Peripheral access control method, system, electronic device and storage medium

Abstract

This invention provides a peripheral access control method, system, electronic device, and storage medium. The method includes: configuring a memory protection unit (MPU) to configure the memory region of the target register of the peripheral to be protected to be accessed only in privileged mode; if it is determined that code in non-privileged mode attempts to access the memory region of the target register, the current access is deemed to be illegal, and a hardware exception is triggered by the MPU; in response to the hardware exception, the PLC processor switches to privileged mode, obtains the target address of the current access, queries a pre-configured access control whitelist, and verifies the current access; if the current access verification is successful, the memory region of the target register is accessed in privileged mode. This invention, by employing an on-demand trigger verification mechanism based on MPU hardware exceptions, can achieve fine-grained access control of peripherals with extremely low runtime overhead without modifying the existing hardware architecture, offering strong security and real-time performance.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a peripheral access control method, system, electronic device, and storage medium. Background Technology

[0002] As a core device in industrial automation systems, the security of Programmable Logic Controllers (PLCs) is paramount. Currently, to prevent malicious tampering attacks targeting PLC output peripherals, Trusted Execution Environment (TEE) technology is widely used to isolate security-critical modules of the system. Existing peripheral access control schemes mainly fall into two categories: The first is a hardware TEE scheme based on a custom underlying layer. While this type of scheme offers high isolation security, it heavily relies on specific customized hardware architectures, making it incompatible with the vast number of resource-constrained traditional PLC devices and resulting in high deployment costs. The second type is a pure software TEE scheme. This type of scheme achieves monitoring by forcibly inserting check code before each peripheral access command. However, this indiscriminate, high-frequency, routine software verification incurs significant overhead and suffers from poor real-time performance. Summary of the Invention

[0003] This invention provides a peripheral access control method, system, electronic device, and storage medium to address the shortcomings of existing peripheral access control methods, which rely on specific customized hardware architectures, have high overhead, and cannot simultaneously guarantee security and real-time performance.

[0004] This invention provides a peripheral access control method applied to a programmable logic controller (PLC) including a memory protection unit (MPU), comprising: Configure the memory protection unit (MPU) to configure the memory region of the target register of the peripheral to be protected to be accessed only in privileged mode; If it is determined that code running in non-privileged mode attempts to access the memory region of the target register, the current access is deemed to be illegal, and a hardware exception is triggered by the MPU. In response to the hardware anomaly, the PLC processor switches to privileged mode, obtains the target address of the current access, queries the pre-configured access control whitelist based on the target address of the current access, and verifies the current access; If the current access verification is successful, the memory region of the target register is accessed in the privileged mode.

[0005] In some embodiments, the method further includes, after verifying the current access: If the current access verification fails, the current access is intercepted in the privileged mode and a security log is recorded. The PLC processor then reverts to the non-privileged mode and continues to operate.

[0006] In some embodiments, the access control whitelist stores multiple peripheral access policies, and the peripheral access policies include: the target address of legal access, the operation type, the constraints, the access order, and the result address.

[0007] In some embodiments, the step of querying a pre-configured access control whitelist based on the target address of the current access to verify the current access includes: Determine the operation type, constraints, and access order of the currently accessed operation; Based on the target address, operation type, constraints, and access order of the current access, the current access is matched with all the peripheral access policies; If any of the peripheral access policies is found to match the current access successfully, the current access is deemed to have passed verification.

[0008] In some embodiments, prior to configuring the memory protection unit (MPU), the method further includes: The core module of the PLC is configured to run in the privileged mode, and the core module includes control logic; The non-core modules of the PLC are configured to run in the non-privileged mode, and the non-core modules include network communication driver modules.

[0009] In some embodiments, after accessing the memory region of the target register in the privileged mode, the method further includes: The PLC processor is restored to the non-privileged mode and continues to operate.

