A method, apparatus, device, and storage medium for recovering OPC communication interruptions in an industrial firewall.

Abstract

This application discloses a method, apparatus, device, and storage medium for recovering OPC communication interruptions in an industrial firewall, relating to the field of computer technology. The method includes: if both the source and destination ports of a TCP packet are high-order ports, and the four-tuple information of the TCP packet belongs to a preset TCP data processing flow table, then determining whether the TCP packet is the first packet in the current TCP stream; based on the determination result and the preset TCP data processing flow table, determining whether it is the first retransmission packet; if so, and the TCP packet has a payload, then checking the target byte of the payload based on OPC protocol characteristics; if the target byte meets preset byte conditions, then allowing all packets in the current TCP stream to proceed, thus completing the OPC communication interruption recovery operation. This method effectively and cost-efficiently prevents OPC communication interruptions caused by dynamic changes in high-order ports, firewall restarts, or deployment delays.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, device, and storage medium for recovering OPC communication interruptions in an industrial firewall. Background Technology

[0002] OPC (OLE for Process Control, a communication protocol standard in industrial automation) is widely used in manufacturing, energy, transportation, and other industries. Client and server devices using the OPC protocol transmit data through two high-order TCP (Transmission Control Protocol) ports greater than 1024. The server's high-order port is communicated to the client via TCP port 135. When using industrial firewalls to protect OPC communication, the most common approach is to parse the traffic on port 135 to obtain the high-order port provided by the server, and then instruct the kernel to allow data plane traffic by establishing iptables rules or establishing desired connections. However, since the established iptables rules or desired connections only exist in memory, if the industrial firewall restarts or is deployed later than the time the server provided the high-order port, the port information will be lost. This leads to multiple retransmissions of OPC packets, preventing them from passing through the firewall and ultimately causing OPC communication interruption.

[0003] To solve the OPC communication interruption problem, there are usually two solutions: (1) The administrator manually issues rules for the high-level ports to the industrial firewall by observing the interception logs of the high-level ports; (2) When the high-level ports are resolved, the port information is stored in the firewall's local file. After the firewall is powered on again, rules are automatically created based on the stored port information to allow OPC data packets. However, manually issuing rules requires a high level of expertise from the administrator, who needs to detect problems in a timely manner, otherwise it may cause production accidents. The high-level ports used for communication are renegotiations every once in a while. If these ports are all stored locally, it will cause the creation of too many useless rules when the firewall is powered on and restarted, thus affecting the firewall's performance.

[0004] As can be seen from the above, how to prevent OPC communication from being interrupted due to dynamic changes in high-level ports, firewall restarts, or deployment delays at low cost and with high efficiency is an urgent problem to be solved. Summary of the Invention

[0005] In view of this, the purpose of this invention is to provide a method, apparatus, device, and storage medium for recovering OPC communication interruptions in industrial firewalls, which can prevent OPC communication interruptions caused by dynamic changes in high-level ports, firewall restarts, or deployment delays at low cost and with high efficiency. The specific solution is as follows:

[0006] Firstly, this application provides a method for recovering from OPC communication interruption in an industrial firewall, including:

[0007] The network interface card (NIC) of an industrial firewall receives TCP packets from the network. If both the source and destination ports of the TCP packet are high-order ports, and the four-tuple information of the TCP packet belongs to a preset TCP data processing flow table, then the number of packets in the current TCP flow in the preset TCP data processing flow table is updated, and it is determined whether the TCP packet is the first packet of the current TCP flow. Based on the first determination result, the sequence number of the previous packet and the sequence number of the current packet are determined. The high-order port is a port in the TCP protocol whose port number is greater than a preset threshold.

[0008] Determine whether the sequence number of the previous packet is equal to the sequence number of the current packet, and determine whether the TCP data packet is the first retransmission packet of the current TCP stream based on the second determination result and the preset TCP data processing flow table;

[0009] If the TCP packet is the first retransmission packet of the current TCP stream, then it is determined whether the TCP packet has a payload. If the TCP packet has a payload, then the target byte of the payload is checked based on the OPC protocol characteristics, and the check result is used to determine whether the target byte meets the preset byte conditions.

[0010] If the target byte satisfies the preset byte condition, then the TCP data packet is characterized as an OPC data packet that meets the preset OPC protocol standard, and all data packets in the current TCP stream are allowed to complete the corresponding OPC communication interruption recovery operation.

[0011] Optionally, when using the network interface card of the industrial firewall to receive TCP packets from the network, if both the source port and destination port of the TCP packet are high-order ports, and the four-tuple information of the TCP packet belongs to a preset TCP data processing flow table, then the number of packets in the current TCP flow in the preset TCP data processing flow table is updated, including:

[0012] The network interface card of the industrial firewall is used to receive TCP packets from the network, and it is determined whether the source port and destination port of the TCP packets are both high-order ports.

[0013] If both the source port and destination port of the TCP data packet are high-order ports, then determine whether the four-tuple information of the TCP data packet belongs to the preset TCP data processing flow table.

[0014] If it does not belong to the preset TCP data processing flow table, then create a flow table node, assign the quadruple information to the target element of the flow table node, and add the flow table node to the preset TCP data processing flow table.

[0015] If it belongs to the preset TCP data processing flow table, the number of data packets in the current TCP flow in the preset TCP data processing flow table is updated based on the first preset increment method.

