Data interaction method and device and storage medium

Abstract

The embodiment of the invention relates to the technical field of industrial network security, in particular to a data interaction method and device and a storage medium. The method comprises the following steps: receiving an S7Comm-plus protocol message sent by a client; the message type of the S7Comm-plus protocol message is determined; determining a processing mode of the S7Comm-plus protocol message according to the message type, wherein the processing mode comprises message encryption and security attribute check; the S7Comm-plus protocol message is processed on the basis of the processing mode, so that the processed S7Comm-plus protocol message is obtained; the processed S7Comm-plus protocol message is sent to the equipment end, and the S7Comm-plus protocol message is sent to the equipment end; receiving response data returned by the equipment end; and sending the processed response data to the client. Through the scheme, the confidentiality and security of the data can be improved, illegal access and malicious control are effectively prevented, and the security of data interaction is improved.

Description

Technical Field

[0001] The present application relates to the technical field of industrial network security, and specifically to a data interaction method, device, storage medium and computer program product. Background Art

[0002] As a product of the deep integration of new-generation information technology and manufacturing, the Industrial Internet is leading the global manufacturing industry towards a new height of digital and intelligent transformation. With the widespread application of the Industrial Internet, the frequency of data exchange and remote control has increased significantly, and industrial network security issues have become increasingly prominent. In the era of intelligent manufacturing, industrial control systems face a variety of threats from both inside and outside, such as malware attacks, unauthorized access, data leakage, etc., which may have a serious impact on production safety, operational efficiency and even national security. Therefore, how to protect industrial networks, especially to protect industrial equipment from external hazards, is a topic that is receiving increasing attention at home and abroad.

[0003] Protocol analysis is one of the important means to prevent industrial networks from being attacked. S7Comm-Plus is an advanced communication protocol designed by Siemens for its PLC (Programmable Logic Controller) series. It is based on the TCP / IP protocol stack and supports remote access, data reading and writing, diagnostic tasks, and program download and upload. This protocol is widely used in the field of industrial automation and is of great significance for improving production efficiency and realizing remote monitoring and control. However, with the continuous evolution of network attack technology, the S7Comm-plus protocol is also facing the risk of being exploited, such as data tampering and information leakage. Therefore, it is particularly important to strictly detect and protect the S7Comm-plus protocol.

[0004] At present, the detection and protection of the S7Comm-plus protocol are all single settings. Starting from the request type of the S7Comm-plus protocol itself, different protection methods are not set for different requests in a targeted manner. As a result, the protection effect of the S7Comm-plus protocol is poor, and there are problems such as data leakage and insufficient security. Summary of the invention

[0005] The purpose of the embodiments of the present application is to provide a data interaction method, device, storage medium and computer program product to solve the problems of data leakage and low data interaction security in the prior art.

[0006] In order to achieve the above-mentioned purpose, the first aspect of the present application provides a data interaction method, the method comprising:

[0007] Receive S7Comm-plus protocol messages sent by the client;

[0008] Determine the message type of the S7Comm-plus protocol message;

[0009] Determine the processing method of S7Comm-plus protocol messages according to the message type, including message encryption and security attribute check;

[0010] Processing the S7Comm-plus protocol message based on the processing mode to obtain a processed S7Comm-plus protocol message;

[0011] Send the processed S7Comm-plus protocol message to the device end;

[0012] Receive the response data returned by the device;

[0013] Send the processed response data to the client.

[0014] In an embodiment of the present application, the message type includes a request message for establishing a connection. When the message type of the S7Comm-plus protocol message is a request message, the processing method is determined to be message encryption. The processing of the S7Comm-plus protocol message based on message encryption includes: extracting the creatobject in the S7Comm-plus protocol message; generating an encryption key using a national secret algorithm; converting the sensitive information in the creatobject into ciphertext based on the encryption key to obtain an encrypted creatobject; and replacing the creatobject in the S7Comm-plus protocol message with the encrypted creatobject to obtain a processed S7Comm-plus protocol message.

