01 Interpretation of Terminology
Verification code: The verification code is obtained from the previous data through a certain algorithm to verify the correctness of the set of data. Code, as data input to computers or other devices, is prone to input errors. In order to reduce such input errors, coding experts have invented various verification and error detection methods and set verification codes based on these methods.
Common verifications include: Sum Up Check (SUM), Byte XOR Check (XOR), Longitudinal Redundancy Check (LRC), Cyclic Redundancy Check (CRC), etc
Discrete input: mainly used to read single bit data, such as the status of IO;
Coil: The switch output signal is mainly used to write single bit data and form a positional operation with discrete quantities;
Input register: mainly used to read 16 bits, which is two bytes of data;
Keep register: mainly used to write 16 bit data.
PLC: Programmable Logic Controller (PLC) is a type of programmable memory used to store programs internally, execute user oriented instructions such as logical operations, sequential control, timing, counting, and arithmetic operations, and control various types of machinery or production processes through digital or analog input/output.
Serial communication: With the application of computer systems and the development of microcomputer networks, communication functions are becoming increasingly important The communication referred to here refers to the exchange of information between computers and the outside world Therefore, communication includes both the exchange of information between computers and external devices, as well as between computers themselves Due to the fact that serial communication transmits information bit by bit over a single transmission line, requiring fewer transmission lines and utilizing existing telephone networks for information transmission, it is particularly suitable for long-distance transmission For human-machine exchange devices and external devices with serial storage such as terminals, printers, logic analyzers, disks, etc. that are not far from computers, serial data exchange is also common In terms of real-time control and management, in a hierarchical distributed control system composed of multiple microcomputer processors, communication between each CPU is generally in serial mode So serial interface is a commonly used interface in microcomputer application systems. Many peripherals and computers communicate in a serial manner, where serial refers to the way information is transmitted between the peripherals and interface circuits. In fact, the CPU and interface still work in parallel
Serial port: Serial port is a very common protocol for device communication on computers, and should not be confused with Universal Serial Bus (USB). Most computers come with two RS232 based serial ports. Serial port is also a universal communication protocol for instruments and equipment; Many GPIB compatible devices also come with RS-232 ports. Meanwhile, the serial communication protocol can also be used to obtain data from remote collection devices.
The concept of serial communication is very simple, where the serial port sends and receives bytes bit by bit. Although slower than byte based parallel communication, serial ports can send data using one wire while receiving data using another wire. It is simple and capable of long-distance communication. For example, when IEEE488 defines parallel traffic status, it stipulates that the total length of equipment lines shall not exceed 20 meters, and the length between any two devices shall not exceed 2 meters; For serial ports, the length can reach 1200 meters.
Typically, serial ports are used for transmitting ASCII code characters. Communication is completed using three wires: (1) ground wire, (2) transmission, and (3) reception. Due to the asynchronous nature of serial communication, ports are able to send data on one line while receiving data on another line. Other wires are used for shaking hands, but they are not necessary. The most important parameters for serial communication are baud rate, data bits, stop bits, and parity check. For two ports to pass through, these parameters must match:
a. Baud rate: This is a parameter used to measure communication speed. It represents the number of bits transmitted per second. For example, 300 baud means sending 300 bits per second. When we refer to clock cycles, we mean baud rate. For example, if the protocol requires a baud rate of 4800, then the clock is 4800Hz. This means that the sampling rate of serial communication on the data line is 4800Hz. Typically, the baud rates of telephone lines are 144002800 and 36600. The baud rate can be much higher than these values, but the baud rate is inversely proportional to the distance. High baud rate is often used for communication between instruments placed in close proximity, with a typical example being GPIB device communication.
b. Data bits: This is a parameter that measures the actual data bits in communication. When a computer sends a packet, the actual data will not be 8-bit, the standard values are 5, 7, and 8 bits. How to set it depends on the information you want to transmit. For example, the standard ASCII code is 0-127 (7 bits). The extended ASCII code is 0-255 (8 bits). If the data uses simple text (standard ASCII code), then each data packet uses 7-bit data. Each packet refers to a byte, including start/stop bits, data bits, and parity bits. Due to the fact that the actual data bits depend on the selection of the communication protocol, the term 'packet' refers to any communication situation.
