CN114500005A - Protection method, device, terminal and storage medium for ModbusTcp instruction - Google Patents

Abstract

The application discloses a method, a device, a terminal and a storage medium for protecting a ModbusTcp instruction. The method comprises the following steps: the method comprises the steps that a zero-trust gateway client receives an initial ModbusTcp instruction transmitted by a master device, encrypts the initial ModbusTcp instruction, sends the encrypted initial ModbusTcp instruction to a zero-trust gateway through a Tcp communication tunnel, then the zero-trust gateway conducts identity authentication, decryption and danger monitoring on the encrypted initial ModbusTcp instruction in sequence, and if the initial ModbusTcp instruction is a non-dangerous instruction, the initial ModbusTcp instruction is forwarded to a slave device according to a preset strategy. According to the method, the initial ModbusTcp instruction is encrypted, and is subjected to identity authentication, authorization and danger monitoring, the initial ModbusTcp instruction is protected from multiple angles of communication link safety, access behavior authentication, access authorization, data packet continuous authentication, ModbusTcp instruction control and the like of the ModbusTcp, an IoT system based on the ModbusTcp is protected, and attacks on the IoT system from multiple angles of a physical network, an IoT application system, a network identity, flow attack and the like are effectively prevented from a third party.

Description

Protection method, device, terminal and storage medium for ModbusTcp instruction

technical field

The present application relates to the technical field of the Internet of Things, and in particular, to a method, device, terminal and storage medium for protecting a ModbusTcp instruction.

Background technique

Modbus communication is an application layer message transmission protocol invented by Modicon (now a brand of Schneider) in 1979 and mainly used in the industrial field. Because of its openness, stability, efficiency and low cost, it has become the most popular communication protocol in the IoT field. one. However, in the communication process of the ModbusTcp protocol, how to effectively protect the ModbusTcp command has become an urgent problem to be solved.

At present, in the process of ModbusTcp protocol communication, the IoT application system regularly sends ModbusTcp commands to the slave device (ModbusTcp Slave) through the master device (ModbusTcpMaster) to realize the four remote control (telemetry, remote signaling, remote control, and remote adjustment) in the traditional control field. function, wherein the instructions include write register, read register, write coil, read coil, etc.

However, in the communication process of the above-mentioned ModbusTcp protocol, the ModbusTcp command transmitted between the master and slave devices lacks an effective protection mechanism.

SUMMARY OF THE INVENTION

The main purpose of the present application is to provide a protection method, device, terminal and storage medium for ModbusTcp instructions, so as to solve the problem that the ModbusTcp instruction lacks an effective protection mechanism in the related art.

In order to achieve the above purpose, in the first aspect, the present application provides a method for protecting a ModbusTcp instruction, including:

The zero-trust gateway client receives the initial ModbusTcp command transmitted by the master device, encrypts the initial ModbusTcp command, and uses the Tcp communication tunnel to send the encrypted initial ModbusTcp command to the zero-trust gateway;

The zero-trust gateway performs identity authentication, decryption, and danger monitoring on the encrypted initial ModbusTcp command in sequence. If the initial ModbusTcp command is a non-hazardous command, it forwards the initial ModbusTcp command to the slave device according to the preset policy.

In a possible implementation, the zero-trust gateway performs identity authentication, decryption, and risk monitoring on the encrypted initial ModbusTcp command in sequence, including:

Identify the first identity corresponding to the encrypted initial ModbusTcp command;

If the first identity identifier satisfies the first preset condition, decrypt the encrypted initial ModbusTcp command to obtain the initial ModbusTcp command;

Compare the initial ModbusTcp command with all dangerous commands in the preset dangerous command library to determine whether the initial ModbusTcp command is a dangerous command.

In a possible implementation manner, if the identity identifier satisfies the first preset condition, the method further includes:

Authorize the encrypted initial ModbusTcp command.

In a possible implementation manner, after judging whether the initial ModbusTcp command is a dangerous command, the method further includes:

If the initial ModbusTcp command is a dangerous command, send the initial ModbusTcp command to the alarm server for processing.

In a possible implementation manner, after forwarding the initial ModbusTcp command to the slave device according to a preset policy, the method further includes:

The zero trust gateway receives the execution receipt transmitted from the device;

Encrypt the execution receipt, and use the Tcp communication tunnel to send the encrypted execution receipt to the zero-trust gateway client.