[0010] The present invention also provides a peripheral access control system applied to a programmable logic controller (PLC) including a memory protection unit (MPU), comprising: The configuration module is used to configure the memory protection unit (MPU) to configure the memory region of the target register of the peripheral to be protected to be accessed only in privileged mode. The exception triggering module is used to determine that the access is illegal and trigger a hardware exception by the MPU when it is determined that code running in non-privileged mode attempts to access the memory region of the target register. The adjudication verification module is used to respond to the hardware anomaly by switching the PLC processor to privileged mode, obtaining the target address of the current access, querying the pre-configured access control whitelist based on the target address of the current access, and verifying the current access. The proxy execution module is used to access the memory region of the target register in the privileged mode if it is determined that the current access verification is successful.

[0011] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the peripheral access control method as described above.

[0012] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the peripheral access control method as described above.

[0013] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements any of the peripheral access control methods described above.

[0014] This invention provides a peripheral access control method, system, electronic device, and storage medium. By configuring a Memory Protection Unit (MPU), the memory region of the target register of the peripheral to be protected is configured to be accessible only in privileged mode. If code in non-privileged mode attempts to access the memory region of the target register, the access is deemed illegal, and a hardware exception is triggered by the MPU. In response to the hardware exception, the PLC processor switches to privileged mode, obtains the target address of the current access, queries a pre-configured access control whitelist, and verifies the current access. If the current access verification is successful, the memory region of the target register is accessed in privileged mode. This transforms the traditional continuous software polling verification paradigm into an on-demand trigger verification mechanism based on MPU hardware exceptions. It can achieve fine-grained access control of peripherals with extremely low runtime overhead without modifying the existing PLC hardware architecture, effectively defending against malicious tampering while ensuring the stringent real-time requirements of the PLC. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0016] Figure 1 This is one of the structural schematic diagrams of the peripheral access control system provided in the embodiments of the present invention.

[0017] Figure 2 This is a schematic diagram of the memory region division of the memory protection unit provided in an embodiment of the present invention.

[0018] Figure 3 This is a schematic diagram of the system construction and initialization phase provided in an embodiment of the present invention.

[0019] Figure 4 This is one of the flowcharts of the peripheral access control method provided in the embodiments of the present invention.

[0020] Figure 5 This is the second flowchart of the peripheral access control method provided in the embodiments of the present invention.

[0021] Figure 6 This is the second schematic diagram of the peripheral access control system provided in the embodiment of the present invention.

[0022] Figure 7 This is a schematic diagram of the structure of the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0024] Figure 1 This is one of the structural schematic diagrams of the peripheral access control system provided in the embodiments of the present invention. For example... Figure 1As shown, the system is logically divided into two main parts: a non-secure world and a secure world. The non-secure world contains the Lightweight Embedded Programmable Logic Controller (LE-PLC). Non-core modules primarily run in the non-secure world, such as the network communication module that handles external network data and its underlying network drivers. These modules are configured to run in non-privileged mode. The secure world contains the core security component of this invention, namely the Lightweight Trusted Execution Environment for Programmable Logic Controllers (LITEE-PLC) core, and the PLC's core business logic, namely the control program and firmware within the trusted program. The core modules, such as the control program, cycle management, and task scheduling modules, are configured to run in privileged mode. The trusted computing module in the LITEE-PLC core is responsible for memory isolation and access control, while the security service module provides additional functions such as authentication and security updates. Through this division, network data from the insecure world must be reviewed and filtered by the LITEE-PLC core, and cannot directly access or affect the control programs in the secure world, thus building the first line of security at the system architecture level.

[0025] Figure 2 This is a schematic diagram of the memory region division of the memory protection unit provided in an embodiment of the present invention. Figure 2 As shown, the physical address space of the entire system, from 0x00000000 to 0xFFFFFFFF, is divided into multiple regions, including Flash Electrically Erasable Programmable Read-Only Memory (FLASH ROM), Static Random-Access Memory (SRAM), Peripheral, and System Memory. After MPU configuration, the MPU imposes different access permissions on these regions.

[0026] For example, in the FLASH ROM area, region 0, which stores insecure code, is readable, while the background region storing trusted programs and the LITEE-PLC core is marked as inaccessible. In the SRAM area, the region storing insecure data is readable and writable, while the region storing secure data is inaccessible. Most critically, in the peripheral area, the secure peripheral region, representing the peripheral to be protected, is marked as privileged proxy access. In non-privileged mode, this region is not directly accessible; any access will trigger a hardware exception.