c. Stop bit: used to represent the last bit of a single package. Typical values are 1, 1.5, and 2 digits. Due to the fact that data is timed on transmission lines and each device has its own clock, it is likely that there may be a slight synchronization issue between the two devices during communication. Therefore, the stop bit not only indicates the end of transmission, but also provides an opportunity for the computer to calibrate clock synchronization. The more bits are suitable for stopping, the greater the tolerance for different clock synchronization, but the data transfer rate is also slower.
d. Parity check bit: a simple error detection method in serial communication. There are four error detection methods: even, odd, high, and low. Of course, it is also possible without a checksum. For even and odd parity, the serial port will set a parity bit (the one after the data bit) to ensure that the transmitted data has even or odd logical high bits. For example, if the data is 011, then for even parity, the parity bit is 0, ensuring that the number of logically high bits is even. If it is odd parity, the parity bit is 1, so there are 3 logical high bits. The high and low positions do not truly check the data, simply setting the logic high or low for verification. This allows the receiving device to know the status of a bit, giving it the opportunity to determine whether there is noise interfering with communication or whether the transmission and reception of data are not synchronized.
02 Background
As early as 1971, Modicon Corporation first introduced the Modbus protocol, where Modbus RTU and Modbus ASCII were born. Later, Schneider Electric acquired Modicon and launched the Modbus TCP protocol in 1997. In 2004, the National Standards Committee of China officially adopted Modbus as the national standard, ushering in an era where Modbus contributed to industrial communication in China.
Through this protocol, controllers can communicate with each other and with other devices via a network. The Modbus protocol has the characteristics of standardization, openness, support for multiple electrical interfaces, simple and compact data frame format, large data transmission volume, and good real-time performance. It has been widely used in industrial control systems and has become a universal industrial standard. An in-depth analysis of the Modbus protocol implementation principle and its security is of great practical significance for improving the security of industrial control systems. Modbus RTU and Modbus ASCII are mainly used in the field of serial communication, while Modbus TCP is commonly used in Ethernet communication. Nowadays, Modbus has become a communication protocol standard in the industrial field and is a commonly used connection method between industrial electronic devices.
03 Protocol Principle
Modbus uses a simple Master and Slave protocol (client/server protocol) for communication. The client serves as the main station and sends requests to the server; After receiving a request, the server (slave) analyzes the request and responds. The communication frames used are called Application Data Units (ADUs), which include communication address segments, functional code segments, data segments, and checksum segments, as shown in the following figure:
Generally, in use, the monitoring system (HMI) is a Master, and PLCs, meters, instruments, etc. are all Slaves. The HMI system continuously polls the latest values of various relays in the Slave, and then performs display, various logical calculations, and control adjustments.
Among them, the combination of functional code segments and data segments is called a Protocol Data Unit or Protocol Description Unit (PDU). The functional code segment occupies one byte with a value range of 1-255, of which 128~255 are reserved values used for exception message response messages. 1-127 are function code numbers, of which 65-72 and 100-110 are user-defined codes.
04 Transmission Method
The Modbus protocol is an application layer message transmission protocol that includes three message types: ASCII, RTU, and TCP. The protocol itself does not define a physical layer, but only defines the message structure that controllers can recognize and use, regardless of the network they communicate through.
The Modbus protocol allows for the selection of RTU or ASCII mode for serial transmission and specifies message, data structure, command, and response methods, as well as the need for data validation. ASCII mode uses LRC verification, while RTU mode uses 16 bit CRC verification. When transmitting over Ethernet, TCP is used, which does not use checksum because TCP protocol is a reliable connection oriented protocol.
What is the difference between Modbus RTU and Modbus ASCII
Modbus is an application layer protocol that defines data units (ADUs) that are independent of the underlying network and can communicate over Ethernet (TCP/IP) or serial links (RS232, RS485, etc.) (Ethernet ADUs and serial ADUs are slightly different). On the serial link, the Modbus protocol has two transmission modes - ASCII mode and RTU mode. Among them, ASCII stands for "American Standard Code for Information Interchange" in English, which is translated as "National Standard Code for Information Interchange" in Chinese; RTU is the abbreviation for "Remote Terminal Unit" in English, translated as "Remote Terminal Device" in Chinese.
Firstly, let's take a look at the working principle of Modbus.
