Message processing method, computing device, machine-readable storage medium, and program product

Abstract

Embodiments of the application disclose a message processing method, a computing device, a machine readable storage medium and a program product, and belong to the field of network security. The message processing method comprises the following steps: receiving a target message based on a GOOSE protocol; extracting the target message to obtain a feature information group corresponding to the target message; determining a logical function code corresponding to each feature field based on the feature information group; and determining a processing strategy of the target message according to all the logical function codes. Through feature analysis on the message based on the GOOSE protocol, the logical function code derived through the extracted feature field, and further accurate detection of the attack message transmitted based on the GOOSE protocol, network security risks can be avoided.

Description

Technical Field

[0001] This invention relates to the field of network security, and more specifically to a message processing method, a computing device, a machine-readable storage medium, and a program product. Background Technology

[0002] GOOSE is a communication protocol used for real-time protection and control of efficient data transmission between multiple devices. With the rapid development of Industrial Internet technology, GOOSE (Generic Object Oriented Substation Event) is widely used in industrial control systems such as smart substations. Since industrial control systems are targets of network attacks, traditional firewalls detect the MAC (Media Access Control) address, IP (Internet Protocol) address, and port of the packet sender, thereby filtering abnormal packets from abnormal senders.

[0003] However, the GOOSE protocol lacks explicit logical function codes and address characteristic fields. When cyber attackers transmit abnormal attack packets via the GOOSE protocol, traditional firewalls struggle to detect them, leading to network security vulnerabilities. Summary of the Invention

[0004] The purpose of this invention is to provide a message processing method, a computing device, a machine-readable storage medium, and a program product. The message processing method is used to solve the problem of difficulty in detecting attack messages transmitted through the GOOSE protocol.

[0005] To achieve the above objectives, firstly, this application provides a message processing method, which includes:

[0006] Receive target messages based on the GOOSE protocol;

[0007] Extract the target message to obtain the feature information group corresponding to the target message. The feature information group includes at least two feature fields: dataset, flag bit, data length, data content, and field type.

[0008] Based on the feature information group, determine the logical function code corresponding to each feature field;

[0009] Based on all logical function codes, determine the processing strategy for the target message, which includes allowing the target message to pass or blocking the target message.

[0010] In the embodiments of this application, the target message includes a header message and an APDU message. The header message includes a first feature field, and the APDU message includes at least one second feature field.

[0011] Extracting the target message yields the corresponding feature information group, including:

[0012] Extract the header message to obtain the first feature information corresponding to the first feature field;

[0013] Extract the APDU message to obtain the second feature information corresponding to each second feature field;

[0014] The first feature information and all the second feature information are combined to obtain the feature information group.

[0015] In the embodiments of this application, the target message also includes a TLV structure message;

[0016] The APDU message is extracted to obtain the second feature information corresponding to each second feature field, including:

[0017] Decode the TLV structure message to obtain the offset corresponding to each second feature field;

[0018] For each second feature field, the second feature field is extracted according to the corresponding offset to obtain the second feature information corresponding to the second feature field.

[0019] In embodiments of this application, at least one second feature field includes a message lifetime field;

[0020] Based on all logical function codes, determine the processing strategy for the target message, including:

[0021] Determine whether the feature information group meets the preset conditions, wherein the preset conditions include at least one of the following: the data length of the second feature field other than the message live time field is zero, the length of the header message and the APDU message are inconsistent, the field value of at least one feature field is abnormal, and the length of the target message is less than the preset length.

[0022] If the feature information group does not meet the preset conditions, the processing strategy for the target message is determined based on all logical function codes.

[0023] In embodiments of this application, the message processing method further includes:

[0024] If the characteristic information group meets the preset conditions, the target message is blocked and a prompt message is generated, which is used to indicate that the target message is a malformed message.