[0016] Optionally, determining whether the TCP packet is the first packet of the current TCP stream, and determining the sequence number of the previous packet and the sequence number of the current packet based on the first determination result, includes:

[0017] Determine whether the TCP packet is the first packet in the current TCP stream;

[0018] If the TCP packet is the first packet in the current TCP stream, then the first sequence number corresponding to the TCP packet is determined as the sequence number of the previous packet and the current packet of the TCP packet;

[0019] If the TCP packet is not the first packet of the current TCP stream, then the second sequence number corresponding to the TCP packet is determined as the current packet sequence number of the TCP packet, and the current packet sequence number corresponding to the previous packet is determined as the previous packet sequence number of the TCP packet.

[0020] Optionally, the step of determining whether the sequence number of the previous packet is equal to the sequence number of the current packet, and determining whether the TCP data packet is the first retransmission packet of the current TCP stream based on the second determination result and the preset TCP data processing flow table, includes:

[0021] Determine whether the sequence number of the previous TCP packet is equal to the sequence number of the current packet;

[0022] If they are not equal, it indicates that the TCP data packet is a new packet, and the retransmission packet count of the current TCP stream in the preset TCP data processing flow table is cleared to zero;

[0023] If they are equal, the TCP data packet is a retransmission packet, and the retransmission packet count is updated based on the second preset increment method. If the updated retransmission packet count is the first target value, the current TCP stream has its first retransmission packet. The number of the first retransmission packet markers in the preset TCP data processing flow table of the current TCP stream is determined as the second target value. If the number of stream packets in the preset TCP data processing flow table of the current TCP stream is the third target value, the TCP data packet is the first retransmission packet of the current TCP stream.

[0024] Optionally, after determining whether the TCP packet is the first retransmission packet of the current TCP stream based on the second judgment result and the preset TCP data processing flow table, the method further includes:

[0025] If the TCP packet is not the first retransmission packet of the current TCP stream, then based on the target node element in the preset TCP data processing flow table and the TCP packet, all packets of the current TCP stream are allowed or blocked to complete the corresponding OPC communication interruption recovery operation.

[0026] Optionally, if the TCP data packet is the first retransmission packet of the current TCP stream, then it is determined whether the TCP data packet has a payload. If the TCP data packet has a payload, the target byte of the payload is checked based on OPC protocol characteristics, and the check result is used to determine whether the target byte meets a preset byte condition, including:

[0027] If the TCP packet is the first retransmission packet of the current TCP stream, then determine whether the TCP packet has a payload;

[0028] If the TCP packet has no payload, it indicates that the TCP packet is a connection packet, and the number of temporarily allowed packets in the current TCP flow in the preset TCP data processing flow table is determined as the fourth target value; the connection packet is a packet obtained based on the TCP three-way handshake for establishing a connection relationship;

[0029] If the TCP packet has a payload, the target byte of the payload is checked based on the characteristics of the OPC protocol, and the check result is used to determine whether the target byte meets the preset byte conditions.

[0030] Optionally, if the target byte satisfies the preset byte condition, then the TCP data packet is characterized as an OPC data packet that satisfies the preset OPC protocol standard, and all data packets in the current TCP stream are allowed to complete the corresponding OPC communication interruption recovery operation, including:

[0031] If the target byte satisfies the preset byte condition, then the TCP data packet is an OPC data packet that meets the preset OPC protocol standard. The number of permanently allowed data packets in the preset TCP data processing flow table of the current TCP stream is determined to be the fifth target value, and all data packets of the current TCP stream are allowed to complete the corresponding OPC communication interruption recovery operation.

[0032] Secondly, this application provides an industrial firewall OPC communication interruption recovery device, comprising:

[0033] The sequence number determination module is used to receive TCP packets from the network using the network card of the industrial firewall. If the source port and destination port of the TCP packet are both high-order ports, and the four-tuple information of the TCP packet belongs to a preset TCP data processing flow table, then the number of packets in the current TCP flow in the preset TCP data processing flow table is updated, and it is determined whether the TCP packet is the first packet of the current TCP flow. Based on the first determination result, the sequence number of the previous packet and the sequence number of the current packet of the TCP packet are determined. The high-order port is a port in the TCP protocol whose port number is greater than a preset threshold.

[0034] The data packet judgment module is used to determine whether the sequence number of the previous packet is equal to the sequence number of the current packet, and to determine whether the TCP data packet is the first retransmission packet of the current TCP stream based on the second judgment result and the preset TCP data processing flow table;

[0035] The byte checking module is used to determine whether the TCP data packet has a payload if the TCP data packet is the first retransmission packet of the current TCP stream. If the TCP data packet has a payload, the target byte of the payload is checked based on the OPC protocol characteristics, and the check result is used to determine whether the target byte meets the preset byte conditions.

[0036] The data packet release module is used to indicate that the TCP data packet is an OPC data packet that meets the preset OPC protocol standard if the target byte meets the preset byte condition, and to release all data packets in the current TCP stream to complete the corresponding OPC communication interruption recovery operation.

[0037] Thirdly, this application provides an electronic device, comprising:

[0038] Memory, used to store computer programs;

[0039] A processor is used to execute the computer program to implement the aforementioned industrial firewall OPC communication interruption recovery method.

[0040] Fourthly, this application provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned industrial firewall OPC communication interruption recovery method.

