Message processing method, computing device, machine readable storage medium and program product

Abstract

The embodiment of the invention discloses a message processing method, computing equipment, a machine readable storage medium and a program product, and belongs to the field of network security. The message processing method comprises the following steps: receiving a target message based on a GOOSE protocol; extracting the target message to obtain a feature information group corresponding to the target message; based on the feature information group, determining a logic function code corresponding to each feature field; and determining a processing strategy of the target message according to all the logic function codes. According to the method, the message based on the GOOSE protocol is subjected to feature analysis, and the logic function code is derived through the extracted feature field, so that the attack message transmitted based on the GOOSE protocol can be accurately detected, and potential network safety hazards are avoided.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a message processing method, a computing device, a machine-readable storage medium and a program product. Background Art

[0002] The GOOSE protocol is a communication protocol used to protect and control efficient data transmission between multiple devices in real time. With the rapid development of industrial Internet technology, the GOOSE (Generic Object Oriented Substation Event) protocol is widely used in industrial control systems such as smart substations. Since industrial control systems are the target of network attacks, traditional firewalls will detect the MAC (Media Access Control) address, IP (Internet Protocol) and port of the message sender, and then filter out abnormal messages from the sender of abnormal messages.

[0003] However, the GOOSE protocol is a protocol without clear logical function codes and address feature fields. When the network attacker transmits abnormal attack messages through the GOOSE protocol, it is difficult for traditional firewalls to detect the attack messages transmitted through the GOOSE protocol, which brings network security risks. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide a message processing method, a computing device, a machine-readable storage medium and a program product. The message processing method is used to solve the problem that it is difficult to detect attack messages transmitted through the GOOSE protocol.

[0005] In order to achieve the above objectives, in a first aspect, the present application provides a message processing method, the message processing method comprising:

[0006] Receive target messages based on the GOOSE protocol;

[0007] Extracting the target message to obtain a characteristic information group corresponding to the target message, wherein the characteristic information group includes a data set of at least two characteristic fields, a flag bit, a data length, a data content, and a field type;

[0008] Based on the characteristic information group, determining the logic function code corresponding to each characteristic field;

[0009] According to all logical function codes, a processing strategy for the target message is determined, wherein the processing strategy includes releasing the target message and blocking the target message.

[0010] In an embodiment of the present application, the target message includes a header message and an APDU message, the header message includes a first characteristic field, and the APDU message includes at least one second characteristic field;

[0011] Extract the target message to obtain the characteristic information group corresponding to the target message, including:

[0012] Extracting the header message to obtain first characteristic information corresponding to the first characteristic field;

[0013] Extract the APDU message to obtain the second characteristic information corresponding to each second characteristic field;

[0014] The first characteristic information and all the second characteristic information are combined to obtain a characteristic information group.

[0015] In an embodiment of the present application, the target message also includes a TLV structure message;

[0016] The APDU message is extracted to obtain the second characteristic information corresponding to each second characteristic field, including:

[0017] Decode the TLV structure message to obtain the offset corresponding to each second characteristic field;

[0018] For each second characteristic field, the second characteristic field is extracted according to the corresponding offset to obtain second characteristic information corresponding to the second characteristic field.

[0019] In an embodiment of the present application, at least one second characteristic field includes a message survival time field;

[0020] Determine the target message processing strategy based on all logical function codes, including:

[0021] Determine whether the characteristic information group meets a preset condition, wherein the preset condition includes at least one of the following: the data length of the second characteristic field other than the message survival time field is zero, the length of the header message is inconsistent with the length of the APDU message, the field value of at least one characteristic field is abnormal, and the length of the target message is less than a preset length;

[0022] When the characteristic information group does not meet the preset conditions, the processing strategy of the target message is determined according to all logical function codes.

[0023] In an embodiment of the present application, the message processing method further includes:

[0024] When the characteristic information group meets the preset conditions, the target message is blocked and prompt information is generated, wherein the prompt information is used to prompt that the target message is a malformed message.