In a possible implementation manner, after encrypting the execution receipt and sending the encrypted execution receipt to the zero-trust gateway client by using a Tcp communication tunnel, the method further includes:

The zero trust gateway client authenticates the encrypted execution receipt;

If the authentication is passed, decrypt the encrypted execution receipt, and send the execution receipt to the master device.

In a possible implementation, the zero trust gateway client authenticates the encrypted execution receipt, including:

The zero-trust gateway client identifies the second identity identifier corresponding to the encrypted execution receipt.

In a second aspect, an embodiment of the present invention provides a protection device for a ModbusTcp instruction, including:

The command encryption module is used for the zero trust gateway client to receive the initial ModbusTcp command transmitted by the master device, encrypt the initial ModbusTcp command, and use the Tcp communication tunnel to send the encrypted initial ModbusTcp command to the zero trust gateway;

The command control module is used for the zero trust gateway to perform identity authentication, decryption and risk monitoring on the encrypted initial ModbusTcp command in turn. If the initial ModbusTcp command is a non-hazardous command, the initial ModbusTcp command is forwarded to the slave device according to the preset strategy.

In a third aspect, an embodiment of the present invention provides a terminal, including a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, the protection of any of the above ModbusTcp instructions is implemented. steps of the method.

In a fourth aspect, embodiments of the present invention provide a computer-readable storage medium, where the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, implements the steps of any of the above protection methods for ModbusTcp instructions.

The embodiments of the present invention provide a method, device, terminal and storage medium for protecting a ModbusTcp instruction, including: a zero-trust gateway client receives an initial ModbusTcp instruction transmitted by a master device, encrypts the initial ModbusTcp instruction, and uses a Tcp communication tunnel to The encrypted initial ModbusTcp command is sent to the zero-trust gateway, and then the zero-trust gateway performs identity authentication, decryption, and danger monitoring on the encrypted initial ModbusTcp command. Forward to the slave device. The present invention encrypts the initial ModbusTcp command, performs identity authentication, authorization, and danger monitoring, from the aspects of ModbusTcp communication link security, access behavior authentication, access authorization, data packet continuous authentication, and ModbusTcp command control. For protection, the ModbusTcp-based IoT system is fully protected, effectively preventing third parties from attacking the IoT system from multiple perspectives such as physical network, IoT application system, network identity, and traffic attacks.

Description of drawings

The accompanying drawings, which constitute a part of this application, are used to provide a further understanding of the application and make other features, objects and advantages of the application more apparent. The accompanying drawings and descriptions of the exemplary embodiments of the present application are used to explain the present application, and do not constitute an improper limitation of the present application. In the attached image:

1 is a schematic structural diagram of a traditional ModbusTcp communication system provided by an embodiment of the present invention;

2 is a schematic structural diagram of a protection device for a ModbusTcp instruction provided by an embodiment of the present invention;

Fig. 3 is the realization flow chart of the protection method of a kind of ModbusTcp instruction provided by the embodiment of the present invention;

4 is a schematic structural diagram of a protection device for a ModbusTcp instruction provided by another embodiment of the present invention;

FIG. 5 is a schematic diagram of a terminal provided by an embodiment of the present invention.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments It is only a part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

The terms "first", "second", "third", "fourth", etc. (if present) in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to Describe a particular order or sequence. It is to be understood that the data so used may be interchanged under appropriate circumstances such that the embodiments of the invention described herein can be practiced in sequences other than those illustrated or described herein.

It should be understood that, in various embodiments of the present invention, the size of the sequence numbers of each process does not mean the sequence of execution, and the execution sequence of each process should be determined by its functions and internal logic, and should not be used in the embodiments of the present invention. Implementation constitutes any limitation.

It should be understood that in the present invention, "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to Those steps or elements that are expressly listed may instead include other steps or elements that are not expressly listed or are inherent to the process, method, product or apparatus.

It should be understood that, in the present invention, "plurality" refers to two or more. "And/or" is only an association relationship that describes the associated objects, indicating that there can be three kinds of relationships, for example, and/or B, it can mean that A exists alone, A and B exist at the same time, and B exists alone. . The character "/" generally indicates that the associated objects are an "or" relationship. "Contains A, B and C", "contains A, B, C" means that A, B, and C are all contained, "contains A, B or C" means that one of A, B, and C is contained, "Comprising A, B and/or C" means including any one or any two or three of A, B, and C.