[0015] In an embodiment of the present application, sending the processed response data to the client includes: decrypting the response data using a national encryption algorithm; sending the decrypted response data to the client, wherein the response data is returned by the device in response to the processed S7Comm-plus protocol message.

[0016] In an embodiment of the present application, the message type includes a read-write function code message. When the message type of the S7Comm-plus protocol message is a read-write function code message, the processing method is determined to be a security attribute check. Processing the S7Comm-plus protocol message based on the security attribute check includes: performing an effective time check, an access object quantity check, and an access object address check on the S7Comm-plus protocol message; when the S7Comm-plus protocol message passes the effective time check, the access object quantity check, and the access object address check, it is determined that the S7Comm-plus protocol message is a processed S7Comm-plus protocol message.

[0017] In an embodiment of the present application, the method also includes: if the S7Comm-plus protocol message fails to pass any one of the effectiveness time check, the access object quantity check, and the access object address check, rejecting the read and write function request carried by the S7Comm-plus protocol message.

[0018] In an embodiment of the present application, the effective time check, access object quantity check and access object address check of the S7Comm-plus protocol message include: determining whether the access time of the S7Comm-plus protocol message is within the preset effective time range; if the access time of the S7Comm-plus protocol message is within the preset effective time range, determining that the S7Comm-plus protocol message passes the effective time check; if the access time of the S7Comm-plus protocol message is not within the preset effective time range, determining that the S7Comm-plus protocol message fails to pass the effective time check; determining whether the current access of the S7Comm-plus protocol message reaches the preset access quantity upper limit; in the current access of the S7Comm-plus protocol message When the access does not reach the preset access quantity upper limit, it is determined that the S7Comm-plus protocol message passes the access object quantity check; when the current access of the S7Comm-plus protocol message reaches the preset access quantity upper limit, it is determined that the S7Comm-plus protocol message does not pass the access object quantity check; it is determined whether the message address of the S7Comm-plus protocol message is in the preset address list; when the message address of the S7Comm-plus protocol message is in the preset address list, it is determined that the S7Comm-plus protocol message passes the access object address check; when the message address of the S7Comm-plus protocol message is not in the preset address list, it is determined that the S7Comm-plus protocol message does not pass the access object address check.

[0019] In an embodiment of the present application, determining the message type of an S7Comm-plus protocol message includes: parsing the message header of the S7Comm-plus protocol message to determine whether there is a flag in the message header indicating that the message type of the S7Comm-plus protocol message is a request message for establishing a connection; if there is a flag in the message header indicating that the message type of the S7Comm-plus protocol message is a request message, determining that the message type of the S7Comm-plus protocol message is a request message; if there is no flag in the message header indicating that the message type of the S7Comm-plus protocol message is a request message, checking the function code field of the S7Comm-plus protocol message to determine whether the field value of the function code field matches the historical read-write function code; if the field value of the function code field matches the historical read-write function code, determining that the message type of the S7Comm-plus protocol message is a read-write function code message.

[0020] A second aspect of the present application provides a data interaction device, including:

[0021] a memory configured to store instructions;

[0022] The processor is configured to call instructions from the memory and implement the above-mentioned data interaction method when executing the instructions.

[0023] A third aspect of the present application provides a machine-readable storage medium, on which instructions are stored, and the instructions are used to enable a machine to execute the above-mentioned data interaction method.

[0024] A fourth aspect of the present application provides a computer program product, including a computer program, which implements the above-mentioned data interaction method when executed by a processor.

[0025] Through the above technical solution, the S7Comm-plus protocol message can be processed according to the message type of the S7Comm-plus protocol message, and then the processed S7Comm-plus protocol message is sent to the device side, and the response data returned by the device side is processed and sent to the client side, thereby improving the confidentiality and security of the data, effectively preventing illegal access and malicious control, and improving the security of data interaction.

