Message detection method and apparatus, and security device

Abstract

The invention relates to the technical field of network security, and discloses a message detection method and device, and security equipment. The method comprises the following steps: receiving a current message transmitted between a client and a server; detecting whether the current message is an RSSP-I message or not; when it is detected that the current message is the RSSP-I message, determining whether the current message is abnormal or not according to the message type of the current message and the historical message record of the security device; the historical message record is used for recording historical RSSP-I messages transmitted between the client and the server. According to the embodiment of the invention, the RSSP-I message can be accurately detected by using the safety equipment, and the abnormal RSSP-I message can be effectively identified.

Description

Technical Field

[0001] The present application relates to the technical field of network security, and in particular to a message detection method and device, and a security device. Background Art

[0002] The railway system is an important link between cities and people. In order to ensure the safe and punctual operation of trains, the railway system relies on a special communication protocol RSSP-I (Railway Signal Safety Protocol-I), which is responsible for transmitting key information between trains and ground control centers.

[0003] Security devices such as firewalls can defend against threats from outside the network by identifying network traffic to detect abnormal patterns or atypical communication behavior, thereby discovering complex attacks or new vulnerabilities in protocols.

[0004] Therefore, although the RSSP-I protocol provides necessary security checks for network traffic, it is still necessary to use the firewall's ability to identify and filter network traffic to provide an additional security guarantee for the railway signal communication system, thereby helping to improve the security of the entire track network and its ability to resist complex attacks.

[0005] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present application, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0006] In order to provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. The summary is not an extensive review, nor is it intended to identify key / critical components or delineate the scope of protection of these embodiments, but rather serves as a prelude to the detailed description that follows.

[0007] The embodiments of the present application provide a message detection method and apparatus, and a security device to effectively identify abnormal RSSP-I messages.

[0008] An embodiment of the present application provides a message detection method, which is applied to a security device, including: receiving a current message transmitted between a client and a server; detecting whether the current message is an RSSP-I message; when detecting that the current message is an RSSP-I message, determining whether the current message is abnormal based on the message type of the current message and a historical message record of the security device; the historical message record is used to record historical RSSP-I messages transmitted between the client and the server.

[0009] In the above implementation, when it is detected that the current message transmitted between the client and the server is an RSSP-I message, it is possible to determine whether the currently received RSSP-I message and the historical message conform to the normal interaction logic through the message type of the current message and the historical message record of the safety device. By performing message identification in this manner, it is possible to effectively identify the current message with abnormalities. At the same time, for the message transmitted from the ground control center to the terminal device (such as a train), before the message is transmitted to the terminal device, the current message is identified as abnormal by the safety device, rather than by the terminal device (such as a train), which can reduce the computing burden of the terminal device.

[0010] In some embodiments, the historical message record includes: a sequence number table entry, a timestamp table entry, and an SSE message record cache table; when it is detected that the current message is an RSSP-I message, determining whether the current message is abnormal based on the message type of the current message and the historical message record of the security device, including: if the current message is an RSD type message, then when the RSD message sequence number is recorded in the historical message record, determining whether the SSE type historical message is recorded in the SSE message record cache table; if there is a record, determining that the current message is abnormal; if there is no record, determining whether the current message is abnormal based on the sequence number of the current message, the timestamp of the current message, the RSD message sequence number in the sequence number table entry, and the RSD message timestamp in the timestamp table entry, wherein the RSD message timestamp is generated by the transport layer.

[0011] In the above implementation, when there are SSE type historical messages recorded in the SSE message record cache table, it reflects that the communication between the client and the server needs to be timed and corrected, that is, the communication process is abnormal, and the received RSD type message will be considered abnormal. If there are no SSE type historical messages recorded in the SSE message record cache table, the communication process is normal at this time, and the current message is judged to be abnormal according to the interaction logic between the RSD type message and the previously received RSD type historical message. In this way, by first judging the records of the SSE message record cache table, some abnormal RSD type messages can be directly excluded, reducing the RSD type messages that need to be compared with the RSD type historical messages, thereby saving the computing resources of the security device.

[0012] In some embodiments, determining whether the current message is abnormal is based on the sequence number of the current message, the timestamp of the current message, the RSD message sequence number in the sequence number table entry, and the RSD message timestamp in the timestamp table entry, including: determining whether the sequence number of the current message is consistent with the RSD message sequence number most recently recorded in the sequence number table entry; if consistent, determining whether the current message is abnormal based on the time interval between the timestamp of the current message and the RSD message timestamp most recently recorded in the timestamp table entry; if inconsistent, determining that the current message is normal if the sequence number of the current message increases compared to the RSD message sequence number most recently recorded in the sequence number table entry, and the timestamp of the current message increases compared to the RSD message timestamp most recently recorded in the timestamp table entry; otherwise, determining that the current message is abnormal.

[0013] In the above implementation, whether the sequence number of the current message is consistent with the latest RSD message sequence number recorded in the sequence number table item can reflect whether the current message and the historical message belong to the same period of messages. According to whether the message belongs to the same period, different judgment methods can be used to make targeted judgments on the current message, thereby improving the accuracy of judging whether the current message is abnormal.

[0014] In some embodiments, the historical message record includes: a sequence number table entry, a timestamp table entry, and an SSE message record cache table; when it is detected that the current message is an RSSP-I message, determining whether the current message is abnormal based on the message type of the current message and the historical message record of the security device, including: if the current message is an SSE type message, determining whether there are SSE type historical messages recorded in the SSE message record cache table; if there are SSE type historical messages recorded in the SSE message record cache table, determining that the current message is abnormal; if there are no SSE type historical messages recorded in the SSE message record cache table, recording the message information of the current message in the SSE message record cache table, and clearing the sequence number table entry and the timestamp table entry.

[0015] In the above implementation, there is no SSE type historical message recorded in the SSE message record cache table, and it can be determined that the current message is the first SSE type message received in the current cycle, that is, the communication process is abnormal at this time, and the current SSE type message in the SSE message record cache table will be recorded at this time. In addition, by clearing the sequence number table entry and the timestamp table entry, it can make the subsequent judgment whether the RSD type message is abnormal more accurate.