[0041] This application utilizes the network interface card (NIC) of an industrial firewall to receive TCP packets from the network. If both the source and destination ports of the TCP packet are high-order ports, and the four-tuple information of the TCP packet belongs to a preset TCP data processing flow table, then the number of packets in the current TCP flow in the preset TCP data processing flow table is updated, and it is determined whether the TCP packet is the first packet of the current TCP flow. Based on the first determination result, the sequence number of the previous packet and the sequence number of the current packet are determined. The high-order port is a port in the TCP protocol whose port number is greater than a preset threshold. It is determined whether the sequence number of the previous packet and the sequence number of the current packet are equal, and based on the second determination result... The system determines whether the TCP packet is the first retransmission packet of the current TCP stream based on the preset TCP data processing flow table. If the TCP packet is the first retransmission packet of the current TCP stream, it determines whether the TCP packet has a payload. If the TCP packet has a payload, it checks the target byte of the payload based on OPC protocol characteristics and uses the check result to determine whether the target byte meets the preset byte condition. If the target byte meets the preset byte condition, it indicates that the TCP packet is an OPC packet that meets the preset OPC protocol standard, and all packets of the current TCP stream are allowed to complete the corresponding OPC communication interruption recovery operation.

[0042] As can be seen from the above, this application first automatically identifies the TCP stream of the high-order port, avoiding manual intervention. Then, by monitoring the first retransmission packet of the TCP stream of the high-order port and performing OPC protocol feature checks on the payload of the first retransmission packet, it ensures that the target byte of the payload meets the preset byte conditions. Without relying on port parsing or storage, the OPC attribute of the TCP stream can be confirmed. If it is determined to be an OPC data packet, all data packets of the current TCP stream are allowed to pass, achieving immediate communication recovery. In this way, by judging the first retransmission packet and allowing OPC data packets that conform to the preset OPC protocol standard to pass, the problem of OPC communication terminals is directly solved. Even if the firewall restarts, deployment is delayed, or the port changes dynamically, the OPC stream can still be identified through retransmission packet features, ensuring communication continuity and guaranteeing the stability of industrial firewall performance. Attached Figure Description

[0043] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0044] Figure 1 This application discloses a flowchart of an OPC communication interruption recovery method for an industrial firewall.

[0045] Figure 2 This application discloses a pre-defined TCP data processing stream representation intent;

[0046] Figure 3 This is a schematic diagram of OPC communication interruption recovery disclosed in this application;

[0047] Figure 4 This application discloses a specific flowchart of an industrial firewall OPC communication interruption recovery method.

[0048] Figure 5 This is a schematic diagram of TCP data preprocessing disclosed in this application;

[0049] Figure 6 This is a schematic diagram of a retransmission packet processing method disclosed in this application;

[0050] Figure 7 This is a schematic diagram of the structure of an industrial firewall OPC communication interruption recovery device disclosed in this application;

[0051] Figure 8 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0052] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0053] Currently, to resolve OPC communication interruption issues, administrators need to manually issue rules for high-level ports to the industrial firewall by observing the interception logs of these ports; or, when a high-level port is parsed, the port information is stored in a local file on the firewall, and rules are automatically created to allow OPC data packets after the firewall is powered on again. However, manually issuing rules places high demands on administrators, requiring them to promptly identify problems; otherwise, it could lead to production accidents. Furthermore, the high-level ports used for communication are renegotiations periodically. Storing these ports locally would result in too many useless rules being created during power-on restarts, impacting firewall performance. Therefore, this application provides a method for recovering from OPC communication interruptions in industrial firewalls. By judging the first retransmission packet, OPC data packets conforming to the preset OPC protocol standard are allowed to pass, directly solving the OPC communication terminal problem. Even if the firewall restarts, deployment is delayed, or ports change dynamically, the OPC flow can still be identified through retransmission packet characteristics, ensuring communication continuity and guaranteeing the stability of the industrial firewall performance.

[0054] See Figure 1 As shown in the figure, an embodiment of the present invention discloses a method for recovering from OPC communication interruption in an industrial firewall, comprising:

[0055] Step S11: Receive TCP packets from the network using the network card of the industrial firewall. If both the source port and destination port of the TCP packet are high-order ports, and the four-tuple information of the TCP packet belongs to a preset TCP data processing flow table, update the number of packets in the preset TCP data processing flow table for the current TCP flow, and determine whether the TCP packet is the first packet of the current TCP flow. Based on the first determination result, determine the sequence number of the previous packet and the sequence number of the current packet of the TCP packet. The high-order port is a port in the TCP protocol whose port number is greater than a preset threshold.

[0056] In this embodiment, the network interface card of the industrial firewall is first used to receive TCP data packets from the network. Then, it is determined whether the source port and destination port of the TCP data packet are both high-order ports with port numbers greater than 1024 in the TCP protocol. If both the source port and the destination port are high-order ports, a preset TCP data processing flow table is established and maintained. Figure 2This embodiment provides a preset TCP data processing flow representation. The preset TCP data processing flow table records key information for each TCP flow, including the elements of each flow table node corresponding to each key information. It then determines whether the four-tuple information of the TCP data packet belongs to the preset TCP data processing flow table. The four-tuple information includes the source IP address, destination IP address, source port, and destination port. If it does not belong to the preset TCP data processing flow table, a new flow table node is created, and the four-tuple information is assigned to the target elements of the flow table node, namely src_ip, dst_ip, src_port, and dst_port. The flow table node is then added to the preset TCP data processing flow table. If it belongs to the preset TCP data processing flow table, the number of data packets pkts_counter for the current TCP flow in the preset TCP data processing flow table is incremented by 1 for updating.