Modbus adopts a master slave communication mode, where only the master device can initialize the transmission, and the slave device responds to the master device's request. A typical master device includes field instruments and display panels, while a typical slave device is a programmable logic controller (PLC).
In the master-slave communication of serial links, Modbus master devices can connect one or N (up to 247) slave devices, and communication between master and slave devices includes unicast mode and broadcast mode.
In broadcast mode, the Modbus master device can simultaneously send requests to multiple slave devices (device address 0 is used for broadcast mode), and the slave devices do not respond to broadcast requests.
In unicast mode, the master device sends a request to a specific slave device (each Modbus slave device has a unique address), and the requested message frame contains function code and data, such as function code "01" used to read the status of discrete coils. After receiving the request, the slave device responds and feeds back the message to the master device.
In communication between master and slave devices, ASCII mode or RTU mode can be used.
In ASCII (American Standard Code for Information Interchange) transmission mode, message frames start with a colon (":", ASCII 3A Hex) and end with carriage return and carriage change (CRLF, ASCII 0D and 0A Hex) symbols. The allowed character sets for transmission are hexadecimal 0-9 and A~F; In the network, the slave device monitors whether there is an English colon (":") on the transmission path. If there is, it decodes the message frame and checks whether the address in the message is the same as its own address. If it is the same, it receives the data in it; If they are different, ignore them.
In ASCII mode, each 8-bit byte is split into two ASCII characters for transmission, such as the hexadecimal number 0xAF, which is split into ASCII characters "A" and "F" for transmission, doubling the number of characters sent compared to RTU. The advantage of ASCII mode is that it allows for a time interval of up to 1 second between two characters without causing communication failures. This mode uses the method of Longitudinal Redundancy Check (LRC) to check for errors,
When the controller is set to communicate in RTU mode on a Modbus network, each 8 bit byte in the message contains two 4-bit hexadecimal characters, and this mode does not have start and end markers. Its advantage is that it can transmit more data at the same baud rate.
In RTU (Remote Terminal Unit) mode, each byte can transmit two hexadecimal characters, such as the hexadecimal number 0xAF, which can be directly sent as hexadecimal 0xAF (binary: 10101111). Therefore, its transmission density is twice as high as ASCII mode; The RTU mode adopts cyclic redundancy check (CRC), and the following is a summary of the RTU mode:
The specific format is shown in the figure.
06 Modbus TCP and its precautions
6.1 Host and Slave, Server and Client
In the Modbus protocol
The host sends a Modbus request, and the slave returns a response to the host based on the request content. In the Modbus protocol, the host is always the active party and the slave is always the passive party.
In online applications
In network applications, there are client and server sides. The client (such as a browser) sends requests to the server, and the server returns content (such as HTML text) to the client.
[In Modbus TCP]
The host is the client, while the slave is the server. Never think that the server side is important, and the host is also important, so the host is the server side.
6.2 Is it possible to have multiple hosts
Based on the previous analysis, if the host is a client, modbustcp supports multiple hosts, and there can be multiple hosts and slaves in a local area network. The connection capability of the slave (the number of connections to the host) is determined by the maximum number of TCP connections in uIP.
6.3 Overview of Modbus TCP Protocol
Modbus TCP and Modbus RTU are essentially the same, but there are also some differences
a. The slave address becomes less important and is often ignored. In a sense, the slave address is replaced by an IP address
b. CRC verification has become less important and can even be ignored. Due to the presence of checksum in TCP packets, Modbus TCP simply canceled CRC checksum in order to avoid creating duplicate wheels.
The TCP mode is designed to facilitate the smooth transmission of Modbus data over Ethernet, using the TCP502 port. The physical layer, data link layer, network layer, and transport layer of this protocol are all based on the TCP protocol, and only at the application layer, the Modbus protocol is modified and encapsulated; After unpacking the TCP packet, the receiving end retrieves the original Modbus frame, parses it according to the Modbus protocol specification, and re encapsulates the returned packet into the TCP protocol before returning it to the sending end. Unlike the data format transmitted through serial links, TCP mode removes additional addresses and checksum, and adds message headers. Its specific format is shown in Figure 4.