[0027] Figure 3 This is a schematic diagram of the system construction and initialization phase provided in an embodiment of the present invention, such as... Figure 3 As shown, the establishment of the peripheral access control system is divided into a compilation phase and an execution phase. In phase 1, the LITEE-PLC core and other security components, developed by a trusted programmer, are compiled. In phase 2, untrusted programs are processed to generate binary files. In the final execution phase, a security loader running in the secure world is responsible for loading the code from the insecure world and the code from the secure world into designated areas of memory, respectively. Crucially, this loader can configure the MPU according to a preset Memory Protection Unit (MPU) policy, thereby establishing a securely isolated memory layout.

[0028] Figure 4 This is one of the flowcharts illustrating the peripheral access control method provided in this embodiment of the invention, such as... Figure 4 As shown, a peripheral access control method is provided, applied to a peripheral access control system. The system includes a programmable logic controller (PLC), wherein the PLC includes a memory protection unit (MPU). The method includes: Step 410: Configure the memory protection unit (MPU) to configure the memory region of the target register of the peripheral to be protected to be accessed only in privileged mode.

[0029] It should be noted that a Programmable Logic Controller (PLC) is a computer specifically designed for industrial automation control. Its core operating characteristic is a cyclic scanning mode, requiring extremely high real-time performance. The Memory Protection Unit (MPU) is a hardware module integrated into the PLC's processor core, commonly found in microcontrollers based on ARM Cortex-M or RISC-V architectures. Its function is to partition the processor's memory space and configure different access permissions for each region.

[0030] Specifically, during the initialization phase of the PLC system startup, a series of control registers inside the MPU are set by executing specific instructions. For example, one or more MPU regions can be configured, each region being defined by a start address, end address or region size, and access permission attributes.

[0031] The peripheral device to be protected can be any hardware unit in the PLC that requires safety protection. In a preferred embodiment of the present invention, it specifically refers to output peripheral devices that are crucial to industrial control safety, such as physical pins controlling the interface of network actuators. The target register is the hardware register that controls the behavior of these peripheral devices to be protected. In modern processor architectures, these registers are typically mapped into the processor's physical address space as memory regions, i.e., memory-mapped I / O. Therefore, accessing these registers is equivalent to reading and writing to a specific memory address.

[0032] Privileged mode and non-privileged mode are two basic operating states of the processor. Code running in privileged mode has the highest privileges to access all system resources, while the access permissions of code running in non-privileged mode are strictly limited by the MPU.

[0033] Optionally, the memory region of the target register can be configured to be accessible only in privileged mode. This can be achieved by setting the access permissions of the MPU region, for example, by setting it to "privileged mode only, no access in non-privileged mode".

[0034] Step 420: If it is determined that the code running in non-privileged mode is attempting to access the memory region of the target register, the current access is deemed to be illegal, and a hardware exception is triggered by the MPU.

[0035] Specifically, when code attempts to access the memory region of a target register, the MPU hardware determines the current operating mode of that code. If it determines that the code is running in non-privileged mode, the MPU hardware compares the target address of this access with all configured protected memory regions. If a match is found, the MPU hardware determines that this access is a privilege violation. Subsequently, the MPU hardware automatically triggers a hardware exception.

[0036] It's important to note that the hardware anomaly here doesn't refer to physical alarms like sounds or lights, but rather to an internal error handling mechanism within the processor core. For example, in ARM Cortex-M processors, this typically manifests as a memory management failure. This anomaly immediately halts the currently violating access instruction, preventing it from completing the actual read / write operation to peripheral registers and forcing the processor to alter its normal execution flow.

[0037] Step 430: In response to a hardware anomaly, the PLC processor switches to privileged mode, obtains the target address to be accessed, queries the pre-configured access control whitelist based on the target address to verify the current access.