[0025] In the embodiments of this application, the logical function code corresponding to each feature field is determined based on the feature information group, including:

[0026] When the flag value of the first feature field is the flag value of the second feature field, the logical function code corresponding to the first feature field is determined to be a state change logical function code, wherein the first feature field is any one of at least two feature fields, and the second feature field is any one of at least two feature fields other than the first feature field.

[0027] When the data length of a feature field is inconsistent with the preset value length, the logical function code corresponding to the feature field is determined to be the length change logical function code;

[0028] If the feature field is the configuration version number field and the feature field changes, determine the logical function code corresponding to the feature field as the configuration update logical function code;

[0029] When the feature field is a test field and the field value of the feature field is a preset field value, the logical function code corresponding to the feature field is determined to be the maintenance status logical function code.

[0030] When the feature field is a dataset entry field, determine the logical function code corresponding to the feature field as the field value of the feature field.

[0031] In the embodiments of this application, after determining the processing strategy for the target message based on all logical function codes, the method further includes:

[0032] When the processing strategy for the target message is to allow the target message to pass, at least one target feature field to be detected is determined for the target message, wherein the target feature field is any one of at least two feature fields;

[0033] Based on the feature information group, obtain the field value of each target feature field;

[0034] If at least one of the target feature fields has an abnormal value, the processing policy for the target packet will be updated to block the target packet.

[0035] In the embodiments of this application, the processing strategy for the target message is determined based on all logical function codes, including:

[0036] Determine whether each logical function code is an abnormal function code;

[0037] If at least one logical function code is an abnormal function code, the processing strategy for the target message is determined to be blocking the target message;

[0038] If none of the logical function codes are abnormal, the processing strategy for the target message is to allow the target message to pass.

[0039] Secondly, this application provides a message processing apparatus, which includes:

[0040] The message receiving module is used to receive target messages based on the GOOSE protocol;

[0041] The feature information acquisition module is used to extract the target message and obtain the feature information group corresponding to the target message. The feature information group includes the dataset, flag bit, data length, data content and field type of at least two feature fields.

[0042] The function code determination module is used to determine the logical function code corresponding to each feature field based on the feature information group.

[0043] The processing strategy determination module is used to determine the processing strategy for the target packet based on all logical function codes. The processing strategy includes allowing the target packet to pass or blocking the target packet.

[0044] Thirdly, this application provides a computing device, comprising:

[0045] The memory is configured to store instructions;

[0046] The processor is configured to retrieve instructions from memory and, when executing instructions, to implement the aforementioned message processing methods.

[0047] Fourthly, this application provides a machine-readable storage medium storing instructions that, when executed by a processor, configure the processor to perform the aforementioned message processing method.

[0048] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the above-described message processing method.

[0049] This application provides a message processing method, including: receiving a target message based on the GOOSE protocol; extracting features from the target message to obtain a feature information group corresponding to the target message; determining the logical function code corresponding to each feature field based on the feature information group; and determining a processing strategy for the target message based on all logical function codes. By performing feature analysis on messages based on the GOOSE protocol and deriving logical function codes from the extracted feature fields, attack messages transmitted via the GOOSE protocol can be accurately detected, thus avoiding network security risks.

[0050] Other features and advantages of the embodiments of the present invention will be described in detail in the following detailed description section. Attached Figure Description

[0051] The accompanying drawings are provided to further illustrate embodiments of the present invention and form part of the specification. They are used together with the following detailed description to explain the embodiments of the present invention, but do not constitute a limitation thereof. In the drawings:

[0052] Figure 1 A flowchart of the message processing method provided in an embodiment of this application is shown;

[0053] Figure 2 A schematic diagram of the message processing apparatus provided in an embodiment of this application is shown. Detailed Implementation

[0054] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustrative and explanatory purposes only and are not intended to limit the scope of the present invention.