[0016] In some embodiments, the message detection method also includes: when a message to be compared is obtained within a preset time length after recording the current message, setting the message information of the current message in the SSE message record cache table to invalid; the message to be compared is an SSR type message received after the current message; and determining whether the current message is abnormal based on the requester sequence number of the message to be compared and the requester sequence number of the current message.

[0017] In the above implementation, if an SSR type message consistent with the requester sequence number of the SSE type message is received after the current message, it reflects that the abnormal timing has been corrected at this time, that is, the communication process has returned to normal at this time. By clearing the SSE message record cache table and updating the information of the SSE message record cache table in time, it is easier to judge whether the subsequently received RSD type message is abnormal and more accurate.

[0018] In some embodiments, the historical message record includes: an SSE message record cache table; the SSE message record cache table is used to record SSE type historical messages, the requester sequence number of the SSE type historical messages and the corresponding reception time of the SSE type historical messages; when it is detected that the current message is an RSSP-I message, according to the message type of the current message and the historical message record of the security device, it is determined whether the current message is abnormal, including: if the current message is an SSR type message, then the SSE type historical message is recorded in the SSE message record cache table, and the current message is received within the current preset time after receiving the SSE type historical message, according to the requester sequence number of the SSE type historical message and the requester sequence number of the current message, it is determined whether the current message is abnormal; otherwise, it is determined that the current message is abnormal.

[0019] In the above implementation, through the interaction logic between the SSE type historical message and the SSR type current message, it is possible to accurately reflect whether the SSR type message is abnormal.

[0020] In some embodiments, detecting whether the current message is an RSSP-I message includes: upon detecting that the current message meets the RSSP-I message format requirements, obtaining a first historical message, wherein the first historical message is a historical message that meets the RSSP-I message format requirements and is most recently detected by the security device before the current message; comparing the message header content of the current message with the message header content of the first historical message to determine whether the current message is an RSSP-I message.

[0021] In the above implementation, the features that can be extracted from a single message are relatively few, and it is not possible to accurately identify whether the current message belongs to the RSSP protocol based only on the current message. By using the message header contents of two messages that are continuously received and meet the requirements of the RSSP-I message format, more features and associations between the features can be obtained, thereby accurately identifying whether the current message belongs to the RSSP-I message.

[0022] In some embodiments, based on the message type of the current message and the historical message records of the security device, it includes: verifying the current message using the message tail of the current message according to a set verification method; if the verification fails, determining that the current message is abnormal; if the verification succeeds, determining whether the current message is abnormal based on the information of the current message and the historical message records of the security device.

[0023] It can be understood that in order to determine whether there will be a transmission error in the current message during transmission, verification data is usually added to the current message. If the verification of the current message fails, that is, the current message has an abnormality during transmission, there is no need to verify whether the current message is abnormal again. Only judging the current message that is transmitted normally can reduce the calculation amount of the security device.

[0024] In some embodiments, the message detection method also includes: for the current message determined to be normal, when the message header content of the current message does not match the preset whitelist, or the message header content of the current message matches the preset blacklist, performing a preset protection action on the current message.

[0025] In the above implementation, by matching the message header content with the blacklist and the whitelist, it is possible to detect whether the current message is abnormal from the content of the current message itself. In this way, by combining the interaction logic of the current message of the RSSP-I protocol and the content of the current message itself, it is possible to more accurately identify and protect the current message from abnormalities.

[0026] An embodiment of the present application provides a message detection device, which is applied to a security device, including: a receiving module, used to receive a current message transmitted between a client and a server; a detection module, used to detect whether the current message is an RSSP-I message; a determination module, used to determine whether the current message is abnormal based on the message type of the current message and the historical message record of the security device when detecting that the current message is an RSSP-I message; the historical message record is used to record the historical RSSP-I messages transmitted between the client and the server.

[0027] An embodiment of the present application provides an electronic device, including a processor and a memory, wherein the memory stores computer-executable instructions that can be executed by the processor, and the processor executes the computer-executable instructions to implement the above-mentioned message detection method.

[0028] The above general description and the following description are exemplary and explanatory only and are not intended to limit the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] One or more embodiments are exemplarily described by corresponding drawings, which do not limit the embodiments. Elements with the same reference numerals in the drawings are shown as similar elements, and the drawings do not constitute a scale limitation, and wherein:

[0030] Figure 1 It is a schematic diagram of a RSSP-I message structure provided in an embodiment of the present application;

[0031] Figure 2 It is a schematic diagram of RSSP-I protocol message interaction provided by an embodiment of the present application;

[0032] Figure 3 is a schematic diagram of a device interaction provided by an embodiment of the present application;

[0033] Figure 4 It is a schematic diagram of a message detection method provided in an embodiment of the present application;

[0034] Figure 5 It is a schematic diagram of another message detection method provided in an embodiment of the present application;

[0035] Figure 6 is a schematic diagram of a message detection device provided in an embodiment of the present application;

[0036] Figure 7 It is a schematic diagram of a safety device provided in an embodiment of the present application.

[0037] Reference numerals:

[0038] 1: security device; 2: client; 3: server; 4: processor; 5: communication interface; 6: bus; 7: memory; 61: receiving module; 62: detection module; 63: determination module. DETAILED DESCRIPTION

[0039] In order to be able to understand the features and technical contents of the embodiments of the present application in more detail, the implementation of the embodiments of the present application is described in detail below in conjunction with the accompanying drawings. The attached drawings are for reference only and are not used to limit the embodiments of the present application. In the following technical description, for the convenience of explanation, a full understanding of the disclosed embodiments is provided through multiple details. However, one or more embodiments can still be implemented without these details. In other cases, to simplify the drawings, well-known structures and devices can be simplified for display.

[0040] The terms "first", "second", etc. in the specification and claims of the embodiments of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the embodiments of the present application described here. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions.