[0038] In this context, responding to a hardware exception refers to the series of operations embedded in the hardware logic that the processor performs after receiving a hardware exception signal from the MPU. First, the processor forcibly switches its operating state from non-privileged mode to privileged mode to obtain the highest privileges required to handle the exception. Simultaneously, the processor saves the target address that caused the exception—the memory address the code attempted to illegally access—into a dedicated fault address register, such as the MMFAR register in the ARM architecture. Then, the processor jumps to a pre-defined exception handler based on the interrupt vector table. In this exception handler, the software code can obtain the target address that caused the exception by reading the contents of the aforementioned dedicated fault address register.

[0039] The access control whitelist is a data structure pre-stored in a secure memory area to define legitimate access. In its simplest implementation, this whitelist can be a list recording all legitimate target addresses. The software code verifies whether the access is permitted by comparing the obtained target address with the address list in the whitelist.

[0040] Step 440: If the current access verification is successful, access the memory region of the target register in privileged mode.

[0041] It's important to note that once it's confirmed that the target address being accessed exists within the access control whitelist, the access is considered successful. At this point, the exception handler code, currently in privileged mode, replaces the code previously running in non-privileged mode to perform the access operation to the target register's memory region. This type of access, executed by privileged code, is called proxy access. Because it executes in privileged mode, it is no longer blocked by the MPU. For example, if the original intention was to write a value to a register, the exception handler will execute the corresponding memory write instruction, writing the value to the previously obtained target address.

[0042] In this embodiment of the invention, the method described above transforms the continuous, high-overhead software polling checks in traditional security schemes into low-cost, on-demand verification triggered only when a hardware permission violation occurs. This ensures that the security mechanism incurs no performance overhead for the vast majority of the system's normal operation, thereby enabling access control of critical peripherals without modifying existing PLC hardware or compromising its stringent real-time requirements. This solves the dilemma of prior art where security and performance are mutually exclusive.

[0043] In some embodiments, the method further includes, after verifying the current access: If the current access verification fails, the current access is intercepted in privileged mode and a security log is recorded. The PLC processor then reverts to non-privileged mode and continues operation.

[0044] During the verification process, if the target address being accessed is not found in the access control whitelist, or does not meet other policies defined in the whitelist, the current access verification is deemed to have failed. In this case, the exception handler in privileged mode will not perform proxy access, but will instead perform an interception operation.

[0045] Interception specifically refers to terminating the access request without any processing, thereby preventing unauthorized or malicious peripheral operations. Simultaneously, for subsequent security auditing and tracing, the exception handling program records relevant information about the violation in a pre-designated, protected secure memory area, forming a security log. This log information may include the timestamp of the event, the address of the instruction that triggered the exception, the target address of the unauthorized access, and the type of violation. Whether the verification passes and the proxy execution is completed, or the verification fails and the request is intercepted, a recovery step must ultimately be performed. That is, the PLC processor executes a specific exception return instruction to switch its running state from privileged mode back to non-privileged mode, and returns the program's execution flow to the point where it was interrupted to continue running, ensuring the continuity of the PLC's main loop scanning task.

[0046] In this embodiment of the invention, by supplementing the handling of verification failures and the steps of restoring to non-privileged mode, the invention constructs a complete and robust security processing closed loop. This mechanism not only effectively prevents unauthorized access but also provides evidence for tracing the source of attacks afterward through security logs. Simultaneously, it ensures the instantaneous nature of the security mechanism, preventing PLC system shutdowns or freezes due to abnormal handling, thereby enhancing security while maintaining system availability and real-time performance.

[0047] In some embodiments, the access control whitelist stores multiple peripheral access policies, which include: the target address of legal access, operation type, constraints, access order, and result address.

[0048] Each peripheral access policy can be stored in the form of a tuple or structure, containing fields that precisely describe a legal access behavior from multiple dimensions. The target address of the legal access is the address of the allowed memory-mapped register. The operation type specifies whether the access is a read, write, or execute operation. Constraints can further restrict the accessed data content; for example, for a write operation, it can be specified that only specific values ​​or values ​​within a certain range can be written. The access order defines the timing relationship of the accesses; for example, within a PLC scan cycle, an access to one register must occur after an access to another register. The result address can be used to verify the return value of a read operation, ensuring that the read data meets expectations.