[0026] Other features and advantages of the embodiments of the present application will be described in detail in the subsequent specific implementation section. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present application, but do not constitute a limitation on the embodiments of the present application. In the accompanying drawings:

[0028] Figure 1 A schematic diagram of a process flow of a data interaction method according to an embodiment of the present application is schematically shown;

[0029] Figure 2 Another flow chart of a data interaction method according to an embodiment of the present application is schematically shown;

[0030] Figure 3 The internal structure diagram of a computer device according to an embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the specific implementation methods described herein are only used to illustrate and explain the embodiments of the present application, and are not used to limit the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0032] It should be noted that if the embodiments of the present application involve directional indications (such as up, down, left, right, front, back...), the directional indications are only used to explain the relative position relationship, movement status, etc. between the components under a certain specific posture (as shown in the accompanying drawings). If the specific posture changes, the directional indication will also change accordingly.

[0033] In addition, if there are descriptions involving "first", "second", etc. in the embodiments of the present application, the descriptions of "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or suggesting their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0034] Figure 1 A schematic diagram of a data interaction method according to an embodiment of the present application is shown. Figure 1 As shown, an embodiment of the present application provides a data interaction method, which may include the following steps.

[0035] Step 101: Receive the S7Comm-plus protocol message sent by the client.

[0036] Step 102: Determine the message type of the S7Comm-plus protocol message.

[0037] The S7Comm-plus protocol message is an advanced communication protocol designed by Siemens for its PLC (Programmable Logic Controller) series. It is based on the TCP / IP protocol stack and supports remote access, data reading and writing, diagnostic tasks, and program download and upload. The processor can receive the S7Comm-plus protocol message sent by the client and determine the message type of the S7Comm-plus protocol message.

[0038] In an embodiment of the present application, determining the message type of an S7Comm-plus protocol message includes: parsing the message header of the S7Comm-plus protocol message to determine whether there is a flag in the message header indicating that the message type of the S7Comm-plus protocol message is a request message for establishing a connection; if there is a flag in the message header indicating that the message type of the S7Comm-plus protocol message is a request message, determining that the message type of the S7Comm-plus protocol message is a request message; if there is no flag in the message header indicating that the message type of the S7Comm-plus protocol message is a request message, checking the function code field of the S7Comm-plus protocol message to determine whether the field value of the function code field matches the historical read-write function code; if the field value of the function code field matches the historical read-write function code, determining that the message type of the S7Comm-plus protocol message is a read-write function code message.

[0039] The processor can determine the message type of the S7Comm-plus protocol message. Specifically, the processor can analyze the message header of the S7Comm-plus protocol message to determine whether the message header has a flag indicating that the message type of the S7Comm-plus protocol message is a request message for establishing a connection. In the case where the message header has a flag indicating that the message type of the S7Comm-plus protocol message is a request message, the processor can determine that the message type of the S7Comm-plus protocol message is a request message. In the case where the message header does not have a flag indicating that the message type of the S7Comm-plus protocol message is a request message, the processor can check the function code field of the S7Comm-plus protocol message to determine whether the field value of the function code field matches the historical read-write function code. In the case where the field value of the function code field matches the historical read-write function code, the processor can determine that the message type of the S7Comm-plus protocol message is a read-write function code message.

[0040] Step 103: Determine the processing method for the S7Comm-plus protocol message according to the message type, and the processing method includes message encryption and security attribute check.

[0041] Step 104: Process the S7Comm-plus protocol message based on the processing method to obtain a processed S7Comm-plus protocol message.

[0042] After determining the message type of the S7Comm-plus protocol message, the processor may determine a processing method for the S7Comm-plus protocol message according to the message type. The processing method may include message encryption and security attribute checking. After determining the processing method for the S7Comm-plus protocol message, the processor may process the S7Comm-plus protocol message based on the processing method to obtain a processed S7Comm-plus protocol message.

