Data interaction method and device, and storage medium

Abstract

The embodiment of the application relates to the technical field of industrial network security, and in particular to a data interaction method and device and a storage medium. The method comprises the following steps: receiving an S7Comm-plus protocol message sent by a client; determining the message type of the S7Comm-plus protocol message; determining the processing mode of the S7Comm-plus protocol message according to the message type, wherein the processing mode comprises message encryption and security attribute checking; processing the S7Comm-plus protocol message based on the processing mode to obtain a processed S7Comm-plus protocol message; sending the processed S7Comm-plus protocol message to a device end; receiving response data returned by the device end; and sending the processed response data to the client. The above scheme can improve the confidentiality and security of data, effectively prevent illegal access and malicious control, and improve the security of data interaction.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of industrial network security, in particular to a data interaction method and device, a storage medium and a computer program product. BACKGROUND

[0002] Industrial Internet, as a product of the deep integration of new generation information technology and manufacturing industry, is leading the global manufacturing industry to a new height of digital and intelligent transformation. With the wide application of industrial Internet, the frequency of data exchange and remote control has increased significantly, and the problem of industrial network security has become increasingly prominent. In the era of intelligent manufacturing, industrial control systems are facing various threats from the inside and outside, such as malicious software attacks, unauthorized access, data leakage, etc., which may have a serious impact on production safety, operational efficiency and even national security. Therefore, how to protect industrial networks, especially to protect industrial equipment from external harm, is a topic that is increasingly emphasized at home and abroad.

[0003] Protocol analysis is one of the important means to prevent industrial networks from being attacked. S7Comm-plus is a high-level communication protocol designed by Siemens for its PLC (Programmable Logic Controller) series, which is based on the TCP / IP protocol stack and supports remote access, data reading and writing, diagnostic tasks and program download / upload functions. The protocol is widely used in the field of industrial automation and has important significance for improving production efficiency and realizing remote monitoring and control. However, with the continuous evolution of network attack technology, S7Comm-plus protocol also faces the risk of being exploited, such as data tampering and information leakage. Therefore, it is particularly important to strictly detect and protect S7Comm-plus protocol.

[0004] Currently, the detection and protection of S7Comm-plus protocol are single settings, without starting from the request type of S7Comm-plus protocol, and setting different protection methods for different requests, resulting in poor protection effect of S7Comm-plus protocol, and problems of data leakage and insufficient security. SUMMARY

[0005] The purpose of the embodiments of the present application is to provide a data interaction method, device, storage medium and computer program product to solve the problem of data leakage and low security of data interaction in the prior art.

[0006] In order to achieve the above-mentioned purpose, the first aspect of the present application provides a data interaction method, the method comprising:

[0007] receiving an S7Comm-plus protocol packet sent by a client;

[0008] determining the packet type of the S7Comm-plus protocol packet;

[0009] determining a processing manner for the S7Comm-plus protocol message according to the message type, the processing manner including message encryption and security attribute checking;

[0010] processing the S7Comm-plus protocol message based on the processing manner to obtain a processed S7Comm-plus protocol message;

[0011] sending the processed S7Comm-plus protocol message to the device side;

[0012] receiving response data returned by the device side;

[0013] sending the processed response data to the client side.

[0014] In the embodiments of the present application, the message type includes a request message for establishing a connection, and in the case where the message type of the S7Comm-plus protocol message is the request message, the processing manner is determined to be message encryption, and processing the S7Comm-plus protocol message based on the message encryption includes: extracting creatobject in the S7Comm-plus protocol message; generating an encryption key using a national secret algorithm; converting sensitive information in the creatobject into ciphertext based on the encryption key to obtain encrypted creatobject; and replacing the creatobject in the S7Comm-plus protocol message with the encrypted creatobject to obtain the processed S7Comm-plus protocol message.

[0015] In the embodiments of the present application, sending the processed response data to the client side includes: decrypting the response data using a national secret algorithm; and sending the decrypted response data to the client side, wherein the response data is returned by the device side in response to the processed S7Comm-plus protocol message.

[0016] In the embodiments of the present application, the message type includes a read-write function code message, and in the case where the message type of the S7Comm-plus protocol message is the read-write function code message, the processing manner is determined to be security attribute checking, and processing the S7Comm-plus protocol message based on the security attribute checking includes: performing validity time checking, access object quantity checking, and access object address checking on the S7Comm-plus protocol message; and in the case where the S7Comm-plus protocol message passes the validity time checking, the access object quantity checking, and the access object address checking, the S7Comm-plus protocol message is determined to be the processed S7Comm-plus protocol message.