[0055] The components of the embodiments of the invention described and illustrated herein can typically be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0056] In the following, the terms “comprising,” “having,” and their cognates, which may be used in various embodiments of the invention, are intended only to indicate a particular feature, number, step, operation, element, component, or combination thereof, and should not be construed as excluding, firstly, the presence of one or more other features, numbers, steps, operations, elements, components, or combinations thereof, or adding the possibility of one or more features, numbers, steps, operations, elements, components, or combinations thereof.

[0057] Furthermore, the terms "first," "second," and "third" are used only to distinguish descriptions and should not be interpreted as indicating or implying relative importance.

[0058] Unless otherwise specified, all terms used herein (including technical and scientific terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which the various embodiments of the invention pertain. Terms (such as those defined in commonly used dictionaries) shall be interpreted as having the same meaning as in their contextual meaning in the relevant technical field and shall not be interpreted as having an idealized or overly formal meaning, unless clearly defined in the various embodiments of the invention.

[0059] Example 1

[0060] Please participate Figure 1 , Figure 1 A flowchart of the message processing method provided in an embodiment of this application is shown.

[0061] Figure 1 The message processing methods in the text include:

[0062] S110 receives target messages based on the GOOSE protocol.

[0063] In this embodiment, the message processing method is applied to a gateway device. When a message request based on the GOOSE protocol is sent to the target device, the gateway device determines whether to allow the message through its message processing policy. Specifically, when the gateway device receives a message, it identifies the message's MAC address and Ethernet frame header, and then determines whether the received message is a target message based on the GOOSE protocol. Upon receiving the target message based on the GOOSE protocol, the target message is parsed.

[0064] S120, extract the target message to obtain the feature information group corresponding to the target message, wherein the feature information group includes at least two feature fields: dataset, flag bit, data length, data content and field type.

[0065] Since messages based on the GOOSE protocol do not inherently possess a defined function code field, it is impossible to obtain a clear function code field when extracting from a target message. This embodiment extracts feature information from at least two feature fields in the target message, including the dataset, flag bit, data length, data content, and field type, to obtain a feature information group corresponding to the target message. The feature information group comprises feature information from at least two feature fields, and the feature information is a quintuple data structure consisting of the dataset, flag bit, data length, data content, and field type.

[0066] S130, based on the feature information group, determine the logical function code corresponding to each feature field.

[0067] Logical function codes (LFCs) are used to indicate the purpose of information frames, thus informing the device of the required operation. Based on the feature information group dataset, flag bits, data length, data content, and field types, the requested operation of the message is analyzed to determine the LFC corresponding to each feature field. The LFCs derived from the extracted feature fields overcome the limitation of the GOOSE protocol itself lacking explicitly defined LFC fields.

[0068] In the embodiments of this application, the logical function code corresponding to each feature field is determined based on the feature information group, including:

[0069] When the flag value of the first feature field is the flag value of the second feature field, the logical function code corresponding to the first feature field is determined to be a state change logical function code, wherein the first feature field is any one of at least two feature fields, and the second feature field is any one of at least two feature fields other than the first feature field.

[0070] When the data length of a feature field is inconsistent with the preset value length, the logical function code corresponding to the feature field is determined to be the length change logical function code;

[0071] If the feature field is the configuration version number field and the feature field changes, determine the logical function code corresponding to the feature field as the configuration update logical function code;

[0072] When the feature field is a test field and the field value of the feature field is a preset field value, the logical function code corresponding to the feature field is determined to be the maintenance status logical function code.

[0073] When the feature field is a dataset entry field, determine the logical function code corresponding to the feature field as the field value of the feature field.

[0074] The first feature field is any one of at least two feature fields, and the second feature field is any one of at least two feature fields other than the first feature field. If the flag value of the first feature field is the same as the flag value of the second feature field, the logical function code corresponding to the first feature field is determined to be a state change logical function code. In scenarios such as intelligent substation control, the state change logical function code indicates a change in the state of equipment, systems, and signals, thereby determining the change in the state of equipment, systems, and signals based on the target message.

