Heterogeneous industrial control protocol security enhancement method, terminal and system in cross-domain communication scene

Abstract

The invention provides a heterogeneous industrial control protocol security enhancement method, terminal and system in a cross-domain communication scene, and the method comprises the steps: a master device which enables a corresponding function code to be stored in a function code part of a specified message according to a self demand, and transmits the specified message to a slave device; the gateway performs protocol conversion when the protocol of the specified message is different from the protocol of the slave device, and then sends the specified message to the slave device; and the slave device receives the specified message sent by the slave gateway, determines whether the specified message is encrypted or verified according to a function code carried in the specified message, and if the specified message is encrypted or verified, performs corresponding decryption or decoding verification on the specified message according to a decryption mode or a decoding verification mode corresponding to the function code, and performs corresponding decryption or decoding verification on the specified message according to the decryption mode or the decoding verification mode corresponding to the function code. And obtaining a plaintext or integrity verification result. The data security and interoperability of the Modbus protocol in an industrial environment are improved by combining hierarchical encryption, integrity check and a heterogeneous network compatibility mechanism.

Description

Technical Field

[0001] The present invention belongs to the technical field of industrial data security, and particularly relates to a method, a terminal and a system for enhancing the security of heterogeneous industrial control protocols in a cross-domain communication scenario. Background Art

[0002] In industrial scenarios with high real-time requirements, how to reduce latency while ensuring security; in heterogeneous network environments, how to efficiently integrate different protocols and devices; and how to reduce the upgrade costs of traditional industrial equipment. In the future, with the continuous development of industrial Internet of Things and intelligent manufacturing technologies, the Modbus protocol security mechanism based on encryption, integrity verification, and heterogeneous network adaptation will continue to evolve, providing a more solid guarantee for the industrial control field and promoting the global industrial network to develop in a more secure, reliable, and intelligent direction.

[0003] The prior art proposes a description of a secure communication method and system based on national cryptographic algorithms and an improved Modbus TCP protocol as follows:

[0004] (1) Secure Transmission Design Scheme

[0005] This scheme combines national cryptographic algorithms (SM2, SM4) and an improved Modbus TCP protocol, aiming to achieve secure and efficient data transmission. In terms of secure transmission design, SM2 asymmetric encryption and SM4 symmetric encryption algorithms are adopted to ensure the confidentiality of data during transmission. Random numbers are generated by a hardware cryptographic module for identity authentication and key negotiation, ensuring the identity authentication between the host and the slave and the security of the encryption key.

[0006] (2) Secure Verification Design Scheme

[0007] The host and the slave share the initial SM2 public key, and complete identity authentication through a signature and verification mechanism based on the SM2 algorithm. During the key negotiation process, both parties use SM2 asymmetric encryption technology to securely negotiate the SM4 symmetric key to ensure the encrypted transmission of data. In the protocol design, an improved Modbus TCP protocol is adopted, and a secure verification field (such as a random number field) is added to the data frame to prevent replay attacks.

[0008] This scheme ensures that the transmitted data is not tampered with through methods such as signature, random number verification, and message authentication code. The host and the slave generate random numbers when establishing a connection and sign them. The receiving party verifies the signature through the public key to ensure the authenticity of the identity. The random number is also used as part of the data verification. A new random number is generated for each communication, and the receiving party compares this random number with the stored random number list to ensure that the data is valid and not replayed.

[0009] Although the solutions recorded in the prior art can resist replay attacks, this solution also has certain limitations. This solution does not provide a hierarchical encryption mechanism. For some insensitive data, the same SM4 symmetric encryption is also used, which brings unnecessary performance overhead and high complexity in key management. This solution lacks data tampering protection. This solution does not provide an integrity verification mechanism for data tampering and only uses random numbers to prevent replay attacks. And this solution only improves the Modbus TCP protocol and does not consider the compatibility with other protocol systems. Summary of the Invention

[0010] To solve the above problems existing in the prior art, the present invention provides a method, a terminal and a system for enhancing the security of heterogeneous industrial control protocols in a cross-domain communication scenario. The technical problems to be solved by the present invention are realized through the following technical solutions:

[0011] In a first aspect, the present invention provides a method for enhancing the security of heterogeneous industrial control protocols in a cross-domain communication scenario, including:

[0012] The master device places the corresponding function code into the function code part of the specified message according to its own needs and sends the specified message to the slave device; wherein, the specified message includes Modbus TCP protocol messages, Modbus RTU messages and ASCII messages;

[0013] The gateway determines whether the protocol of the specified message is the same as that of the slave device. If not, the specified message is protocol-converted and then sent to the slave device; if the same, the specified message is directly forwarded to the slave device;

[0014] The slave device receives the specified message sent from the gateway and determines whether the specified message is encrypted or verified according to the function code carried in the specified message. If the specified message is encrypted or verified, the specified message is decrypted or decoded and verified in accordance with the decryption mode or decoding verification method corresponding to the function code to obtain the plaintext or the integrity verification result.

[0015] In a second aspect, the present invention provides a terminal for enhancing the security of heterogeneous industrial control protocols in a cross-domain communication scenario, which is used to implement the specific functions of the master device or the slave device in the method for enhancing the security of heterogeneous industrial control protocols in the cross-domain communication scenario of the first aspect.

[0016] In a third aspect, the present invention provides a system for enhancing the security of heterogeneous industrial control protocols in a cross-domain communication scenario, which includes a master device, a gateway and a slave device, and the master device, the gateway and the slave device cooperate with each other to implement the method for enhancing the security of heterogeneous industrial control protocols in the cross-domain communication scenario of the first aspect.