It should be understood that in the present invention, "B corresponding to A", "B corresponding to A", "A corresponds to B" or "B corresponds to A" means that B is associated with A, according to A B can be determined. Determining B based on A does not mean determining B based only on A, but also determining B based on A and/or other information. The matching between A and B means that the similarity between A and B is greater than or equal to a preset threshold.

"If" as used herein may be interpreted as "at" or "when" or "in response to determining" or "in response to detecting," depending on the context.

The technical solutions of the present invention will be described in detail below with specific examples. The following specific embodiments may be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

In order to make the objectives, technical solutions and advantages of the present invention clearer, the following descriptions will be given through specific embodiments in conjunction with the accompanying drawings.

Figure 1 is a traditional ModbusTcp master-slave (Master/Slave) architecture. The IoT application system regularly sends instructions to the ModbusTcp Slave through the ModbusTcp Master module, and the instructions include write register, read register, write coil, read coil, etc. In order to realize the four remote functions (telemetry, remote signaling, remote control, and remote adjustment) in the traditional control field.

The traditional ModbusTcp communication system has problems such as "no authentication", "no authorization", "no transmission security", "no instruction protection", etc. Specifically, "no authentication" means that the Modbus protocol does not have any definition of authentication, as long as If you can access the Modbus service site, you can use function codes to collect device information and send control commands, thereby disrupting or destroying the operation of the entire system; "No Authorization", that is, Modbus has no user classification, no role control, and no authority for visitors. This allows the visitor to perform any function; "instruction without protection" means there is no encryption mechanism, that is, the encryption mechanism of network communication ensures that the data of both parties in the communication will not be monitored and tampered with by a third party. In the Modbus protocol communication process, the instructions and addresses are sent in clear text, which can be easily parsed and modified by the listener.

Based on the above problems, the present invention provides a complete set of protection mechanisms, as shown in FIG. 2 , so as to comprehensively protect the security of the ModbusTcp communication of the existing IoT system.

With reference to FIG. 2 , compared with the prior art ( FIG. 1 ), the present invention adds five components, namely: a zero-trust gateway client, a zero-trust gateway, and three services: authentication service, authorization service, and dangerous command control strategy Serve. Each part is described below, as follows:

(1) Zero Trust Gateway Client

All ModbusTcp traffic on the IoT application system server must pass through the zero-trust gateway client, and the zero-trust gateway client obtains the device identity. This device identity includes but is not limited to the hardware ID of the device, the certificate of the device, etc. The zero-trust gateway client The terminal also attaches identity information to all communication packets sent by the ModbusTcp Master, and this identity information will be used for zero-trust gateway authentication (that is, identity recognition). The identity information is generated by the gateway client through the hardware features of the ModbusTcpMaster server. The Zero Trust Gateway client encrypts ModbusTcp traffic through mTLS and tunnels it to the Zero Trust Gateway.

(2) Zero Trust Gateway

The device identity of all requests (each communication packet) is verified through the authentication and authorization service, where the device identity includes the unique ID of the device. If the device authentication is unsuccessful, the user will be directed to the authentication and authorization service to establish a session identity (generally This happens when the device is connected for the first time), after the authentication and authority pass, the received mTLS traffic will be restored to ModbusTcp traffic. If the control policy service determines that a certain communication traffic contains harmful instructions, it will be intercepted. , where the control policy service handles external/internal route mappings according to predefined policies.

(3) Authentication service

The device identity information in the data package is verified as needed, and the OIDC (OpenId Connect) identity authentication token of the device identity session is established when the device accesses for the first time. The device identity OIDC token is stored in the data cache. After the identity OIDC token expires, the token is updated by static authentication.

(4) Authorized service

Grant permissions to each ModbusTcp Master service by policy, check session permissions for all device identities, and, if needed, bootstrap the Zero Trust Gateway to initiate the device authentication flow.

(5) Dangerous order control strategy service

Continuously monitor the ModbusTcp traffic passing through the zero-trust gateway, and record the recent (usually 7 days) commands from the ModbusTcp Master to the Slave. The command security policy is used to determine whether the command issued to the slave is harmful. If there is any harm, the zero-trust gateway is notified to intercept it. The security policy includes the dangerous command library (blacklist), the command logic tree (the command execution order that should not appear), and is configured by the security operation and maintenance personnel in the gateway policy; for the traffic that obviously exceeds the processing capacity of the industrial equipment where the ModbusTcp Slave is located, intercept, Prevent traffic attacks.