[0043] In an embodiment of the present application, the message type includes a request message for establishing a connection. When the message type of the S7Comm-plus protocol message is a request message, the processing method is determined to be message encryption. The processing of the S7Comm-plus protocol message based on message encryption includes: extracting the creatobject in the S7Comm-plus protocol message; generating an encryption key using a national secret algorithm; converting the sensitive information in the creatobject into ciphertext based on the encryption key to obtain an encrypted creatobject; and replacing the creatobject in the S7Comm-plus protocol message with the encrypted creatobject to obtain a processed S7Comm-plus protocol message.

[0044] The message type may include a request message for establishing a connection. For example, a request message for establishing a COTP (Connection-Oriented Transport Protocol) connection. When the message type of the S7Comm-plus protocol message is a request message, the processor may determine that the processing method is message encryption. After determining that the message mode is message encryption, the processor may process the S7Comm-plus protocol message based on message encryption. Specifically, the processor may extract the creatobject (a specific part in the message, including a series of information for establishing a connection) in the S7Comm-plus protocol message. The processor may also generate an encryption key using a national secret algorithm. After generating the encryption key, the processor may convert the sensitive information in the creatobject into ciphertext based on the encryption key to obtain the encrypted creatobject. The sensitive information may be a device identifier, connection parameters, etc. After obtaining the encrypted creatobject, the processor may replace the creatobject in the S7Comm-plus protocol message with the encrypted creatobject to obtain the processed S7Comm-plus protocol message to improve the security and confidentiality of the S7Comm-plus protocol message.

[0045] In an embodiment of the present application, the message type includes a read-write function code message. When the message type of the S7Comm-plus protocol message is a read-write function code message, the processing method is determined to be a security attribute check. Processing the S7Comm-plus protocol message based on the security attribute check includes: performing an effective time check, an access object quantity check, and an access object address check on the S7Comm-plus protocol message; when the S7Comm-plus protocol message passes the effective time check, the access object quantity check, and the access object address check, it is determined that the S7Comm-plus protocol message is a processed S7Comm-plus protocol message.

[0046] The message type may include a read-write function code message. In the case where the message type of the S7Comm-plus protocol message is a read-write function code message, the processor may determine that the processing method is a security attribute check. After determining that the processing method is a security attribute check, the processor may process the S7Comm-plus protocol message based on the security attribute check. Specifically, the processor may perform an effective time check, an access object quantity check, and an access object address check on the S7Comm-plus protocol message. And determine whether the S7Comm-plus protocol message passes the effective time check, the access object quantity check, and the access object address check. In the case where the S7Comm-plus protocol message passes the effective time check, the access object quantity check, and the access object address check, the processor may determine that the S7Comm-plus protocol message is a processed S7Comm-plus protocol message. In an embodiment of the present application, in the case where the S7Comm-plus protocol message fails to pass any one of the effective time check, the access object quantity check, and the access object address check, the processor may reject the read-write function request carried by the S7Comm-plus protocol message to improve the security of message interaction.

[0047] In an embodiment of the present application, the effective time check, access object quantity check and access object address check of the S7Comm-plus protocol message include: determining whether the access time of the S7Comm-plus protocol message is within the preset effective time range; if the access time of the S7Comm-plus protocol message is within the preset effective time range, determining that the S7Comm-plus protocol message passes the effective time check; if the access time of the S7Comm-plus protocol message is not within the preset effective time range, determining that the S7Comm-plus protocol message fails to pass the effective time check; determining whether the current access of the S7Comm-plus protocol message reaches the preset access quantity upper limit; in the current access of the S7Comm-plus protocol message When the access does not reach the preset access quantity upper limit, it is determined that the S7Comm-plus protocol message passes the access object quantity check; when the current access of the S7Comm-plus protocol message reaches the preset access quantity upper limit, it is determined that the S7Comm-plus protocol message does not pass the access object quantity check; it is determined whether the message address of the S7Comm-plus protocol message is in the preset address list; when the message address of the S7Comm-plus protocol message is in the preset address list, it is determined that the S7Comm-plus protocol message passes the access object address check; when the message address of the S7Comm-plus protocol message is not in the preset address list, it is determined that the S7Comm-plus protocol message does not pass the access object address check.