[0041] Unless otherwise stated, the term "plurality" means two or more.

[0042] The term "correspondence" may refer to an association relationship or a binding relationship. The correspondence between A and B means that there is an association relationship or a binding relationship between A and B.

[0043] Combination Figure 1 As shown in FIG. 1 , the message structure of RSSP-I includes: a message header, a security check field, a user data packet and a message tail. Among them, the multi-byte fields in the user data packet need to be arranged in the order required by the specific application specification; the multi-byte fields in other messages are arranged in the little-endian order, that is, the low byte is arranged first. The message tail needs to be generated according to the message header, the security check field and the user data packet using the set check method. The set check method, for example: CRC (cyclic redundancy check) 16, CRC32, etc.

[0044] It can be understood that RSSP-I uses the following three types of messages in secure communication interactions: RSD (Real-time Security Data) type messages, SSE (Timing Correction Request) type messages, and SSR (Timing Correction Reply) type messages. Among them, the purpose of the RSD type message is to transmit secure user data packets, and its total length is less than or equal to 546 bytes. The purpose of the SSE type message is the timing correction request initiated by the receiving end to the sending end when a reception timing error occurs. Its total length is 20 bytes, and there is no user data packet. The purpose of the SSR type message is a feedback message in which the sending end responds to the timing correction request from the receiving end. Its total length is 20 bytes, and there is no user data packet.

[0045] Exemplarily, the format of the RSD type message is shown in Table 1. The message structure of the RSD type message includes: a message header, a security check field, a user data packet, and a message tail CRC16. Among them, the message tail CRC16 indicates that the message tail is generated by calculating the message header, the security check field and the user data packet through the CRC16 check method. In Table 1, when 0x01 in the protocol interaction category field indicates that the receiving end must wait for the synchronization time to be correct before determining that the frame is valid, it is applicable to the security data sent by the host; when 0x02 indicates that the receiving end does not need to perform a synchronization check to determine that the frame is a valid frame, it is applicable to the security data sent by the standby machine. Among them, the synchronization check means that the receiving end does not trigger the SSE frame.

[0046]

[0047]

[0048] When the receiving end detects that the timing of the current security data message has exceeded the predetermined tolerance range, it needs to send an SSE type message to the sending end to request timing synchronization correction. The format of the SSE type message is shown in Table 2. The message structure of the SSE type message includes: message header, security check field and message tail CRC16.

[0049] Table 2:

[0050]

[0051]

[0052] The SSR type message is used to respond to the SSE type message. The format of the SSR type message is shown in Table 3. The message structure of the SSR type message includes: message header, security check field and message tail CRC16.

[0053] Table 3:

[0054]

[0055]

[0056] During the transmission of the current message, the current message will be timestamped. The timestamp is based on a 32-bit linear feedback shift register value, with an initial value of T(0) = SID, shifted according to the system cycle and using a fixed polynomial as an additional interference input. The timestamp is incremented synchronously with the local cycle counter. The parameter configuration used in the security verification channel is shown in Table 4. Table 4 is an example table of formula parameters for the security communication channel.

[0057] Table 4:

[0058] Channel Number CRC32 Generator Polynomial SCW Constants Timestamp Generator Polynomial 1 100D4E63 AE390B5A 0FC22F87 2 8CE56011 C103589C C3E887E1

[0059] In the above table, SID_1 and SID_2 are communication source identifiers, and each channel has a predetermined marking parameter. E )、T_2(N E )、T_1(N R )、T_2(N R ) is the timestamp of the communication party at the Nth cycle. Each channel has a real-time calculated value parameter. SCW_1 and SCW_2 are system check words. DATAVER_1 and DATAVER_2 are data versions.

[0060] Combination Figure 2 As shown, Figure 2 The RSSP-I protocol safety data interaction principle between the transmitter and the receiver is described: Referring to the interaction process between the transmitter B (e.g., the ground control center) and the receiver A (e.g., the train): the receiver detects the timing of the RSD type message from the transmitter in real time. If there is a timing error, the timing correction mechanism is triggered, and the RSD type message is accepted only after the timing correction is restored. Referring to the interaction process between the transmitter B and the receiver C: If the timing is normal, only one direction needs to send the RSD type message in real time, and there is no need to trigger the SSE type message and the SSR type message. When multiple messages are sent from the ground control center to the train in the same cycle (or, when multiple messages are sent from the train to the ground control center in the same cycle), the following requirements must be observed: The time interval between two consecutive frames in the same cycle shall not be less than 5 milliseconds, so that the receiver can identify different complete messages. Multiple messages in the same cycle must use the same sequence number to identify data sent in the same cycle.

[0061] Combination Figure 3 As shown, the message detection method provided by the present application is applied to a security device 1, and the security device 1 is used to detect messages transmitted between a client 2 (e.g., a train) and a server 3 (e.g., a ground control center). The security device 1 identifies abnormalities in the current message, releases normal messages, and intercepts abnormal messages. Among them, the server 3 can be a server of the ground control center.

[0062] Embodiment 1

[0063] The present application provides a message detection method. Figure 4 As shown, Figure 4 A basic flow chart of the message detection method provided in the embodiment of the present application includes:

[0064] Step S101, receiving a current message transmitted between a client and a server.

[0065] The method provided in this embodiment is applied to security devices. For example, the security device may be a border security device, including but not limited to a network traffic border security device, a network data forwarding device, a network traffic analysis device, a network traffic management device, such as FW / NGFW, IDS / IPS, WAF, ADC, BDS, etc. Alternatively, the security device may also be a virtualized border security device, including but not limited to a virtualized network traffic border security device, a virtualized network data forwarding device, a virtualized network traffic analysis device, a virtualized network traffic management device, etc.

[0066] The security device is deployed between the client and the server, and the current message may be a message sent from the client to the server, or may be a message sent from the server to the client.

[0067] Step S102, detecting whether the current message is an RSSP-I message.