[0049] In this embodiment of the invention, an access control whitelist is constructed by employing a peripheral access policy containing multiple fields, thereby elevating the granularity of security protection from a simple address level to a semantic level. This refined policy model can accurately characterize the legitimate behavior of a PLC in deterministic scanning mode, not only defending against illegal address access but also effectively resisting more complex attack methods such as data tampering, timing disruption, and replay attacks, greatly enhancing the accuracy and effectiveness of protection.

[0050] In some embodiments, the process of querying a pre-configured access control whitelist based on the target address of the current access to verify the current access includes: Determine the type of operation, constraints, and access order for the current access; Based on the target address, operation type, constraints, and access order of the current access, the current access is matched with all peripheral access policies; If any peripheral access policy is found to match the current access policy, the current access is deemed to have passed verification.

[0051] It's important to note that after responding to a hardware exception and switching to privileged mode, the exception handler not only obtains the target address but also needs to further determine other attributes of the current access. For example, it can analyze the machine instruction that caused the exception to determine whether its operation type is read or write. It can read the contents of the relevant general-purpose registers at the time of the exception to obtain the data value the code attempted to write, which can then be compared with the constraints in the policy. It can query a status variable that records the phase of the PLC scan cycle to determine whether the access sequence of the current access is compliant.

[0052] After obtaining the complete attributes of the current access, the handler iterates through all peripheral access policies in the access control whitelist and matches them one by one. The matching process compares each attribute of the current access, including the target address, operation type, data value, and access order, with the corresponding field of a specific policy in the whitelist. If all fields of any peripheral access policy completely match the attributes of the current access, the access is considered legitimate and verification passes. If no completely matching entry is found after iterating through all policies, verification fails.

[0053] In this embodiment of the invention, a deep understanding and adjudication of access intent is achieved by jointly matching and verifying multiple attributes of access behavior. This multi-dimensional verification mechanism ensures that only operations that fully conform to the predetermined behavior pattern are allowed, effectively preventing attackers from bypassing security checks by forging some legitimate features, and significantly improving the anti-evasion capability and overall security of the security mechanism.

[0054] In some embodiments, prior to configuring the memory protection unit (MPU), the following is also included: Configure the PLC's core module to run in privileged mode. The core module includes control logic. Configure the PLC's non-core modules to run in non-privileged mode. These non-core modules include the network communication driver module.

[0055] During system startup, in addition to configuring the MPU, the system software also needs to be security-partitioned. The core modules, which contain the control logic code that carries the PLC's main industrial control algorithms and task scheduling, are configured to run in privileged mode. This ensures that the core control code has the authority to execute all necessary operations. Conversely, non-core modules, especially those that handle a large amount of untrusted external input and are highly susceptible to becoming attack entry points, are configured to run in non-privileged mode. This division clearly isolates the system into a secure world and an insecure world, with the code in the insecure world naturally subject to access restrictions.

[0056] In this embodiment of the invention, by classifying the privilege levels of core and non-core modules during system initialization, the principle of least privilege in security design is followed. This architectural design fundamentally reduces the system's attack surface. Even if non-core modules such as network port drivers are compromised by malicious code, the attacking code cannot directly tamper with the PLC's core control logic or directly operate critical peripherals protected by the MPU because it is in a sandbox of non-privileged mode. This creates a front-end, architecture-based security barrier for the entire system.

[0057] In some embodiments, after accessing the memory region of the target register in privileged mode, the method further includes: The PLC's processor is restored to non-privileged mode and continues to run.

[0058] In step 440, after the exception handler successfully accesses the target register memory region in privileged mode, replacing the original code, it must perform a recovery operation. This recovery operation is accomplished by the processor executing a specific exception return instruction. This instruction automatically switches the processor's running state from privileged mode back to non-privileged mode and exits the exception handling flow, returning control of the program to the previously interrupted non-privileged code, which then resumes execution of its normal business logic from the next instruction.

[0059] In this embodiment of the invention, by explicitly defining the steps to restore to non-privileged mode after successful proxy access, the atomicity and transience of the security processing mechanism are ensured. This guarantees that the privileged mode is only enabled for a brief period to handle exceptions, and control is immediately returned once the task is completed. Therefore, the entire security verification and proxy execution process is transparent to the upper-layer application and will not interrupt the continuous execution of the PLC's cyclic scanning task. This process ensures the lightweight nature and real-time performance advantages of this invention.