[0017] Advantageous Effects:

[0018] 1. Use domestic cryptographic algorithms such as SM3 and SM4, which meet the requirements of cryptographic compliance, promote the localization of equipment, and protect national security and data sovereignty. This solution uses two domestic cryptographic algorithms, SM3 and SM4, which meet the national compliance requirements for cryptographic technologies, especially the requirements of the Cybersecurity Law and the Cryptography Law. The use of these algorithms can promote the localization of equipment, reduce dependence on external technologies, and at the same time provide an autonomous and controllable solution for information security and data protection. By using domestic encryption algorithms, the country's data sovereignty and information security can be ensured, external intervention and potential security risks can be prevented, thus protecting the security of critical data during transmission and storage.

[0019] 2. Implement hierarchical encryption and use different security measures for messages of different levels. This solution implements hierarchical encryption and uses different security measures according to messages of different levels. By setting different function codes, the system can flexibly choose plaintext transmission or encrypted transmission during the transmission process. This design can ensure that messages with high security requirements are encrypted and protected, while unnecessary encryption operations avoid wasting computing and bandwidth resources, balancing security and efficiency, and improving the overall performance and scalability of the system.

[0020] 3. Adopt the SM4 encryption algorithm and the SM3 message authentication code algorithm to achieve integrity protection and hierarchical encryption. Through the SM4 symmetric encryption algorithm and the SM3 message authentication code, this solution realizes the encryption protection and integrity verification of data. As a symmetric encryption algorithm, SM4 has lower computational overhead and higher encryption efficiency compared with asymmetric encryption algorithms (such as RSA). In application scenarios where encryption and decryption need to be performed frequently, SM4 can provide higher speed and lower energy consumption, and is especially suitable for low-power devices (such as sensors, edge computing devices, etc.). SM3 provides the function of message authentication code to ensure that the data has not been tampered with during transmission, enhancing the data integrity and credibility of the system.

[0021] 4. Use symmetric encryption algorithms, which have lower overhead and better adaptability compared with asymmetric cryptographic algorithms. Compared with asymmetric encryption algorithms, this solution uses the symmetric encryption SM4 algorithm, which can achieve better adaptability on low-power devices. Symmetric encryption has lower computational complexity compared with asymmetric encryption algorithms, and does not require complex key exchange and management mechanisms, reducing the overall computational burden of the system. Therefore, it is especially suitable for the Internet of Things and intelligent devices that require efficient computing and low power consumption. These devices usually have limited resources and need a more lightweight encryption solution to ensure long-term stable operation.

[0022] 5. An heterogeneous network is implemented, enabling old devices to also adapt to this solution. By achieving heterogeneous network compatibility, the compatibility issues between traditional industrial devices (such as PLCs, sensors, frequency converters, etc.) and modern control systems (such as the Modbus TCP protocol based on Ethernet) are resolved. Through a protocol converter, devices with different protocols can be smoothly interconnected, ensuring seamless communication between old and new devices. This design not only avoids communication problems caused by device incompatibility but also enables existing devices to continue to be used in modern systems, avoiding large-scale device replacement and high upgrade costs.

[0023] 6. Supports multiple network architectures, enhancing system compatibility. Using the heterogeneous network design, this solution allows devices with different protocols (such as Modbus RTU / ASCII and Modbus TCP devices) to interact smoothly through a protocol converter, enabling old devices to be compatible with new devices. In this way, the industrial automation system can gradually achieve modernization upgrades without completely replacing existing devices, reducing the risks and costs during the upgrade process. The system can not only be compatible with old devices but also support various different network architectures and protocols, adapting to a variety of complex industrial scenarios.

[0024] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Description of the Drawings

[0025] Figure 1 is a schematic flowchart of a method for enhancing the security of heterogeneous industrial control protocols in a cross-domain communication scenario provided by the present invention;

[0026] Figure 2 is the Modbus TCP message format provided by the present invention;

[0027] Figure 3 is a schematic diagram of the message format of the Modbus TCP non-encrypted mode provided by the present invention;

[0028] Figure 4 is a schematic diagram of the message format of the Modbus TCP encrypted mode provided by the present invention;

[0029] Figure 5 is the Modbus RTU / ASCII message format provided by the present invention;

[0030] Figure 6 is a schematic diagram of the message format of the Modbus RTU / ASCII non-encrypted mode provided by the present invention;

[0031] Figure 7 is a schematic diagram of the message format of the Modbus RTU / ASCII encrypted mode provided by the present invention;

[0032] Figure 8 It is a schematic diagram of the message format of Modbus TCP with only verification provided by the present invention;

[0033] Figure 9 It is a schematic diagram of the message format of Modbus TCP with encryption and verification provided by the present invention;

[0034] Figure 10 It is a schematic diagram of the message format of Modbus RTU / ASCII with only verification provided by the present invention;

[0035] Figure 11 It is a schematic diagram of the message format of Modbus RTU / ASCII with encryption and verification provided by the present invention;

[0036] Figure 12 It is a flow chart of the protocol conversion between Modbus TCP and Modbus RTU / ASCII provided by the present invention. Specific embodiments

[0037] The following further describes the present invention in detail with specific embodiments, but the implementation manners of the present invention are not limited thereto.

[0038] The present invention proposes a method for enhancing the security of heterogeneous industrial control protocols in a cross-domain communication scenario, combining hierarchical encryption, integrity verification, and heterogeneous network compatibility mechanisms to improve the data security and interoperability of the Modbus protocol in an industrial environment. In terms of secure transmission design, the improvements can include enhancing the encryption mechanism and supporting more refined function codes. Multiple encryption methods can be introduced, such as combining SM2 and SM4, to improve the encryption strength. At the same time, dynamic key management helps avoid security risks caused by using the same key for a long time. In addition, by further refining the function codes, appropriate encryption strengths can be selected for different data types or application scenarios to achieve more flexible security control.