[0068] In some embodiments, the messages received by the security device may be recorded through a preset message database. Exemplarily, when a message is received, the message is recorded in the message database in the order in which the message is received. The content of the message and the sender of the message may be recorded.

[0069] In some embodiments, the above step S102 may include:

[0070] When it is detected that the current message meets the RSSP-I message format requirements, a first historical message is obtained, wherein the first historical message is a historical message that meets the RSSP-I message format requirements and is most recently detected by the security device before the current message; the message header content of the current message is compared with the message header content of the first historical message to determine whether the current message is an RSSP-I message.

[0071] In an optional manner of the above embodiment, detecting whether the current message complies with the RSSP-I message format requirement according to the message header of the current message may be: determining whether the fillable fields in the message header of the current message comply with the RSSP-I message format requirement.

[0072] For any historical message, detecting whether the historical message complies with the RSSP-I message format requirement according to the message header of the historical message may include: determining whether the fillable fields in the message header of the historical message comply with the RSSP-I message format requirement.

[0073] In some examples, comparing the message header content of the current message with the message header content of the first historical message to determine whether the current message is an RSSP-I message may include: when a first fillable field in the message header of the current message and a second fillable field in the message header of the first historical message are completely consistent, determining that the current message is an RSSP-I message.

[0074] In the above optional manner, the fields that can be filled include: protocol interaction class, message type, source address and destination address (also called: destination address), wherein the protocol interaction class is 1-byte data, the message type is 1-byte data, the source address is 2-byte data, and the destination address is 2-byte data.

[0075] In some examples, for the current message and the first historical message, the first 6 bytes of data of the two messages are respectively extracted. If the first 6 bytes of data of the two messages are completely consistent, it is determined that the current message is an RSSP-I message.

[0076] In some examples, for the current message and the first historical message, the source address in the message header of the current message is opposite to the source address in the message header of the first historical message, and the destination address in the message header of the current message is opposite to the destination address in the message header of the first historical message, and the current message is determined to be an RSSP-I message.

[0077] The source address is usually located at bytes 3-4, and the destination address is usually located at bytes 5-6. That is, the contents of bytes 3-4 of the two historical current messages can be compared to see if they are opposite, and the contents of bytes 5-6 of the two historical current messages can be compared to see if they are opposite.

[0078] It is understandable that the specific content in the message header of the historical current message can be extracted by regular expressions. For example, fillable fields can be extracted by regular expressions, and source addresses and destination addresses can also be extracted by regular expressions.

[0079] It is worth noting that, in the case of no conflict, the above-mentioned multiple ways can be combined to identify whether the current message received by the security device belongs to the RSSP-I protocol message. When the above-mentioned condition that the current message belongs to the RSSP-I protocol is not met, it is determined that the current message does not belong to the RSSP-I protocol.

[0080] Step S103: When it is detected that the current message is an RSSP-I message, it is determined whether the current message is abnormal according to the message type of the current message and the historical message record of the security device.

[0081] The historical message record is used to record the historical RSSP-I messages transmitted between the client and the server.

[0082] Among them, the historical message records include: a sequence number table entry, a timestamp table entry, and an SSE message record cache table; the sequence number table entry is used to record the RSD message sequence number of the RSD type historical message; the timestamp table entry is used to record the RSD message timestamp of the RSD type historical message; the SSE message record cache table is used to record the SSE type historical message.

[0083] The message detection method provided in the embodiment of the present application can determine whether the currently received RSSP-I message and the historical message conform to the normal interaction logic by using the message type of the current message and the historical message record of the safety device when the current message transmitted between the client and the server is detected to be an RSSP-I message. By performing message identification in this way, the current message with abnormalities can be effectively identified. At the same time, for the message transmitted from the ground control center to the terminal device (such as a train), before the message is transmitted to the terminal device, the current message is identified as abnormal by the safety device, rather than by the terminal device (such as a train), which can reduce the computing burden of the terminal device.

[0084] In some embodiments, before determining whether the current message is abnormal based on the message type of the current message and the historical message records of the security device in step S103, it may also include: verifying the current message using the message tail of the current message according to a set verification method; if the verification fails, determining that the current message is abnormal; if the verification succeeds, determining whether the current message is abnormal based on the message type of the current message and the historical message records.

[0085] Exemplarily, the verification method used by the current message is CRC16, and the message tail is used for verification according to the verification rule of CRC16.

[0086] In some embodiments, the historical message record includes: a sequence number table entry, a timestamp table entry, and an SSE message record cache table; step S103 may include:

[0087] If the current message is an RSD type message, then if the RSD message sequence number is recorded in the historical message record, determine whether the SSE type historical message is recorded in the SSE message record cache table; if there is a record, determine that the current message is abnormal;

[0088] In the absence of records, determine whether the current message is abnormal based on the sequence number of the current message, the timestamp of the current message, the RSD message sequence number in the sequence number table entry, and the RSD message timestamp in the timestamp table entry, where the RSD message timestamp is generated by the transport layer.

[0089] Here, the timestamp of the current message is generated by the transport layer when transmitting the current message, and the timestamp of the RSD message recorded in the timestamp table entry is generated by the transport layer when transmitting the historical message.

[0090] In an optional manner of the above embodiment, for the current message of the RSD type, when the RSD message sequence number is not recorded in the sequence number table item, the RSD message sequence number of the current message is recorded in the sequence number table item, and the timestamp of the current message is recorded in the timestamp table item. In this way, when the RSD message sequence number is not recorded in the sequence number table item, it is considered that the RSD type message has not been received before, that is, the current message is the first packet, and the RSD message timestamp of the current message is recorded in the timestamp table item, and the RSD message sequence number of the current message is recorded in the sequence number table item, so as to facilitate judging whether the subsequent interaction logic of the current message is normal according to the record.