Include an MBAP header in Modbus TCP, which includes the following parts
【Note】
【1】 The transmission flag can be understood as a sequence number to prevent misplacement in MODBUS TCP communication, for example, responses that occur later arrive at the host first, while responses that occur earlier arrive at the host later
【2】 The unit flag can be understood as the slave address, which is no longer important at this point
6.4 The Relationship between Modbus TCP and TCP IP
Modbus TCP can be understood as an application layer protocol that occurs on top of TCP. Since it is a TCP protocol, a complete Modbus TCP packet must include a TCP header, an IP header, and an Ethernet header.
07 Function Code Function
Create a Modbus application data unit for the client that initiates Modbus transaction processing. The function code (in PDU) indicates to the server which operation will be performed.
Encode the function code field of a Modbus data unit with one byte. The effective range is from 1-255 on a ten point scale (128-255 is reserved for abnormal response). What operation does the function code domain perform through the server when sending messages from the client to the server.
The data field of the message sent from the client to the server includes additional information, which the server uses to perform operations defined by the function code. This field also includes discrete items and register addresses, the number of processed items, and the actual number of data bytes in the field.
In a certain request, the data domain may not exist, in which case the server does not require any additional information. The function code only indicates the operation.
Types of Function Codes
Function codes are mainly divided into valid function codes, abnormal function codes, and incorrect function codes.
If there are no errors related to requesting Modbus functionality in a correctly received Modbus ADU, the response data from the server to the client will include the normal functionality code in the request. If there is an error related to requesting Modbus functionality, the response data will include an exception code and an error code.
For example, the client can read a set of discrete output or input on/off states, or the user can read/write a set of register data contents. When a server responds to a client, it uses a function code field to indicate a normal (error free) response or the occurrence of some kind of error (known as an abnormal response). For a normal response, the server only responds to the original function code, as shown in the following figure:
For abnormal responses, the server returns a code equivalent to the client, sets the most significant bit of the original function code to logic 1, and adds an error code after adding the exception code to notify the client of the reason for the exception. As shown in the figure below:
Valid Function Code
There are over twenty types of valid function codes, but generally, the eight most commonly used ones are 1, 2, 3, 4, 5, 6, 15, and 16, as well as the two special ones of 20 and 21. This is the General Reference Register, which is not provided by the vast majority of Modbus devices. There are four main types of control data on PLC. These eight function codes are used to process these control data, with detailed explanations of the following points:
There are four types of control data:
DI: DigitalInput, one address, one data bit, users can only read its status and cannot modify it. Representing On/Off with one bit, used to record the status input of control signals, such as switches, contact points, motor operation, over limit switches, etc. It is called input relay, input coil, etc. on PLC.
DO: Digital Output (coil output), one address, one data bit, users can set, reset, and read back the status. Represent On/Off with one bit, used to output control signals to activate or stop motors, alarm bells, lights, and so on. It is called output relay, output coil, etc. on PLC.
AI: Analog Input (input register), a 16 bit data address that can only be read by users and cannot be modified. It represents a value in 16 bits integer format and is used to record the numerical input of control signals, such as temperature, flow rate, material quantity, speed, rotation speed, document board opening, liquid level, weight, etc. It is called an Input register on PLC.
AO: Analog Output (holding register), a 16 bit data address that can be written or read back by the user. It represents a value in 16 bit integers and is used to output control signal values, such as temperature, flow rate, speed, file board opening, feed quantity, and so on. It is called Output register or Holding register on PLC.
Security Analysis of Modbus Protocol 08
The Modbus protocol is a typical industrial control network protocol, and studying its security is of great significance for strengthening the security of industrial control networks. Generally speaking, protocol security issues can be divided into two types: one is security issues caused by the design and description of the protocol itself; Another type is security issues caused by incorrect implementation of the protocol. The Modbus protocol also exists
These two issues.
8.1 Inherent issues of Modbus protocol
The vast majority of industrial control protocols were designed with only functional implementation, efficiency improvement, and reliability in mind, without considering security issues. The Modbus protocol is no exception, although it has become a de facto industry standard. From the previous principle analysis, it can be seen that its own security issues are the lack of authentication, authorization, encryption and other security protection mechanisms, as well as the problem of functional code abuse.
(1) Lack of certification
The purpose of authentication is to ensure that the received information comes from legitimate users, and that unauthenticated users sending control commands to the device will not be executed. In the communication process of Modbus protocol, there is no relevant definition of authentication. Attackers only need to find a valid address to establish a Modbus communication session using function codes, thereby disrupting the entire or partial control process.