[0025] In an embodiment of the present application, based on the feature information group, determining the logical function code corresponding to each feature field includes:

[0026] In the case where the flag bit value of the first characteristic field is the flag bit value of the second characteristic field, determining that the logic function code corresponding to the first characteristic field is a state change logic function code, wherein the first characteristic field is any one of the at least two characteristic fields, and the second characteristic field is any one of the at least two characteristic fields except the first characteristic field;

[0027] When the data length of the characteristic field is inconsistent with the preset value length, the logic function code corresponding to the characteristic field is determined to be a length change logic function code;

[0028] When the characteristic field is a configuration version number field and the characteristic field changes, determining that the logic function code corresponding to the characteristic field is a configuration update logic function code;

[0029] When the characteristic field is a test field and the field value of the characteristic field is a preset field value, determining that the logic function code corresponding to the characteristic field is a maintenance state logic function code;

[0030] In the case where the characteristic field is a data set entry field, the logical function code corresponding to the characteristic field is determined as the field value of the characteristic field.

[0031] In an embodiment of the present application, after determining the processing strategy of the target message according to all logical function codes, it also includes:

[0032] When the processing strategy of the target message is to release the target message, determining at least one target characteristic field to be detected corresponding to the target message, wherein the target characteristic field is any one of the at least two characteristic fields;

[0033] According to the feature information group, the field value of each target feature field is obtained respectively;

[0034] When the field value of at least one target characteristic field is an abnormal field value, the processing strategy of the target message is updated to block the target message.

[0035] In an embodiment of the present application, a processing strategy for a target message is determined according to all logical function codes, including:

[0036] Determine whether each logic function code is an abnormal function code;

[0037] In the case where at least one logical function code is an abnormal function code, determining the processing strategy of the target message to block the target message;

[0038] When each logical function code is not an abnormal function code, the processing strategy of the target message is determined to release the target message.

[0039] In a second aspect, the present application provides a message processing device, the message processing device comprising:

[0040] A message receiving module, used for receiving target messages based on the GOOSE protocol;

[0041] A characteristic information obtaining module is used to extract the target message and obtain a characteristic information group corresponding to the target message, wherein the characteristic information group includes a data set of at least two characteristic fields, a flag bit, a data length, a data content and a field type;

[0042] A function code determination module, used to determine the logic function code corresponding to each feature field based on the feature information group;

[0043] The processing strategy determination module is used to determine the processing strategy of the target message according to all logical function codes, wherein the processing strategy includes releasing the target message and blocking the target message.

[0044] In a third aspect, the present application provides a computing device, including:

[0045] a memory configured to store instructions;

[0046] The processor is configured to call instructions from the memory and implement the above-mentioned message processing method when executing the instructions.

[0047] In a fourth aspect, the present application provides a machine-readable storage medium, on which instructions are stored, and when the instructions are executed by a processor, the processor is configured to execute the above-mentioned message processing method.

[0048] In a fifth aspect, the present application provides a computer program product, including a computer program, which implements the above-mentioned message processing method when executed by a processor.

[0049] The present application provides a message processing method, including: receiving a target message based on the GOOSE protocol; extracting the target message to obtain a characteristic information group corresponding to the target message; determining the logical function code corresponding to each characteristic field based on the characteristic information group; and determining the processing strategy of the target message according to all logical function codes. By performing characteristic analysis on the message based on the GOOSE protocol and deriving the logical function code through the extracted characteristic field, it is possible to accurately detect attack messages transmitted through the GOOSE protocol and avoid network security risks.

[0050] Other features and advantages of the embodiments of the present invention will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the following specific embodiments, they are used to explain the embodiments of the present invention, but do not constitute a limitation on the embodiments of the present invention. In the accompanying drawings:

[0052] Figure 1 A flowchart of a message processing method provided in an embodiment of the present application is shown;

[0053] Figure 2 A schematic diagram of the structure of a message processing device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0054] The specific implementation of the embodiment of the present invention will be described in detail below in conjunction with the accompanying drawings in the embodiment of the present invention. It should be understood that the specific implementation described here is only used to illustrate and explain the embodiment of the present invention, and is not used to limit the embodiment of the present invention.