[0091] In an optional manner of the above embodiment, determining whether the current message is abnormal according to the sequence number of the current message, the timestamp of the current message, the RSD message sequence number in the sequence number table item, and the RSD message timestamp in the timestamp table item may include:

[0092] Determine whether the sequence number of the current message is consistent with the RSD message sequence number most recently recorded in the sequence number table entry; if consistent, determine whether the current message is abnormal based on the time interval between the timestamp of the current message and the timestamp of the RSD message most recently recorded in the timestamp table entry; if inconsistent, determine that the current message is normal if the sequence number of the current message increases compared to the RSD message sequence number most recently recorded in the sequence number table entry, and the timestamp of the current message increases compared to the RSD message timestamp most recently recorded in the timestamp table entry; otherwise, determine that the current message is abnormal.

[0093] In the above optional method, determining whether the current message is abnormal can be based on the time interval between the timestamp of the current message and the timestamp of the RSD message most recently recorded in the timestamp table entry: when the time interval between the timestamp of the current message and the timestamp of the RSD message most recently recorded in the timestamp table entry is within a preset time range, determining that the current message is normal; otherwise, determining that the current message is abnormal.

[0094] The preset time range may be greater than 5 milliseconds and less than 2 seconds.

[0095] In some embodiments, the historical message record includes: a sequence number table entry, a timestamp table entry, and an SSE message record cache table. Step S103 may include: if the current message is an SSE type message, determining whether an SSE type historical message is recorded in the SSE message record cache table; if an SSE type historical message is recorded in the SSE message record cache table, determining that the current message is abnormal; if an SSE type historical message is not recorded in the SSE message record cache table, recording the message information of the current message, and clearing the sequence number table entry and the timestamp table entry.

[0096] In this way, when an SSE type message is received, it proves that there is a problem with the timing between the current message and the historical message, and it needs to be recalibrated. After the correction, the current message received again is no longer associated with the previous historical message. By clearing the sequence number table entry and the timestamp table entry when receiving the SSE type message, the interaction logic of the current message can be accurately judged later, ensuring the accuracy of the judgment.

[0097] In some embodiments, the method may also include: determining the receiving frequency of SSE type messages based on the number of SSE type historical messages recorded within a preset time length in the SSE message record cache table, and when the receiving frequency of SSE type messages is greater than the preset frequency, determining that an attack behavior occurs during the interaction between the client and the server.

[0098] Here, the SSE message record cache table records SSE type historical messages, which may include the hexadecimal content of the SSE type historical messages, Ne value, first packet time, last packet receiving time, total number of packets received in the same cycle, etc., which are used to calculate the SSE message frequency to detect abnormal situations.

[0099] In some embodiments, the message detection method further includes: if a message to be compared is obtained within a preset time after recording the current message, setting the message information of the current message in the SSE message record cache table to invalid; and determining whether the current message is abnormal according to the requester sequence number of the message to be compared and the requester sequence number of the current message. The message to be compared is an SSR type message received after the current message.

[0100] In the above embodiment, determining whether the current message is abnormal based on the requester sequence number of the message to be compared and the requester sequence number of the current message may include: determining whether the requester sequence number is extracted from the message to be compared; if the requester sequence number is not extracted from the message to be compared, determining that the current message is abnormal; if the requester sequence number is extracted from the message to be compared, determining whether the current message is abnormal based on the requester sequence number of the message to be compared and the requester sequence number of the current message.

[0101] In the above embodiment, determining whether the current message is abnormal based on the requester sequence number of the message to be compared and the requester sequence number of the current message can be: comparing whether the requester sequence number of the current message is consistent with the requester sequence number extracted from the message to be compared; if they are consistent, determining that the current message is normal; otherwise, determining that the current message is abnormal.

[0102] It can be understood that before comparing the requester sequence number of the message to be compared with the requester sequence number of the current message, it is necessary to first extract the requester sequence number from the message to be compared. If the requester sequence number cannot be extracted from the message to be compared, the comparison between the requester sequence number of the subsequent message to be compared and the requester sequence number of the current message cannot be performed. Therefore, when the requester sequence number is not extracted from the message to be compared, it can be determined that the current message is abnormal.

[0103] In some embodiments, the historical message record includes: an SSE message record cache table; the SSE message record cache table is used to record SSE type historical messages, the requester sequence number of the SSE type historical messages, and the corresponding reception time of the SSE type historical messages. Step S103 may include: if the current message is an SSR type message, then the SSE type historical message is recorded in the SSE message record cache table, and the current message is received within the current preset time length after receiving the SSE type historical message, determine whether the current message is abnormal according to the requester sequence number of the SSE type historical message and the requester sequence number of the current message; otherwise, determine that the current message is abnormal.

[0104] In the above embodiment, determining whether the current message is abnormal based on the requester sequence number of the SSE type historical message located within the preset time length before the current message and the requester sequence number of the current message can be: when the requester sequence number of the SSE type historical message located within the preset time length before the current message and the requester sequence number of the current message are consistent, determining that the current message is normal; otherwise, determining that the current message is abnormal.

[0105] In some embodiments, the message detection method also includes: for a current message determined to be normal, when the message header content of the current message does not match a preset whitelist, or the message header content of the current message matches a preset blacklist, performing a preset protection action on the current message.

[0106] Among them, preset protection actions, such as: releasing, blocking or resetting TCP (Transmission Control Protocol) / UDP (User Datagram Protocol) connections, etc.

[0107] Exemplarily, the whitelist stores features that indicate that the message is normal, and the blacklist stores features that indicate that the message is abnormal. When the message header content of the message header hits all the features in the whitelist, the message execution measure is determined to be release.

[0108] Exemplarily, different blacklists or whitelists may be set according to the message type of the current message. For example, for SSE type messages or SSR type messages, the protocol interaction category may be recorded as 0x01 in the whitelist. If the current message is an SSE type message or an SSR type message, and the protocol interaction category extracted from the message header of the current message is not 0x01, the message execution measure is to report the exception to the user.

[0109] For example, a message detection method is provided in an embodiment of the present application. Figure 5 As shown, Figure 5 A flow chart of a message detection method provided in an embodiment of the present application includes:

[0110] Step S201, obtain the message to be transmitted (ie: the current message transmitted between the client and the server), and then execute step S202.