[0057] Specifically, the step of receiving TCP packets from the network using the industrial firewall's network interface card (NIC), if both the source and destination ports of the TCP packets are high-order ports, and the four-tuple information of the TCP packets belongs to a preset TCP data processing flow table, then updating the number of packets in the preset TCP data processing flow table for the current TCP flow includes: receiving TCP packets from the network using the industrial firewall's NIC, determining whether both the source and destination ports of the TCP packets are high-order ports; if both the source and destination ports of the TCP packets are high-order ports, determining whether the four-tuple information of the TCP packets belongs to the preset TCP data processing flow table; if it does not belong to the preset TCP data processing flow table, creating a flow table node, assigning the four-tuple information to the target element of the flow table node, and adding the flow table node to the preset TCP data processing flow table; if it belongs to the preset TCP data processing flow table, updating the number of packets in the preset TCP flow table for the current TCP flow based on a first preset incrementing method.

[0058] Understandably, it is determined whether the TCP packet is the first packet of the current TCP stream. If it is, the first sequence number corresponding to the TCP packet is determined as the previous packet sequence number (last_seq) and the current packet sequence number (current_seq). If it is not the first packet of the current TCP stream, the current packet sequence number corresponding to the previous packet is determined as the previous packet sequence number of the TCP packet, and the second sequence number corresponding to the TCP packet is determined as the current packet sequence number of the TCP packet.

[0059] Specifically, determining whether the TCP data packet is the first data packet of the current TCP stream, and determining the previous packet sequence number and the current packet sequence number of the TCP data packet based on the first determination result, includes: determining whether the TCP data packet is the first data packet of the current TCP stream; if the TCP data packet is the first data packet of the current TCP stream, then determining the first sequence number corresponding to the TCP data packet as the previous packet sequence number and the current packet sequence number of the TCP data packet; if the TCP data packet is not the first data packet of the current TCP stream, then determining the second sequence number corresponding to the TCP data packet as the current packet sequence number of the TCP data packet, and determining the current packet sequence number corresponding to the previous data packet of the TCP data packet as the previous packet sequence number of the TCP data packet.

[0060] Step S12: Determine whether the sequence number of the previous packet is equal to the sequence number of the current packet, and determine whether the TCP data packet is the first retransmission packet of the current TCP stream based on the second determination result and the preset TCP data processing flow table.

[0061] In this embodiment, after determining the sequence number of the previous packet and the sequence number of the current packet of the TCP data packet, the sequence number of the previous packet and the sequence number of the current packet are compared to determine whether they are equal. If they are not equal, it indicates that the TCP data packet is a new packet, and the retransmission packet count retrans_counter in the preset TCP data processing flow table of the current TCP flow is cleared to zero. If they are equal, it indicates that the TCP data packet is a retransmission packet, and the retransmission packet count retrans_counter is incremented by 1. In one specific implementation, if the updated retransmission packet count is 3, it indicates that the current TCP flow has encountered its first retransmission packet, and the first retransmission packet flag first_retrans_flag in the preset TCP data processing flow table of the current TCP flow is set to 1. If the stream packet count pkts_counter in the preset TCP data processing flow table of the current TCP flow is 3, it indicates that the TCP data packet is the first retransmission packet of the current TCP flow.

[0062] Specifically, the step of determining whether the sequence number of the previous packet is equal to the sequence number of the current packet, and determining whether the TCP data packet is the first retransmission packet of the current TCP stream based on the second determination result and the preset TCP data processing flow table, includes: determining whether the sequence number of the previous packet of the TCP data packet is equal to the sequence number of the current packet; if they are not equal, it indicates that the TCP data packet is a new packet, and the retransmission packet count of the current TCP stream in the preset TCP data processing flow table is cleared to zero; if they are equal, it indicates that the TCP data packet is a retransmission packet, and the retransmission packet count is updated based on the second preset increment method; if the updated retransmission packet count is a first target value, it indicates that the current TCP stream has its first retransmission packet, and the number of the first retransmission packet markers of the current TCP stream in the preset TCP data processing flow table is determined as a second target value; if the number of stream packets of the current TCP stream in the preset TCP data processing flow table is a third target value, it indicates that the TCP data packet is the first retransmission packet of the current TCP stream.

[0063] It is understood that if the TCP packet is not the first retransmission packet of the current TCP stream, then all packets of the current TCP stream are allowed or blocked based on the target node element in the preset TCP data processing flow table and the TCP packet. Figure 3This embodiment illustrates an OPC communication interruption recovery process. The number of permanently allowed packets (per_pass_flag) in the preset TCP data processing flow table is read. If it is 1, it indicates that the current TCP flow is an OPC flow that meets the preset OPC protocol standard, and all packets in the current TCP flow are allowed. If per_pass_flag is not 1, the number of temporarily allowed packets (tmp_pass_flag) in the preset TCP data processing flow table is checked to see if it is 1. If it is, it is determined whether the TCP packet is the first retransmission packet of the current TCP flow. If it is, the first retransmission packet of the current TCP flow is allowed. If it is not, it is determined whether the TCP packet has a payload. If there is no payload, the current TCP flow is still in the three-way handshake connection establishment phase, and all data in the TCP flow is allowed. If a TCP packet has a payload, determine whether it is an OPC packet that meets the preset OPC protocol standard. If it is an OPC packet that meets the preset OPC protocol standard, allow all packets in the current TCP stream and set the number of permanently allowed packets per_pass_flag in the preset TCP data processing flow table to 1, indicating that the current TCP stream is an OPC stream. If it is not an OPC packet that meets the preset OPC protocol standard, set the number of temporarily allowed packets tmp_pass_flag in the preset TCP data processing flow table to 0. When both the number of permanently allowed packets per_pass_flag and the number of temporarily allowed packets tmp_pass_flag are 0, it indicates that the current TCP stream is identified as a non-OPC stream, and all packets in the current TCP stream are intercepted to complete the corresponding OPC communication interruption recovery operation. Specifically, after determining whether the TCP data packet is the first retransmission packet of the current TCP stream based on the second judgment result and the preset TCP data processing flow table, the method further includes: if the TCP data packet is not the first retransmission packet of the current TCP stream, then based on the target node element in the preset TCP data processing flow table and the TCP data packet, allow or intercept all data packets of the current TCP stream to complete the corresponding OPC communication interruption recovery operation.