[0075] If the data length of a feature field is inconsistent with the preset value length, it is determined that the data length of the feature field has changed, and therefore the logical function code corresponding to the feature field is determined to be a length change logical function code. If the feature field is a configuration version number field, and the feature field changes (i.e., the value of the confREV field changes), the logical function code corresponding to the feature field is determined to be a configuration update logical function code. If the feature field is a test field, and the field value of the feature field is a preset field value, the logical function code corresponding to the feature field is determined to be a maintenance status logical function code. The preset field value is set according to actual needs and is not limited here. For ease of understanding, in the embodiments of this application, the preset field value is 1, that is, the field value of the test field is 1, and the logical function code is determined to be a maintenance status logical function code.

[0076] When the feature field is a dataset entry field, the logical function code corresponding to the feature field is determined by the field value of the feature field. In this embodiment, the dataset entry field is the `numdatasetentries` field, which is used to represent the number of entries in the dataset. When the field value of the `numdatasetentries` field is 1, the logical function code indicates that the dataset includes 1 entry. When the field value of the `numdatasetentries` field is greater than 1, the logical function code indicates that the dataset includes at least one entry.

[0077] S140, based on all logical function codes, determine the processing strategy for the target message, wherein the processing strategy includes allowing the target message to pass or blocking the target message.

[0078] Based on all logical function codes, the processing strategy for the target message is determined. Specifically, for each derived logical function code, it is determined whether there are any logical function codes that need to be filtered out. Logical function codes that typically need to be filtered out are those containing violations, which will not be elaborated upon here.

[0079] If any logical function codes (Logical Function Codes) require filtering, the strategy is to block the target packet. If no Logical Function Codes require filtering, the strategy is to allow the target packet. By performing feature analysis on packets based on the GOOSE protocol and deriving the Logical Function Code from the extracted feature fields, attack packets transmitted via the GOOSE protocol can be accurately detected, thus preventing network security risks.

[0080] In the embodiments of this application, the target message includes a header message and an APDU message. The header message includes a first feature field, and the APDU message includes at least one second feature field.

[0081] Extracting the target message yields the corresponding feature information group, including:

[0082] Extract the header message to obtain the first feature information corresponding to the first feature field;

[0083] Extract the APDU message to obtain the second feature information corresponding to each second feature field;

[0084] The first feature information and all the second feature information are combined to obtain the feature information group.

[0085] When the target message is based on the GOOSE protocol, the application layer of the GOOSE protocol is divided into two parts. The target message corresponds to the application layer. The first part is the header message, which consists of the first 8 bytes and contains the application identifier (APPID), data length, and reserved bits. The second part is the APDU (Application Protocol Data Unit) message.

[0086] APDU messages include at least one second feature field. It should be understood that APDU messages also include at least one third feature field. The second feature field is the field that requires feature analysis, while the third feature field is the field that does not require feature analysis. The types of both the second and third feature fields are set according to actual needs and are not limited here. For ease of understanding, in this embodiment, at least one second feature field includes a gocbRef (GOOSE Control Block Reference) field, a Time Allowed to Live (TLL) field, a GOID (Global Unique Identifier) ​​field, a Status Number (StNum) field, a Sequence Number (SqNum) field, a timestamp (time) field, a Configuration ReVision (confREV) field, a retransmission flag (no data substitutionCommand (ndsCom)) field, and a test field.

[0087] Extracting the header message yields the first feature information corresponding to the first feature field, which is the feature information corresponding to the application identification code field. Extracting the APDU message yields the second feature information corresponding to each second feature field. Combining the first feature information and all second feature information results in a feature information group, which includes the dataset, flag bits, data length, data content, and field type for each feature field.

[0088] In the embodiments of this application, the target message also includes a TLV structure message;

[0089] The APDU message is extracted to obtain the second feature information corresponding to each second feature field, including:

[0090] Decode the TLV structure message to obtain the offset corresponding to each second feature field;

[0091] For each second feature field, the second feature field is extracted according to the corresponding offset to obtain the second feature information corresponding to the second feature field.

