it is a malformed message; comparing the payload length, decoding information, target address node byte value, and source address node byte value with a preset security policy to obtain a comparison result; allowing the PowerLink protocol message if the comparison result satisfies the preset security policy; and blocking the PowerLink protocol message if the comparison result does not satisfy the preset security policy.

[0053] The processor can process PowerLink protocol messages based on the payload length, decoding information, and the byte value of the address node. Specifically, the processor can determine whether a PowerLink protocol message is a malformed message based on the payload length, decoding information, the byte value of the destination address node, and the byte value of the source address node. If the PowerLink protocol message is a malformed message, the processor can block it. If the PowerLink protocol message is not a malformed message, the processor can compare the payload length, decoding information, the byte value of the destination address node, and the byte value of the source address node with a preset security policy to obtain a comparison result. If the comparison result satisfies the preset security policy, the processor can allow the PowerLink protocol message. If the comparison result does not satisfy the preset security policy, the processor can block the PowerLink protocol message. The preset security policy can be determined by the user based on requirements. In this embodiment, the processor can send an alarm notification when blocking a PowerLink protocol message.

[0054] In this embodiment, determining whether a PowerLink protocol message is a malformed message based on the payload length, decoding information, the byte value of the target address node, and the byte value of the source address node includes: obtaining the malformation conditions corresponding to the function code type; determining that the PowerLink protocol message is a malformed message if the payload length, decoding information, the byte value of the target address node, and the byte value of the source address node meet the malformation conditions; and determining that the PowerLink protocol message is not a malformed message if the payload length, decoding information, the byte value of the target address node, and the byte value of the source address node do not meet the malformation conditions.

[0055] The processor can determine whether a PowerLink protocol message is malformed based on the payload length, decoded information, the byte value of the destination address node, and the byte value of the source address node. Specifically, the processor can obtain the malformation conditions corresponding to the function code type. If the payload length, decoded information, the byte value of the destination address node, and the byte value of the source address node meet the malformation conditions, the processor can determine that the PowerLink protocol message is malformed. If the payload length, decoded information, the byte value of the destination address node, and the byte value of the source address node do not meet the malformation conditions, the processor can determine that the PowerLink protocol message is not malformed.

[0056] In this embodiment, the function code types include SoC function code, PReq function code, PRes function code, SoA function code, and ASnd function code. When the function code type is SoC function code, the abnormal conditions are: the decoded information reaches a preset decoded information value, the payload length is less than a first preset length, the byte value of the source address node is not equal to a first preset byte value, and the byte value of the target address node is not equal to a second preset byte value. When the function code type is PReq function code, the abnormal conditions are: the payload length is less than a second preset length, the byte value of the source address node is not equal to a first preset byte value, and the byte value of the target address node is less than a third preset byte value. The default byte value is greater than the fourth default byte value; when the function code type is PRes function code, the abnormal conditions are that the payload length is less than the second default length, the byte value of the source address node is less than the third default byte value or greater than the fourth default byte value, and the byte value of the destination address node is not equal to the second default byte value; when the function code type is SoA function code, the abnormal conditions are that the payload length is less than the second default length, the byte value of the source address node is not equal to the first default byte value, and the byte value of the destination address node is not equal to the second default byte value; when the function code type is ASnd function code, the abnormal condition is that the payload length is less than the third default length.

[0057] The processor can acquire malformation conditions corresponding to the function code type. When the function code type is a SoC function code, the malformation conditions are: the decoded information reaches a preset decoded information value; the payload length is less than a first preset length; the byte value of the source address node is not equal to the first preset byte value; and the byte value of the destination address node is not equal to a second preset byte value. The preset decoded information can be that the difference between the feature value of the feature region "RelativeTime" and the feature value in the previous SoC is not equal to one cycle time, and the feature value in the first SoC is not 0. The first preset length can be 22. The first preset byte value can be 240. The second preset byte value can be 255. That is, the malformation conditions can be: the source address node is not equal to 240, the destination address node is not equal to 255, the payload length is less than 22, the difference between the feature value of the feature region "RelativeTime" and the feature value in the previous SoC is not equal to one cycle time, and the feature value in the first SoC is not 0.