[0017] In the embodiment of the present application, the method further comprises: in the case that the S7Comm-plus protocol message fails any one of the validity time check, the access object quantity check and the access object address check, rejecting the read-write function request carried by the S7Comm-plus protocol message.

[0018] In the embodiment of the present application, the validity time check, the access object quantity check and the access object address check on the S7Comm-plus protocol message comprise: determining whether the access time of the S7Comm-plus protocol message is within a preset validity time range; in the case that the access time of the S7Comm-plus protocol message is within the preset validity time range, determining that the S7Comm-plus protocol message passes the validity time check; in the case that the access time of the S7Comm-plus protocol message is not within the preset validity time range, determining that the S7Comm-plus protocol message fails the validity time check; determining whether the current access of the S7Comm-plus protocol message reaches a preset access quantity upper limit; in the case that the current access of the S7Comm-plus protocol message does not reach the preset access quantity upper limit, determining that the S7Comm-plus protocol message passes the access object quantity check; in the case that the current access of the S7Comm-plus protocol message reaches the preset access quantity upper limit, determining that the S7Comm-plus protocol message fails the access object quantity check; determining whether the message address of the S7Comm-plus protocol message is within a preset address list; in the case that the message address of the S7Comm-plus protocol message is within the preset address list, determining that the S7Comm-plus protocol message passes the access object address check; in the case that the message address of the S7Comm-plus protocol message is not within the preset address list, determining that the S7Comm-plus protocol message fails the access object address check.

[0019] In the embodiment of the present application, determining the message type of the S7Comm-plus protocol message comprises: parsing the message header of the S7Comm-plus protocol message to determine whether the message header contains a flag indicating that the message type of the S7Comm-plus protocol message is a request message for establishing a connection; in the case where the message header contains the flag indicating that the message type of the S7Comm-plus protocol message is the request message, determining that the message type of the S7Comm-plus protocol message is the request message; and in the case where the message header does not contain the flag indicating that the message type of the S7Comm-plus protocol message is the request message, checking the function code field of the S7Comm-plus protocol message to determine whether the field value of the function code field matches a historical read-write function code; and in the case where the field value of the function code field matches the historical read-write function code, determining that the message type of the S7Comm-plus protocol message is a read-write function code message.

[0020] The second aspect of the present application provides a data interaction device, comprising:

[0021] a memory configured to store instructions;

[0022] a processor configured to call the instructions from the memory and capable of implementing the above-mentioned data interaction method when executing the instructions.

[0023] The third aspect of the present application provides a machine-readable storage medium having instructions stored thereon, the instructions being used to cause a machine to execute the above-mentioned data interaction method.

[0024] The fourth aspect of the present application provides a computer program product comprising a computer program, the computer program being used to implement the above-mentioned data interaction method when executed by a processor.

[0025] Through the above technical solution, the S7Comm-plus protocol message can be processed according to the message type of the S7Comm-plus protocol message, and then the processed S7Comm-plus protocol message is sent to the device end, and the response data returned by the device end is processed and then sent to the client, thereby improving the confidentiality and security of data, effectively preventing illegal access and malicious control, and improving the security of data interaction.

[0026] Other features and advantages of the embodiments of the present application will be described in detail in the following specific implementation part. BRIEF DESCRIPTION OF DRAWINGS

[0027] The accompanying drawings are included to provide a further understanding of the embodiments of the present application, and constitute a part of the specification, and are used together with the following specific implementation to explain the embodiments of the present application, but do not constitute a limitation on the embodiments of the present application. In the drawings:

[0028] Figure 1 Fig. 1 schematically shows a flowchart of a data interaction method according to an embodiment of the present application;

[0029] Figure 2 Fig. 2 schematically shows another flowchart of a data interaction method according to an embodiment of the present application;

[0030] Figure 3 Fig. 3 schematically shows an internal structure diagram of a computer device according to an embodiment of the present application. DETAILED DESCRIPTION

[0031] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. It should be understood that the specific embodiments described herein are merely used to explain and illustrate the embodiments of the present application, and should not be used to limit the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort belong to the scope of protection of the present application.