[0092] Between the header message and the APDU message, there is also a TLV (Type-Length-Value) structure message. In this implementation, the second feature field is a TLV structure. The TLV structure message is decoded based on the ASN.1 (Abstract Syntax Notation One) format to obtain the offset corresponding to each second feature field.

[0093] For each second feature field, extract the second feature field according to the corresponding offset to obtain the second feature information corresponding to the second feature field. Taking the current second feature field as the first feature field in the APDU message as an example, the header message is 8 fixed bytes. After setting the offset to 8, extract one byte. The extracted TAG value is the flag bit of the feature field. For example, the flag bit of the extracted gocbRef field is 0x83, the flag bit of the time field is 0x84, and the flag bit of the StNum field is 0x85. Further details are omitted here. Increment the offset value by 1 and extract the next byte. The extracted TAG value is the data length of the feature field. Combine the extracted feature information to obtain the feature information group.

[0094] In embodiments of this application, at least one second feature field includes a message lifetime field;

[0095] Based on all logical function codes, determine the processing strategy for the target message, including:

[0096] Determine whether the feature information group meets the preset conditions, wherein the preset conditions include at least one of the following: the data length of the second feature field other than the message live time field is zero, the length of the header message and the APDU message are inconsistent, the field value of at least one feature field is abnormal, and the length of the target message is less than the preset length.

[0097] If the feature information group does not meet the preset conditions, the processing strategy for the target message is determined based on all logical function codes.

[0098] After determining the processing strategy for the target message, it is necessary to check whether the target message conforms to the GOOSE protocol specification. In this embodiment, the preset conditions for identifying malformed messages include: the data length of all feature fields except the message lifetime field is zero, the length of the header message is inconsistent with the length of the APDU message, the field value of at least one feature field is abnormal, and the length of the target message is less than the preset length.

[0099] Determine whether the feature information group meets preset conditions. Specifically, since the header message is 8 fixed bytes, and the preset length is 8, if the total payload length of the target message based on the GOOSE protocol is less than 8, then the target message is determined to be a malformed message. If the length of the header message is inconsistent with the payload length of the APDU message, then the target message is determined to be a malformed message. If the data length of the second feature field, excluding the message lifetime field, is all zero, then the target message is determined to be a malformed message.

[0100] Furthermore, if the value of at least one feature field is abnormal, the target message is determined to be a malformed message. It should be understood that abnormal field values ​​of feature fields include, but are not limited to, the value of the test field not being 0 or 1, the value of the ndsCom field not being 0 or 1, the values ​​of the StNum and SqNum fields not matching, and the value of the StNum field being out of range, etc., which will not be elaborated here.

[0101] If the feature information group does not meet the preset conditions, it is determined that the target message is not a malformed message. Then, based on all logical function codes, the processing strategy for the target message is determined so as to filter the abnormal attack message through the processing strategy.

[0102] In embodiments of this application, the message processing method further includes:

[0103] If the characteristic information group meets the preset conditions, the target message is blocked and a prompt message is generated, which is used to indicate that the target message is a malformed message.

[0104] If the characteristic information group meets the preset conditions, the target message is determined to be a malformed message. Before determining the processing strategy for the target message based on all logical function codes, the target message is blocked, and a prompt message is generated. The prompt message alerts that the target message is malformed, and can also indicate the cause of the malformed message, etc., which will not be elaborated here.

[0105] In the embodiments of this application, after determining the processing strategy for the target message based on all logical function codes, the method further includes:

[0106] When the processing strategy for the target message is to allow the target message to pass, at least one target feature field to be detected is determined for the target message, wherein the target feature field is any one of at least two feature fields;

[0107] Based on the feature information group, obtain the field value of each target feature field;

[0108] If at least one of the target feature fields has an abnormal value, the processing policy for the target packet will be updated to block the target packet.