[0111] Step S202, obtaining a historical message to be transmitted adjacent to the message to be transmitted (ie, the first historical message in the aforementioned embodiment), and then executing step S203.

[0112] Step S203, determining whether the message to be transmitted belongs to the RSSP-I protocol message according to the message header of the message to be transmitted and the message headers of the adjacent historical messages to be transmitted; if the message to be transmitted belongs to the RSSP-I protocol message, executing step S204; if the message to be transmitted does not belong to the RSSP-I protocol message, executing step S224.

[0113] Step S204, determining whether the message to be transmitted is an RSD type message; if so, executing step S205; if not, executing step S213.

[0114] Step S205, verify the message to be transmitted using the message tail of the message to be transmitted according to the set verification protocol to determine whether the verification passes; if passed, execute step S206; if not, execute step S226.

[0115] Step S206, determine whether the message to be transmitted is the first packet; if so, execute step S212; if not, execute step S207.

[0116] Step S207, determining whether there are SSE type historical messages recorded in the SSE message record cache table; if yes, executing step S225; if not, executing step S208.

[0117] Step S208, determining whether the sequence number of the message to be transmitted is consistent with the latest recorded RSD message sequence number in the sequence number table; if consistent, executing step S209; if inconsistent, executing step S210.

[0118] Step S209, determine whether the time interval between the timestamp of the message to be transmitted and the timestamp of the latest recorded RSD message in the timestamp table entry is within a preset time range; if so, proceed to step S223; if not, proceed to step S226.

[0119] Step S210, determine whether the sequence number of the message to be transmitted increases compared to the latest recorded RSD message sequence number in the sequence number table; if it increases, go to step S211; if it does not increase, go to step S226.

[0120] Step S211, determine whether the timestamp of the message to be transmitted is incremented compared to the latest recorded RSD message timestamp in the timestamp table entry; if it is incremented, proceed to step S223; if it is not incremented, proceed to step S226.

[0121] Step S212: record the RSD message sequence number of the message to be transmitted in the sequence number table entry, and record the RSD message timestamp of the message to be transmitted in the timestamp table entry.

[0122] Step S213, determine whether the message to be transmitted is an SSE type message; if so, execute step S214; if not, execute step S219.

[0123] Step S214, verify the message to be transmitted using the message tail of the message to be transmitted according to the set verification protocol to determine whether the verification passes; if passed, execute step S215; if not, execute step S226.

[0124] Step S215, determining whether there is any SSE type historical message recorded in the SSE message record cache table; if there is, executing step S226; if there is no record, executing step S216.

[0125] Step S216, record the message information of the message to be transmitted, and clear the sequence number table entry and the timestamp table entry, and then execute step S217.

[0126] Step S217, determining whether an SSR type message is received within a preset time period after the message to be transmitted; if received, executing step S218; if not received, executing step S226.

[0127] Step S218, determine whether the requester sequence number in the SSR type message is consistent with the requester sequence number of the message to be transmitted; if they are consistent, execute step S223; if they are inconsistent, execute step S226.

[0128] Step S219, determine whether the message to be transmitted is an SSR type message; if so, execute step S220; if not, execute step S224.

[0129] Step S220, verify the message to be transmitted using the message tail of the message to be transmitted according to the set verification protocol to determine whether the verification passes; if passed, execute step S221; if not, execute step S226.

[0130] Step S221, determine whether there is an SSE type historical message corresponding to a timestamp within a preset time length before the message to be transmitted; if so, execute step S222; if not, execute step S226.

[0131] Step S222, determine whether the requester sequence number in the SSE type message whose timestamp is within a preset time length before the message to be transmitted is consistent with the requester sequence number of the message to be transmitted; if consistent, execute step S223; if inconsistent, execute step S226.

[0132] Step S223, for the message to be transmitted that is determined to be normal, if the message header content of the message to be transmitted does not match the preset whitelist, or the message header content of the message to be transmitted matches the preset blacklist, a preset protection action is performed on the message to be transmitted.

[0133] Step S224, end the process.

[0134] Step S225, discard the message to be transmitted.

[0135] Step S226, confirm that the message to be transmitted is abnormal, and report the abnormality.

[0136] It is understandable that after the security device first determines that the message to be transmitted belongs to the RSSP-I protocol, the subsequently received message to be transmitted may be assumed to belong to the RSSP-I protocol. That is, the security device may only perform step S202 and step S203 when determining whether the message to be transmitted is abnormal for the first time according to the historical message record, and may omit step S202 and step S203 when it is not the first determination.

[0137] Through the above-mentioned message detection method, different message identification methods are used for different types of messages to be transmitted, so that each type of message to be transmitted can be more specifically identified as abnormal. For the RSD message type, the sequence number of the message to be transmitted, the timestamp of the message to be transmitted, the RSD message sequence number of the historical message to be transmitted, and the RSD message timestamp of the historical message to be transmitted can reflect whether the message to be transmitted of the RSD message type conforms to the communication logic. For the SSE message type, whether the message to be transmitted of the SSE message type conforms to the communication logic can be identified by whether there are historical messages to be transmitted of the type SSE message. For the SSR message type, the interaction time between the message to be transmitted of the SSR message type and the message to be transmitted of the SSE message type can reflect whether the message to be transmitted of the SSR message type conforms to the communication logic. According to the communication logic, it can be effectively identified whether the message to be transmitted is abnormal, which is convenient for users to protect the message to be transmitted according to whether the communication logic of the message to be transmitted is normal. At the same time, by having the safety device identify abnormalities in the messages to be transmitted before they are transmitted to the ground control center, rather than having the ground control center identify them, the operating pressure of the ground control center can be reduced.