[0055] The components of the embodiments of the present invention generally described and shown in the drawings herein may be arranged and designed in a variety of different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0056] Hereinafter, the terms "including", "having" and their cognates, which may be used in various embodiments of the present invention, are intended only to indicate specific features, numbers, steps, operations, elements, components or combinations of the foregoing items, and should not be understood as first excluding the existence of one or more other features, numbers, steps, operations, elements, components or combinations of the foregoing items or adding the possibility of one or more features, numbers, steps, operations, elements, components or combinations of the foregoing items.

[0057] Furthermore, the terms “first”, “second”, “third”, etc. are merely used for distinguishing descriptions and are not to be understood as indicating or implying relative importance.

[0058] Unless otherwise defined, all terms (including technical terms and scientific terms) used herein have the same meanings as those generally understood by those skilled in the art to which the various embodiments of the present invention belong. The terms (such as those defined in generally used dictionaries) will be interpreted as having the same meanings as the contextual meanings in the relevant technical field and will not be interpreted as having idealized meanings or overly formal meanings unless clearly defined in the various embodiments of the present invention.

[0059] Example 1

[0060] Please participate Figure 1 , Figure 1 A flow chart of a message processing method provided in an embodiment of the present application is shown.

[0061] Figure 1 The message processing methods in include:

[0062] S110, receiving a target message based on the GOOSE protocol.

[0063] In this embodiment, the message processing method is applied to the gateway device. When a message request based on the GOOSE protocol is sent to the target device, the gateway device message processing strategy is used to determine whether to release the message. Specifically, when the gateway device receives the message, the MAC address and Ethernet frame header of the message are identified, and then the received message is identified as the target message based on the GOOSE protocol. After receiving the target message based on the GOOSE protocol, the target message is parsed.

[0064] S120, extracting the target message to obtain a characteristic information group corresponding to the target message, wherein the characteristic information group includes a data set of at least two characteristic fields, a flag bit, a data length, a data content, and a field type.

[0065] Since the message based on the GOOSE protocol itself does not have a clear function code field, when the target message is extracted, a clear function code field cannot be obtained. In this embodiment, characteristic information such as a data set, a flag bit, a data length, a data content, and a field type of at least two characteristic fields in the target message is extracted to obtain a characteristic information group corresponding to the target message. The characteristic information group is characteristic information including at least two characteristic fields, and the characteristic information is a five-tuple data structure consisting of a data set, a flag bit, a data length, a data content, and a field type.

[0066] S130, determining a logic function code corresponding to each characteristic field based on the characteristic information group.

[0067] The logical function code is used to indicate the purpose of the information frame, and the function code can be used to inform the device of the operation to be performed. Based on the characteristic information group data set, flag bit, data length, data content and field type, the requested operation of the message is analyzed to determine the logical function code corresponding to each characteristic field. The logical function code derived from the extracted characteristic field makes up for the limitation that the GOOSE protocol itself has no clear function code field.

[0068] In an embodiment of the present application, based on the feature information group, determining the logical function code corresponding to each feature field includes:

[0069] In the case where the flag bit value of the first characteristic field is the flag bit value of the second characteristic field, determining that the logic function code corresponding to the first characteristic field is a state change logic function code, wherein the first characteristic field is any one of the at least two characteristic fields, and the second characteristic field is any one of the at least two characteristic fields except the first characteristic field;

[0070] When the data length of the characteristic field is inconsistent with the preset value length, the logic function code corresponding to the characteristic field is determined to be a length change logic function code;

[0071] When the characteristic field is a configuration version number field and the characteristic field changes, determining that the logic function code corresponding to the characteristic field is a configuration update logic function code;

[0072] When the characteristic field is a test field and the field value of the characteristic field is a preset field value, determining that the logic function code corresponding to the characteristic field is a maintenance state logic function code;

[0073] In the case where the characteristic field is a data set entry field, the logical function code corresponding to the characteristic field is determined as the field value of the characteristic field.

[0074] The first characteristic field is any one of at least two characteristic fields, and the second characteristic field is any one of at least two characteristic fields other than the first characteristic field. When the flag value of the first characteristic field is the flag value of the second characteristic field, it is determined that the logic function code corresponding to the first characteristic field is a state change logic function code. In scenarios such as smart substation control, the state change logic function code indicates a function code in which the state of a device, system, or signal changes, and then determines the change in the state of the device, system, or signal according to the target message.