Based on the above protection mechanism, as shown in FIG. 3 , the present invention provides a method for protecting a ModbusTcp instruction, including the following steps:

Step S301: the zero-trust gateway client receives the initial ModbusTcp command transmitted by the master device, encrypts the initial ModbusTcp command, and uses a Tcp communication tunnel to send the encrypted initial ModbusTcp command to the zero-trust gateway;

Step S302: The zero-trust gateway sequentially performs identity authentication, decryption and risk monitoring on the encrypted initial ModbusTcp command. If the initial ModbusTcp command is a non-hazardous command, it forwards the initial ModbusTcp command to the slave device according to a preset policy.

Specifically, the encryption is to perform encryption processing on the initial ModbusTcp command through mTLS to obtain the encrypted initial ModbusTcp command, that is, the mTLS command. Decryption is the process of restoring the mTLS command, that is, restoring the mTLS command to the original ModbusTcp command.

An embodiment of the present invention provides a method for protecting a ModbusTcp instruction, including: a zero-trust gateway client receives an initial ModbusTcp instruction transmitted by a master device, encrypts the initial ModbusTcp instruction, and uses a Tcp communication tunnel to send the encrypted initial ModbusTcp instruction to the zero-trust gateway, and then the zero-trust gateway performs identity authentication, decryption, and danger monitoring on the encrypted initial ModbusTcp command in turn. If the initial ModbusTcp command is a non-hazardous command, it forwards the initial ModbusTcp command to the slave device according to the preset strategy. The present invention encrypts the initial ModbusTcp command, performs identity authentication, authorization, and danger monitoring, from the aspects of ModbusTcp communication link security, access behavior authentication, access authorization, data packet continuous authentication, and ModbusTcp command control. For protection, the ModbusTcp-based IoT system is fully protected, effectively preventing third parties from attacking the IoT system from multiple perspectives such as physical network, IoT application system, network identity, and traffic attacks.

In one embodiment, step S302 includes:

Step S401: Identify the first identity identifier corresponding to the encrypted initial ModbusTcp instruction;

Step S402: if the first identity identifier satisfies the first preset condition, decrypt the encrypted initial ModbusTcp command to obtain the initial ModbusTcp command;

Step S403: Compare the initial ModbusTcp command with all the dangerous commands in the preset dangerous command library to determine whether the initial ModbusTcp command is a dangerous command.

Specifically, performing identity verification on the encrypted initial ModbusTcp command, that is, first identifying the first identity identifier corresponding to the encrypted initial ModbusTcp command, and then judging whether the first identity identifier satisfies the first preset condition, and if so, the encrypted The encrypted initial ModbusTcp command is decrypted; if it is not satisfied, the encrypted initial ModbusTcp command is discarded. Wherein, when the first identity identifier satisfies the first preset condition, the encrypted initial ModbusTcp instruction is also authorized.

In one embodiment, after judging whether the initial ModbusTcp command is a dangerous command, if the initial ModbusTcp command is a dangerous command, the initial ModbusTcp command is sent to the alarm server for processing; if the initial ModbusTcp command is a non-hazardous command, the initial ModbusTcp command is ModbusTcp commands are forwarded to slave devices.

When the slave device receives the initial ModbusTcp command, it will execute the corresponding behavior according to the initial ModbusTcp command. After the execution is completed, the execution receipt will be sent back to the zero-trust gateway, and then the zero-trust gateway will encrypt the execution receipt through TLS, and use The Tcp communication tunnel sends the encrypted execution receipt to the zero-trust gateway client. The zero-trust gateway client authenticates the encrypted execution receipt. If the authentication passes, it decrypts the encrypted execution receipt and sends the execution receipt. sent to the master device. The zero-trust gateway client performs identity verification on the encrypted execution receipt, that is, the zero-trust gateway client identifies the second identity corresponding to the encrypted execution receipt. If the second identity satisfies the second preset condition, it indicates that If the authentication is passed, if the authentication fails, the encrypted execution receipt will be discarded.

It should be understood that the size of the sequence numbers of the steps in the above embodiments does not mean the sequence of execution, and the execution sequence of each process should be determined by its functions and internal logic, and should not constitute any limitation to the implementation process of the embodiments of the present invention.

The following are apparatus embodiments of the present invention, and for details that are not described in detail, reference may be made to the above-mentioned corresponding method embodiments.