[0138] Embodiment 2

[0139] Based on the same inventive concept, the present application embodiment provides a message detection device, such as Figure 6 As shown, the message detection device includes: a receiving module 61, a detection module 62 and a determination module 63. The receiving module 61 is used to receive the current message transmitted between the client and the server; the detection module 62 is used to detect whether the current message is an RSSP-I message; the determination module 63 is used to determine whether the current message is abnormal according to the message type of the current message and the historical message record of the security device when the current message is detected to be an RSSP-I message; the historical message record is used to record the historical RSSP-I messages transmitted between the client and the server.

[0140] In some embodiments, the historical message record includes: a sequence number table entry, a timestamp table entry, and an SSE message record cache table; the determination module 63 is used to:

[0141] If the current message is an RSD type message, then if the RSD message sequence number is recorded in the historical message record, determine whether the SSE type historical message is recorded in the SSE message record cache table;

[0142] If there are records, determine that the current message is abnormal;

[0143] In the absence of records, determine whether the current message is abnormal based on the sequence number of the current message, the timestamp of the current message, the RSD message sequence number in the sequence number table entry, and the RSD message timestamp in the timestamp table entry, where the RSD message timestamp is generated by the transport layer.

[0144] In some embodiments, the determination module 63 is used to:

[0145] Determine whether the sequence number of the current message is consistent with the latest RSD message sequence number recorded in the sequence number table;

[0146] If they are consistent, determine whether the current message is abnormal based on the time interval between the timestamp of the current message and the timestamp of the latest RSD message recorded in the timestamp table entry;

[0147] If there is inconsistency, if the sequence number of the current message increases compared to the latest recorded RSD message sequence number in the sequence number table entry, and the timestamp of the current message increases compared to the latest recorded RSD message timestamp in the timestamp table entry, the current message is determined to be normal; otherwise, the current message is determined to be abnormal.

[0148] In some embodiments, the historical message record includes: a sequence number table entry, a timestamp table entry, and an SSE message record cache table; the determination module 63 is used to:

[0149] If the current message is an SSE type message, determine whether there is an SSE type historical message recorded in the SSE message record cache table;

[0150] If the SSE message record cache table contains SSE type historical messages, it is determined that the current message is abnormal;

[0151] If there is no SSE type historical message recorded in the SSE message record cache table, the message information of the current message is recorded in the SSE message record cache table, and the sequence number table entry and the timestamp table entry are cleared.

[0152] In some embodiments, the determination module 63 is further configured to:

[0153] When a message to be compared is obtained within a preset time after recording the current message, the message information of the current message in the SSE message record cache table is set to invalid; the message to be compared is an SSR type message received after the current message;

[0154] Determine whether the current message is abnormal according to the requester sequence number of the message to be compared and the requester sequence number of the current message.

[0155] In some embodiments, the historical message record includes: an SSE message record cache table; the SSE message record cache table is used to record SSE type historical messages, the requester sequence number of the SSE type historical message and the corresponding reception time of the SSE type historical message; the determination module 63 is used to:

[0156] If the current message is an SSR type message, an SSE type historical message is recorded in the SSE message record cache table, and the current message is received within the current preset time length after receiving the SSE type historical message, determine whether the current message is abnormal based on the requester sequence number of the SSE type historical message and the requester sequence number of the current message; otherwise, determine that the current message is abnormal.

[0157] In some embodiments, the detection module 62 is used to:

[0158] When it is detected that the current message meets the RSSP-I message format requirement, a first historical message is obtained, wherein the first historical message is a historical message that meets the RSSP-I message format requirement and is most recently detected by the security device before the current message;

[0159] Compare the message header content of the current message with the message header content of the first historical message to determine whether the current message is an RSSP-I message.

[0160] In some embodiments, the determination module 63 is further configured to:

[0161] Verify the current message using the message tail of the current message according to the set verification method;

[0162] If the verification fails, the current message is determined to be abnormal;

[0163] If the verification is successful, it is determined whether the current message is abnormal based on the message type of the current message and the historical message records of the security device.

[0164] In some embodiments, the message detection device further includes: an execution module, configured to:

[0165] For the current message determined to be normal, when the message header content of the current message does not match the preset whitelist, or when the message header content of the current message matches the preset blacklist, a preset protection action is performed on the current message.

[0166] It can be understood that the various embodiments described in the first embodiment are also applicable to the second embodiment if there is no conflict. Based on the consideration of brevity of description, they will not be repeated here.

[0167] Embodiment 3

[0168] Combination Figure 7As shown, an embodiment of the present application provides a security device, including a processor 4 and a memory 7. Optionally, the device may also include a communication interface 5 and a bus 6. Among them, the processor 4, the communication interface 5, and the memory 7 can communicate with each other through the bus 6. The communication interface 5 can be used for information transmission. The processor 4 can call the logic instructions in the memory 7 to execute the message detection method of the above embodiment.

[0169] In addition, the logic instructions in the above-mentioned memory 7 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product.

[0170] The memory 7 is a computer-readable storage medium that can be used to store software programs and computer executable programs, such as program instructions / modules corresponding to the method in the embodiment of the present application. The processor 4 executes the function application and data processing by running the program instructions / modules stored in the memory 7, that is, the message detection method in the above embodiment is implemented.

[0171] The memory 7 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function; the data storage area may store data created according to the use of the terminal device, etc. In addition, the memory 7 may include a high-speed random access memory and may also include a non-volatile memory.

[0172] The security device may be a firewall.

[0173] An embodiment of the present application provides a storage medium storing computer executable instructions, wherein the computer executable instructions are configured to execute the above-mentioned message detection method.

[0174] An embodiment of the present application provides a computer program product, which includes a computer program stored on a storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the above-mentioned message detection method.

[0175] The computer-readable storage medium mentioned above may be a transient computer-readable storage medium or a non-transitory computer-readable storage medium.

[0176] The technical solution of the embodiment of the present application can be embodied in the form of a software product, which is stored in a storage medium and includes one or more instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method of the embodiment of the present application. The aforementioned storage medium can be a non-transient storage medium, including: a USB flash drive, a mobile hard disk, a read-only memory, a random access memory, a magnetic disk or an optical disk, etc., which can store program codes, or a transient storage medium.