[0032] It should be noted that if the embodiments of the present application involve directional indications (such as up, down, left, right, front, back, etc.), the directional indications are merely used to explain the relative positional relationship, movement condition, etc. between components in a certain posture (as shown in the drawings), and if the certain posture changes, the directional indications also change accordingly.

[0033] In addition, if the embodiments of the present application involve descriptions such as "first", "second", etc., the descriptions of "first", "second", etc. are merely for description purposes, and should not be understood as indicating or implying the relative importance of the indicated technical features or implicitly indicating the number of the indicated technical features. Therefore, the features limited by "first", "second" can explicitly or implicitly include at least one of the features. In addition, the technical solutions of the various embodiments can be combined with each other, but it must be based on the fact that a person of ordinary skill in the art can realize it, and when the combination of technical solutions contradicts each other or cannot be realized, it should be considered that the combination of technical solutions does not exist, and is not within the scope of protection claimed by the present application.

[0034] Figure 1 Fig. 1 schematically shows a flowchart of a data interaction method according to an embodiment of the present application. As shown in Figure 1 the present application provides a data interaction method, which can include the following steps.

[0035] Step 101: receiving an S7Comm-plus protocol packet sent by a client.

[0036] Step 102: determining the message type of the S7Comm-plus protocol message.

[0037] The S7Comm-plus protocol message is a high-level communication protocol designed by Siemens for its PLC (Programmable Logic Controller) series, which is based on the TCP / IP protocol stack and supports remote access, data reading and writing, diagnostic tasks, and program download and upload functions. The processor can receive the S7Comm-plus protocol message sent by the client. The processor determines the message type of the S7Comm-plus protocol message.

[0038] In the embodiments of the present application, determining the message type of the S7Comm-plus protocol message includes: parsing the message header of the S7Comm-plus protocol message to determine whether the message header contains a flag indicating that the message type of the S7Comm-plus protocol message is a request message for establishing a connection; in the case that the message header contains the flag indicating that the message type of the S7Comm-plus protocol message is the request message, determining that the message type of the S7Comm-plus protocol message is the request message; in the case that the message header does not contain the flag indicating that the message type of the S7Comm-plus protocol message is the request message, checking the function code field of the S7Comm-plus protocol message to determine whether the field value of the function code field matches the historical read-write function code; in the case that the field value of the function code field matches the historical read-write function code, determining that the message type of the S7Comm-plus protocol message is the read-write function code message.

[0039] The processor can determine the message type of the S7Comm-plus protocol message. Specifically, the processor can analyze the message header of the S7Comm-plus protocol message to determine whether the message header contains a flag indicating that the message type of the S7Comm-plus protocol message is a request message for establishing a connection. In the case that the message header contains the flag indicating that the message type of the S7Comm-plus protocol message is the request message, the processor can determine that the message type of the S7Comm-plus protocol message is the request message. In the case that the message header does not contain the flag indicating that the message type of the S7Comm-plus protocol message is the request message, the processor can check the function code field of the S7Comm-plus protocol message to determine whether the field value of the function code field matches the historical read-write function code. In the case that the field value of the function code field matches the historical read-write function code, the processor can determine that the message type of the S7Comm-plus protocol message is the read-write function code message.

[0040] Step 103: determining the processing method for the S7Comm-plus protocol message according to the message type, the processing method including message encryption and security attribute checking.

[0041] Step 104: processing the S7Comm-plus protocol message based on the processing manner to obtain a processed S7Comm-plus protocol message.

[0042] After determining the message type of the S7Comm-plus protocol message, the processor can determine the processing manner of the S7Comm-plus protocol message according to the message type. The processing manner can include message encryption and security attribute checking. After determining the processing manner of the S7Comm-plus protocol message, the processor can process the S7Comm-plus protocol message based on the processing manner to obtain a processed S7Comm-plus protocol message.

[0043] In the embodiments of the present application, the message type includes a request message for establishing a connection. In the case where the message type of the S7Comm-plus protocol message is the request message, it is determined that the processing manner is message encryption. Processing the S7Comm-plus protocol message based on the message encryption includes: extracting creatobject in the S7Comm-plus protocol message; generating an encryption key using a national secret algorithm; converting sensitive information in the creatobject into ciphertext based on the encryption key to obtain encrypted creatobject; and replacing the creatobject in the S7Comm-plus protocol message with the encrypted creatobject to obtain a processed S7Comm-plus protocol message.