[0048] The processor can perform an effective time check, an access object quantity check, and an access object address check on the S7Comm-plus protocol message. Specifically, the processor can determine whether the access time of the S7Comm-plus protocol message is within the preset effective time range. The preset effective time range can be configured by the user based on actual conditions. In the case where the access time of the S7Comm-plus protocol message is within the preset effective time range, the processor can determine that the S7Comm-plus protocol message passes the effective time check. In the case where the access time of the S7Comm-plus protocol message is not within the preset effective time range, the processor can determine that the S7Comm-plus protocol message fails the effective time check.

[0049] The processor may determine whether the current access of the S7Comm-plus protocol message reaches the preset access quantity upper limit. The preset access quantity upper limit may be determined based on actual conditions. In the case that the current access of the S7Comm-plus protocol message does not reach the preset access quantity upper limit, the processor may determine that the S7Comm-plus protocol message passes the access object quantity check. In the case that the current access of the S7Comm-plus protocol message reaches the preset access quantity upper limit, the processor may determine that the S7Comm-plus protocol message fails the access object quantity check.

[0050] The processor may determine whether the message address of the S7Comm-plus protocol message is in a preset address list. The preset address list may be determined based on actual conditions. In the case where the message address of the S7Comm-plus protocol message is in the preset address list, the processor may determine that the S7Comm-plus protocol message passes the access object address check. In the case where the message address of the S7Comm-plus protocol message is not in the preset address list, the processor may determine that the S7Comm-plus protocol message fails the access object address check.

[0051] Step 105: Send the processed S7Comm-plus protocol message to the device end.

[0052] Step 106: Receive response data returned by the device.

[0053] Step 107: Send the processed response data to the client.

[0054] After obtaining the processed S7Comm-plus protocol message, the processor may send the processed S7Comm-plus protocol message to the device end. In a specific embodiment, the device end may be a PLC device. After sending the processed S7Comm-plus protocol message to the device end, the processor may receive the response data returned by the device end and process the response data. The processor may send the processed response data to the client to realize data interaction between the client and the device end.

[0055] In an embodiment of the present application, sending the processed response data to the client includes: decrypting the response data using a national encryption algorithm; sending the decrypted response data to the client, wherein the response data is returned by the device in response to the processed S7Comm-plus protocol message.

[0056] The processor can send the processed response data to the client. Specifically, when the message type of the S7Comm-plus protocol message is a request message, the processor can send the processed S7Comm-plus protocol message to the device side, and receive the response data returned by the device side based on the processed S7Comm-plus protocol message. After receiving the returned response data, the processor can decrypt the response data using the national encryption algorithm to obtain the decrypted response data. After obtaining the decrypted response data, the processor can send the decrypted response data to the client.

[0057] In the embodiments of the present application, Figure 2 As shown, the client can send an S7Comm-plus protocol message, which can contain read and write operation instructions for the PLC device. After receiving the S7Comm-plus protocol message, the industrial control firewall (corresponding to the processor above) can identify whether it is an S7Comm-plus protocol through the industrial control firewall protocol. If it is determined that it is not an S7Comm-plus protocol, the industrial control firewall can process it. If it is an S7Comm-plus protocol, the industrial control firewall can further determine whether the S7Comm-plus protocol message is a request to establish a connection or a request to read and write function codes.