[0075] When the data length of the characteristic field is inconsistent with the preset value length, it is determined that the data length of the characteristic field has changed, and then the logical function code corresponding to the characteristic field is determined to be a length change logical function code. When the characteristic field is a configuration version number field and the characteristic field has changed, that is, when the value of the confrev field has changed, it is determined that the logical function code corresponding to the characteristic field is a configuration update logical function code. When the characteristic field is a test field and the field value of the characteristic field is a preset field value, it is determined that the logical function code corresponding to the characteristic field is a maintenance status logical function code. The preset field value is set according to actual needs and is not limited here. For ease of understanding, in the embodiment of the present application, the preset field value is 1, that is, the field value of the test field is 1, and the logical function code is determined to be a maintenance status logical function code.

[0076] In the case where the feature field is a data set entry field, the logical function code corresponding to the feature field is determined to be the field value of the feature field. In this embodiment, the data set entry field is the numdatasetentries field, which is used to indicate the number of entries in the data set. When the field value of the numdatasetentries field is 1, the logical function code indicates that the data set includes 1 entry. When the field value of the numdatasetentries field is greater than 1, the logical function code indicates that the data set includes at least one entry.

[0077] S140, determining a processing strategy for the target message according to all logical function codes, wherein the processing strategy includes releasing the target message and blocking the target message.

[0078] According to all logical function codes, the processing strategy of the target message is determined. Specifically, for each derived logical function code, it is determined whether there is a logical function code that needs to be filtered out. Usually, the logical function code that needs to be filtered out is the function code with illegal operations, which will not be described here.

[0079] When there are logic function codes that need to be filtered out among all logic function codes, the processing strategy is to block the target message. When there are no logic function codes that need to be filtered out among all logic function codes, the processing strategy is to release the target message. By performing feature analysis on messages based on the GOOSE protocol and deriving logical function codes through extracted feature fields, attack messages transmitted through the GOOSE protocol can be accurately detected to avoid network security risks.

[0080] In an embodiment of the present application, the target message includes a header message and an APDU message, the header message includes a first characteristic field, and the APDU message includes at least one second characteristic field;

[0081] Extract the target message to obtain the characteristic information group corresponding to the target message, including:

[0082] Extracting the header message to obtain first characteristic information corresponding to the first characteristic field;

[0083] Extract the APDU message to obtain the second characteristic information corresponding to each second characteristic field;

[0084] The first characteristic information and all the second characteristic information are combined to obtain a characteristic information group.

[0085] In the case where the target message is based on the GOOSE protocol, the application layer of the GOOSE protocol is divided into two parts. The target message corresponds to the application layer, the first part is the header message with the first 8 bytes fixed, which is the application identifier (Application IDentifier, APPID), data length (length) and reserved bits, and the second part is the APDU (Application Protocol Data Unit) message.

[0086] The APDU message includes at least one second characteristic field, and it should be understood that the APDU message includes at least one third characteristic field. The second characteristic field is a field that needs to be analyzed for characteristics, and the third characteristic is a field that does not need to be analyzed for characteristics. The types of the second characteristic field and the third characteristic field are set according to actual needs and are not limited here. For ease of understanding, at least one second characteristic field in the present embodiment includes a gocbRef (GOOSE Control Block Reference, GOOSE control block reference) field, a message survival time (Time Allowed to Live, TLL) field, a GOID (Global Unique IDentifier, Global Unique Identifier) ​​field, a status number (Status Number, StNum) field, a sequence number (Sequence Number, SqNum) field, a timestamp (time) field, a configuration version number (Configuration REVision, confREV) field, a resend flag (no data substitution Command, ndsCom) field and a test (test) field.

[0087] Extract the header message to obtain the first characteristic information corresponding to the first characteristic field, that is, obtain the characteristic information corresponding to the application identification code field. Extract the APDU message to obtain the second characteristic information corresponding to each second characteristic field. Combine the first characteristic information and all the second characteristic information to obtain a characteristic information group, so that the characteristic information group includes the data set, flag bit, data length, data content and field type of each characteristic field.