[0044] The message type can include a request message for establishing a connection. For example, a request message for establishing a COTP (Connection-Oriented Transport Protocol) connection. In the case where the message type of the S7Comm-plus protocol message is a request message, the processor can determine that the processing manner is message encryption. After determining that the message manner is message encryption, the processor can process the S7Comm-plus protocol message based on message encryption. Specifically, the processor can extract the creatobject (a specific part of the message, including a series of information for establishing a connection) in the S7Comm-plus protocol message. The processor can also generate an encryption key using a national secret algorithm. After generating the encryption key, the processor can convert sensitive information in the creatobject into ciphertext based on the encryption key to obtain an encrypted creatobject. The sensitive information can be a device identifier, connection parameters, and the like. After obtaining the encrypted creatobject, the processor can replace the creatobject in the S7Comm-plus protocol message with the encrypted creatobject to obtain a processed S7Comm-plus protocol message, so as to improve the security and confidentiality of the S7Comm-plus protocol message.

[0045] In the embodiments of the present application, the message type includes a read-write function code message, and in the case where the message type of the S7Comm-plus protocol message is a read-write function code message, it is determined that the processing manner is security attribute checking, and the S7Comm-plus protocol message is processed based on security attribute checking, including validity time checking, access object quantity checking, and access object address checking on the S7Comm-plus protocol message; in the case where the S7Comm-plus protocol message passes the validity time checking, the access object quantity checking, and the access object address checking, the S7Comm-plus protocol message is determined to be a processed S7Comm-plus protocol message.

[0046] The message type can include a read-write function code message. In a case where the message type of the S7Comm-plus protocol message is the read-write function code message, the processor can determine that the processing manner is a security attribute check. After determining that the processing manner is the security attribute check, the processor can process the S7Comm-plus protocol message based on the security attribute check. Specifically, the processor can perform a validity time check, an access object quantity check, and an access object address check on the S7Comm-plus protocol message, and determine whether the S7Comm-plus protocol message passes the validity time check, the access object quantity check, and the access object address check. In a case where the S7Comm-plus protocol message passes the validity time check, the access object quantity check, and the access object address check, the processor can determine that the S7Comm-plus protocol message is a processed S7Comm-plus protocol message. In an embodiment of the present application, in a case where the S7Comm-plus protocol message does not pass any one of the validity time check, the access object quantity check, and the access object address check, the processor can reject the read-write function request carried by the S7Comm-plus protocol message, so as to improve the security of message interaction.

[0047] In an embodiment of the present application, the validity time check, the access object quantity check, and the access object address check on the S7Comm-plus protocol message include: determining whether the access time of the S7Comm-plus protocol message is within a preset validity time range; in a case where the access time of the S7Comm-plus protocol message is within the preset validity time range, determining that the S7Comm-plus protocol message passes the validity time check; in a case where the access time of the S7Comm-plus protocol message is not within the preset validity time range, determining that the S7Comm-plus protocol message does not pass the validity time check; determining whether the current access of the S7Comm-plus protocol message reaches a preset access quantity upper limit; in a case where the current access of the S7Comm-plus protocol message does not reach the preset access quantity upper limit, determining that the S7Comm-plus protocol message passes the access object quantity check; in a case where the current access of the S7Comm-plus protocol message reaches the preset access quantity upper limit, determining that the S7Comm-plus protocol message does not pass the access object quantity check; determining whether the message address of the S7Comm-plus protocol message is within a preset address list; in a case where the message address of the S7Comm-plus protocol message is within the preset address list, determining that the S7Comm-plus protocol message passes the access object address check; in a case where the message address of the S7Comm-plus protocol message is not within the preset address list, determining that the S7Comm-plus protocol message does not pass the access object address check.

[0048] The processor can perform a validity time check, an access object quantity check, and an access object address check on the S7Comm-plus protocol message. Specifically, the processor can determine whether the access time of the S7Comm-plus protocol message is within a preset validity time range. The preset validity time range can be configured by a user based on actual conditions. In a case where the access time of the S7Comm-plus protocol message is within the preset validity time range, the processor can determine that the S7Comm-plus protocol message passes the validity time check. In a case where the access time of the S7Comm-plus protocol message is not within the preset validity time range, the processor can determine that the S7Comm-plus protocol message fails the validity time check.