FIG. 4 shows a schematic structural diagram of a ModbusTcp instruction protection device provided by an embodiment of the present invention. For convenience of description, only parts related to the embodiment of the present invention are shown. A ModbusTcp instruction protection device includes an instruction encryption module 41 and the instruction control module 42, as follows:

The command encryption module 41 is used for the zero-trust gateway client to receive the initial ModbusTcp command transmitted by the master device, encrypt the initial ModbusTcp command, and use the Tcp communication tunnel to send the encrypted initial ModbusTcp command to the zero-trust gateway;

The command control module 42 is used for the zero trust gateway to perform identity authentication, decryption and risk monitoring on the encrypted initial ModbusTcp command in sequence. If the initial ModbusTcp command is a non-hazardous command, the initial ModbusTcp command is forwarded to the slave device according to a preset strategy.

In a possible implementation, the instruction control module 42 includes:

The instruction authentication sub-module is used to identify the first identity identifier corresponding to the encrypted initial ModbusTcp instruction;

an instruction decryption submodule, configured to decrypt the encrypted initial ModbusTcp instruction to obtain the initial ModbusTcp instruction if the first identity identifier satisfies the first preset condition;

The command discrimination sub-module is used to compare the initial ModbusTcp command with all the dangerous commands in the preset dangerous command library, and judge whether the initial ModbusTcp command is a dangerous command.

In a possible implementation manner, after the instruction decryption submodule, further includes:

The command authorization sub-module is used to authorize the encrypted initial ModbusTcp command.

In a possible implementation manner, after the instruction discriminates the sub-module, it further includes:

The alarm processing sub-module is used to send the initial ModbusTcp command to the alarm server for processing if the initial ModbusTcp command is a dangerous command.

In a possible implementation manner, after the instruction control module 42, further includes:

The receipt receiving sub-module is used for the zero trust gateway to receive the execution receipt transmitted from the device;

The encryption sub-module is used to encrypt the execution receipt, and use the Tcp communication tunnel to send the encrypted execution receipt to the zero-trust gateway client.

In a possible implementation manner, after the encryption sub-module, it also includes:

The receipt verification sub-module is used for the zero trust gateway client to authenticate the encrypted execution receipt;

The receipt decryption sub-module is used to decrypt the encrypted execution receipt if the identity verification is passed, and send the execution receipt to the main device.

In a possible implementation, the receipt verification sub-module includes:

The identification identification unit is used for the zero trust gateway client to identify the second identification corresponding to the encrypted execution receipt.

FIG. 5 is a schematic diagram of a terminal provided by an embodiment of the present invention. As shown in FIG. 5 , the terminal 5 of this embodiment includes: a processor 50 , a memory 51 , and a computer program 52 stored in the memory 51 and executable on the processor 50 . When the processor 50 executes the computer program 52, it implements the steps in each of the foregoing embodiments of the protection method for ModbusTcp instructions, for example, steps 301 to 302 shown in FIG. 3 . Alternatively, when the processor 50 executes the computer program 52, the functions of the modules/units in the protection device embodiments of the various ModbusTcp instructions described above are realized, for example, the functions of the modules/units 41 to 42 shown in FIG. 4 .

The present invention further provides a readable storage medium, where a computer program is stored in the readable storage medium, and when the computer program is executed by a processor, is used to implement the methods provided by the above-mentioned various embodiments.

The readable storage medium may be a computer storage medium or a communication medium. Communication media includes any medium that facilitates transfer of a computer program from one place to another. Computer storage media can be any available media that can be accessed by a general purpose or special purpose computer. For example, a readable storage medium is coupled to the processor such that the processor can read information from, and write information to, the readable storage medium. Of course, the readable storage medium can also be an integral part of the processor. The processor and the readable storage medium may be located in application specific integrated circuits (Application Specific Integrated Circuits, ASIC for short). Alternatively, the ASIC may be located in the user equipment. Of course, the processor and the readable storage medium may also exist in the communication device as discrete components. The readable storage medium may be read only memory (ROM), random access memory (RAM), CD-ROMs, magnetic tapes, floppy disks, optical data storage devices, and the like.

The present invention also provides a program product including execution instructions stored in a readable storage medium. At least one processor of the device can read the execution instruction from the readable storage medium, and the execution of the execution instruction by the at least one processor causes the device to implement the methods provided by the various embodiments described above.