[0058] In the case of determining a request to establish a connection, the industrial control firewall can perform message encryption processing. Specifically, the industrial control firewall can extract the creatObject part, which includes sensitive information such as the device firmware version, device model, and general protocol. After extracting the creatObject, the industrial control firewall can encrypt the creatObject using SM4 (block cipher algorithm, national secret algorithm) to obtain the encrypted creatObject. After obtaining the encrypted creatObject, the industrial control firewall can use the encrypted creatObject to replace the original creatObject in the S7Comm-plus protocol message to reorganize the message and obtain the reorganized S7Comm-plus protocol message. After obtaining the reorganized S7Comm-plus protocol message, the industrial control firewall can send the reorganized S7Comm-plus protocol message to the PLC device and receive the response data returned by the PLC device. After receiving the response data returned by the PLC device, the industrial control firewall can decrypt the response data and send the processed response data to the client to realize data interaction between the client and the PLC device and improve the confidentiality and security of the device information.

[0059] When it is determined that it is a read-write function code request, the industrial control firewall can check the effective time, request source IP address, and number of access objects of the S7Comm-plus protocol message. Among them, checking the effective time refers to whether the effective time of the S7Comm-plus protocol message is within the setting range, checking the request source IP address refers to whether the address of the S7Comm-plus protocol message is in the list of IP addresses allowed to access, and checking the number of access objects refers to checking whether the current access of the S7Comm-plus protocol message reaches the access limit of the PLC device. When the S7Comm-plus protocol message passes the effective time, request source IP address, and number of access objects check, the industrial control firewall sends the S7Comm-plus protocol message to the PLC device, receives the response data returned by the PLC device, and sends the response data to the client, thereby improving the controllability and precise management capabilities of access to the PLC device, effectively preventing illegal access and malicious control, and improving access security.

[0060] Through the above technical solution, the confidentiality and security of data are improved, and illegal access and malicious control are effectively prevented, thereby improving the security of data interaction.

[0061] Figure 1 and Figure 2 FIG. 1 is a flow chart of a data interaction method in an embodiment. It should be understood that although Figure 1 and Figure 2The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 1 and Figure 2 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0062] The present application also provides a data interaction device, including:

[0063] a memory configured to store instructions;

[0064] The processor is configured to call instructions from the memory and implement the above-mentioned data interaction method when executing the instructions.

[0065] An embodiment of the present application also provides a machine-readable storage medium, on which instructions are stored, and the instructions are used to enable a machine to execute the above-mentioned data interaction method.

[0066] An embodiment of the present application also provides a computer program product, including a computer program, which implements the above-mentioned data interaction method when executed by a processor.

[0067] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 3 As shown. The computer device includes a processor A01, a network interface A02, a memory (not shown in the figure) and a database (not shown in the figure) connected through a system bus. Among them, the processor A01 of the computer device is used to provide computing and control capabilities. The memory of the computer device includes an internal memory A03 and a non-volatile storage medium A04. The non-volatile storage medium A04 stores an operating system B01, a computer program B02 and a database (not shown in the figure). The internal memory A03 provides an environment for the operation of the operating system B01 and the computer program B02 in the non-volatile storage medium A04. The database of the computer device is used to store data such as S7Comm-plus protocol messages, message types, response data, etc. The network interface A02 of the computer device is used to communicate with an external terminal through a network connection. When the computer program B02 is executed by the processor A01, a data interaction method is implemented.

[0068] Those skilled in the art will understand that Figure 3The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0069] An embodiment of the present application provides a device, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, the following steps are implemented: receiving an S7Comm-plus protocol message sent by a client; determining a message type of the S7Comm-plus protocol message; determining a processing method for the S7Comm-plus protocol message according to the message type, the processing method including message encryption and security attribute checking; processing the S7Comm-plus protocol message based on the processing method to obtain a processed S7Comm-plus protocol message; sending the processed S7Comm-plus protocol message to a device end; receiving response data returned by the device end; and sending the processed response data to the client.

[0070] In one embodiment, the message type includes a request message for establishing a connection. When the message type of the S7Comm-plus protocol message is a request message, the processing method is determined to be message encryption. The processing of the S7Comm-plus protocol message based on message encryption includes: extracting the creatobject in the S7Comm-plus protocol message; generating an encryption key using a national secret algorithm; converting the sensitive information in the creatobject into ciphertext based on the encryption key to obtain an encrypted creatobject; and replacing the creatobject in the S7Comm-plus protocol message with the encrypted creatobject to obtain a processed S7Comm-plus protocol message.