[0088] In an embodiment of the present application, the target message also includes a TLV structure message;

[0089] The APDU message is extracted to obtain the second characteristic information corresponding to each second characteristic field, including:

[0090] Decode the TLV structure message to obtain the offset corresponding to each second characteristic field;

[0091] For each second characteristic field, the second characteristic field is extracted according to the corresponding offset to obtain second characteristic information corresponding to the second characteristic field.

[0092] There is also a TLV (Type-Length-Value) structure message between the header message and the APDU message. In this implementation, the second characteristic field is a TLV structure. The TLV structure message is decoded based on the ASN.1 (Abstract Syntax Notation One) format to obtain the offset corresponding to each second characteristic field.

[0093] For each second characteristic field, the second characteristic field is extracted according to the corresponding offset to obtain the second characteristic information corresponding to the second characteristic field. Taking the current second characteristic field as the first characteristic field in the APDU message as an example, the header message is 8 fixed bytes. After setting the offset to 8, a byte is extracted. The extracted TAG value is the flag bit of the characteristic field. For example, the flag bit of the extracted gocbRef field is 0x83, the flag of the time field is 0x84, and the flag of the StNum field is 0x85. I will not go into details here. Add 1 to the offset value and extract the next byte. The extracted TAG value is the data length of the characteristic field. Combine the extracted characteristic information together to obtain a characteristic information group.

[0094] In an embodiment of the present application, at least one second characteristic field includes a message survival time field;

[0095] Determine the target message processing strategy based on all logical function codes, including:

[0096] Determine whether the characteristic information group meets a preset condition, wherein the preset condition includes at least one of the following: the data length of the second characteristic field other than the message survival time field is zero, the length of the header message is inconsistent with the length of the APDU message, the field value of at least one characteristic field is abnormal, and the length of the target message is less than a preset length;

[0097] When the characteristic information group does not meet the preset conditions, the processing strategy of the target message is determined according to all logical function codes.

[0098] After determining the processing strategy of the target message, it is necessary to detect whether the target message complies with the GOOSE protocol specification. The preset conditions for identifying deformed messages in this embodiment include: the data length of the characteristic fields other than the message survival time field is zero, the length of the header message and the length of the APDU message are inconsistent, the field value of at least one characteristic field is abnormal, and the length of the target message is less than at least one of the preset lengths.

[0099] Determine whether the characteristic information group meets the preset conditions. Specifically, since the header message is 8 fixed bytes, the preset length corresponds to 8, that is, the total load length of the target message based on the GOOSE protocol is less than 8, then the target message is determined to be a malformed message. If the length of the header message is inconsistent with the load length of the APDU message, the target message is determined to be a malformed message. When the data length of the second characteristic field except the message survival time field is zero, the target message is determined to be a malformed message.

[0100] In addition, when the field value of at least one characteristic field is abnormal, the target message is determined to be a malformed message. It should be understood that the field value abnormality of the characteristic field includes but is not limited to the field value of the test field is not 0 or 1, the field value of the ndsCom field is not 0 or 1, the field value of the StNum field and the SqNum field does not match, and the field value of the StNum field is out of range, etc., which will not be elaborated here.

[0101] When the characteristic information group does not meet the preset conditions, it is determined that the target message is not a malformed message, and then the processing strategy of the target message is determined according to all logical function codes, so as to filter and process the abnormal attack message through the processing strategy.

[0102] In an embodiment of the present application, the message processing method further includes:

[0103] When the characteristic information group meets the preset conditions, the target message is blocked and prompt information is generated, wherein the prompt information is used to prompt that the target message is a malformed message.

[0104] When the characteristic information group meets the preset conditions, the target message is determined to be a malformed message, and before the processing strategy of the target message is determined according to all logical function codes, the target message is blocked and a prompt message is generated. The prompt message is used to warn that the target message is a malformed message, and the prompt message can also be used to prompt the cause of the malformed message, etc., which will not be repeated here.

[0105] In an embodiment of the present application, after determining the processing strategy of the target message according to all logical function codes, it also includes:

[0106] When the processing strategy of the target message is to release the target message, determining at least one target characteristic field to be detected corresponding to the target message, wherein the target characteristic field is any one of the at least two characteristic fields;

[0107] According to the feature information group, the field value of each target feature field is obtained respectively;

[0108] When the field value of at least one target characteristic field is an abnormal field value, the processing strategy of the target message is updated to block the target message.

