"# Modbus \u5b89\u5168\u6700\u4f73\u5b9e\u8df5\uff1a\u6784\u5efa\u5de5\u4e1a\u7269\u8054\u7f51\u9632\u62a4\u4f53\u7cfb\n\n> 2026-03-01 | 2026-03-01\n> https:\/\/www.modbus.cn\/en\/40582.html\n\n**Modbus\u89e3\u51b3\u65b9\u6848**\n\n---\n\nModbus \u5b89\u5168\u6700\u4f73\u5b9e\u8df5\uff1a\u6784\u5efa\u5de5\u4e1a\u7269\u8054\u7f51\u9632\u62a4\u4f53\u7cfb\n\n## \u5f15\u8a00\uff1a\u5de5\u4e1a\u7f51\u7edc\u5b89\u5168\u7684\u91cd\u8981\u6027\n\n\u968f\u7740\u5de5\u4e1a 4.0 \u548c\u7269\u8054\u7f51\u6280\u672f\u7684\u5feb\u901f\u53d1\u5c55\uff0c\u5de5\u4e1a\u63a7\u5236\u7cfb\u7edf\u4e0e\u4e92\u8054\u7f51\u7684\u8fb9\u754c\u65e5\u76ca\u6a21\u7cca\u3002Modbus \u4f5c\u4e3a\u5de5\u4e1a\u81ea\u52a8\u5316\u9886\u57df\u6700\u5e7f\u6cdb\u4f7f\u7528\u7684\u901a\u4fe1\u534f\u8bae\uff0c\u5176\u5b89\u5168\u6027\u76f4\u63a5\u5173\u7cfb\u5230\u6574\u4e2a\u5de5\u4e1a\u7cfb\u7edf\u7684\u5b89\u5168\u7a33\u5b9a\u8fd0\u884c\u3002\u7136\u800c\uff0cModbus \u534f\u8bae\u8bbe\u8ba1\u4e4b\u521d\u5e76\u672a\u8003\u8651\u5b89\u5168\u56e0\u7d20\uff0c\u7f3a\u4e4f\u8ba4\u8bc1\u3001\u52a0\u5bc6\u548c\u5b8c\u6574\u6027\u9a8c\u8bc1\u673a\u5236\uff0c\u8fd9\u4f7f\u5f97\u57fa\u4e8e Modbus \u7684\u5de5\u4e1a\u7cfb\u7edf\u9762\u4e34\u7740\u4e25\u5cfb\u7684\u5b89\u5168\u6311\u6218\u3002\n\n\u672c\u6587\u5c06\u6df1\u5165\u63a2\u8ba8 Modbus \u534f\u8bae\u7684\u5b89\u5168\u98ce\u9669\uff0c\u63d0\u4f9b\u4ece\u7f51\u7edc\u9694\u79bb\u3001\u8bbf\u95ee\u63a7\u5236\u3001\u6570\u636e\u52a0\u5bc6\u5230\u5b89\u5168\u76d1\u63a7\u7684\u5b8c\u6574\u9632\u62a4\u65b9\u6848\uff0c\u5e2e\u52a9\u4f01\u4e1a\u548c\u5f00\u53d1\u8005\u6784\u5efa\u53ef\u9760\u7684\u5de5\u4e1a\u7269\u8054\u7f51\u5b89\u5168\u4f53\u7cfb\u3002\n\n## \u4e00\u3001Modbus \u534f\u8bae\u5b89\u5168\u98ce\u9669\u5206\u6790\n\n### 1.1 \u534f\u8bae\u8bbe\u8ba1\u7f3a\u9677\n\n**\u65e0\u8ba4\u8bc1\u673a\u5236**\n- Modbus \u534f\u8bae\u4e0d\u5305\u542b\u4efb\u4f55\u8eab\u4efd\u9a8c\u8bc1\u673a\u5236\n- \u4efb\u4f55\u80fd\u591f\u8fde\u63a5\u5230\u8bbe\u5907\u7684\u5ba2\u6237\u7aef\u90fd\u53ef\u4ee5\u53d1\u9001\u547d\u4ee4\n- \u653b\u51fb\u8005\u53ef\u4ee5\u4f2a\u88c5\u6210\u5408\u6cd5\u4e3b\u7ad9\u8fdb\u884c\u64cd\u4f5c\n\n**\u65e0\u52a0\u5bc6\u4fdd\u62a4**\n- \u6240\u6709\u901a\u4fe1\u6570\u636e\u4ee5\u660e\u6587\u4f20\u8f93\n- \u654f\u611f\u6570\u636e\uff08\u5982\u63a7\u5236\u53c2\u6570\u3001\u751f\u4ea7\u6570\u636e\uff09\u53ef\u88ab\u7a83\u542c\n- \u653b\u51fb\u8005\u53ef\u4ee5\u8f7b\u6613\u83b7\u53d6\u7cfb\u7edf\u8fd0\u884c\u72b6\u6001\n\n**\u65e0\u5b8c\u6574\u6027\u9a8c\u8bc1**\n- \u65e0\u6cd5\u68c0\u6d4b\u6570\u636e\u662f\u5426\u88ab\u7be1\u6539\n- \u4e2d\u95f4\u4eba\u653b\u51fb\u53ef\u4ee5\u4fee\u6539\u63a7\u5236\u6307\u4ee4\n- \u53ef\u80fd\u5bfc\u81f4\u8bbe\u5907\u8bef\u64cd\u4f5c\u6216\u635f\u574f\n\n### 