[0039] In terms of integrity verification, it mainly combines the message authentication code and encryption technology to ensure the integrity and anti-tampering ability of the message during transmission. Specifically, the scheme defines different function codes to identify the security measure strength of the message, including two security levels: only verification and verification + encryption. This scheme provides effective integrity verification measures at different security levels by combining the message authentication code and encryption algorithms, ensuring the data integrity and confidentiality of Modbus messages during transmission.

[0040] In terms of heterogeneous network protocol conversion, a flexible protocol conversion mechanism is introduced to solve the compatibility problem between Modbus RTU / ASCII and Modbus TCP. Specifically, a Modbus gateway device or an embedded protocol conversion module can be used to achieve seamless protocol conversion while ensuring data encryption and integrity verification.

[0041] The present invention proposes a hierarchical encryption, integrity protection, and heterogeneous network design solution for Modbus TCP protocol and Modbus RTU / ASCII protocol. The symbols used in the solution and their meanings are shown in Table 1 of the symbols used in the solution and their meanings.

[0042] Table 1 Symbols used in the solution and their meanings

[0043] Symbol Meaning <![CDATA[SID i > Identifier of slave address (1 byte) <![CDATA[MID l > Identifier of master address (1 byte) <![CDATA[R i > Random number (7 bytes) <![CDATA[CTR l > Counter of message l (2 bytes) <![CDATA[C i > Ciphertext in key negotiation process <![CDATA[AUTH i > Message authentication code in key negotiation process <![CDATA[K pre,l > Pre-shared key of group l <![CDATA[K sess,l > Session key of group l PM Plaintext CM Ciphertext <![CDATA[AUTH PM > Authentication code for plaintext (16 / 32 bytes) <![CDATA[AUTH DM > Authentication code for data field <![CDATA[F kdf (·)]]> Key one-way function for key derivation <![CDATA[F mac (·)]]> One-way function for generating message authentication code <![CDATA[F enc (·)]]> Function for encryption operation <![CDATA[F dec (·)]]> Function for decryption operation || Connector for two pieces of information

[0044] Combined with Figures 1 to 12 , the present invention provides a method for enhancing the security of heterogeneous industrial control protocols in a cross-domain communication scenario, including:

[0045] The master device puts the corresponding function code into the function code part of the specified message according to its own needs and sends the specified message to the slave device; wherein, the specified message includes Modbus TCP protocol message and Modbus RTU / ASCII message.

[0046] The present invention mainly focuses on the slave address field and function code field of Modbus TCP message and Modbus RTU / ASCII message.

[0047] In the sending stage, for the standard format of Modbus TCP, the length of the transaction processing identifier is 2 bytes, the length of the protocol identifier is 2 bytes, the length is 2 bytes, the length of the slave address field is 8 bits, the length of the function code field is 8 bits, and the length of the data field is 0 to 252 bytes. The present invention defines different function codes as classification markers for using different security measures to divide different encryption and decryption levels. The structure is as Figure 2 shown.

[0048] Function code: Mark the strength of the security measure of this message type to implement a hierarchical encryption mechanism. The specific value is consistent with the Modbus RTU / ASCII message rule. The specific rule is as follows:

[0049] When the function code is defined as 101 (no operation code within the domain) and 105 (no operation code across domains), no operation is performed on the data, and the data field is in plain text to ensure compatibility, as Figure 3 shown.

[0050] When the function code is defined as 102 (only encryption within the domain) and 106 (only encryption across domains), only encryption operation is performed on the plain text, and the data field is the encrypted ciphertext, as Figure 4 shown.

[0051] Modbus RTU / ASCII

[0052] For the standard format of Modbus RTU / ASCII, the slave address field has a length of 8 bits, the function code field has a length of 8 bits, and the data field has a length of 0 to 252 bytes. This solution defines different function codes as classification markers for using different security measures to divide different security transmission levels. The structure is as Figure 5 shown.

[0053] Function code: Marks the strength of the security measures for this message type. The strength of the security measures is divided into two security levels: no operation and encryption only. The encryption algorithm uses SM4. The specific rules are as follows:

[0054] When the function code is defined as 101 (intra-domain no-operation code) and 105 (cross-domain no-operation code), no operation is performed on the data, and the data field is in plain text to ensure compatibility, as Figure 6 shown.

[0055] When the function code is defined as 102 (intra-domain encryption) and 106 (cross-domain encryption), only the plain text is encrypted, and the data field is the encrypted ciphertext, as Figure 7 shown.

[0056] The present invention proposes an integrity protection design solution:

[0057] For Modbus TCP messages, the present invention proposes a function code: Marks the strength of the security verification measures for this message type. The strength of the security verification measures is divided into two security levels: verification only and verification + encryption. Among them, verification only and verification + encryption will be specifically introduced in this section. The encryption algorithm uses SM4, and the message authentication code uses SM3. The specific rules are as follows:

[0058] When the function code is defined as 103 (intra-domain verification code only) and 107 (cross-domain verification code only), only message verification is performed on the plain text, and the data field is a 16 / 32-byte message authentication code and the plain text, as Figure 8 shown.

[0059] When the function code is defined as 104 (intra-domain verification + encryption password) and 108 (cross-domain verification + encryption password), message verification is performed on the plain text, and the message authentication code and the plain text of the plain text are encrypted together. Among them, the first 16 / 32 bytes are the message authentication code of the plain text, and the following is the plain text. The data field is the encrypted ciphertext, as Figure 9 shown.