[0049] The processor can determine whether the current access of the S7Comm-plus protocol message reaches a preset access quantity upper limit. The preset access quantity upper limit can be determined based on actual conditions. In a case where the current access of the S7Comm-plus protocol message does not reach the preset access quantity upper limit, the processor can determine that the S7Comm-plus protocol message passes the access object quantity check. In a case where the current access of the S7Comm-plus protocol message reaches the preset access quantity upper limit, the processor can determine that the S7Comm-plus protocol message fails the access object quantity check.

[0050] The processor can determine whether the message address of the S7Comm-plus protocol message is within a preset address list. The preset address list can be determined based on actual conditions. In a case where the message address of the S7Comm-plus protocol message is within the preset address list, the processor can determine that the S7Comm-plus protocol message passes the access object address check. In a case where the message address of the S7Comm-plus protocol message is not within the preset address list, the processor can determine that the S7Comm-plus protocol message fails the access object address check.

[0051] Step 105: sending the processed S7Comm-plus protocol message to the device end.

[0052] Step 106: receiving response data returned by the device end.

[0053] Step 107: sending the processed response data to the client end.

[0054] After receiving the processed S7Comm-plus protocol message, the processor can send it to the device. In one specific embodiment, the device can be a PLC. After sending the processed S7Comm-plus protocol message to the device, the processor can receive the response data returned by the device and process it. The processor can then send the processed response data to the client to enable data interaction between the client and the device.

[0055] In this embodiment of the application, sending the processed response data to the client includes: decrypting the response data using a national cryptographic algorithm; and sending the decrypted response data to the client, wherein the response data is the response returned by the device in response to the processed S7Comm-plus protocol message.

[0056] The processor can send the processed response data to the client. Specifically, when the S7Comm-plus protocol message is a request message, the processor can send the processed S7Comm-plus protocol message to the device and receive the response data returned by the device based on the processed S7Comm-plus protocol message. After receiving the returned response data, the processor can decrypt the response data using a national cryptographic algorithm to obtain the decrypted response data. After obtaining the decrypted response data, the processor can send the decrypted response data to the client.

[0057] In the embodiments of this application, such as Figure 2 As shown, the client can send S7Comm-plus protocol messages, which may contain read / write operation instructions for the PLC device. Upon receiving an S7Comm-plus protocol message, the industrial control firewall (corresponding to the processor mentioned above) can identify whether it is an S7Comm-plus protocol. If it is determined not to be an S7Comm-plus protocol, the industrial control firewall can process it. If it is an S7Comm-plus protocol, the industrial control firewall can further determine whether the S7Comm-plus protocol message is a connection establishment request or a read / write function code request.

[0058] In the case of determining the request of establishing a connection, the industrial control firewall can perform message encryption processing. Specifically, the industrial control firewall can extract the creatObject part, which includes device firmware version, device model, general protocol, and other sensitive information. After extracting the creatObject, the industrial control firewall can encrypt the creatObject using SM4 (a block cipher algorithm, a national secret algorithm) to obtain the encrypted creatObject. After obtaining the encrypted creatObject, the industrial control firewall can replace the original creatObject in the S7Comm-plus protocol message with the encrypted creatObject to perform message reorganization and obtain the reorganized S7Comm-plus protocol message. After obtaining the reorganized S7Comm-plus protocol message, the industrial control firewall can send the reorganized S7Comm-plus protocol message to the PLC device and receive the response data returned by the PLC device. After receiving the response data returned by the PLC device, the industrial control firewall can perform decryption processing on the response data and send the processed response data to the client to realize data interaction between the client and the PLC device and improve the confidentiality and security of the device information.

[0059] In the case of determining the read-write function code request, the industrial control firewall can check the validity time, check the request source IP address, and check the number of access objects of the S7Comm-plus protocol message. The validity time check refers to whether the validity time of the S7Comm-plus protocol message is within the set range, the request source IP address check refers to whether the address of the S7Comm-plus protocol message is within the allowed IP address list, and the access object number check refers to whether the current access of the S7Comm-plus protocol message reaches the access limit of the PLC device. In the case where the S7Comm-plus protocol message passes the validity time, request source IP address, and access object number checks, the industrial control firewall sends the S7Comm-plus protocol message to the PLC device, receives the response data returned by the PLC device, and sends the response data to the client, thereby improving the controllability and precise management capability of the PLC device access, effectively preventing illegal access and malicious control, and improving the access security.

[0060] Through the above technical solution, the confidentiality and security of the data are improved, illegal access and malicious control are effectively prevented, and the security of data interaction is improved.