1.2 \u5e38\u89c1\u653b\u51fb\u573a\u666f\n\n#### \u573a\u666f 1\uff1a\u672a\u6388\u6743\u8bbf\u95ee\n\n```\n\u653b\u51fb\u8005 \u2500\u2500\u25b6 Modbus \u8bbe\u5907 (\u7aef\u53e3 502)\n           \u2502\n           \u251c\u2500\u2500 \u8bfb\u53d6\u654f\u611f\u6570\u636e\uff08\u5de5\u827a\u53c2\u6570\u3001\u751f\u4ea7\u6570\u636e\uff09\n           \u251c\u2500\u2500 \u4fee\u6539\u63a7\u5236\u53c2\u6570\uff08\u8bbe\u5b9a\u70b9\u3001\u9608\u503c\uff09\n           \u2514\u2500\u2500 \u6267\u884c\u5371\u9669\u64cd\u4f5c\uff08\u505c\u673a\u3001\u91cd\u542f\uff09\n\n```\n\n**\u771f\u5b9e\u6848\u4f8b\uff1a** 2010 \u5e74\u9707\u7f51\u75c5\u6bd2 (Stuxnet) \u901a\u8fc7\u4fee\u6539 PLC \u53c2\u6570\uff0c\u5bfc\u81f4\u4f0a\u6717\u6838\u8bbe\u65bd\u79bb\u5fc3\u673a\u635f\u574f\u3002\n\n#### \u573a\u666f 2\uff1a\u4e2d\u95f4\u4eba\u653b\u51fb\n\n```\n\u4e3b\u7ad9 \u25c0\u2500\u2500 \u653b\u51fb\u8005 \u2500\u2500\u25b6 \u4ece\u7ad9\n       \u2502\n       \u251c\u2500\u2500 \u7a83\u542c\u901a\u4fe1\u5185\u5bb9\n       \u251c\u2500\u2500 \u7be1\u6539\u63a7\u5236\u6307\u4ee4\n       \u2514\u2500\u2500 \u6ce8\u5165\u6076\u610f\u6570\u636e\n\n```\n\n#### \u573a\u666f 3\uff1a\u62d2\u7edd\u670d\u52a1\u653b\u51fb\n\n```\n\u653b\u51fb\u8005 \u2500\u2500\u25b6 \u5927\u91cf\u6076\u610f\u8bf7\u6c42 \u2500\u2500\u25b6 Modbus \u8bbe\u5907\n                              \u2502\n                              \u25bc\n                         \u8bbe\u5907\u8fc7\u8f7d\n                              \u2502\n                              \u25bc\n                         \u670d\u52a1\u4e2d\u65ad\n\n```\n\n### 1.3 \u98ce\u9669\u7b49\u7ea7\u8bc4\u4f30\n\n  \u98ce\u9669\u7c7b\u578b\n  \u53ef\u80fd\u6027\n  \u5f71\u54cd\u7a0b\u5ea6\n  \u98ce\u9669\u7b49\u7ea7\n\n  \u672a\u6388\u6743\u8bbf\u95ee\n  \u9ad8\n  \u4e25\u91cd\n  \ud83d\udd34 \u9ad8\u5371\n\n  \u6570\u636e\u7a83\u542c\n  \u4e2d\n  \u4e2d\u7b49\n  \ud83d\udfe1 \u4e2d\u5371\n\n  \u6307\u4ee4\u7be1\u6539\n  \u4e2d\n  \u4e25\u91cd\n  \ud83d\udd34 \u9ad8\u5371\n\n  \u62d2\u7edd\u670d\u52a1\n  \u4e2d\n  \u4e2d\u7b49\n  \ud83d\udfe1 \u4e2d\u5371\n\n  \u91cd\u653e\u653b\u51fb\n  \u4f4e\n  \u4e2d\u7b49\n  \ud83d\udfe2 \u4f4e\u5371\n\n## \u4e8c\u3001\u7f51\u7edc\u5c42\u5b89\u5168\u9632\u62a4\n\n### 2.1 \u7f51\u7edc\u9694\u79bb\u7b56\u7565\n\n#### \u7269\u7406\u9694\u79bb\n\n```\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510     \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 \u529e\u516c\u7f51\u7edc         \u2502     \u2502 \u5de5\u4e1a\u63a7\u5236\u7f51\u7edc     \u2502\n\u2502 (IT \u7f51\u7edc)       \u2502     \u2502 (OT \u7f51\u7edc)       \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524     \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 - \u529e\u516c\u7535\u8111       \u2502     \u2502 - PLC \u8bbe\u5907       \u2502\n\u2502 - \u90ae\u4ef6\u670d\u52a1\u5668     \u2502     \u2502 - SCADA \u7cfb\u7edf     \u2502\n\u2502 - ERP \u7cfb\u7edf       \u2502     \u2502 - DCS \u7cfb\u7edf       \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518     \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n         \u2502                       \u2502\n         \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n                    \u2502\n            \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u25bc\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n            \u2502  \u5de5\u4e1a\u9632\u706b\u5899    \u2502\n            \u2502  (\u5355\u5411\u9694\u79bb)   \u2502\n            \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\n```\n\n**\u5b9e\u65bd\u8981\u70b9\uff1a**\n1. \u529e\u516c\u7f51\u7edc\u4e0e\u5de5\u4e1a\u7f51\u7edc\u7269\u7406\u5206\u79bb\n2. \u4f7f\u7528\u5de5\u4e1a\u9632\u706b\u5899\u8fdb\u884c\u9694\u79bb\n3. \u4ec5\u5141\u8bb8\u5fc5\u8981\u7684\u901a\u4fe1\u6d41\u91cf\u901a\u8fc7\n4. \u90e8\u7f72\u5355\u5411\u9694\u79bb\u7f51\u95f8\uff08\u6570\u636e\u4e8c\u6781\u7ba1\uff09\n\n#### VLAN \u5212\u5206\n\n```\n# Cisco \u4ea4\u6362\u673a\u914d\u7f6e\u793a\u4f8b\nvlan 10\n  name IT-Network\nvlan 20\n  name SCADA-Network\nvlan 30\n  name PLC-Network\n\ninterface GigabitEthernet0\/1\n  switchport mode access\n  switchport access vlan 20\n  switchport port-security\n  switchport port-security maximum 2\n\n```\n\n### 2.2 \u9632\u706b\u5899\u89c4\u5219\u914d\u7f6e\n\n#### iptables \u914d\u7f6e\u793a\u4f8b\n\n```\n#!\/bin\/bash\n# Modbus \u5b89\u5168\u9632\u706b\u5899\u811a\u672c\n\n# \u6e05\u7a7a\u73b0\u6709\u89c4\u5219\niptables -F\niptables -X\n\n# \u8bbe\u7f6e\u9ed8\u8ba4\u7b56\u7565\niptables -P INPUT DROP\niptables -P FORWARD DROP\niptables -P OUTPUT ACCEPT\n\n# \u5141\u8bb8\u672c\u5730\u56de\u73af\niptables -A INPUT -i lo -j ACCEPT\n\n# \u5141\u8bb8\u5df2\u5efa\u7acb\u7684\u8fde\u63a5\niptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT\n\n# \u4ec5\u5141\u8bb8\u7279\u5b9a IP \u8bbf\u95ee Modbus \u7aef\u53e3 (502)\niptables -A INPUT -p tcp -s 192.168.1.100 --dport 502 -j ACCEPT\niptables -A INPUT -p tcp -s 192.168.1.101 --dport 502 -j ACCEPT\n\n# \u5141\u8bb8 SSH \u7ba1\u7406\uff08\u4ec5\u9650\u7ba1\u7406\u7f51\u6bb5\uff09\niptables -A INPUT -p tcp -s 192.168.100.0\/24 --dport 22 -j ACCEPT\n\n# \u8bb0\u5f55\u88ab\u62d2\u7edd\u7684\u8fde\u63a5\niptables -A INPUT -p tcp --dport 502 -j LOG --log-prefix \"Modbus Denied: \"\niptables -A INPUT -p tcp --dport 502 -j DROP\n\n# \u4fdd\u5b58\u89c4\u5219\niptables-save > \/etc\/iptables\/rules.v4\n\n```\n\n#### Windows \u9632\u706b\u5899\u914d\u7f6e\n\n```\n# PowerShell \u914d\u7f6e\u793a\u4f8b\n\n# \u521b\u5efa\u5165\u7ad9\u89c4\u5219\nNew-NetFirewallRule -DisplayName \"Modbus TCP Secure\" `\n  -Direction Inbound `\n  -Protocol TCP `\n  -LocalPort 502 `\n  -Action Allow `\n  -RemoteAddress 192.168.1.100,192.168.1.101 `\n  -Profile Private\n\n# \u542f\u7528\u65e5\u5fd7\u8bb0\u5f55\nSet-NetFirewallProfile -Name Private `\n  -LogAllowed True `\n  -LogBlocked True `\n  -LogMaxSizeKilobytes 4096\n\n```\n\n### 2.3 \u7aef\u53e3\u5b89\u5168\u52a0\u56fa\n\n#### \u4fee\u6539\u9ed8\u8ba4\u7aef\u53e3\n\n```\n# \u4e0d\u5efa\u8bae\u4f7f\u7528\u9ed8\u8ba4\u7aef\u53e3 502\uff0c\u6539\u7528\u975e\u6807\u51c6\u7aef\u53e3\n# Modbus TCP \u670d\u52a1\u914d\u7f6e\u793a\u4f8b\n\n# \u539f\u59cb\u914d\u7f6e\n# ListenPort=502\n\n# \u5b89\u5168\u914d\u7f6e\nListenPort=50200\n\n```\n\n**\u6ce8\u610f\uff1a** \u7aef\u53e3\u9690\u85cf\u4e0d\u662f\u771f\u6b63\u7684\u5b89\u5168\u63aa\u65bd\uff0c\u5e94\u914d\u5408\u5176\u4ed6\u5b89\u5168\u673a\u5236\u4f7f\u7528\u3002\n\n#### \u7aef\u53e3\u626b\u63cf\u9632\u62a4\n\n```\n# \u4f7f\u7528 fail2ban \u9632\u6b62\u7aef\u53e3\u626b\u63cf\ncat > \/etc\/fail2ban\/jail.local << EOF\n[modbus-scan]\nenabled  = true\nport     = 502\nfilter   = modbus-scan\nlogpath  = \/var\/log\/syslog\nmaxretry = 3\nbantime  = 3600\nEOF\n\n```\n\n## \u4e09\u3001\u5e94\u7528\u5c42\u5b89\u5168\u9632\u62a4\n\n### 3.1 \u8ba4\u8bc1\u673a\u5236\u5b9e\u73b0\n\n#### JWT Token \u8ba4\u8bc1\n\n```\npackage com.example.modbus.security;\n\nimport io.jsonwebtoken.*;\nimport java.util.Date;\n\npublic class ModbusAuthenticator {\n\n    private final String secretKey = \"your-secret-key-at-least-32-chars\";\n\n    public String generateToken(String username, String role) {\n        return Jwts.builder()\n            .setSubject(username)\n            .claim(\"role\", role)\n            .setIssuedAt(new Date())\n            .setExpiration(new Date(System.currentTimeMillis() + 3600000))\n            .signWith(SignatureAlgorithm.HS256, secretKey)\n            .compact();\n    }\n\n    public boolean validateToken(String token) {\n        try {\n            Jwts.parser()\n                .setSigningKey(secretKey)\n                .parseClaimsJws(token);\n            return true;\n        } catch (JwtException e) {\n            return false;\n        }\n    }\n\n    public Claims getClaims(String token) {\n        return Jwts.parser()\n            .setSigningKey(secretKey)\n            .parseClaimsJws(token)\n            .getBody();\n    }\n}\n\n```\n\n#### API Key \u8ba4\u8bc1\n\n```\nimport hashlib\nimport hmac\nimport time\n\nclass ModbusAPIKeyAuth:\n    def __init__(self, api_key, secret):\n        self.api_key = api_key\n        self.secret = secret\n\n    def