[0060] Figure 5 This is a second flowchart illustrating the peripheral access control method provided in this embodiment of the invention, as shown below. Figure 5 As shown, when code such as a network communication module running in the insecure world attempts to access a protected peripheral device, this behavior is considered a critical trusted data trigger. This trigger is intercepted by the hardware due to a violation of the permissions set by the MPU, thus entering the access control module in the secure world. The access control module contains a peripheral access control unit, which embeds an access control whitelist and performs whitelist verification. If the verification passes, the proxy service module calls the trusted peripheral device driver to perform a legitimate access operation, ultimately affecting the peripheral device's memory. The entire process clearly demonstrates the closed-loop control process from hardware anomaly triggering to whitelist verification and then to proxy execution.

[0061] The peripheral access control system provided by the present invention is described below. The peripheral access control system described below can be referred to in correspondence with the peripheral access control method described above.

[0062] Figure 6 This is a second schematic diagram of the peripheral access control system provided in this embodiment of the invention, as shown below. Figure 6 As shown, the system 600 is applied to a programmable logic controller (PLC) that includes a memory protection unit (MPU), and includes: Configuration module 610 is used to configure the memory protection unit MPU to configure the memory region of the target register of the peripheral to be protected to be accessed only in privileged mode; The exception triggering module 620 is used to determine that the current access is illegal and trigger a hardware exception by the MPU when it is determined that code running in non-privileged mode attempts to access the memory region of the target register. The adjudication verification module 630 is used to respond to hardware abnormalities, switch the PLC processor to privileged mode, obtain the target address of the current access, query the pre-configured access control whitelist based on the target address of the current access, and verify the current access. The proxy execution module 640 is used to access the memory region of the target register in privileged mode if it is determined that the current access verification is successful.

[0063] Optionally, the above system also includes an interception module, which is used for: If the current access verification fails, the current access is intercepted in privileged mode and a security log is recorded, allowing the PLC processor to revert to non-privileged mode and continue operating.

[0064] Optionally, the access control whitelist stores multiple peripheral access policies, which include: the target address of legal access, operation type, constraints, access order, and result address.

[0065] Optionally, based on the target address of the current access, a pre-configured access control whitelist is queried to verify the current access, including: Determine the type of operation, constraints, and access order for the current access; Based on the target address, operation type, constraints, and access order of the current access, the current access is matched with all peripheral access policies; If any peripheral access policy is found to match the current access policy, the current access is deemed to have passed verification.

[0066] Optionally, the system also includes a PLC configuration module, which is used for: Configure the PLC's core module to run in privileged mode. The core module includes control logic. Configure the PLC's non-core modules to run in non-privileged mode. These non-core modules include the network communication driver module.

[0067] Optionally, the system further includes a recovery module, which is used for: After accessing the memory region of the target register in privileged mode, the PLC processor is restored to non-privileged mode to continue running.

[0068] Figure 7 This is a schematic diagram of the structure of the electronic device provided in the embodiment of the present invention, such as... Figure 7As shown, the electronic device may include: a processor 710, a communications interface 720, a memory 730, and a communication bus 740, wherein the processor 710, communications interface 720, and memory 730 communicate with each other through the communication bus 740. The processor 710 can call logic instructions in the memory 730 to execute a peripheral access control method. This method is applied to a programmable logic controller (PLC) containing a memory protection unit (MPU), and includes: configuring the MPU to configure the memory region of the target register of the peripheral to be protected to be accessed only in privileged mode; if it is determined that code running in non-privileged mode attempts to access the memory region of the target register, the current access is deemed to be illegal, and a hardware exception is triggered by the MPU; in response to the hardware exception, the PLC's processor switches to privileged mode, obtains the target address of the current access, queries a pre-configured access control whitelist based on the target address of the current access, and verifies the current access; if the current access verification is successful, the memory region of the target register is accessed in privileged mode.