[0064] Step S13: If the TCP data packet is the first retransmission packet of the current TCP stream, determine whether the TCP data packet has a payload. If the TCP data packet has a payload, check the target byte of the payload based on the OPC protocol characteristics, and use the check result to determine whether the target byte meets the preset byte conditions.

[0065] In this embodiment, if the TCP data packet is the first retransmission packet of the current TCP stream, it is determined whether the payload portion of the TCP data packet contains data. If not, the TCP data packet is characterized as a connection packet, and the number of temporarily allowed packets (tmp_pass_flag) in the preset TCP data processing flow table for the current TCP stream is set to 1. If yes, the target byte of the payload is checked based on OPC protocol characteristics, and the check result is used to determine whether the target byte meets the preset byte conditions. In one specific implementation, if the first byte of the payload is 0x5, the second byte is 0x0 to 0x7, the third byte is 0x0 to 0x13, and the fourth byte cannot be 0x0 or 0x10, then it indicates whether the target byte meets the preset byte conditions.

[0066] Specifically, if the TCP packet is the first retransmission packet of the current TCP stream, then it is determined whether the TCP packet has a payload. If the TCP packet has a payload, the target byte of the payload is checked based on the OPC protocol characteristics, and the check result is used to determine whether the target byte meets the preset byte conditions. This includes: if the TCP packet is the first retransmission packet of the current TCP stream, then it is determined whether the TCP packet has a payload; if the TCP packet has no payload, then the TCP packet is characterized as a connection packet, and the number of temporarily allowed packets in the preset TCP data processing flow table of the current TCP stream is determined as the fourth target value; the connection packet is a packet obtained based on the TCP three-way handshake for establishing a connection relationship; if the TCP packet has a payload, the target byte of the payload is checked based on the OPC protocol characteristics, and the check result is used to determine whether the target byte meets the preset byte conditions.

[0067] Step S14: If the target byte satisfies the preset byte condition, then the TCP data packet is identified as an OPC data packet that meets the preset OPC protocol standard, and all data packets in the current TCP stream are allowed to complete the corresponding OPC communication interruption recovery operation.

[0068] In this embodiment, if the target byte satisfies the preset byte condition, it indicates that the TCP data packet is an OPC data packet that meets the preset OPC protocol standard. The number of permanently allowed data packets per_pass_flag in the preset TCP data processing flow table for the current TCP stream is set to 1, and all data packets in the current TCP stream are allowed to complete the OPC communication interruption recovery operation. Specifically, the step of indicating that the TCP data packet is an OPC data packet that meets the preset OPC protocol standard and allowing all data packets in the current TCP stream to complete the corresponding OPC communication interruption recovery operation includes: if the target byte satisfies the preset byte condition, it indicates that the TCP data packet is an OPC data packet that meets the preset OPC protocol standard. The number of permanently allowed data packets in the preset TCP data processing flow table for the current TCP stream is set to a fifth target value, and all data packets in the current TCP stream are allowed to complete the corresponding OPC communication interruption recovery operation.

[0069] As can be seen from the above, this application first automatically identifies the TCP stream of the high-order port, avoiding manual intervention. Then, by monitoring the first retransmission packet of the TCP stream of the high-order port and performing OPC protocol feature checks on the payload of the first retransmission packet, it ensures that the target byte of the payload meets the preset byte conditions. Without relying on port parsing or storage, the OPC attribute of the TCP stream can be confirmed. If it is determined to be an OPC data packet, all data packets of the current TCP stream are allowed to pass, achieving immediate communication recovery. In this way, by judging the first retransmission packet and allowing OPC data packets that conform to the preset OPC protocol standard to pass, the problem of OPC communication terminals is directly solved. Even if the firewall restarts, deployment is delayed, or the port changes dynamically, the OPC stream can still be identified through retransmission packet features, ensuring communication continuity and guaranteeing the stability of industrial firewall performance.

[0070] As can be seen from the above embodiments, this application determines whether to allow data packets by checking the payload of the first retransmission packet of the high-order port, so as to realize the OPC communication interruption recovery operation. Therefore, the process of determining whether to allow data packets by checking the payload of the first retransmission packet of the high-order port is described.