[0060] For Modbus RTU / ASCII messages

[0061] Function code: Marks the strength of the security verification measures for this message type. The strength of the security verification measures is divided into two security levels: verification only and verification + encryption. Among them, verification only and verification + encryption will be specifically introduced in this section.

[0062] The encryption algorithm uses SM4, and the message authentication code uses SM3. The specific rules are as follows:

[0063] When the function code is defined as 103 (only verification code within the domain) or 107 (only verification code across domains), only message verification is performed on the plaintext. The data field contains 16 / 32-byte message authentication code and plaintext, as Figure 10 shown.

[0064] When the function code is defined as 104 (verification + encryption within the domain) or 108 (verification + encryption across domains), message verification is performed on the plaintext, and the message authentication code and plaintext of the plaintext are encrypted together. Among them, the first 16 / 32 bytes are the message authentication code of the plaintext, and the following is the plaintext. The data field is the encrypted ciphertext, as Figure 11 shown.

[0065] The gateway determines whether the protocol of the specified message is the same as that of the slave device. If not, protocol conversion is performed on the specified message and then it is sent to the slave device; if the same, the specified message is directly forwarded to the slave device;

[0066] The slave device receives the specified message sent from the gateway and determines whether the specified message is encrypted or verified according to the function code carried in the specified message. If the specified message is encrypted or verified, corresponding decryption or decoding verification is performed on the specified message according to the decryption mode or decoding verification method corresponding to the function code, and the plaintext or integrity verification result is obtained.

[0067] For the sake of convenience of description, both the slave device and the master device are described as nodes in the following description.

[0068] In a specific embodiment of the present invention, the master device includes putting a predetermined function code into the function code part of the specified message according to its own needs and sending the specified message to the slave device:

[0069] The master device puts the corresponding function code into the function code part of the specified message according to its own need of whether to encrypt or not, and sends the specified message to the slave device;

[0070] The master device puts the corresponding function code into the function code part of the specified message according to its own need of only verification or combined encryption verification, and sends the specified message to the slave device.

[0071] In a specific embodiment of the present invention, the master device includes putting the corresponding function code into the function code part of the specified message according to its own need of whether to encrypt or not, and sending the specified message to the slave device:

[0072] The master device, according to its own requirements that neither in-domain nor cross-domain encryption is needed, puts the plaintext into the DATA field of a predetermined message; sets the function code flag to 101 and 105, puts them into the function code of the predetermined message, generates a data frame, and sends it to the bus;

[0073] Taking the Modbus TCP message as an example, the message sending process without encryption is as follows:

[0074] Step 1: Put the plaintext into the DATA field of the Modbus message.

[0075] Step 2: Set the function code flag to 101 (no opcode in-domain) and 105 (no opcode cross-domain), put them into the function code of the Modbus message, generate a Modbus data frame, and send it to the bus.

[0076] The master device, according to its own requirements that only in-domain and cross-domain encryption is needed, calculates the ciphertext using the session key and the plaintext; according to the message format of the security level with only encryption, puts the ciphertext into the DATA field of the predetermined message; sets the function code flag to 102 and 106, puts them into the function code of the predetermined message to generate a data frame, and sends it to the bus; where 101 represents no opcode in-domain, 105 represents no opcode cross-domain, 102 represents only encrypted in-domain, and 106 represents only encrypted cross-domain.

[0077] The message sending process in the encryption mode is as follows:

[0078] When a node sends a message, the following steps are required:

[0079] Step 1: Calculate the ciphertext using the session key and the plaintext, as shown in Formula 1.

[0080] CM = F enc (K sess,l , PM) #1

[0081] Step 2: According to the message format of the security level with only encryption, put the ciphertext into the DATA field of the Modbus message.

[0082] Step 3: Set the function code flag to 102 (only encrypted in-domain) and 106 (only encrypted cross-domain), put them into the function code of the Modbus message, generate a Modbus data frame, and send it to the bus.

[0083] In a specific embodiment of the present invention, the master device, according to its own requirements of only verification or combined verification of encryption, puts the corresponding function code into the function code part of the specified message and sends the specified message to the slave device, including:

[0084] The master device, according to its own requirements of only verification, uses the session key K sess,l, counter CTR l and the plaintext PM, calculate the 16 / 32-byte message authentication code AUTH for the plaintext PM ; According to the message format of the security level of only verification, put the message authentication code for the plaintext and the plaintext into the DATA field of the predetermined message; Set the function code flag to 103, 107, and put it together with the identifier of the slave address into the protocol header of the predetermined message to generate a data frame and send it to the bus; After sending, increment the counter corresponding to the slave device by one;

[0085] For Modbus messages, during the development stage, developers can select the security measure suitable for this message from two different levels of security measures: only verification and verification + encryption, according to the importance of the message and the tolerance for latency. Before sending, use the corresponding method to process the message and then send it to the Modbus bus. The message sending steps of the following two different levels of security measures: only verification and verification + encryption are discussed separately.

[0086] Message sending process for only verification:

[0087] When a node sends a message, the following steps are required:

[0088] Step 1: Use the session key K sess,l , counter CTR l and the plaintext PM, calculate the 16 / 32-byte message authentication code AUTH for the plaintext PM , as shown in Formula 2.

[0089] AUTH PM = F mac (K sess,l || CTR l , PM) #2

[0090] Step 2: According to the message format of the security level of only verification, put the message authentication code for the plaintext and the plaintext into the DATA field of the Modbus message.

[0091] Step 3: Set the function code flag to 103 (only verification code within the domain), 107 (only verification code across domains), and put it together with SID i into the Modbus protocol header of the Modbus message to generate a Modbus data frame and send it to the bus.

[0092] Step 4: After sending, increment the counter CTR l corresponding to this slave node by one.