[0069] Furthermore, the logical instructions in the aforementioned memory 730 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0070] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the peripheral access control method provided by the above methods. This method is applied to a programmable logic controller (PLC) including a memory protection unit (MPU), and includes: configuring the MPU to configure the memory region of the target register of the peripheral to be protected to be accessed only in privileged mode; determining that the current access is violated when it is determined that code running in non-privileged mode attempts to access the memory region of the target register, and triggering a hardware exception by the MPU; in response to the hardware exception, the PLC processor switches to privileged mode, obtains the target address of the current access, queries a pre-configured access control whitelist based on the target address of the current access, and verifies the current access; if it is determined that the current access verification is successful, accessing the memory region of the target register in privileged mode.

[0071] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program is implemented to perform the peripheral access control methods provided by the above methods. This method is applied to a programmable logic controller (PLC) including a memory protection unit (MPU), and includes: configuring the MPU to configure the memory region of the target register of the peripheral to be protected to be accessed only in privileged mode; determining that the current access is violated when it is determined that code running in non-privileged mode attempts to access the memory region of the target register, and triggering a hardware exception by the MPU; in response to the hardware exception, the PLC processor switches to privileged mode, obtains the target address of the current access, queries a pre-configured access control whitelist based on the target address of the current access, and verifies the current access; if it is determined that the current access verification is successful, accessing the memory region of the target register in privileged mode.

[0072] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0073] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0074] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A peripheral access control method applied to a programmable logic controller (PLC) comprising a memory protection unit (MPU), characterized in that, include: Configure the memory protection unit (MPU) to configure the memory region of the target register of the peripheral to be protected to be accessed only in privileged mode; If it is determined that code running in non-privileged mode attempts to access the memory region of the target register, the current access is deemed to be illegal, and a hardware exception is triggered by the MPU. In response to the hardware anomaly, the PLC processor switches to privileged mode, obtains the target address of the current access, queries the pre-configured access control whitelist based on the target address of the current access, and verifies the current access; If the current access verification is successful, the memory region of the target register is accessed in the privileged mode.

2. The peripheral access control method according to claim 1, wherein, After verifying the current access, the process further includes: If the current access verification fails, the current access is intercepted in the privileged mode and a security log is recorded. The PLC processor then reverts to the non-privileged mode and continues to operate.

3. The peripheral access control method according to claim 1, wherein, The access control whitelist stores multiple peripheral access policies, which include: the target address of legal access, operation type, constraints, access order, and result address.

4. The peripheral access control method according to claim 3, wherein, The step of querying a pre-configured access control whitelist based on the target address of the current access and verifying the current access includes: Determine the operation type, constraints, and access order of the currently accessed operation; Based on the target address, operation type, constraints, and access order of the current access, the current access is matched with all the peripheral access policies; If any of the peripheral access policies is found to match the current access successfully, the current access is deemed to have passed verification.

5. The peripheral access control method of claim 1, wherein, Before configuring the memory protection unit (MPU), the following is also included: The core module of the PLC is configured to run in the privileged mode, and the core module includes control logic; The non-core modules of the PLC are configured to run in the non-privileged mode, and the non-core modules include network communication driver modules.

6. The peripheral access control method according to claim 1, characterized in that, After accessing the memory region of the target register in the privileged mode, the method further includes: The PLC processor is restored to the non-privileged mode and continues to operate.

7. A peripheral access control system, applied to a programmable logic controller (PLC) including a memory protection unit (MPU), characterized in that, include: The configuration module is used to configure the memory protection unit (MPU) to configure the memory region of the target register of the peripheral to be protected to be accessed only in privileged mode. The exception triggering module is used to determine that the access is illegal and trigger a hardware exception by the MPU when it is determined that code running in non-privileged mode attempts to access the memory region of the target register. The adjudication verification module is used to respond to the hardware anomaly by switching the PLC processor to privileged mode, obtaining the target address of the current access, querying the pre-configured access control whitelist based on the target address of the current access, and verifying the current access. The proxy execution module is used to access the memory region of the target register in the privileged mode if it is determined that the current access verification is successful.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the peripheral access control method as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the peripheral access control method as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the peripheral access control method as described in any one of claims 1 to 6.

Images