[0071] See Figure 4 As shown in the figure, this invention discloses a specific method for recovering from OPC communication interruption in an industrial firewall, including:

[0072] In this embodiment, the network card of the industrial firewall is used to receive TCP data packets. It is determined whether the source port and destination port of the TCP data packet are both high-order ports with port numbers greater than 1024 in the TCP protocol. If the source port and the destination port are both high-order ports, a preset TCP data processing flow table is established and maintained. Then, it is determined whether the four-tuple information of the TCP data packet belongs to the preset TCP data processing flow table. Figure 5 This embodiment provides a schematic diagram of TCP data preprocessing. If the four-tuple information of the TCP data packet does not belong to the preset TCP data processing flow table, a new flow table node is created, and the four-tuple information is assigned to the target element of the flow table node. If the four-tuple information of the TCP data packet belongs to the preset TCP data processing flow table, the number of data packets in the current TCP flow in the preset TCP data processing flow table is updated.

[0073] Understandable Figure 6 This embodiment provides a schematic diagram of retransmission packet processing. Before determining whether a retransmission packet is a new packet, it first determines whether the TCP data packet is the first data packet of the current TCP stream. Based on the determination result, it determines the sequence number of the previous packet and the sequence number of the current packet. It then determines whether the sequence number of the previous packet and the sequence number of the current packet are equal. If they are not equal, the TCP data packet is considered a new packet, and the retransmission packet count in the preset TCP data processing flow table of the current TCP stream is cleared to zero. If they are equal, the TCP data packet is considered a retransmission packet, and the retransmission packet count is incremented by 1. If the TCP data packet is not the first retransmission packet of the current TCP stream, the TCP data packet is considered a connection packet, and the number of temporarily allowed packets (tmp_pass_flag) in the preset TCP data processing flow table of the current TCP stream is set to 1.

[0074] Furthermore, if the TCP packet is the first retransmission packet of the current TCP stream, it is determined whether the TCP packet has a payload. If the TCP packet has a payload, the target byte of the payload is checked based on OPC protocol characteristics, and the check result is used to determine whether the target byte meets a preset byte condition. If the target byte meets the preset byte condition, the TCP packet is considered an OPC packet that meets the preset OPC protocol standard. The number of permanently allowed packets per_pass_flag in the preset TCP data processing flow table for the current TCP stream is set to 1, and all packets of the current TCP stream are allowed to complete the OPC communication interruption recovery operation. If the TCP packet is not the first retransmission packet of the current TCP stream, all packets of the current TCP stream are allowed or blocked based on the target node element in the preset TCP data processing flow table and the TCP packet.

[0075] As can be seen from the above, this application monitors the first retransmission packet of the TCP stream on the high-order port and checks the payload of the first retransmission packet based on OPC protocol characteristics. If the target byte of the payload meets the preset byte conditions, the TCP data packet is determined to be an OPC data packet, and all data packets in the current TCP stream are allowed, thus achieving immediate communication recovery. In this way, by checking the payload of the first retransmission packet on the high-order port to determine whether to allow data packets, OPC communication interruption recovery operations are realized. Even if the firewall restarts, deployment is delayed, or the port changes dynamically, the OPC stream can still be identified through the retransmission packet characteristics, ensuring communication continuity and guaranteeing the stability of industrial firewall performance.

[0076] Accordingly, see Figure 7 As shown, this application also provides an industrial firewall OPC communication interruption recovery device, comprising:

[0077] The sequence number determination module 11 is used to receive TCP packets from the network using the network card of the industrial firewall. If the source port and destination port of the TCP packet are both high-order ports, and the four-tuple information of the TCP packet belongs to a preset TCP data processing flow table, then the number of packets in the current TCP flow in the preset TCP data processing flow table is updated, and it is determined whether the TCP packet is the first packet of the current TCP flow. Based on the first determination result, the sequence number of the previous packet and the sequence number of the current packet of the TCP packet are determined. The high-order port is a port in the TCP protocol whose port number is greater than a preset threshold.

[0078] The data packet judgment module 12 is used to determine whether the sequence number of the previous packet is equal to the sequence number of the current packet, and to determine whether the TCP data packet is the first retransmission packet of the current TCP stream based on the second judgment result and the preset TCP data processing flow table;

[0079] The byte checking module 13 is used to determine whether the TCP data packet has a payload if the TCP data packet is the first retransmission packet of the current TCP stream; if the TCP data packet has a payload, the target byte of the payload is checked based on the OPC protocol characteristics, and the check result is used to determine whether the target byte meets the preset byte conditions.

[0080] The packet release module 14 is used to indicate that the TCP packet is an OPC packet that meets the preset OPC protocol standard if the target byte meets the preset byte condition, and to release all packets of the current TCP stream to complete the corresponding OPC communication interruption recovery operation.

[0081] In some specific embodiments, the serial number determination module 11 may specifically include:

[0082] The port determination unit is used to receive TCP packets from the network using the network card of the industrial firewall and determine whether the source port and destination port of the TCP packets are both high-order ports.

[0083] The information judgment unit is used to determine whether the four-tuple information of the TCP data packet belongs to the preset TCP data processing flow table if both the source port and the destination port of the TCP data packet are high-order ports.

[0084] The node adding unit is used to create a flow table node if it does not belong to the preset TCP data processing flow table, assign the four-tuple information to the target element of the flow table node, and add the flow table node to the preset TCP data processing flow table.

[0085] The packet update unit is used to update the number of packets in the preset TCP data processing flow table of the current TCP flow based on a first preset incrementing method if the packet belongs to the preset TCP data processing flow table.

[0086] In some specific embodiments, the serial number determination module 11 may specifically include:

[0087] A packet determination unit is used to determine whether the TCP packet is the first packet in the current TCP stream;

[0088] The first sequence number determination unit is used to determine the first sequence number corresponding to the TCP data packet as the previous packet sequence number and the current packet sequence number of the TCP data packet if the TCP data packet is the first data packet of the current TCP stream.