generate_signature(self, timestamp, method, path, body=''):\n        message = f\"{timestamp}{method}{path}{body}\"\n        signature = hmac.new(\n            self.secret.encode(),\n            message.encode(),\n            hashlib.sha256\n        ).hexdigest()\n        return signature\n\n    def get_headers(self, method, path, body=''):\n        timestamp = str(int(time.time()))\n        signature = self.generate_signature(timestamp, method, path, body)\n        return {\n            'X-API-Key': self.api_key,\n            'X-Timestamp': timestamp,\n            'X-Signature': signature\n        }\n\n```\n\n### 3.2 \u8bbf\u95ee\u63a7\u5236\u5217\u8868 (ACL)\n\n#### \u57fa\u4e8e\u89d2\u8272\u7684\u8bbf\u95ee\u63a7\u5236\n\n```\npackage com.example.modbus.security;\n\nimport java.util.*;\n\npublic class ModbusAccessControl {\n\n    enum Role {\n        OPERATOR,      \/\/ \u64cd\u4f5c\u5458\uff1a\u53ea\u8bfb\n        ENGINEER,      \/\/ \u5de5\u7a0b\u5e08\uff1a\u8bfb\u5199\u666e\u901a\u5bc4\u5b58\u5668\n        ADMINISTRATOR  \/\/ \u7ba1\u7406\u5458\uff1a\u5168\u90e8\u6743\u9650\n    }\n\n    private final Map<Role, Set<Integer>> readPermissions = new HashMap<>();\n    private final Map<Role, Set<Integer>> writePermissions = new HashMap<>();\n\n    public ModbusAccessControl() {\n        \/\/ \u521d\u59cb\u5316\u6743\u9650\n        readPermissions.put(Role.OPERATOR, Set.of(0, 1, 2, 3, 4));\n        readPermissions.put(Role.ENGINEER, Set.of(0, 1, 2, 3, 4, 5, 6, 7, 8, 9));\n        readPermissions.put(Role.ADMINISTRATOR, Set.of()); \/\/ \u5168\u90e8\n\n        writePermissions.put(Role.OPERATOR, Set.of()); \/\/ \u65e0\u5199\u5165\u6743\u9650\n        writePermissions.put(Role.ENGINEER, Set.of(100, 101, 102));\n        writePermissions.put(Role.ADMINISTRATOR, Set.of()); \/\/ \u5168\u90e8\n    }\n\n    public boolean canRead(Role role, int registerAddress) {\n        Set<Integer> allowed = readPermissions.get(role);\n        return allowed.isEmpty() || allowed.contains(registerAddress);\n    }\n\n    public boolean canWrite(Role role, int registerAddress) {\n        Set<Integer> allowed = writePermissions.get(role);\n        return allowed.isEmpty() || allowed.contains(registerAddress);\n    }\n}\n\n```\n\n#### IP \u767d\u540d\u5355\n\n```\nclass IPWhitelist:\n    def __init__(self):\n        self.allowed_ips = {\n            '192.168.1.100': {'read', 'write'},\n            '192.168.1.101': {'read'},\n            '192.168.1.102': {'read', 'write'},\n        }\n\n    def check_permission(self, ip_address, operation):\n        if ip_address not in self.allowed_ips:\n            return False\n        return operation in self.allowed_ips[ip_address]\n\n    def add_ip(self, ip_address, permissions):\n        self.allowed_ips[ip_address] = set(permissions)\n\n    def remove_ip(self, ip_address):\n        if ip_address in self.allowed_ips:\n            del self.allowed_ips[ip_address]\n\n```\n\n### 3.3 \u6570\u636e\u52a0\u5bc6\u4f20\u8f93\n\n#### TLS\/SSL \u52a0\u5bc6\n\n```\npackage com.example.modbus.security;\n\nimport javax.net.ssl.