[0071] In one embodiment, sending the processed response data to the client includes: decrypting the response data using a national encryption algorithm; sending the decrypted response data to the client, wherein the response data is returned by the device in response to the processed S7Comm-plus protocol message.

[0072] In one embodiment, the message type includes a read-write function code message. When the message type of the S7Comm-plus protocol message is a read-write function code message, the processing method is determined to be a security attribute check. Processing the S7Comm-plus protocol message based on the security attribute check includes: performing an effective time check, an access object quantity check, and an access object address check on the S7Comm-plus protocol message; when the S7Comm-plus protocol message passes the effective time check, the access object quantity check, and the access object address check, it is determined that the S7Comm-plus protocol message is a processed S7Comm-plus protocol message.

[0073] In one embodiment, the method further includes: if the S7Comm-plus protocol message fails any one of the validity time check, the access object quantity check, and the access object address check, rejecting the read / write function request carried by the S7Comm-plus protocol message.

[0074] In one embodiment, the effective time check, access object quantity check and access object address check of the S7Comm-plus protocol message include: determining whether the access time of the S7Comm-plus protocol message is within the preset effective time range; if the access time of the S7Comm-plus protocol message is within the preset effective time range, determining that the S7Comm-plus protocol message passes the effective time check; if the access time of the S7Comm-plus protocol message is not within the preset effective time range, determining that the S7Comm-plus protocol message fails to pass the effective time check; determining whether the current access of the S7Comm-plus protocol message reaches the preset access quantity upper limit; in the current access of the S7Comm-plus protocol message When the access does not reach the preset access quantity upper limit, it is determined that the S7Comm-plus protocol message passes the access object quantity check; when the current access of the S7Comm-plus protocol message reaches the preset access quantity upper limit, it is determined that the S7Comm-plus protocol message does not pass the access object quantity check; it is determined whether the message address of the S7Comm-plus protocol message is in the preset address list; when the message address of the S7Comm-plus protocol message is in the preset address list, it is determined that the S7Comm-plus protocol message passes the access object address check; when the message address of the S7Comm-plus protocol message is not in the preset address list, it is determined that the S7Comm-plus protocol message does not pass the access object address check.

[0075] In one embodiment, determining the message type of an S7Comm-plus protocol message includes: parsing a message header of the S7Comm-plus protocol message to determine whether there is a flag in the message header indicating that the message type of the S7Comm-plus protocol message is a request message for establishing a connection; if there is a flag in the message header indicating that the message type of the S7Comm-plus protocol message is a request message, determining that the message type of the S7Comm-plus protocol message is a request message; if there is no flag in the message header indicating that the message type of the S7Comm-plus protocol message is a request message, checking a function code field of the S7Comm-plus protocol message to determine whether a field value of the function code field matches a historical read-write function code; if the field value of the function code field matches a historical read-write function code, determining that the message type of the S7Comm-plus protocol message is a read-write function code message.

[0076] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program that initializes the steps of the data interaction method.

[0077] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0078] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0079] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0080] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0081] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0082] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0083] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0084] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0085] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A data interaction method, characterized in that: The method comprises: Receive S7Comm-plus protocol messages sent by the client; Determine the message type of the S7Comm-plus protocol message; Determine a processing method for the S7Comm-plus protocol message according to the message type, wherein the processing method includes message encryption and security attribute checking; Processing the S7Comm-plus protocol message based on the processing method to obtain a processed S7Comm-plus protocol message; Send the processed S7Comm-plus protocol message to the device end; Receiving response data returned by the device; The processed response data is sent to the client.