[0109] In this embodiment, the malformed message is first filtered, and then a processing strategy is determined for the target message based on the GOOSE protocol according to the derived logical function code to filter the message. After the processing strategy of the target message is determined in this embodiment, the field value in the target message is filtered by extracting the characteristic information group previously.

[0110] Specifically, a target feature field to be filtered is pre-determined, where the target feature field is any one of at least two feature fields. When the processing strategy of the target message is to release the target message, at least one target feature field to be detected corresponding to the target message is determined. According to the feature information group, the field value of each target feature field is obtained respectively.

[0111] In the case where the field value of each target characteristic field is not an abnormal field value, it is determined that there is no field value that needs to be filtered in the target message, and the processing strategy remains to release the target message, and the processing strategy is executed by the gateway device to send the target message to the target device. In the case where the field value of at least one target characteristic field is an abnormal field value, the processing strategy of the target message is updated to block the target message, and the processing strategy is executed by the gateway device to discard the target message, thereby avoiding network security risks caused by sending the target message to the target device.

[0112] In an embodiment of the present application, a processing strategy for a target message is determined according to all logical function codes, including:

[0113] Determine whether each logic function code is an abnormal function code;

[0114] In the case where at least one logical function code is an abnormal function code, determining the processing strategy of the target message to block the target message;

[0115] When each logical function code is not an abnormal function code, the processing strategy of the target message is determined to release the target message.

[0116] After determining the logical function code corresponding to each characteristic field, determine whether each logical function code is an abnormal function code. The abnormal function code is preset according to actual needs and is not limited here. For ease of understanding, the abnormal function code in the embodiment of the present application is a read data function code. In the case where at least one logical function code is an abnormal function code, it is determined that the target message is an attack message with an abnormal request to read data, and the processing strategy of the target message is determined to block the target message to discard the entire message. In the case where each logical function code is not an abnormal function code, it is determined that there is no illegal operation in the target message, and the processing strategy of the target message is determined to release the target message so that the target message is sent to the target device.

[0117] The present application provides a message processing method, including: receiving a target message based on the GOOSE protocol; extracting the target message to obtain a characteristic information group corresponding to the target message; determining the logical function code corresponding to each characteristic field based on the characteristic information group; and determining the processing strategy of the target message according to all logical function codes. By performing characteristic analysis on the message based on the GOOSE protocol and deriving the logical function code through the extracted characteristic field, it is possible to accurately detect attack messages transmitted through the GOOSE protocol and avoid network security risks.

[0118] Example 2

[0119] See also Figure 2 , Figure 2 A schematic diagram of the structure of a message processing device provided in an embodiment of the present application is shown. Figure 2 The message processing device 200 in the embodiment includes:

[0120] The message receiving module 210 is used to receive the target message based on the GOOSE protocol;

[0121] The characteristic information obtaining module 220 is used to extract the target message and obtain the characteristic information group corresponding to the target message, wherein the characteristic information group includes a data set of at least two characteristic fields, a flag bit, a data length, a data content and a field type;

[0122] The function code determination module 230 is used to determine the logic function code corresponding to each feature field based on the feature information group;

[0123] The processing strategy determination module 240 is used to determine the processing strategy of the target message according to all logical function codes, wherein the processing strategy includes releasing the target message and blocking the target message.

[0124] In an embodiment of the present application, the target message includes a header message and an APDU message, the header message includes a first characteristic field, and the APDU message includes at least one second characteristic field;

[0125] The feature information obtaining module 220 includes:

[0126] The header extraction submodule is used to extract the header message to obtain the first characteristic information corresponding to the first characteristic field;

[0127] An APDU extraction submodule, used to extract the APDU message and obtain the second characteristic information corresponding to each second characteristic field;

[0128] The characteristic information group obtaining submodule is used to combine the first characteristic information and all the second characteristic information to obtain a characteristic information group.

[0129] In an embodiment of the present application, the target message also includes a TLV structure message;

[0130] The APDU extraction submodule includes:

[0131] A message decoding submodule, used to decode the TLV structure message to obtain an offset corresponding to each second characteristic field;

[0132] The field extraction submodule is used to extract the second characteristic field according to the corresponding offset for each second characteristic field, so as to obtain the second characteristic information corresponding to the second characteristic field.