[0109] In this embodiment, malformed packets are first filtered out. Then, based on the derived logical function code, a processing strategy is determined for the target packets based on the GOOSE protocol to filter them. After determining the processing strategy for the target packets, the field values ​​in the target packets are filtered using the previously extracted feature information groups.

[0110] Specifically, the target feature field to be filtered is pre-determined, and the target feature field is any one of at least two feature fields. When the processing strategy for the target packet is to allow the target packet, at least one target feature field to be detected corresponding to the target packet is determined. Based on the feature information group, the field value of each target feature field is obtained.

[0111] If none of the target feature fields have an anomalous value, it is determined that there are no field values ​​in the target packet that require filtering. The processing policy remains to allow the target packet, and the processing policy is executed through the gateway device to send the target packet to the target device. If at least one target feature field has an anomalous value, the processing policy for the target packet is updated to block the target packet. The processing policy is executed through the gateway device to discard the target packet, thereby avoiding network security risks caused by the target packet being sent to the target device.

[0112] In the embodiments of this application, the processing strategy for the target message is determined based on all logical function codes, including:

[0113] Determine whether each logical function code is an abnormal function code;

[0114] If at least one logical function code is an abnormal function code, the processing strategy for the target message is determined to be blocking the target message;

[0115] If none of the logical function codes are abnormal, the processing strategy for the target message is to allow the target message to pass.

[0116] After determining the logical function code corresponding to each feature field, it is then determined whether each logical function code is an abnormal function code. Abnormal function codes are preset according to actual needs and are not limited here. For ease of understanding, in this embodiment, the abnormal function code is the data read function code. If at least one logical function code is an abnormal function code, the target message is determined to be an attack message requesting abnormal data read, and the processing strategy for the target message is determined to be blocking the target message, discarding the entire message. If none of the logical function codes are abnormal function codes, it is determined that there is no illegal operation in the target message, and the processing strategy for the target message is determined to be allowing the target message to be sent to the target device.

[0117] This application provides a message processing method, including: receiving a target message based on the GOOSE protocol; extracting features from the target message to obtain a feature information group corresponding to the target message; determining the logical function code corresponding to each feature field based on the feature information group; and determining a processing strategy for the target message based on all logical function codes. By performing feature analysis on messages based on the GOOSE protocol and deriving logical function codes from the extracted feature fields, attack messages transmitted via the GOOSE protocol can be accurately detected, thus avoiding network security risks.

[0118] Example 2

[0119] Please see Figure 2 , Figure 2 A schematic diagram of the message processing apparatus provided in an embodiment of this application is shown. Figure 2 The message processing device 200 in the middle includes:

[0120] Message receiving module 210 is used to receive target messages based on the GOOSE protocol;

[0121] The feature information acquisition module 220 is used to extract the target message and obtain the feature information group corresponding to the target message. The feature information group includes at least two feature fields: dataset, flag bit, data length, data content, and field type.

[0122] The function code determination module 230 is used to determine the logical function code corresponding to each feature field based on the feature information group;

[0123] The processing strategy determination module 240 is used to determine the processing strategy of the target packet based on all logical function codes, wherein the processing strategy includes allowing the target packet to pass or blocking the target packet.

[0124] In the embodiments of this application, the target message includes a header message and an APDU message. The header message includes a first feature field, and the APDU message includes at least one second feature field.

[0125] Feature information acquisition module 220 includes:

[0126] The header extraction submodule is used to extract the header message and obtain the first feature information corresponding to the first feature field;

[0127] The APDU extraction submodule is used to extract APDU messages and obtain the second feature information corresponding to each second feature field.

[0128] The feature information group submodule is used to combine the first feature information and all the second feature information to obtain the feature information group.

[0129] In the embodiments of this application, the target message also includes a TLV structure message;

[0130] The APDU extraction submodule includes:

[0131] The message decoding submodule is used to decode TLV structure messages to obtain the offset corresponding to each second feature field;

[0132] The field extraction submodule is used to extract the second feature field for each second feature field according to the corresponding offset, so as to obtain the second feature information corresponding to the second feature field.