2. The data interaction method according to claim 1, characterized in that: The message type includes a request message for establishing a connection. When the message type of the S7Comm-plus protocol message is the request message, determining that the processing method is message encryption, and processing the S7Comm-plus protocol message based on the message encryption includes: Extract the creatobject in the S7Comm-plus protocol message; Generate encryption keys using the national secret algorithm; Convert the sensitive information in the creatobject into ciphertext based on the encryption key to obtain an encrypted creatobject; The encrypted creatobject is used to replace the creatobject in the S7Comm-plus protocol message to obtain the processed S7Comm-plus protocol message.

3. The data interaction method according to claim 2, characterized in that: The sending the processed response data to the client comprises: Decrypt the response data using the national secret algorithm; The decrypted response data is sent to the client, wherein the response data is returned by the device in response to the processed S7Comm-plus protocol message.

4. The data interaction method according to claim 1, characterized in that: The message type includes a read-write function code message. When the message type of the S7Comm-plus protocol message is the read-write function code message, determining that the processing method is the security attribute check, and processing the S7Comm-plus protocol message based on the security attribute check includes: Performing an effective time check, an access object quantity check, and an access object address check on the S7Comm-plus protocol message; In the case that the S7Comm-plus protocol message passes the effectiveness time check, the access object quantity check and the access object address check, it is determined that the S7Comm-plus protocol message is the processed S7Comm-plus protocol message.

5. The data interaction method according to claim 4, characterized in that: The method further comprises: In the case that the S7Comm-plus protocol message fails to pass any one of the validity time check, the access object quantity check and the access object address check, the read / write function request carried by the S7Comm-plus protocol message is rejected.

6. The data interaction method according to claim 4, characterized in that: The checking of the effective time, the number of access objects and the address of access objects for the S7Comm-plus protocol message includes: Determine whether the access time of the S7Comm-plus protocol message is within a preset effective time range; In a case where the access time of the S7Comm-plus protocol message is within the preset effective time range, determining that the S7Comm-plus protocol message passes the effective time check; In the case where the access time of the S7Comm-plus protocol message is not within the preset effective time range, determining that the S7Comm-plus protocol message fails the effective time check; Determine whether the current access of the S7Comm-plus protocol message reaches a preset access quantity upper limit; In a case where the current access of the S7Comm-plus protocol message does not reach the preset access quantity upper limit, determining that the S7Comm-plus protocol message passes the access object quantity check; In the case where the current access of the S7Comm-plus protocol message reaches the preset access quantity upper limit, determining that the S7Comm-plus protocol message fails the access object quantity check; Determine whether the message address of the S7Comm-plus protocol message is in a preset address list; In a case where the message address of the S7Comm-plus protocol message is in the preset address list, determining that the S7Comm-plus protocol message passes the access object address check; When the message address of the S7Comm-plus protocol message is not in the preset address list, it is determined that the S7Comm-plus protocol message fails to pass the access object address check.

7. The data interaction method according to claim 1, characterized in that: Determining the message type of the S7Comm-plus protocol message includes: Parsing a message header of the S7Comm-plus protocol message to determine whether the message header contains a flag indicating that the message type of the S7Comm-plus protocol message is a request message for establishing a connection; In a case where there is a flag in the message header indicating that the message type of the S7Comm-plus protocol message is the request message, determining that the message type of the S7Comm-plus protocol message is the request message; In the case where there is no flag in the message header indicating that the message type of the S7Comm-plus protocol message is the request message, checking the function code field of the S7Comm-plus protocol message to determine whether the field value of the function code field matches the historical read-write function code; When the field value of the function code field matches the historical read-write function code, it is determined that the message type of the S7Comm-plus protocol message is a read-write function code message.

8. A data interaction device, characterized in that: include: a memory configured to store instructions; A processor is configured to call the instruction from the memory and implement the data interaction method according to any one of claims 1 to 7 when executing the instruction.

9. A machine-readable storage medium, characterized in that: The machine-readable storage medium stores instructions, which are used to enable a machine to execute the data interaction method according to any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the data interaction method according to any one of claims 1 to 7.

Images