[0093] The master device, according to its own requirements for encrypted joint verification, uses the session key K sess,l , counter CTRl Given the plaintext PM, calculate the 16 / 32-byte message authentication code AUTH for the plaintext PM ; Use the session key K sess,l , the message authentication code AUTH for the plaintext PM and the plaintext PM to calculate the ciphertext CM; According to the message format for verifying the security level of combined encryption, put the ciphertext CM into the DATA field of the predetermined message; Set the function code flag to 104, 108, and put it into the protocol header of the predetermined message to generate a data frame and send it to the bus; After sending, increment the counter corresponding to the slave device by one; Among them, 103 indicates that there is only a verification code within the domain, 107 indicates that there is only a verification code across domains, 104 indicates in-domain verification + encryption, and 108 indicates cross-domain verification + encryption.

[0094] Encryption and verification message sending process:

[0095] When a node sends a message, the following steps are required:

[0096] Step 1: Use the session key K sess,l , the counter CTR l and the plaintext PM to calculate the 16 / 32-byte message authentication code AUTH for the plaintext PM , as shown in Formula 2.

[0097] Step 2: Use the session key K sess,l , the message authentication code AUTH for the plaintext PM and the plaintext PM to calculate the ciphertext CM, as shown in Formula 3.

[0098] CM = F enc (K sess,l , AUTH PM ||PM) #3

[0099] Step 3: According to the message format for verification + encryption security level, put the ciphertext CM into the DATA field of the Modbus message.

[0100] Step 4: Set the function code flag to 104 (in-domain verification + encryption), 108 (cross-domain verification + encryption), and put it into the Modbus protocol header of the Modbus message to generate a Modbus data frame and send it to the bus.

[0101] Step 5: After sending, increment the counter CTR l corresponding to this slave node by one.

[0102] In a specific embodiment of the present invention, the gateway includes a Modbus TCP receiving module, a Modbus TCP decryption module, a Modbus RTU / ASCII data grouping module, a Modbus RTU / ASCII encryption module, a Modbus RTU / ASCII sending module, and a Modbus TCP forwarding module;

[0103] When the Modbus TCP receiving module receives a Modbus TCP frame, it checks the function code in the Modbus TCP frame. If the function code indicates the need to communicate with a Modbus RTU / ASCII device, it triggers the protocol conversion function; extracts the data in the Modbus TCP frame and passes it to the Modbus TCP decryption module;

[0104] After receiving the ciphertext data from the Modbus TCP data frame, the Modbus TCP decryption module decrypts the ciphertext data using the pre-shared Modbus TCP key and decryption mechanism to obtain the plaintext data; and forwards the plaintext data to the Modbus RTU / ASCII data grouping module;

[0105] After receiving the plaintext data, the Modbus RTU / ASCII data grouping module groups the plaintext data according to the Modbus RTU / ASCII protocol format, formats the grouped data according to the Modbus RTU / ASCII communication standard, and then sends it to the Modbus RTU / ASCII encryption module;

[0106] After receiving the grouped data, the Modbus RTU / ASCII encryption module encrypts the grouped data using the Modbus RTU / ASCII key and encryption mechanism, and then inputs it to the Modbus RTU / ASCII sending module;

[0107] The Modbus RTU / ASCII sending module converts the encrypted grouped data from Modbus RTU / ACSII to a Modbus TCP data frame and encrypts it using the Modbus TCP key; sends the converted encrypted data to the Modbus TCP receiving module.

[0108] In a specific embodiment of the present invention, the slave device receives the specified message sent from the gateway and determines whether the specified message is encrypted or whether verification is included according to the function code carried in the specified message.

[0109] After the slave device node receives the data frame, it checks the value of the function code in the predetermined message protocol header;

[0110] If the value of the function code is 101 or 105, it is determined that the specified message is not encrypted;

[0111] If the value of the function code is 102 or 106, it is determined that the specified message is encrypted;

[0112] If the value of the function code is 103 or 107, it is determined that the specified message uses only verification;

[0113] If the value of the function code is 104 or 108, it is determined that the specified message uses encryption combined with verification.

[0114] When the node receives a message, it needs to distinguish different types of messages according to the value of the function code, and then process them separately. According to different security measures, these messages can be divided into two types: non-encrypted mode messages and encrypted mode messages. When the node receives a message, it needs to distinguish different types of messages according to the value of the function code, and then process them separately. According to different security measures, these messages can be divided into two types: only verification level messages and verification + encryption level messages. The processing procedures of the four types of messages, namely non-encrypted mode messages, encrypted mode messages, only verification level messages, and verification + encryption level messages, are described below.

[0115] In a specific embodiment of the present invention, if the specified message is encrypted or verified, the specified message is decrypted or decoded and verified according to the decryption mode or decoding and verification method corresponding to the function code, and the obtained plaintext or integrity verification result includes:

[0116] If the specified message is not encrypted, the slave device extracts the plaintext from the DATA field according to the message format of the non-encrypted mode; temporarily stores the DATA field information of this data frame, and deletes the DATA field information of the previously stored data frame;

[0117] Processing procedure of non-encrypted mode messages:

[0118] After the node receives the Modbus data frame, it checks the value of the function code in the Modbus protocol header. If the value of the function code is 101 (no encryption within the domain) or 105 (no encryption across domains), it indicates that the currently received message is a message in the non-encrypted mode, and then the following steps are executed:

[0119] Step 1: Extract the plaintext from the DATA field according to the message format of the non-encrypted mode.

[0120] Step 2: Temporarily store the DATA field information of this Modbus data frame, and delete the DATA field information of the previously stored Modbus data frame.