(2) Lack of authorization
Authorization is to ensure that different privileged operations need to be completed by authenticated users with different permissions, which can greatly reduce the probability of misoperation and internal attacks. At present, the Modbus protocol does not have a role-based access control mechanism, nor does it classify users or divide their permissions, which can result in any user being able to perform any function.
(3) Lack of encryption
Encryption can ensure that the information of both parties is not illegally obtained by third parties during the communication process. During Modbus protocol communication, all addresses and commands are transmitted in plaintext, making data easily vulnerable to attackers
Capture and parse, providing convenience for attackers.
(4) Abuse of function codes
Function codes are an important part of the Modbus protocol, and almost all communications contain function codes. Currently, the abuse of function codes is a major factor causing Modbus network abnormalities. For example, invalid message length, short cycle useless commands, incorrect message length, and delayed confirmation of abnormal codes can all lead to denial of service attacks.
8.2 Issues arising from protocol implementation
Although the Modbus protocol has been widely used, developers do not have safety knowledge or awareness of safety issues when implementing specific industrial control systems. This may result in various security vulnerabilities in systems using the Modbus protocol.
(1) Design safety issues
Modbus system developers focus on its functional implementation issues, and security concerns are rarely addressed during design. Design safety refers to fully considering safety during design and addressing various issues such as anomalies and illegal operations that may occur in Modbus systems. For example, in the process of communication, if a node is maliciously controlled and sends out illegal data, it is necessary to consider the identification and processing of this data.
(2) Buffer overflow vulnerability
Buffer overflow refers to the situation where when filling data into a buffer, the overflow exceeds the capacity of the buffer itself, causing the overflowing data to overwrite legitimate data. This is the most common and dangerous vulnerability in software development, which can lead to system crashes or be exploited by attackers to control the system. Most Modbus system developers lack security development knowledge, which can lead to many buffer overflow vulnerabilities. Once exploited by malicious individuals, it can result in serious consequences.
(3) Modbus TCP security issues
At present, the Modbus protocol can be implemented on general-purpose computers and general-purpose operating systems, running on top of TCP/IP to meet development needs. In this way, the security issues inherent in the TCP/IP protocol will inevitably affect the security of industrial control networks. Illegal network data acquisition, intermediaries, denial of service, IP spoofing, virus trojans and other common attacks in the IP Internet will affect the security of the Modbus system.
8.3 Safety Suggestions
At present, the security measures adopted by Modbus systems are generally insufficient. Here, based on research in the information security industry and combined with the security issues of industrial control systems, some security suggestions are proposed to effectively reduce the threats faced by industrial control systems.
(1) Starting from the source
A large part of the vulnerabilities in industrial control networks are those that occur during their implementation process. If we start controlling from the source, from the requirements design, development implementation, internal testing, and deployment stages of the Modbus system, and involve security measures throughout the entire lifecycle, integrating security design, coding, and testing technologies, we can greatly eliminate security vulnerabilities and reduce the security risks of the entire Modbus system.
(2) Abnormal behavior detection
Abnormal behavior represents a potential threat, whether or not there are attackers, so developing dedicated abnormal behavior detection devices for Modbus systems can greatly improve the security of industrial control networks. For the Modbus system, the first step is to analyze its various operational behaviors and describe them as a six tuple model based on behaviors such as "subject, location, time, access method, operation, and object"; Further analyze whether its behavior is abnormal; The final decision is to take measures such as recording or alerting.
(3) Security audit
The security audit of Modbus is to deeply decode and analyze protocol data, record key information such as operation time, location, operator, and operation behavior, and achieve the security audit log recording and audit function of Modbus system, thereby providing the ability to trace security events after they occur.
(4) Use network security devices
Use network security devices such as intrusion prevention and firewalls. A firewall is a serial device that allows only specific addresses to access the server and prohibits external addresses from accessing the Modbus server, effectively preventing external intrusion; Intrusion prevention devices can analyze the specific operation content of the Modbus protocol, effectively detect and prevent abnormal operations and various penetration attacks from internal/external sources, and provide protection functions for the internal network.
Source: Network.
Leave a Reply