[0061] Figure 1 and Figure 2 is a flowchart of a data interaction method in one embodiment. It should be understood that although Figure 1 and Figure 2The steps in the flowcharts are displayed in sequence according to the arrows, but the steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, the steps are not strictly limited in sequence, and the steps can be executed in other orders. Moreover, Figure 1 And Figure 2 At least part of the steps in the flowcharts can include multiple sub-steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of the sub-steps or stages is not necessarily sequential, but can be alternately executed with other steps or at least part of the sub-steps or stages of other steps.

[0062] Embodiments of the present application also provide a data interaction device, comprising:

[0063] a memory configured to store instructions;

[0064] a processor configured to call the instructions from the memory and capable of implementing the above-mentioned data interaction method when executing the instructions.

[0065] Embodiments of the present application also provide a machine-readable storage medium having instructions stored thereon for causing a machine to execute the above-mentioned data interaction method.

[0066] Embodiments of the present application also provide a computer program product comprising a computer program, which, when executed by a processor, implements the above-mentioned data interaction method.

[0067] In one embodiment, a computer device, which can be a server, is provided, and an internal structure diagram of the computer device can be as shown in Figure 3 The computer device includes a processor A01, a network interface A02, a memory (not shown in the figure) and a database (not shown in the figure) connected through a system bus. Among them, the processor A01 of the computer device is used to provide computing and control capabilities. The memory of the computer device includes an internal memory A03 and a non-volatile storage medium A04. The non-volatile storage medium A04 stores an operating system B01, a computer program B02 and a database (not shown in the figure). The internal memory A03 provides an environment for the operating system B01 and the computer program B02 in the non-volatile storage medium A04 to run. The database of the computer device is used to store S7Comm-plus protocol messages, message types, response data and other data. The network interface A02 of the computer device is used to communicate with external terminals through network connection. The computer program B02 is executed by the processor A01 to implement a data interaction method.

[0068] Those skilled in the art can understand, Figure 3The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0069] The embodiment of the present application provides a device, which comprises a processor, a memory, and a program stored on the memory and executable on the processor, and the processor implements the following steps when executing the program: receiving an S7Comm-plus protocol packet sent by a client; determining a packet type of the S7Comm-plus protocol packet; determining a processing mode of the S7Comm-plus protocol packet according to the packet type, the processing mode comprising packet encryption and security attribute checking; processing the S7Comm-plus protocol packet based on the processing mode to obtain a processed S7Comm-plus protocol packet; sending the processed S7Comm-plus protocol packet to a device end; receiving response data returned by the device end; and sending the processed response data to the client.

[0070] In one embodiment, the packet type comprises a request packet for establishing a connection, and in the case that the packet type of the S7Comm-plus protocol packet is the request packet, the processing mode is determined to be packet encryption, and processing the S7Comm-plus protocol packet based on the packet encryption comprises: extracting creatobject in the S7Comm-plus protocol packet; generating an encryption key by using a national secret algorithm; converting sensitive information in the creatobject into ciphertext based on the encryption key to obtain encrypted creatobject; and replacing the creatobject in the S7Comm-plus protocol packet with the encrypted creatobject to obtain the processed S7Comm-plus protocol packet.

[0071] In one embodiment, sending the processed response data to the client comprises: decrypting the response data by using the national secret algorithm; and sending the decrypted response data to the client, wherein the response data is returned by the device end in response to the processed S7Comm-plus protocol packet.

[0072] In an embodiment, the message type includes a read-write function code message, the processing mode is determined to be the security attribute check in a case where the message type of the S7Comm-plus protocol message is the read-write function code message, and the S7Comm-plus protocol message is processed based on the security attribute check includes: performing a validity time check, an access object quantity check, and an access object address check on the S7Comm-plus protocol message; and determining that the S7Comm-plus protocol message is a processed S7Comm-plus protocol message in a case where the S7Comm-plus protocol message passes the validity time check, the access object quantity check, and the access object address check.

[0073] In an embodiment, the method further includes: rejecting the read-write function request carried by the S7Comm-plus protocol message in a case where the S7Comm-plus protocol message fails any one of the validity time check, the access object quantity check, and the access object address check.