[0121] If the specified message is encrypted, the slave device extracts the plaintext and ciphertext from the DATA field according to the message format of the encryption mode; decrypts the ciphertext CM to obtain the plaintext PM; temporarily stores the DATA field information of this data frame, and deletes the DATA field information of the previously stored data frame.

[0122] Processing flow of the encrypted mode message:

[0123] After the node receives the Modbus data frame, it checks the value of the function code in the Modbus protocol header. If the value of the function code is 102 (only encryption password within the domain) or 106 (only encryption password across domains), it indicates that the currently received message is an encrypted mode message, and then the following steps are executed:

[0124] Step 1: Extract the ciphertext from the DATA field according to the message format of the encryption mode.

[0125] Step 2: Decrypt the ciphertext CM to obtain the plaintext PM, as shown in Formula 4.

[0126] PM = F dec (K sess,l , CM) #4

[0127] Step 3: Temporarily store the DATA field information of this Modbus data frame, and delete the Modbus field information of the previously stored Modbus data frame.

[0128] If the specified message uses only verification, the slave device extracts the message authentication code AUTH for the plaintext and the plaintext PM from the DATA field according to the message format of the only verification level PM and the plaintext PM; calculates XAUTH using the plaintext PM PM ; compares XAUTH PM with AUTH pM and if they are equal, accepts the plaintext PM, otherwise, discards the plaintext PM and ends the process; increments the counter CTR corresponding to the slave device l by one; temporarily stores the DATA field information of this data frame, and deletes the DATA field information of the previously stored data frame.

[0129] Processing flow of the only verification message:

[0130] After the node receives the Modbus data frame, it checks the function code value in the Modbus protocol header. If the value of the function code is 103 (only verification code within the domain) or 107 (only verification code across domains), it indicates that the currently received message is a message at the only verification level, and then the following steps are executed:

[0131] Step 1: Extract the message authentication code AUTH for the plaintext and the plaintext PM from the DATA field according to the message format of the only verification level PM and the plaintext PM.

[0132] Step 2: Calculate XAUTH PM , as shown in Equation 5. Then compare XAUTH PM with AUTH PM . If they are equal, accept the plaintext PM; otherwise, discard the plaintext PM and end the process.

[0133] XAUTH PM = F mac (K sesxs,l || CTR l , PM) #5

[0134] Step 3: Increment the counter CTR l corresponding to this slave node by one.

[0135] Step 4: Temporarily store the DATA field information of this Modbus data frame and delete the DATA field information of the previously stored Modbus data frame.

[0136] If the specified message uses encrypted combined verification, the slave device retrieves the ciphertext CM from the Modbus domain according to the message format of the verification + encryption level; decrypts the ciphertext CM to obtain the message authentication code AUTH PM for the plaintext and the plaintext PM; calculates XAUTH PM using the plaintext PM; compares XAUTH PM with AUTH PM . If they are equal, accept the plaintext PM; otherwise, discard the plaintext PM and end the process; increment the counter CTR l corresponding to the slave device by one; temporarily store the DATA field information of this data frame and delete the DATA field information of the previously stored data frame;

[0137] Processing flow for encrypting and verifying the message:

[0138] After receiving a Modbus data frame, the node checks the function code value in the Modbus protocol header. If the function code value is 104 (intra-domain verification + encryption) or 108 (cross-domain verification + encryption), it indicates that the currently received message is a message of the verification + encryption level. Then, perform the following steps:

[0139] Step 1: Retrieve the ciphertext CM from the Modbus domain according to the message format of the verification + encryption level.

[0140] Step 2: Decrypt the ciphertext CM to obtain the message authentication code AUTH PM for the plaintext and the plaintext PM, as shown in Equation 6.

[0141] AUTH PM || PM = Fdec (K sess,l ,CM)#6

[0142] Step 3: Calculate XAUTH PM , as shown in Formula 6. Then compare XAUTH PM with AUTH PM . If they are equal, accept the plaintext PM; otherwise, discard the plaintext PM and end the process.

[0143] Step 4: Increment the counter CTR1 corresponding to this slave node by one.

[0144] Step 5: Temporarily store the DATA field information of this Modbus data frame and delete the previously stored DATA field information of the Modbus data frame.

[0145] In this solution, the key protection points are hierarchical encryption, integrity protection, and heterogeneous network protocols. These core functions ensure the secure transmission of data, the compatibility of the system, and the interoperability of devices with different protocols. However, the protocol design is not unique, so similar inventive purposes can be achieved through other solutions. First, regarding the hierarchical encryption mechanism, although this invention uses the SM4 symmetric encryption algorithm and implements hierarchical encryption through function codes, other symmetric encryption algorithms (such as AES or ChaCha20) can also be used as alternatives. As an internationally widely used encryption standard, AES has received hardware acceleration support and may provide better performance in certain scenarios. Additionally, ChaCha20 is an efficient symmetric encryption algorithm, especially suitable for low-power devices and scenarios requiring high performance. Other symmetric encryption algorithms can also provide data encryption functions and optimize performance and resource consumption in different scenarios.

[0146] In terms of the integrity protection mechanism, this invention uses the SM3 message authentication code (MAC), but it can also be replaced by other authentication algorithms, such as HMAC (hash-based message authentication code). For example, HMAC-SHA256 is a widely used authentication scheme that can provide strong collision resistance and encryption strength and is also suitable for ensuring the integrity and authenticity of data. Other hash algorithms such as SHA-256 can also replace SM3 in different environments. Especially in international scenarios, the more widely used SHA series algorithms may provide better compatibility.