[0089] The second sequence number determination unit is used to determine the second sequence number corresponding to the TCP data packet as the current packet sequence number of the TCP data packet if the TCP data packet is not the first data packet of the current TCP stream, and to determine the current packet sequence number corresponding to the previous data packet of the TCP data packet as the previous packet sequence number of the TCP data packet.

[0090] In some specific embodiments, the data packet determination module 12 may specifically include:

[0091] The sequence number determination unit is used to determine whether the sequence number of the previous TCP packet is equal to the sequence number of the current packet.

[0092] The counting processing unit is used to indicate that the TCP data packet is a new packet if they are not equal, and to clear the retransmission packet count of the current TCP stream in the preset TCP data processing flow table to zero.

[0093] The counting update unit is used to indicate that the TCP data packet is a retransmission packet if they are equal, and to update the retransmission packet count based on a second preset incrementing method. If the updated retransmission packet count is a first target value, it indicates that the current TCP stream has its first retransmission packet. The number of the first retransmission packet markers in the preset TCP data processing flow table of the current TCP stream is determined as a second target value. If the number of stream packets in the preset TCP data processing flow table of the current TCP stream is a third target value, it indicates that the TCP data packet is the first retransmission packet of the current TCP stream.

[0094] In some specific embodiments, the industrial firewall OPC communication interruption recovery device may further include:

[0095] The packet processing unit is used to, if the TCP packet is not the first retransmission packet of the current TCP stream, allow or intercept all packets of the current TCP stream based on the target node element in the preset TCP data processing flow table and the TCP packet, so as to complete the corresponding OPC communication interruption recovery operation.

[0096] In some specific embodiments, the byte inspection module 13 may specifically include:

[0097] The load determination unit is used to determine whether the TCP data packet has a load if the TCP data packet is the first retransmission packet of the current TCP stream.

[0098] The numerical determination unit is used to characterize the TCP packet as a connection packet if the TCP packet has no payload, and to determine the number of temporarily allowed packets in the preset TCP data processing flow table of the current TCP flow as a fourth target value; the connection packet is a packet obtained based on the TCP three-way handshake for establishing a connection relationship;

[0099] The byte checking unit is used to check the target byte of the TCP data packet based on the characteristics of the OPC protocol if the TCP data packet has a payload, and to use the check result to determine whether the target byte meets the preset byte conditions.

[0100] In some specific embodiments, the data packet release module 14 may specifically include:

[0101] The data packet release unit is used to, if the target byte satisfies the preset byte condition, indicate that the TCP data packet is an OPC data packet that meets the preset OPC protocol standard, determine the number of permanently released data packets in the preset TCP data processing flow table of the current TCP flow as the fifth target value, and release all data packets of the current TCP flow to complete the corresponding OPC communication interruption recovery operation.

[0102] Furthermore, embodiments of this application also disclose an electronic device, Figure 8 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the industrial firewall OPC communication interruption recovery method disclosed in any of the foregoing embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0103] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0104] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0105] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the industrial firewall OPC communication interruption recovery method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0106] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned disclosed industrial firewall OPC communication interruption recovery method. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0107] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0108] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0109] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0110] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0111] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for recovering from OPC communication interruption in an industrial firewall, characterized in that, include: The network card of the industrial firewall is used to receive TCP packets from the network. If the source port and destination port of the TCP packet are both high-order ports and the four-tuple information of the TCP packet belongs to the preset TCP data processing flow table, the number of packets in the current TCP flow in the preset TCP data processing flow table is updated, and it is determined whether the TCP packet is the first packet of the current TCP flow. Based on the first determination result, the sequence number of the previous packet and the sequence number of the current packet of the TCP packet are determined. The high-order port is the port whose port number in the TCP protocol is greater than a preset threshold; Determine whether the sequence number of the previous packet is equal to the sequence number of the current packet, and determine whether the TCP data packet is the first retransmission packet of the current TCP stream based on the second determination result and the preset TCP data processing flow table; If the TCP packet is the first retransmission packet of the current TCP stream, then it is determined whether the TCP packet has a payload. If the TCP packet has a payload, then the target byte of the payload is checked based on the OPC protocol characteristics, and the check result is used to determine whether the target byte meets the preset byte conditions. If the target byte satisfies the preset byte condition, then the TCP data packet is characterized as an OPC data packet that meets the preset OPC protocol standard, and all data packets in the current TCP stream are allowed to complete the corresponding OPC communication interruption recovery operation.

2. The industrial firewall OPC communication interruption recovery method according to claim 1, characterized in that, The process of receiving TCP packets from the network using the network interface card of the industrial firewall, if both the source and destination ports of the TCP packets are high-order ports, and the four-tuple information of the TCP packets belongs to a preset TCP data processing flow table, then updating the number of packets in the preset TCP data processing flow table for the current TCP flow includes: The network interface card of the industrial firewall is used to receive TCP packets from the network, and it is determined whether the source port and destination port of the TCP packets are both high-order ports. If both the source port and destination port of the TCP data packet are high-order ports, then determine whether the four-tuple information of the TCP data packet belongs to the preset TCP data processing flow table. If it does not belong to the preset TCP data processing flow table, then create a flow table node, assign the quadruple information to the target element of the flow table node, and add the flow table node to the preset TCP data processing flow table. If it belongs to the preset TCP data processing flow table, the number of data packets in the current TCP flow in the preset TCP data processing flow table is updated based on the first preset increment method.