[0074] In an embodiment, the performing the validity time check, the access object quantity check, and the access object address check on the S7Comm-plus protocol message includes: determining whether an access time of the S7Comm-plus protocol message is within a preset validity time range; determining that the S7Comm-plus protocol message passes the validity time check in a case where the access time of the S7Comm-plus protocol message is within the preset validity time range; determining that the S7Comm-plus protocol message fails the validity time check in a case where the access time of the S7Comm-plus protocol message is not within the preset validity time range; determining whether a current access of the S7Comm-plus protocol message reaches a preset access quantity upper limit; determining that the S7Comm-plus protocol message passes the access object quantity check in a case where the current access of the S7Comm-plus protocol message does not reach the preset access quantity upper limit; determining that the S7Comm-plus protocol message fails the access object quantity check in a case where the current access of the S7Comm-plus protocol message reaches the preset access quantity upper limit; determining whether a message address of the S7Comm-plus protocol message is within a preset address list; determining that the S7Comm-plus protocol message passes the access object address check in a case where the message address of the S7Comm-plus protocol message is within the preset address list; and determining that the S7Comm-plus protocol message fails the access object address check in a case where the message address of the S7Comm-plus protocol message is not within the preset address list.

[0075] In one embodiment, determining the message type of the S7Comm-plus protocol message comprises: parsing a message header of the S7Comm-plus protocol message to determine whether the message header contains a flag indicating that the message type of the S7Comm-plus protocol message is a request message for establishing a connection; in a case where the message header contains the flag indicating that the message type of the S7Comm-plus protocol message is the request message, determining that the message type of the S7Comm-plus protocol message is the request message; and in a case where the message header does not contain the flag indicating that the message type of the S7Comm-plus protocol message is the request message, checking a function code field of the S7Comm-plus protocol message to determine whether a field value of the function code field matches a history read-write function code; and in a case where the field value of the function code field matches the history read-write function code, determining that the message type of the S7Comm-plus protocol message is a read-write function code message.

[0076] The application further provides a computer program product adapted to execute the steps of the method for initializing data interaction when executed on a data processing device.

[0077] Those skilled in the art will understand that the embodiments of the present application can be provided as a method, a system or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage etc.) containing computer-usable program code.

[0078] The present application is described with reference to flowcharts and / or block diagrams of the method, device (system), computer program product according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in a flow or multiple flows and / or blocks Figure 1 The functions specified in a flow or multiple flows and / or blocks

[0079] These computer program instructions can also be stored in a computer-readable memory capable of guiding a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a product comprising instruction means, which realizes the functions specified in the flowcharts and / or block diagrams. Figure 1one or more processes and / or blocks Figure 1 the function(s) specified in the block or blocks.

[0080] These computer program instructions can also be loaded into computer or other programmable data processing devices to cause a series of operational steps to be performed on the computer or other programmable devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable devices provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more processes and / or blocks Figure 1 the function(s) specified in the block or blocks.

[0081] In one typical configuration, the computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0082] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) about which the computer stores information about the operating environment. The memory can also include non-volatile memory, such as read only memory (ROM), EPROM, EEPROM, or flash memory, about which the computer stores information, such as firmware for graphics processing. Examples of computer-readable media include but are not limited to phase-change RAM, static RAM, dynamic RAM, other types of random access memory, read-only memory, programmable ROM, erasable programmable ROM, electrically erasable programmable ROM, flash memory, or other memory technology, compact discs, digital versatile discs, or other optical storage, magnetic cassettes, magnetic tapes, magnetic disk storage, or other magnetic storage devices, or any other non-transmission medium that can be used to store information for access by a computing device. In accordance with the teachings herein, computer-readable media does not include transitory media, such as modulated data signals and carrier waves.

[0083] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology for storing information. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact discs, digital versatile discs (DVD) or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device, or any other non-transmission medium that can be used to store information that can be accessed by a computing device. According to the definition herein, computer-readable media does not include transitory media, such as modulated data signals and carrier waves.

[0084] It should also be noted that the terms "comprising", "including", or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article or apparatus that comprises a list of elements does not include only those elements recited, but can also include other elements not expressly listed or inherent to such process, method, article or apparatus. Without further limitation, an element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus including the element.

[0085] The above merely provides an example of the present application, but is not intended to limit the present application. The present application can have various modifications and changes for those skilled in the art. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present application shall be included in the scope of claims of the present application.