[0147] For the interconnection of heterogeneous network protocols, this solution realizes the interoperability between Modbus RTU / ASCII and Modbus TCP protocols through a protocol converter. This design is not limited to the Modbus protocol. Other common industrial protocols, such as OPC UA (Open Platform Communications Unified Architecture), can also be used as alternative solutions. These protocols are widely used in industrial automation and building management systems, and there are already mature protocol conversion mechanisms and adaptation tools. By adapting these protocols, the system can also achieve compatibility and data exchange between different devices, meeting the requirements in different industrial scenarios.

[0148] In addition, in addition to SM3 and SM4, many internationally standardized cryptographic algorithms can also be used as alternatives. For example, AES (Advanced Encryption Standard) and SHA-256 are widely used and have good performance, suitable for scenarios involving large-scale data transmission or high-performance computing. In some scenarios, RSA or ECC (Elliptic Curve Cryptography) may be used for asymmetric encryption, especially in applications that require digital signatures and key exchanges. These alternative solutions can provide similar encryption effects and offer flexible choices according to different security requirements and computing capabilities.

[0149] In a second aspect, the present invention provides a heterogeneous industrial control protocol security enhancement terminal in a cross-domain communication scenario, and the terminal is used to implement the specific functions of the master device or the slave device in the heterogeneous industrial control protocol security enhancement method in the first aspect of the cross-domain communication scenario.

[0150] In a third aspect, the present invention provides a heterogeneous industrial control protocol security enhancement system in a cross-domain communication scenario, and the system includes a master device, a gateway, and a slave device. The master device, the gateway, and the slave device cooperate with each other to implement the heterogeneous industrial control protocol security enhancement method in the first aspect of the cross-domain communication scenario.

[0151] Despite these alternative solutions, the present invention still performs optimally in terms of performance, security, and adaptability. By adopting the SM4 symmetric encryption algorithm, the present invention reduces the high computational overhead of asymmetric encryption, ensuring the encryption and decryption speed and the adaptability to low-power devices. Compared with other solutions, the encryption method of the present invention is more efficient and can handle the high-frequency data transmission requirements in industrial control systems. At the same time, the seamless conversion between Modbus RTU / ASCII and Modbus TCP protocols enables the system to be compatible with new and old devices, avoiding the costly equipment replacement cost.

[0152] It should be noted that the terms "first" and "second" in the present invention are only for descriptive purposes and cannot be construed as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. Thus, features defined with "first" and "second" may explicitly or implicitly include one or more of such features. In the description of the present invention, "a plurality of" means two or more unless otherwise specifically defined.

[0153] Although the present application has been described in conjunction with various embodiments herein, however, in the process of implementing the claimed present application, those skilled in the art can understand and achieve other variations of the disclosed embodiments by viewing the accompanying drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "one" does not exclude a plurality of cases.

[0154] The above content is a further detailed description of the present invention in conjunction with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is only limited to these descriptions. For those of ordinary skill in the technical field to which the present invention pertains, without departing from the concept of the present invention, several simple deductions or substitutions can be made, and all should be regarded as belonging to the protection scope of the present invention.

Claims

1. A method for enhancing the security of heterogeneous industrial control protocols in a cross - domain communication scenario, characterized in that, Including: The master device places the corresponding function code into the function code part of the specified message according to its own needs and sends the specified message to the slave device; wherein, the specified message includes Modbus TCP protocol message, Modbus RTU message and ASCII message; The gateway determines whether the protocol of the specified message is the same as that of the slave device. If not, it performs protocol conversion on the specified message and then sends it to the slave device; if the same, it directly forwards the specified message to the slave device; The slave device receives the specified message sent from the gateway and determines whether the specified message is encrypted or verified according to the function code carried in the specified message. If the specified message is encrypted or verified, it performs corresponding decryption or decoding verification on the specified message according to the decryption mode or decoding verification method corresponding to the function code to obtain the plaintext or integrity verification result.

2. The heterogeneous industrial control protocol security enhancement method in the cross-domain communication scenario according to claim 1, wherein The master device placing the predetermined function code into the function code part of the specified message according to its own needs and sending the specified message to the slave device includes: The master device places the corresponding function code into the function code part of the specified message according to its own need of whether to encrypt or not and sends the specified message to the slave device; The master device places the corresponding function code into the function code part of the specified message according to its own need of only verification or encryption combined with verification and sends the specified message to the slave device.

3. The method for enhancing the security of heterogeneous industrial control protocols in a cross-domain communication scenario according to claim 2, wherein The master device placing the corresponding function code into the function code part of the specified message according to its own need of whether to encrypt or not and sending the specified message to the slave device includes: The master device places the plaintext into the DATA field of the predetermined message according to its own need that neither in-domain nor cross-domain encryption is required; sets the function code flag to 101, 105 and places it into the function code of the predetermined message to generate a data frame and sends it to the bus; The master device calculates the ciphertext using the session key and the plaintext according to its own need that only in-domain and cross-domain encryption is required; places the ciphertext into the DATA field of the predetermined message according to the message format of the security level of only encryption; sets the function code flag to 102, 106 and places it into the function code of the predetermined message to generate a data frame and sends it to the bus; wherein, 101 represents no opcode in the domain, 105 represents no opcode across domains, 102 represents only encryption code in the domain, and 106 represents only encryption code across domains.