[0058] When the function code type is PReq, the malformation conditions are: the payload length is less than the second preset length, the byte value of the source address node is not equal to the first preset byte value, and the byte value of the destination address node is less than the third preset byte value or greater than the fourth preset byte value. The second preset length is 10, the third preset byte value can be 1, and the fourth preset byte value can be 239. That is, the malformation conditions can be: the source address node is not equal to 240, the destination address node is less than 1 or greater than 239, and the payload length is less than 10.

[0059] When the function code type is PRES function code, the malformation conditions are: the payload length is less than the second preset length, the byte value of the source address node is less than the third preset byte value or greater than the fourth preset byte value, and the byte value of the destination address node is not equal to the second preset byte value. That is, the malformation conditions can be that the source address node is less than 1 or greater than 239, the destination address node is not equal to 255, and the payload length is less than 10.

[0060] When the function code type is SoA, the malformation conditions are: the payload length is less than the second preset length, the byte value of the source address node is not equal to the first preset byte value, and the byte value of the destination address node is not equal to the second preset byte value. That is, the malformation conditions can be that the source address node is not equal to 240, the destination address node is not equal to 255, and the payload length is less than 10.

[0061] When the function code type is ASnd, the abnormal condition is that the load length is less than the third preset length. The third preset length can be 5. That is, the abnormal condition can be that the load length is less than 5.

[0062] In the embodiments of this application, such as Figure 2As shown, the industrial control firewall (i.e., the processor) can receive protocol messages sent by the host computer or network node from the packet data inlet. After receiving the protocol message sent by the host computer or network node, the industrial control firewall performs Layer 2 header parsing to determine whether the protocol message is a PowerLink protocol message. Specifically, the industrial control firewall can detect whether the TYPE value of the Ethernet header is 0x88ab. If the TYPE value of the Ethernet header is detected to be 0x88ab, the industrial control firewall can determine that the protocol message is a PowerLink protocol message. After obtaining the PowerLink protocol message, the industrial control firewall can exclude the 14-byte Ethernet header and trailer CRC, and determine the remaining current byte number as the payload length of the shortened PowerLink protocol message. The industrial control firewall can parse the PowerLink protocol message header, that is, parse the SID (Server Identity, Service Type), DA (Destination Address Node), and SA (Source Address Node), and record the decoded information obtained from each parsing in a triple, where the triple can be {Function Code; Feature Type; Feature Value}.

[0063] Specifically, the SID can take different function codes such as SoC, PReq, PRes, SoA, and Asnd. Different decoding operations are performed for different function code types. The industrial firewall records the decoded value in a triplet format and compares the decoded triplet information with the corresponding malformed packet conditions to determine if the PowerLink protocol packet is malformed. Different function code types correspond to different malformed packet detection conditions. If it is determined not to be a malformed packet, the industrial firewall compares the triplet information with a preset security policy, which is determined by the user based on requirements. If it conforms to the preset security policy, the industrial firewall can allow the PowerLink protocol packet. If it conforms to the preset security policy or is a malformed packet, the industrial firewall can block the PowerLink protocol packet, return the packet filtering result, report it in the log, and issue an alarm.

[0064] The above technical solutions improve the efficiency of PowerLink protocol message processing, achieve better processing results, and enable in-depth analysis of PowerLink protocol messages to improve the accuracy of PowerLink protocol message detection.

[0065] Figure 1 and Figure 2 This is a flowchart illustrating a method for processing PowerLink protocol messages in one embodiment. It should be understood that, although... Figure 1 and Figure 2The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 1 and Figure 2 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but may be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but may be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0066] This application also provides a PowerLink protocol message processing apparatus, including:

[0067] The memory is configured to store instructions;

[0068] The processor is configured to retrieve instructions from memory and, when executing instructions, to implement the aforementioned PowerLink protocol message processing method.

[0069] This application also provides a machine-readable storage medium storing instructions that cause a machine to execute the above-described PowerLink protocol message processing method.

[0070] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method for processing PowerLink protocol messages.