[0133] In an embodiment of the present application, at least one second characteristic field includes a message survival time field;

[0134] The processing strategy determination module 240 includes:

[0135] A condition determination module, used to determine whether the characteristic information group meets a preset condition, wherein the preset condition includes at least one of the following: the data length of the second characteristic field other than the message survival time field is zero, the length of the header message is inconsistent with the length of the APDU message, the field value of at least one characteristic field is abnormal, and the length of the target message is less than a preset length;

[0136] The strategy determination submodule is used to determine the processing strategy of the target message according to all logical function codes when the characteristic information group does not meet the preset conditions.

[0137] In the embodiment of the present application, the message processing device 200 further includes:

[0138] The abnormal message prompt module is used to block the target message and generate prompt information when the characteristic information group meets the preset conditions, wherein the prompt information is used to prompt that the target message is a abnormal message.

[0139] In an embodiment of the present application, the function code determination module 230 includes:

[0140] A state change determination submodule, used for determining that a logic function code corresponding to the first feature field is a state change logic function code when the flag bit value of the first feature field is the flag bit value of the second feature field, wherein the first feature field is any one of the at least two feature fields, and the second feature field is any one of the at least two feature fields other than the first feature field;

[0141] The length change determination submodule is used to determine that the logic function code corresponding to the feature field is a length change logic function code when the data length of the feature field is inconsistent with the preset value length;

[0142] The configuration update determination submodule is used to determine that the logic function code corresponding to the characteristic field is the configuration update logic function code when the characteristic field is the configuration version number field and the characteristic field changes;

[0143] The maintenance status determination submodule is used to determine that the logic function code corresponding to the characteristic field is the maintenance status logic function code when the characteristic field is a test field and the field value of the characteristic field is a preset field value;

[0144] The data set entry determination submodule is used to determine the logical function code corresponding to the feature field as the field value of the feature field when the feature field is a data set entry field.

[0145] In the embodiment of the present application, the message processing device 200 further includes:

[0146] A target field determination module, used to determine at least one target feature field to be detected corresponding to the target message when the processing strategy of the target message is to release the target message, wherein the target feature field is any one of the at least two feature fields;

[0147] A field value acquisition module is used to obtain the field value of each target feature field according to the feature information group;

[0148] The policy updating module is used to update the processing policy of the target message to block the target message when the field value of at least one target characteristic field is an abnormal field value.

[0149] In an embodiment of the present application, the processing strategy determination module 240 includes:

[0150] The abnormality determination submodule is used to determine whether each logic function code is an abnormal function code;

[0151] The message blocking submodule is used to determine the processing strategy of the target message as blocking the target message when at least one logical function code is an abnormal function code;

[0152] The message release submodule is used to determine the processing strategy of the target message as releasing the target message when each logical function code is not an abnormal function code.

[0153] The present application also provides a computing device, including:

[0154] a memory configured to store instructions;

[0155] The processor is configured to call instructions from the memory and implement the above-mentioned message processing method when executing the instructions.

[0156] In this embodiment, the message receiving module 210, the feature information obtaining module 220, the function code determining module 230 and the processing strategy determining module 240 are all stored in the memory as program units, and the processor executes the above program units stored in the memory to implement corresponding functions.

[0157] The processor includes a kernel, and the kernel calls the corresponding program unit from the memory. One or more kernels can be set, and the above message processing method is implemented by adjusting kernel parameters.

[0158] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0159] An embodiment of the present application also provides a machine-readable storage medium, on which instructions are stored. When the instructions are executed by a processor, the processor is configured to execute the above-mentioned message processing method.

[0160] An embodiment of the present application also provides a computer program product, including a computer program, which implements the above-mentioned message processing method when executed by a processor.

[0161] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0162] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0163] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0164] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0165] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0166] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0167] Machine-readable storage media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0168] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0169] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A message processing method, characterized in that: The message processing method comprises: Receive target messages based on the GOOSE protocol; Extracting the target message to obtain a characteristic information group corresponding to the target message, wherein the characteristic information group includes a data set, a flag bit, a data length, a data content, and a field type of at least two characteristic fields; Based on the characteristic information group, determining a logical function code corresponding to each characteristic field; According to all the logic function codes, a processing strategy for the target message is determined, wherein the processing strategy includes releasing the target message and blocking the target message.