4. The method for enhancing the security of heterogeneous industrial control protocols in a cross-domain communication scenario according to claim 2, characterized in that, The master device placing the corresponding function code into the function code part of the specified message according to its own need of only verification or encryption combined with verification and sending the specified message to the slave device includes: The master device calculates a 16 / 32-byte message authentication code AUTH for the plaintext using the session key K sess,l , the counter CTR1, and the plaintext PM PM ; according to the message format of the security level to be only verified, the message authentication code for the plaintext and the plaintext are placed in the DATA field of the predetermined message; the function code flag is set to 103, 107, and together with the identifier of the slave address, they are placed in the protocol header of the predetermined message to generate a data frame, which is sent to the bus; after sending, the counter corresponding to the slave device is incremented by one; The master device uses the session key K according to its own requirements for encrypted joint verification sess,l , the counter CTR l and the plaintext PM to calculate the 16 / 32-byte message authentication code AUTH for the plaintext PM ; uses the session key K sess,l , the message authentication code AUTH for the plaintext PM and the plaintext PM to calculate the ciphertext CM; according to the message format of the security level of verification joint encryption, put the ciphertext CM into the DATA field of the predetermined message; set the function code flag to 104, 108, and put it into the protocol header of the predetermined message to generate a data frame and send it to the bus; after sending, increment the counter corresponding to the slave device by one; among them, 103 means only verification code within the domain, 107 means only verification code across domains, 104 means in-domain verification + encryption, and 108 means cross-domain verification + encryption.

5. The method for enhancing the security of heterogeneous industrial control protocols in a cross-domain communication scenario according to claim 1, characterized in that The gateway includes a Modbus TCP receiving module, a Modbus TCP decryption module, a Modbus RTU / ASCII data grouping module, a Modbus RTU / ASCII encryption module, a Modbus RTU / ASCII sending module and a Modbus TCP forwarding module; When the Modbus TCP receiving module receives a Modbus TCP frame, it checks the function code in the Modbus TCP frame. If the function code indicates that communication with a Modbus RTU / ASCII device is required, the protocol conversion function is triggered; the data in the Modbus TCP frame is extracted and passed to the Modbus TCP decryption module; After receiving the ciphertext data from the Modbus TCP data frame, the Modbus TCP decryption module decrypts the ciphertext data using the pre-shared Modbus TCP key and decryption mechanism to obtain the plaintext data; and forwards the plaintext data to the Modbus RTU / ASCII data grouping module; After receiving the plaintext data, the Modbus RTU / ASCII data grouping module groups the plaintext data according to the Modbus RTU / ASCII protocol format, formats the grouped data according to the Modbus RTU / ASCII communication standard, and then sends it to the Modbus RTU / ASCII encryption module; After receiving the grouped data, the Modbus RTU / ASCII encryption module encrypts the grouped data using the Modbus RTU / ASCII key and encryption mechanism, and then inputs it to the Modbus RTU / ASCII sending module; The Modbus RTU / ASCII sending module converts the encrypted grouped data from Modbus RTU / ACSII to a Modbus TCP data frame and encrypts it using the Modbus TCP key; the converted encrypted data is sent to the Modbus TCP receiving module.

6. The heterogeneous industrial control protocol security enhancement method in a cross-domain communication scenario according to claim 1, characterized in that The slave device receives the specified message sent from the gateway, and determining whether the specified message is encrypted or verified according to the function code carried in the specified message includes: The slave device, after receiving the data frame, checks the value of the function code in the predetermined message protocol header; If the value of the function code is 101 or 105, it is determined that the specified message is not encrypted; If the value of the function code is 102 or 106, it is determined that the specified message is encrypted; If the value of the function code is 103 or 107, it is determined that the specified message is only verified; If the value of the function code is 104 or 108, it is determined that the specified message is encrypted and jointly verified.

7. The method for enhancing the security of heterogeneous industrial control protocols in a cross-domain communication scenario according to claim 6, wherein If the specified message is encrypted or verified, corresponding decryption or decoding verification is performed on the specified message according to the decryption mode or decoding verification method corresponding to the function code, and the plaintext or integrity verification result is obtained, including: If the specified message is not encrypted, the slave device extracts the plaintext from the DATA field according to the message format in the non-encrypted mode; temporarily stores the DATA field information of this data frame, and deletes the DATA field information of the previously stored data frame; If the specified message is encrypted, the slave device extracts the plaintext and ciphertext from the DATA field according to the message format of the encryption mode; decrypts the ciphertext CM to obtain the plaintext PM; temporarily stores the DATA field information of this data frame, and deletes the DATA field information of the previously stored data frame. If the specified message uses only verification, the slave device extracts the message authentication code AUTH for the plaintext from the DATA field according to the message format of the only verification level PM and the plaintext PM; calculate XAUTH using the plaintext PM PM ; compare XAUTH PM with AUTH PM If they are equal, accept the plaintext PM, otherwise, discard the plaintext PM and end the process; increment the counter CTR corresponding to the slave device l by one; temporarily store the DATA field information of this data frame and delete the DATA field information of the previously stored data frame; If the specified message uses encrypted combined verification, the slave device retrieves the ciphertext CM from the Modbus domain according to the message format of verification + encryption level; decrypts the ciphertext CM to obtain the message authentication code AUTH for the plaintext PM and the plaintext PM; calculates XAUTH using the plaintext PM PM ; compares XAUTH PM with AUTH PM and if they are equal, accepts the plaintext PM, otherwise, discards the plaintext PM and ends the process; increments the counter CTR corresponding to the slave device l by one; temporarily stores the DATA field information of this data frame and deletes the DATA field information of the previously stored data frame.

8. A heterogeneous industrial control protocol security enhanced terminal in a cross-domain communication scenario, characterized in that, The terminal is used to implement the specific functions of the master device or the slave device in the heterogeneous industrial control protocol security enhancement method in any cross-domain communication scenario of claims 1 to 7.

9. A heterogeneous industrial control protocol security enhancement system in a cross-domain communication scenario, characterized in that The system includes a master device, a gateway, and a slave device, and the master device, the gateway, and the slave device cooperate with each other to implement the heterogeneous industrial control protocol security enhancement method in any cross-domain communication scenario of claims 1 to 7.

Images