*;\nimport java.io.FileInputStream;\nimport java.security.KeyStore;\n\npublic class SecureModbusClient {\n\n    public SSLSocket createSecureConnection(String host, int port) \n        throws Exception {\n\n        \/\/ \u52a0\u8f7d\u5bc6\u94a5\u5e93\n        KeyStore keyStore = KeyStore.getInstance(\"JKS\");\n        keyStore.load(new FileInputStream(\"client.keystore\"), \n                     \"keystore-password\".toCharArray());\n\n        \/\/ \u521d\u59cb\u5316\u5bc6\u94a5\u7ba1\u7406\u5668\n        KeyManagerFactory kmf = KeyManagerFactory.getInstance(\"SunX509\");\n        kmf.init(keyStore, \"key-password\".toCharArray());\n\n        \/\/ \u52a0\u8f7d\u4fe1\u4efb\u5e93\n        KeyStore trustStore = KeyStore.getInstance(\"JKS\");\n        trustStore.load(new FileInputStream(\"truststore.jks\"), \n                       \"truststore-password\".toCharArray());\n\n        \/\/ \u521d\u59cb\u5316\u4fe1\u4efb\u7ba1\u7406\u5668\n        TrustManagerFactory tmf = TrustManagerFactory.getInstance(\"SunX509\");\n        tmf.init(trustStore);\n\n        \/\/ \u521b\u5efa SSL \u4e0a\u4e0b\u6587\n        SSLContext sslContext = SSLContext.getInstance(\"TLSv1.3\");\n        sslContext.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);\n\n        \/\/ \u521b\u5efa\u5b89\u5168\u8fde\u63a5\n        SSLSocketFactory factory = sslContext.getSocketFactory();\n        SSLSocket socket = (SSLSocket) factory.createSocket(host, port);\n\n        \/\/ \u914d\u7f6e\u52a0\u5bc6\u5957\u4ef6\n        socket.setEnabledCipherSuites(new String[] {\n            \"TLS_AES_256_GCM_SHA384\",\n            \"TLS_CHACHA20_POLY1305_SHA256\"\n        });\n\n        socket.setEnabledProtocols(new String[] {\"TLSv1.3\"});\n        socket.setUseClientMode(true);\n\n        return socket;\n    }\n}\n\n```\n\n#### \u5e94\u7528\u5c42\u52a0\u5bc6\n\n```\nfrom cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes\nfrom cryptography.hazmat.backends import default_backend\nimport os\n\nclass ModbusDataEncryptor:\n    def __init__(self, key):\n        self.key = key.encode().ljust(32)[:32]  # AES-256\n\n    def encrypt(self, plaintext):\n        iv = os.urandom(16)\n        cipher = Cipher(algorithms.AES(self.key), modes.CFB(iv), \n                       backend=default_backend())\n        encryptor = cipher.encryptor()\n        ciphertext = encryptor.update(plaintext.encode()) + encryptor.finalize()\n        