Claims

1. A data interaction method, characterized in that, The method includes: Receive S7Comm-plus protocol messages sent by the client; Determine the message type of the S7Comm-plus protocol message, the message type including request messages for establishing a connection and read / write function code messages; The processing method for the S7Comm-plus protocol message is determined based on the message type, and the processing method includes message encryption and security attribute checking; The S7Comm-plus protocol message is processed according to the aforementioned processing method to obtain the processed S7Comm-plus protocol message; The processed S7Comm-plus protocol message is sent to the device. Receive response data returned by the device; The processed response data is sent to the client. The process of determining the message type of the S7Comm-plus protocol message includes: parsing the message header of the S7Comm-plus protocol message to determine whether the message header contains a flag indicating that the message type of the S7Comm-plus protocol message is a request message for establishing a connection; if the message header contains a flag indicating that the message type of the S7Comm-plus protocol message is the request message, then the message type of the S7Comm-plus protocol message is determined to be the request message; if the message header does not contain a flag indicating that the message type of the S7Comm-plus protocol message is the request message, then the function code field of the S7Comm-plus protocol message is checked to determine whether the field value of the function code field matches a historical read / write function code; if the field value of the function code field matches a historical read / write function code, then the message type of the S7Comm-plus protocol message is determined to be a read / write function code message. The step of determining the processing method for the S7Comm-plus protocol message based on the message type includes: when the message type of the S7Comm-plus protocol message is the request message, determining the processing method as message encryption; and when the message type of the S7Comm-plus protocol message is the read / write function code message, determining the processing method as security attribute check.

2. The data interaction method according to claim 1, characterized in that, The encryption processing of the S7Comm-plus protocol message based on the aforementioned message includes: Extract the creatobject from the S7Comm-plus protocol message; Use the national cryptographic algorithm to generate the encryption key; Based on the encryption key, the sensitive information in the createdobject is converted into ciphertext to obtain the encrypted createdobject; Replace the creatobject in the S7Comm-plus protocol message with the encrypted creatobject to obtain the processed S7Comm-plus protocol message.

3. The data interaction method according to claim 2, characterized in that, Sending the processed response data to the client includes: The response data is decrypted using the aforementioned national cryptographic algorithm; The decrypted response data is sent to the client, wherein the response data is the response returned by the device in response to the processed S7Comm-plus protocol message.

4. The data interaction method according to claim 1, characterized in that, The processing of the S7Comm-plus protocol message based on the aforementioned security attributes includes: The S7Comm-plus protocol message is checked for validity time, number of accessed objects, and address of accessed objects. If all S7Comm-plus protocol messages pass the validity time check, the number of accessed objects check, and the address check of the accessed objects, then the S7Comm-plus protocol message is determined to be the processed S7Comm-plus protocol message.

5. The data interaction method according to claim 4, characterized in that, The method further includes: If the S7Comm-plus protocol message fails any one of the validity time check, the number of accessed objects check, and the address check of the accessed objects, the read / write function request carried by the S7Comm-plus protocol message is rejected.

6. The data interaction method according to claim 4, characterized in that, The process of checking the effective time, the number of accessed objects, and the address of the accessed objects in the S7Comm-plus protocol message includes: Determine whether the access time of the S7Comm-plus protocol message is within the preset effective time range; If the access time of the S7Comm-plus protocol message is within the preset effective time range, it is determined that the S7Comm-plus protocol message passes the effective time check. If the access time of the S7Comm-plus protocol message is not within the preset effective time range, it is determined that the S7Comm-plus protocol message has failed the effective time check. Determine whether the current access to the S7Comm-plus protocol message has reached the preset access limit; If the current access of the S7Comm-plus protocol message has not reached the preset access limit, it is determined that the S7Comm-plus protocol message has passed the access object count check. If the current access to the S7Comm-plus protocol message reaches the preset access limit, it is determined that the S7Comm-plus protocol message has failed the access object count check. Determine whether the message address of the S7Comm-plus protocol message is within a preset address list; If the message address of the S7Comm-plus protocol message is within the preset address list, it is determined that the S7Comm-plus protocol message passes the access object address check. If the message address of the S7Comm-plus protocol message is not in the preset address list, it is determined that the S7Comm-plus protocol message has failed the access object address check.

7. A data interaction device, characterized in that, include: The memory is configured to store instructions; A processor is configured to retrieve the instructions from the memory and, when executing the instructions, to implement the data interaction method according to any one of claims 1 to 6.

8. A machine-readable storage medium, characterized in that, The machine-readable storage medium stores instructions for causing the machine to perform the data interaction method according to any one of claims 1 to 6.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the data interaction method according to any one of claims 1 to 6.

Images