[0133] In embodiments of this application, at least one second feature field includes a message lifetime field;

[0134] The processing strategy determination module 240 includes:

[0135] The condition determination module is used to determine whether the feature information group meets the preset conditions. The preset conditions include at least one of the following: the data length of the second feature field other than the message live time field is zero, the length of the header message and the APDU message are inconsistent, the field value of at least one feature field is abnormal, and the length of the target message is less than the preset length.

[0136] The strategy determination submodule is used to determine the processing strategy of the target message based on all logical function codes when the feature information group does not meet the preset conditions.

[0137] In embodiments of this application, the message processing apparatus 200 further includes:

[0138] The malformed packet alert module is used to block the target packet and generate an alert message when the feature information group meets the preset conditions. The alert message is used to indicate that the target packet is a malformed packet.

[0139] In the embodiments of this application, the function code determination module 230 includes:

[0140] The state change determination submodule is used to determine the logical function code corresponding to the first feature field as the state change logical function code when the flag value of the first feature field is the flag value of the second feature field. The first feature field is any one of at least two feature fields, and the second feature field is any one of at least two feature fields other than the first feature field.

[0141] The length change determination submodule is used to determine the logical function code corresponding to the feature field as the length change logical function code when the data length of the feature field is inconsistent with the preset value length.

[0142] The configuration update determination submodule is used to determine the logical function code corresponding to the feature field as the configuration update logical function code when the feature field is the configuration version number field and the feature field has changed.

[0143] The maintenance status determination submodule is used to determine the logical function code corresponding to the feature field as the maintenance status logical function code when the feature field is a test field and the field value of the feature field is a preset field value.

[0144] The dataset entry determination submodule is used to determine the logical function code corresponding to the feature field as the field value of the feature field when the feature field is a dataset entry field.

[0145] In embodiments of this application, the message processing apparatus 200 further includes:

[0146] The target field determination module is used to determine at least one target feature field to be detected corresponding to the target message when the processing policy of the target message is to allow the target message to pass. The target feature field is any one of at least two feature fields.

[0147] The field value acquisition module is used to obtain the field value of each target feature field according to the feature information group;

[0148] The policy update module is used to update the processing policy of the target packet to block the target packet when at least one of the target feature fields has an abnormal field value.

[0149] In embodiments of this application, the processing strategy determination module 240 includes:

[0150] The exception determination submodule is used to determine whether each logical function code is an exception function code;

[0151] The message blocking submodule is used to determine the processing strategy of the target message as blocking the target message when at least one logical function code is an abnormal function code.

[0152] The message release submodule is used to determine the processing strategy for the target message as releasing the target message when each logical function code is not an abnormal function code.

[0153] This application embodiment also provides a computing device, including:

[0154] The memory is configured to store instructions;

[0155] The processor is configured to retrieve instructions from memory and, when executing instructions, to implement the aforementioned message processing methods.

[0156] In this embodiment, the message receiving module 210, the feature information obtaining module 220, the function code determining module 230, and the processing strategy determining module 240 are all stored as program units in the memory, and the processor executes the above-mentioned program units stored in the memory to realize the corresponding functions.

[0157] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and the aforementioned message processing methods can be implemented by adjusting kernel parameters.

[0158] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0159] This application also provides a machine-readable storage medium storing instructions that, when executed by a processor, configure the processor to perform the aforementioned message processing method.

[0160] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described message processing method.

[0161] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0162] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0163] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0164] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0165] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0166] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, like read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0167] Machine-readable storage media include both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0168] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0169] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A message processing method, characterized in that, The message processing method includes: Receive target messages based on the GOOSE protocol; The target message is extracted to obtain the feature information group corresponding to the target message, wherein the feature information group includes at least two feature fields: dataset, flag bit, data length, data content, and field type; Based on the feature information group, determine the logical function code corresponding to each feature field; Based on all the logical function codes, a processing strategy for the target packet is determined, wherein the processing strategy includes allowing the target packet to pass and blocking the target packet.