3. The industrial firewall OPC communication interruption recovery method according to claim 1, characterized in that, The step of determining whether the TCP packet is the first packet of the current TCP stream, and determining the sequence number of the previous packet and the sequence number of the current packet based on the first determination result, includes: Determine whether the TCP packet is the first packet in the current TCP stream; If the TCP packet is the first packet in the current TCP stream, then the first sequence number corresponding to the TCP packet is determined as the sequence number of the previous packet and the current packet of the TCP packet; If the TCP packet is not the first packet of the current TCP stream, then the second sequence number corresponding to the TCP packet is determined as the current packet sequence number of the TCP packet, and the current packet sequence number corresponding to the previous packet is determined as the previous packet sequence number of the TCP packet.

4. The industrial firewall OPC communication interruption recovery method according to claim 1, characterized in that, The step of determining whether the sequence number of the previous packet is equal to the sequence number of the current packet, and determining whether the TCP data packet is the first retransmission packet of the current TCP stream based on the second determination result and the preset TCP data processing flow table, includes: Determine whether the sequence number of the previous TCP packet is equal to the sequence number of the current packet; If they are not equal, it indicates that the TCP data packet is a new packet, and the retransmission packet count of the current TCP stream in the preset TCP data processing flow table is cleared to zero; If they are equal, the TCP packet is a retransmission packet, and the retransmission packet count is updated based on the second preset increment method. If the updated retransmission packet count is the first target value, the current TCP stream has its first retransmission packet. The number of the first retransmission packet markers in the preset TCP data processing flow table of the current TCP stream is determined as the second target value. If the number of stream packets in the preset TCP data processing flow table of the current TCP stream is the third target value, the TCP packet is the first retransmission packet of the current TCP stream.

5. The industrial firewall OPC communication interruption recovery method according to claim 1, characterized in that, After determining whether the TCP packet is the first retransmission packet of the current TCP stream based on the second judgment result and the preset TCP data processing flow table, the method further includes: If the TCP packet is not the first retransmission packet of the current TCP stream, then based on the target node element in the preset TCP data processing flow table and the TCP packet, all packets of the current TCP stream are allowed or blocked to complete the corresponding OPC communication interruption recovery operation.

6. The industrial firewall OPC communication interruption recovery method according to claim 1, characterized in that, If the TCP packet is the first retransmission packet of the current TCP stream, then it is determined whether the TCP packet has a payload. If the TCP packet has a payload, the target byte of the payload is checked based on OPC protocol characteristics, and the check result is used to determine whether the target byte meets preset byte conditions, including: If the TCP packet is the first retransmission packet of the current TCP stream, then determine whether the TCP packet has a payload; If the TCP packet has no payload, it indicates that the TCP packet is a connection packet, and the number of temporarily allowed packets in the current TCP flow in the preset TCP data processing flow table is determined as the fourth target value; the connection packet is a packet obtained based on the TCP three-way handshake for establishing a connection relationship; If the TCP packet has a payload, the target byte of the payload is checked based on the characteristics of the OPC protocol, and the check result is used to determine whether the target byte meets the preset byte conditions.

7. The industrial firewall OPC communication interruption recovery method according to any one of claims 1 to 6, characterized in that, If the target byte satisfies the preset byte condition, then the TCP data packet is characterized as an OPC data packet that meets the preset OPC protocol standard, and all data packets in the current TCP stream are allowed to proceed, thereby completing the corresponding OPC communication interruption recovery operation, including: If the target byte satisfies the preset byte condition, then the TCP data packet is an OPC data packet that meets the preset OPC protocol standard. The number of permanently allowed data packets in the preset TCP data processing flow table of the current TCP stream is determined to be the fifth target value, and all data packets of the current TCP stream are allowed to complete the corresponding OPC communication interruption recovery operation.

8. An industrial firewall OPC communication interruption recovery device, characterized in that, include: The sequence number determination module is used to receive TCP packets from the network using the network card of the industrial firewall. If the source port and destination port of the TCP packet are both high-order ports, and the four-tuple information of the TCP packet belongs to the preset TCP data processing flow table, then the number of packets in the current TCP flow in the preset TCP data processing flow table is updated, and it is determined whether the TCP packet is the first packet of the current TCP flow. Based on the first determination result, the sequence number of the previous packet and the sequence number of the current packet of the TCP packet are determined. The high-order port is the port whose port number in the TCP protocol is greater than a preset threshold; The data packet judgment module is used to determine whether the sequence number of the previous packet is equal to the sequence number of the current packet, and to determine whether the TCP data packet is the first retransmission packet of the current TCP stream based on the second judgment result and the preset TCP data processing flow table; The byte checking module is used to determine whether the TCP data packet has a payload if the TCP data packet is the first retransmission packet of the current TCP stream. If the TCP data packet has a payload, the target byte of the payload is checked based on the OPC protocol characteristics, and the check result is used to determine whether the target byte meets the preset byte conditions. The data packet release module is used to indicate that the TCP data packet is an OPC data packet that meets the preset OPC protocol standard if the target byte meets the preset byte condition, and to release all data packets in the current TCP stream to complete the corresponding OPC communication interruption recovery operation.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the industrial firewall OPC communication interruption recovery method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store a computer program, wherein the computer program, when executed by a processor, implements the industrial firewall OPC communication interruption recovery method as described in any one of claims 1 to 7.

Images