In the embodiment of the above device, it should be understood that the processor may be a central processing unit (English: Central Processing Unit, referred to as: CPU), or other general-purpose processors, digital signal processors (English: Digital Signal Processor, referred to as: DSP) ), application specific integrated circuit (English: Application Specific Integrated Circuit, referred to as: ASIC) and so on. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like. The steps of the method disclosed in conjunction with the present invention can be directly embodied as executed by a hardware processor, or executed by a combination of hardware and software modules in the processor.

The above embodiments are only used to illustrate the technical solutions of the present invention, but not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: The recorded technical solutions are modified, or some technical features thereof are equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the present invention. within the scope of protection.

Claims (10)

1. a protection method of ModbusTcp instruction, is characterized in that, comprises: The zero-trust gateway client receives the initial ModbusTcp command transmitted by the master device, encrypts the initial ModbusTcp command, and uses the Tcp communication tunnel to send the encrypted initial ModbusTcp command to the zero-trust gateway; The zero-trust gateway sequentially performs identity authentication, decryption and danger monitoring on the encrypted initial ModbusTcp command, and if the initial ModbusTcp command is a non-hazardous command, forwards the initial ModbusTcp command to the slave device according to a preset policy. 2. The protection method of ModbusTcp instruction as claimed in claim 1, is characterized in that, described zero trust gateway carries out identity authentication, decryption and danger monitoring to described encrypted initial ModbusTcp instruction successively, comprising: Identify the first identity corresponding to the encrypted initial ModbusTcp instruction; If the first identity identifier satisfies the first preset condition, decrypt the encrypted initial ModbusTcp command to obtain the initial ModbusTcp command; The initial ModbusTcp command is compared with all the dangerous commands in the preset dangerous command library to determine whether the initial ModbusTcp command is a dangerous command. 3. The protection method of ModbusTcp instruction as claimed in claim 2, is characterized in that, after described if described identity mark satisfies the first preset condition, also comprises: Authorize the encrypted initial ModbusTcp command. 4. The protection method of ModbusTcp instruction as claimed in claim 2, is characterized in that, after described judging whether described initial ModbusTcp instruction is dangerous instruction, also comprises: If the initial ModbusTcp command is a dangerous command, the initial ModbusTcp command is sent to the alarm server for processing. 5. The method for protecting a ModbusTcp instruction according to any one of claims 1-4, wherein after the initial ModbusTcp instruction is forwarded to the slave device according to a preset strategy, the method further comprises: The zero-trust gateway receives the execution receipt transmitted from the device; The execution receipt is encrypted, and the encrypted execution receipt is sent to the zero-trust gateway client by using a Tcp communication tunnel. 6. The protection method of ModbusTcp instruction as claimed in claim 5, it is characterised in that the described execution receipt is encrypted, and the encrypted execution receipt is sent to the zero-trust gateway client by using a Tcp communication tunnel, and further include: The zero-trust gateway client authenticates the encrypted execution receipt; If the identity verification is passed, decrypt the encrypted execution receipt, and send the execution receipt to the main device. 7. The method for protecting a ModbusTcp instruction according to claim 6, wherein the zero-trust gateway client performs identity verification on the encrypted execution receipt, comprising: The zero-trust gateway client identifies the second identity identifier corresponding to the encrypted execution receipt. 8. A protection device for a ModbusTcp command, comprising: The instruction encryption module is used for the zero-trust gateway client to receive the initial ModbusTcp instruction transmitted by the master device, encrypt the initial ModbusTcp instruction, and use the Tcp communication tunnel to send the encrypted initial ModbusTcp instruction to the zero-trust gateway; The instruction control module is used for the zero-trust gateway to perform identity authentication, decryption and danger monitoring on the encrypted initial ModbusTcp instruction in sequence. If the initial ModbusTcp instruction is a non-dangerous instruction, forward the initial ModbusTcp instruction according to a preset strategy to the slave device. 9. A terminal, comprising a memory, a processor and a computer program stored in the memory and running on the processor, wherein the processor implements the computer program as claimed in claim 1 when the processor executes the computer program Steps of the protection method for the ModbusTcp instruction described in any one of to 7. 10. A computer-readable storage medium storing a computer program, wherein the computer program is implemented by a processor when the computer program is executed as claimed in any one of claims 1 to 7 The steps of the protection method of the ModbusTcp instruction.

Images