2. The message processing method according to claim 1, characterized in that, The target message includes a header message and an APDU message. The header message includes a first feature field, and the APDU message includes at least one second feature field. The step of extracting the target message to obtain the feature information group corresponding to the target message includes: Extract the header message to obtain the first feature information corresponding to the first feature field; The APDU message is extracted to obtain the second feature information corresponding to each of the second feature fields; The first feature information and all the second feature information are combined to obtain the feature information group.

3. The message processing method according to claim 2, characterized in that, The target message also includes a TLV structure message; The step of extracting the APDU message to obtain the second feature information corresponding to each of the second feature fields includes: The TLV structure message is decoded to obtain the offset corresponding to each of the second feature fields; For each of the second feature fields, the second feature field is extracted according to the corresponding offset to obtain the second feature information corresponding to the second feature field.

4. The message processing method according to claim 2, characterized in that, The at least one second feature field includes a message lifetime field; The step of determining the processing strategy for the target message based on all the logical function codes includes: Determine whether the feature information group meets preset conditions, wherein the preset conditions include at least one of the following: the data length of the second feature field other than the message live time field is all zero, the length of the header message is inconsistent with the length of the APDU message, the field value of at least one feature field is abnormal, and the length of the target message is less than a preset length; If the feature information group does not meet the preset conditions, the processing strategy for the target message is determined based on all the logical function codes.

5. The message processing method according to claim 4, characterized in that, The message processing method further includes: If the feature information group meets the preset conditions, the target packet is blocked and a prompt message is generated, wherein the prompt message is used to indicate that the target packet is a malformed packet.

6. The message processing method according to claim 1, characterized in that, The step of determining the logical function code corresponding to each feature field based on the feature information group includes: When the flag value of the first feature field is the flag value of the second feature field, the logical function code corresponding to the first feature field is determined to be a state change logical function code, wherein the first feature field is any one of the at least two feature fields, and the second feature field is any one of the at least two feature fields other than the first feature field. If the data length of the feature field is inconsistent with the preset value length, the logical function code corresponding to the feature field is determined to be a length change logical function code. If the feature field is a configuration version number field and the feature field changes, the logical function code corresponding to the feature field is determined to be a configuration update logical function code. If the feature field is a test field and the field value of the feature field is a preset field value, then the logical function code corresponding to the feature field is determined to be the maintenance status logical function code. When the feature field is a dataset entry field, the logical function code corresponding to the feature field is determined to be the field value of the feature field.

7. The message processing method according to claim 1, characterized in that, After determining the processing strategy for the target message based on all the logical function codes, the method further includes: When the processing strategy for the target message is to allow the target message, at least one target feature field to be detected corresponding to the target message is determined, wherein the target feature field is any one of the at least two feature fields; Based on the feature information group, obtain the field value of each target feature field; If at least one of the target feature fields has an abnormal value, the processing policy for the target packet will be updated to block the target packet.

8. The message processing method according to claim 1, characterized in that, The step of determining the processing strategy for the target message based on all the logical function codes includes: Determine whether each of the logical function codes is an abnormal function code; If at least one of the logical function codes is an abnormal function code, the processing strategy for the target message is determined to be to block the target message; If none of the logical function codes are abnormal function codes, the processing strategy for the target message is determined to allow the target message to pass.

9. A computing device, characterized in that, include: The memory is configured to store instructions; A processor is configured to retrieve the instructions from the memory and, when executing the instructions, to implement the message processing method according to any one of claims 1 to 8.

10. A machine-readable storage medium storing instructions thereon, characterized in that, When executed by a processor, this instruction causes the processor to be configured to perform the message processing method according to any one of claims 1 to 8.

11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the message processing method according to any one of claims 1 to 8.

Images