[0071] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 3As shown, the computer device includes a processor A01, a network interface A02, memory (not shown), and a database (not shown) connected via a system bus. The processor A01 provides computing and control capabilities. The memory includes internal memory A03 and a non-volatile storage medium A04. The non-volatile storage medium A04 stores an operating system B01, a computer program B02, and a database (not shown). The internal memory A03 provides an environment for the operation of the operating system B01 and the computer program B02 stored in the non-volatile storage medium A04. The database stores data such as PowerLink protocol messages, byte values ​​of service type bytes, decoding information, and byte values ​​of address nodes. The network interface A02 is used for communication with external terminals via a network connection. When executed by the processor A01, the computer program B02 implements a method for processing PowerLink protocol messages.

[0072] Those skilled in the art will understand that Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0073] This application provides an apparatus including a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it performs the following steps: receiving a PowerLink protocol message; deleting Ethernet header bytes and Ethernet trailer bytes from the PowerLink protocol message to obtain a shortened PowerLink protocol message; obtaining the byte value of a service type byte offset from the header of the shortened PowerLink protocol message by a first preset number of bytes; determining the function code type of the service type of the shortened PowerLink protocol message based on the byte value of the service type byte; decoding the function code type to obtain decoding information; obtaining the byte value of an address node offset from the header of the shortened PowerLink protocol message by a second preset number of bytes; and processing the PowerLink protocol message according to the payload length, decoding information, and the byte value of the address node, wherein the payload length is the number of bytes in the shortened PowerLink protocol message.

[0074] In one embodiment, the second preset number of bytes includes a first sub-number of bytes and a second sub-number of bytes, and the address node includes a target address node and a source address node. Obtaining the byte value of the address node in the reduced PowerLink protocol message whose offset from the message header is the second preset number of bytes includes: obtaining the byte value of the target address node in the reduced PowerLink protocol message whose offset from the message header is the first sub-number of bytes; and obtaining the byte value of the source address node in the reduced PowerLink protocol message whose offset from the message header is the second sub-number of bytes.

[0075] In one embodiment, decoding the function code type to obtain decoding information includes: when the function code type is SoC function code, obtaining the byte in the deleted PowerLink protocol message with an offset of a third preset number of bytes from the source address node, and taking the characteristics and byte value of the fourth preset number of bytes after that byte as the feature type and feature value of the SoC function code; using the triple constructed from the feature type and feature value of the SoC function code as the decoding information of the SoC function code; when the function code type is PReq function code, obtaining the byte in the deleted PowerLink protocol message with an offset of a fifth preset number of bytes from the source address node, and taking the characteristics and byte value of the next byte of that byte as the feature type and feature value of the PReq function code; using the triple constructed from the feature type and feature value of the PReq function code as the decoding information of the PReq function code; when the function code type is PRes function code, obtaining the byte in the deleted PowerLink protocol message with an offset of a fifth preset number of bytes from the source address node, and taking the characteristics and byte value of the next byte of that byte as the feature type and feature value of the PReq function code; taking the triple constructed from the feature type and feature value of the PReq function code as the decoding information of the PReq function code; when the function code type is PRes function code, obtaining the byte in the deleted PowerLink protocol message with an offset of a fifth preset number of bytes from the source address node, and taking the characteristics and byte value of the next byte of that byte as the feature type and feature value of the PReq function code as the decoding information of the PReq function code; taking ... In the reduced PowerLink protocol message, the offset from the source address node is the sixth preset number of bytes, and the characteristics and byte value of the next byte are used as the feature type and feature value of the PRES function code; the triple constructed from the feature type and feature value of the PRES function code is used as the decoding information of the PRES function code; in the case of the function code type SoA function code, the offset from the source address node in the reduced PowerLink protocol message is the seventh preset number of bytes, and the characteristics and byte value of the next byte are used as the feature type and feature value of the SoA function code; the triple constructed from the feature type and feature value of the SoA function code is used as the decoding information of the SoA function code; in the case of the function code type ASnd function code, the characteristics and byte value of the next byte of the source address node are used as the feature type and feature value of the ASnd function code; the triple constructed from the feature type and feature value of the ASnd function code is used as the decoding information of the ASnd function code.