2. The message processing method according to claim 1, characterized in that: The target message includes a header message and an APDU message, the header message includes a first characteristic field, and the APDU message includes at least one second characteristic field; The step of extracting the target message to obtain a characteristic information group corresponding to the target message includes: Extracting the header message to obtain first characteristic information corresponding to the first characteristic field; Extracting the APDU message, and obtaining second characteristic information corresponding to each of the second characteristic fields; The first feature information and all the second feature information are combined to obtain the feature information group.

3. The message processing method according to claim 2, characterized in that: The target message also includes a TLV structure message; The extracting the APDU message to obtain the second characteristic information corresponding to each of the second characteristic fields includes: Decoding the TLV structure message to obtain an offset corresponding to each of the second characteristic fields; For each of the second characteristic fields, the second characteristic field is extracted according to the corresponding offset to obtain second characteristic information corresponding to the second characteristic field.

4. The message processing method according to claim 2, characterized in that: The at least one second characteristic field comprises a message survival time field; Determining the processing strategy of the target message according to all the logical function codes includes: Determine whether the characteristic information group meets a preset condition, wherein the preset condition includes at least one of the following: the data length of the second characteristic field except the message survival time field is zero, the length of the header message is inconsistent with the length of the APDU message, the field value of at least one of the characteristic fields is abnormal, and the length of the target message is less than a preset length; When the characteristic information group does not satisfy the preset condition, a processing strategy for the target message is determined according to all the logical function codes.

5. The message processing method according to claim 4, characterized in that: The message processing method further includes: In the case that the characteristic information group meets the preset condition, the target message is blocked and prompt information is generated, wherein the prompt information is used to prompt that the target message is a malformed message.

6. The message processing method according to claim 1, characterized in that: The determining, based on the characteristic information group, a logic function code corresponding to each characteristic field includes: In a case where the flag bit value of the first characteristic field is the flag bit value of the second characteristic field, determining that the logic function code corresponding to the first characteristic field is a state change logic function code, wherein the first characteristic field is any one of the at least two characteristic fields, and the second characteristic field is any one of the at least two characteristic fields except the first characteristic field; In the case where the data length of the characteristic field is inconsistent with the preset value length, determining that the logic function code corresponding to the characteristic field is a length change logic function code; When the characteristic field is a configuration version number field and the characteristic field changes, determining that the logic function code corresponding to the characteristic field is a configuration update logic function code; In the case where the characteristic field is a test field and the field value of the characteristic field is a preset field value, determining that the logic function code corresponding to the characteristic field is a maintenance state logic function code; In the case that the characteristic field is a data set entry field, the logical function code corresponding to the characteristic field is determined as the field value of the characteristic field.

7. The message processing method according to claim 1, characterized in that: After determining the processing strategy of the target message according to all the logical function codes, the method further includes: In a case where the processing strategy of the target message is to release the target message, determining at least one target feature field to be detected corresponding to the target message, wherein the target feature field is any one of the at least two feature fields; According to the characteristic information group, respectively obtain the field value of each target characteristic field; When the field value of at least one of the target characteristic fields is an abnormal field value, the processing strategy of the target message is updated to block the target message.

8. The message processing method according to claim 1, characterized in that: Determining the processing strategy of the target message according to all the logical function codes includes: Determine respectively whether each of the logic function codes is an abnormal function code; In the case where at least one of the logical function codes is an abnormal function code, determining the processing strategy of the target message to block the target message; In the case that each of the logical function codes is not an abnormal function code, the processing strategy of the target message is determined to release the target message.

9. A computing device, characterized in that include: a memory configured to store instructions; A processor is configured to call the instruction from the memory and implement the message processing method according to any one of claims 1 to 8 when executing the instruction.

10. A machine-readable storage medium having instructions stored thereon, characterized in that: When the instruction is executed by a processor, the processor is configured to execute the message processing method according to any one of claims 1 to 8.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the message processing method according to any one of claims 1 to 8.

Images