[0177] The embodiments or examples of the present disclosure are not exhaustive, but are only illustrative of some embodiments or examples, and are not intended to be specific limitations on the scope of protection of the present disclosure. In the absence of contradiction, each step in a certain embodiment or example can be implemented as an independent example, and the steps can be combined arbitrarily. For example, the scheme after removing some steps in a certain embodiment or example can also be implemented as an independent example, and the order of the steps in a certain embodiment or example can be arbitrarily exchanged. In addition, the optional methods or optional examples in a certain embodiment or example can be combined arbitrarily; in addition, the various embodiments or examples can be combined arbitrarily, for example, some or all steps of different embodiments or examples can be combined arbitrarily, and a certain embodiment or example can be combined arbitrarily with the optional methods or optional examples of other embodiments or examples.

[0178] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0179] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A message detection method, characterized in that: Applications in safety equipment, including: Receive the current message transmitted between the client and the server; Detecting whether the current message is an RSSP-I message; When it is detected that the current message is an RSSP-I message, whether the current message is abnormal is determined according to the message type of the current message and the historical message record of the security device; the historical message record is used to record the historical RSSP-I messages transmitted between the client and the server.

2. The method according to claim 1, characterized in that The historical message record includes: a sequence number table entry, a timestamp table entry, and an SSE message record cache table; In the case where it is detected that the current message is an RSSP-I message, determining whether the current message is abnormal according to the message type of the current message and the historical message record of the security device includes: If the current message is an RSD type message, then in the case where the RSD message sequence number is recorded in the historical message record, determining whether an SSE type historical message is recorded in the SSE message record cache table; If there is a record, determining that the current message is abnormal; In the absence of records, determine whether the current message is abnormal based on the sequence number of the current message, the timestamp of the current message, the RSD message sequence number in the sequence number table entry, and the RSD message timestamp in the timestamp table entry, wherein the RSD message timestamp is generated by the transport layer.

3. The method according to claim 2, characterized in that Determining whether the current message is abnormal according to the sequence number of the current message, the timestamp of the current message, the RSD message sequence number in the sequence number table entry, and the RSD message timestamp in the timestamp table entry includes: Determine whether the sequence number of the current message is consistent with the RSD message sequence number most recently recorded in the sequence number table entry; If they are consistent, determine whether the current message is abnormal according to the time interval between the timestamp of the current message and the latest recorded RSD message timestamp in the timestamp table entry; If there is inconsistency, the current message is determined to be normal if the sequence number of the current message increases compared to the latest recorded RSD message sequence number in the sequence number table entry, and the timestamp of the current message increases compared to the latest recorded RSD message timestamp in the timestamp table entry; otherwise, the current message is determined to be abnormal.

4. The method according to claim 1, characterized in that: The historical message record includes: a sequence number table entry, a timestamp table entry, and an SSE message record cache table; In the case where it is detected that the current message is an RSSP-I message, determining whether the current message is abnormal according to the message type of the current message and the historical message record of the security device includes: If the current message is an SSE type message, determining whether there is an SSE type historical message recorded in the SSE message record cache table; If the SSE message record cache table contains a record of an SSE type historical message, determining that the current message is abnormal; If no SSE type historical message is recorded in the SSE message record cache table, the message information of the current message is recorded in the SSE message record cache table, and the sequence number table entry and the timestamp table entry are cleared.

5. The method according to claim 4, characterized in that The method further comprises: In the case where a message to be compared is obtained within a preset time after recording the current message, the message information of the current message in the SSE message record cache table is set to invalid; the message to be compared is an SSR type message received after the current message; Determine whether the current message is abnormal according to the requester sequence number of the message to be compared and the requester sequence number of the current message.

6. The method according to claim 1, characterized in that The historical message record includes: an SSE message record cache table; the SSE message record cache table is used to record SSE type historical messages, the requester sequence number of the SSE type historical message and the corresponding reception time of the SSE type historical message; In the case where it is detected that the current message is an RSSP-I message, determining whether the current message is abnormal according to the message type of the current message and the historical message record of the security device includes: If the current message is an SSR type message, an SSE type historical message is recorded in the SSE message record cache table, and the current message is received within the current preset time length after receiving the SSE type historical message, determine whether the current message is abnormal based on the requester sequence number of the SSE type historical message and the requester sequence number of the current message; otherwise, determine that the current message is abnormal.

7. The method according to any one of claims 1 to 6, characterized in that: Detecting whether the current message is an RSSP-I message includes: When it is detected that the current message meets the RSSP-I message format requirement, obtaining a first historical message, wherein the first historical message is a historical message that meets the RSSP-I message format requirement and is most recently detected by the security device before the current message; Compare the message header content of the current message with the message header content of the first historical message to determine whether the current message is an RSSP-I message.

8. The method according to any one of claims 1 to 6, characterized in that: Determining whether the current message is abnormal according to the message type of the current message and the historical message record of the security device includes: Verify the current message using the message tail of the current message according to the set verification method; If the verification fails, determining that the current message is abnormal; If the verification is successful, it is determined whether the current message is abnormal based on the message type of the current message and the historical message record of the security device.

9. The method according to any one of claims 1 to 6, characterized in that: The method further comprises: For the current message determined to be normal, when the message header content of the current message does not match the preset whitelist, or when the message header content of the current message matches the preset blacklist, a preset protection action is performed on the current message.

10. A message detection device, characterized in that: Applications in safety equipment, including: A receiving module, used to receive the current message transmitted between the client and the server; A detection module, used for detecting whether the current message is an RSSP-I message; A determination module is used to determine whether the current message is abnormal based on the message type of the current message and the historical message record of the security device when it is detected that the current message is an RSSP-I message; the historical message record is used to record the historical RSSP-I messages transmitted between the client and the server.

11. A safety device, characterized in that: It comprises a processor and a memory, wherein the memory stores computer executable instructions that can be executed by the processor, and the processor executes the computer executable instructions to implement the message detection method according to any one of claims 1 to 9.

Images