[0076] In one embodiment, processing a PowerLink protocol message based on the payload length, decoding information, and the byte value of the address node includes: determining whether the PowerLink protocol message is a malformed message based on the payload length, decoding information, the byte value of the target address node, and the byte value of the source address node; blocking the PowerLink protocol message if it is a malformed message; comparing the payload length, decoding information, the byte value of the target address node, and the byte value of the source address node with a preset security policy to obtain a comparison result if the comparison result satisfies the preset security policy; and blocking the PowerLink protocol message if the comparison result does not satisfy the preset security policy.

[0077] In one embodiment, the processing method further includes sending an alarm notification when PowerLink protocol messages are blocked.

[0078] In one embodiment, determining whether a PowerLink protocol message is a malformed message based on the payload length, decoding information, the byte value of the target address node, and the byte value of the source address node includes: obtaining the malformation conditions corresponding to the function code type; determining that the PowerLink protocol message is a malformed message if the payload length, decoding information, the byte value of the target address node, and the byte value of the source address node meet the malformation conditions; and determining that the PowerLink protocol message is not a malformed message if the payload length, decoding information, the byte value of the target address node, and the byte value of the source address node do not meet the malformation conditions.

[0079] In one embodiment, the function code type includes SoC function code, PReq function code, PRes function code, SoA function code, and ASnd function code; when the function code type is SoC function code, the abnormal conditions are: the decoded information reaches a preset decoded information, the payload length is less than a first preset length, the byte value of the source address node is not equal to a first preset byte value, and the byte value of the target address node is not equal to a second preset byte value; when the function code type is PReq function code, the abnormal conditions are: the payload length is less than a second preset length, the byte value of the source address node is not equal to a first preset byte value, and the byte value of the target address node is less than a third preset byte value. The default byte value is greater than the fourth default byte value; when the function code type is PRes function code, the abnormal conditions are that the payload length is less than the second default length, the byte value of the source address node is less than the third default byte value or greater than the fourth default byte value, and the byte value of the destination address node is not equal to the second default byte value; when the function code type is SoA function code, the abnormal conditions are that the payload length is less than the second default length, the byte value of the source address node is not equal to the first default byte value, and the byte value of the destination address node is not equal to the second default byte value; when the function code type is ASnd function code, the abnormal condition is that the payload length is less than the third default length.

[0080] This application also provides a computer program product that, when executed on a data processing device, is adapted to perform the processing method steps for initializing PowerLink protocol messages.

[0081] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0082] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0083] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0084] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0085] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0086] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0087] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0088] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0089] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for processing PowerLink protocol messages, characterized in that, The processing method includes: Receive PowerLink protocol messages; Delete the Ethernet header and Ethernet trailer bytes from the PowerLink protocol message to obtain the shortened PowerLink protocol message; Obtain the byte value of the service type byte whose offset from the header of the deleted PowerLink protocol message is a first preset number of bytes; The function code type of the service type of the shortened PowerLink protocol message is determined based on the byte value of the service type byte. The function code type is decoded to obtain decoded information; Obtain the byte value of the address node in the deleted PowerLink protocol message whose offset from the message header is a second preset number of bytes, wherein the second preset number of bytes includes a first sub-number of bytes and a second sub-number of bytes, and the address node includes a target address node and a source address node; The PowerLink protocol message is processed according to the payload length, the decoding information, and the byte value of the address node, wherein the payload length is the number of bytes in the shortened PowerLink protocol message; The step of obtaining the byte value of the address node in the shortened PowerLink protocol message whose offset from the message header is a second preset number of bytes includes: obtaining the byte value of the target address node in the shortened PowerLink protocol message whose offset from the message header is a first sub-number of bytes; obtaining the byte value of the source address node in the shortened PowerLink protocol message whose offset from the message header is a second sub-number of bytes; and the step of processing the PowerLink protocol message according to the payload length, the decoding information, and the byte value of the address node includes: Specifically, the determination of whether the PowerLink protocol message is a malformed message is based on the payload length, the decoding information, the byte value of the target address node, and the byte value of the source address node. If the PowerLink protocol message is a malformed message, block the PowerLink protocol message; If the PowerLink protocol message is not the malformed message, the payload length, the decoding information, the byte value of the target address node, and the byte value of the source address node are compared with the preset security policy to obtain the comparison result; If the comparison result meets the preset security policy, the PowerLink protocol message is allowed to proceed. If the comparison result shows that the preset security policy is not met, the PowerLink protocol message is blocked.

2. The method for processing PowerLink protocol messages according to claim 1, characterized in that, Decoding the function code type to obtain decoded information includes: When the function code type is SoC function code, obtain the byte in the deleted PowerLink protocol message whose offset between the source address node is a third preset number of bytes, and take the feature and byte value of a fourth preset number of bytes after that byte as the feature type and feature value of the SoC function code respectively. The triples constructed from the feature type and feature value of the SoC function code are used as the decoding information of the SoC function code; When the function code type is PReq function code, obtain the byte in the deleted PowerLink protocol message whose offset from the source address node is the fifth preset number of bytes, and use the characteristics and byte value of the next byte of that byte as the characteristic type and characteristic value of the PReq function code; The triples constructed from the feature type and feature value of the PReq function code are used as the decoding information of the PReq function code; When the function code type is a PRES function code, the offset of the source address node in the deleted PowerLink protocol message is obtained as the sixth preset number of bytes, and the feature and byte value of the next byte are used as the feature type and feature value of the PRES function code. The triples constructed from the feature type and feature value of the PRES function code are used as the decoding information of the PRES function code; When the function code type is SoA function code, the offset of the source address node in the deleted PowerLink protocol message is obtained as the seventh preset number of bytes, and the feature and byte value of the next byte are used as the feature type and feature value of the SoA function code; The triples constructed from the feature type and feature value of the SoA function code are used as the decoding information of the SoA function code; When the function code type is ASnd function code, the feature and byte value of the last byte of the source address node are used as the feature type and feature value of the ASnd function code; The triples constructed from the feature type and feature value of the ASnd function code are used as the decoding information of the ASnd function code.

3. The method for processing PowerLink protocol messages according to claim 1, characterized in that, The processing method further includes: If the PowerLink protocol message is blocked, an alarm will be sent.

4. The method for processing PowerLink protocol messages according to claim 1, characterized in that, The step of determining whether the PowerLink protocol message is a malformed message based on the payload length, the decoding information, the byte value of the target address node, and the byte value of the source address node includes: Obtain the abnormal conditions corresponding to the function code type; If the payload length, the decoding information, the byte value of the target address node, and the byte value of the source address node satisfy the malformation condition, the PowerLink protocol message is determined to be a malformed message. If the payload length, the decoding information, the byte value of the target address node, and the byte value of the source address node do not meet the malformation conditions, the PowerLink protocol message is determined not to be a malformed message.

5. The method for processing PowerLink protocol messages according to claim 4, characterized in that, The function code types include SoC function code, PReq function code, PRes function code, SoA function code, and ASnd function code. When the function code type is SoC function code, the abnormal conditions are: the decoded information reaches the preset decoded information, the load length is less than the first preset length, the byte value of the source address node is not equal to the first preset byte value, and the byte value of the target address node is not equal to the second preset byte value. When the function code type is PReq function code, the abnormal conditions are that the payload length is less than the second preset length, the byte value of the source address node is not equal to the first preset byte value, and the byte value of the target address node is less than the third preset byte value or greater than the fourth preset byte value. When the function code type is PRES function code, the abnormal conditions are that the payload length is less than the second preset length, the byte value of the source address node is less than the third preset byte value or greater than the fourth preset byte value, and the byte value of the target address node is not equal to the second preset byte value. When the function code type is SoA function code, the abnormal conditions are that the payload length is less than the second preset length, the byte value of the source address node is not equal to the first preset byte value, and the byte value of the destination address node is not equal to the second preset byte value. When the function code type is ASnd function code, the abnormal condition is that the load length is less than the third preset length.

6. A processing apparatus for PowerLink protocol messages, characterized in that, include: The memory is configured to store instructions; A processor is configured to retrieve the instructions from the memory and, when executing the instructions, to implement the method of processing PowerLink protocol messages according to any one of claims 1 to 5.

7. A machine-readable storage medium, characterized in that, The machine-readable storage medium stores instructions for causing the machine to perform a method for processing PowerLink protocol messages according to any one of claims 1 to 5.

8. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the method for processing PowerLink protocol messages according to any one of claims 1 to 5.

Images