return iv + ciphertext\n\n    def decrypt(self, ciphertext):\n        iv = ciphertext[:16]\n        actual_ciphertext = ciphertext[16:]\n        cipher = Cipher(algorithms.AES(self.key), modes.CFB(iv), \n                       backend=default_backend())\n        decryptor = cipher.decryptor()\n        plaintext = decryptor.update(actual_ciphertext) + decryptor.finalize()\n        return plaintext.decode()\n\n```\n\n## \u56db\u3001\u5b89\u5168\u76d1\u63a7\u4e0e\u5ba1\u8ba1\n\n### 4.1 \u64cd\u4f5c\u65e5\u5fd7\u8bb0\u5f55\n\n```\npackage com.example.modbus.logging;\n\nimport org.slf4j.Logger;\nimport org.slf4j.LoggerFactory;\nimport java.time.LocalDateTime;\nimport java.time.format.DateTimeFormatter;\n\npublic class SecurityAuditLogger {\n\n    private static final Logger logger = LoggerFactory.getLogger(\n        SecurityAuditLogger.class\n    );\n\n    private static final DateTimeFormatter formatter = \n        DateTimeFormatter.ofPattern(\"yyyy-MM-dd HH:mm:ss.SSS\");\n\n    public void logAccess(String username, String ip, String operation, \n                         int slaveId, int register, Object value) {\n        String log = String.format(\n            \"ACCESS | time=%s | user=%s | ip=%s | op=%s | slave=%d | reg=%d | value=%s\",\n            LocalDateTime.now().format(formatter),\n            username, ip, operation, slaveId, register, value\n        );\n        logger.info(log);\n    }\n\n    public void logViolation(String username, String ip, String reason) {\n        String log = String.format(\n            \"VIOLATION | time=%s | user=%s | ip=%s | reason=%s\",\n            LocalDateTime.now().format(formatter),\n            username, ip, reason\n        );\n        logger.warn(log);\n    }\n\n    public void logAttack(String ip, String attackType, String details) {\n        String log = String.format(\n            \"ATTACK | time=%s | ip=%s | type=%s | details=%s\",\n            LocalDateTime.now().format(formatter),\n            ip, attackType, details\n        );\n        logger.error(log);\n    }\n}\n\n```\n\n### 4.2 \u5f02\u5e38\u884c\u4e3a\u68c0\u6d4b\n\n```\nimport time\nfrom collections import defaultdict, deque\n\nclass AnomalyDetector:\n    def __init__(self):\n        self.request_counts = defaultdict(lambda: deque(maxlen=100))\n        self.thresholds = {\n            'requests_per_second': 50,\n            'failed_auth_per_minute': 10,\n            'unique_slaves_per_minute': 20\n        }\n\n    def record_request(self, ip_address, timestamp):\n        self.request_counts[ip_address].append(timestamp)\n\n    def detect_anomaly(self, ip_address):\n        now = time.time()\n        requests = self.request_counts[ip_address]\n\n        # \u68c0\u6d4b\u8bf7\u6c42\u9891\u7387\n        recent_requests = [t for t in requests if now - t < 1.0]\n        if len(recent_requests) > self.thresholds['requests_per_second']:\n            return 'HIGH_FREQUENCY_REQUEST'\n\n        # \u68c0\u6d4b\u626b\u63cf\u884c\u4e3a\n        if len(recent_requests) > 100:\n            return 'POSSIBLE_SCAN'\n\n        return None\n\n    def get_blocked_ips(self):\n        return [ip for ip in self.request_counts \n                if self.detect_anomaly(ip) is not None]\n\n```\n\n### 4.3 \u5b9e\u65f6\u76d1\u63a7\u4eea\u8868\u677f\n\n```\n\/\/ \u4f7f\u7528 Grafana + Prometheus \u76d1\u63a7\n\/\/ prometheus.yml \u914d\u7f6e\n\nglobal:\n  scrape_interval: 15s\n\nscrape_configs:\n  - job_name: 'modbus-gateway'\n    static_configs:\n      - targets: ['192.168.1.50:9090']\n    metrics_path: '\/metrics'\n\n\/\/ Node.js \u6307\u6807\u5bfc\u51fa\u5668\nconst client = require('prom-client');\n\nconst modbusRequests = new client.Counter({\n  name: 'modbus_requests_total',\n  help: 'Total number of Modbus requests',\n  labelNames: ['type', 'slave_id', 'status']\n});\n\nconst modbusLatency = new client.Histogram({\n  name: 'modbus_request_latency_seconds',\n  help: 'Modbus request latency',\n  labelNames: ['type'],\n  buckets: [0.01, 0.05, 0.1, 0.5, 1.0]\n});\n\nconst securityViolations = new client.Counter({\n  name: 'security_violations_total',\n  help: 'Total number of security violations',\n  labelNames: ['type', 'ip_address']\n});\n\n```\n\n## \u4e94\u3001\u5b89\u5168\u52a0\u56fa\u68c0\u67e5\u6e05\u5355\n\n### 5.1 \u7f51\u7edc\u5c42\u68c0\u67e5\n\n- [ ] \u5de5\u4e1a\u7f51\u7edc\u4e0e\u529e\u516c\u7f51\u7edc\u9694\u79bb\n- [ ] \u9632\u706b\u5899\u89c4\u5219\u5df2\u914d\u7f6e\u5e76\u542f\u7528\n- [ ] \u4ec5\u5f00\u653e\u5fc5\u8981\u7684\u7aef\u53e3\n- [ ] \u4f7f\u7528 VLAN \u8fdb\u884c\u903b\u8f91\u9694\u79bb\n- [ ] \u90e8\u7f72\u5165\u4fb5\u68c0\u6d4b\u7cfb\u7edf (IDS)\n- [ ] \u542f\u7528\u7f51\u7edc\u6d41\u91cf\u76d1\u63a7\n- [ ] \u5b9a\u671f\u66f4\u65b0\u7f51\u7edc\u8bbe\u5907\u56fa\u4ef6\n\n### 5.2 \u8bbe\u5907\u5c42\u68c0\u67e5\n\n- [ ] \u4fee\u6539\u9ed8\u8ba4\u5bc6\u7801\n- [ ] \u7981\u7528\u672a\u4f7f\u7528\u7684\u670d\u52a1\u548c\u7aef\u53e3\n- [ ] \u542f\u7528\u8bbe\u5907\u8bbf\u95ee\u65e5\u5fd7\n- [ ] \u914d\u7f6e\u8bbf\u95ee\u63a7\u5236\u5217\u8868 (ACL)\n- [ ] \u5b9a\u671f\u5907\u4efd\u8bbe\u5907\u914d\u7f6e\n- [ ] \u542f\u7528\u56fa\u4ef6\u7b7e\u540d\u9a8c\u8bc1\n- [ ] \u7269\u7406\u5b89\u5168\u63aa\u65bd\u5230\u4f4d\n\n### 5.3 \u5e94\u7528\u5c42\u68c0\u67e5\n\n- [ ] \u5b9e\u73b0\u8eab\u4efd\u8ba4\u8bc1\u673a\u5236\n- [ ] \u914d\u7f6e\u57fa\u4e8e\u89d2\u8272\u7684\u8bbf\u95ee\u63a7\u5236\n- [ ] \u542f\u7528\u64cd\u4f5c\u5ba1\u8ba1\u65e5\u5fd7\n- [ ] \u654f\u611f\u6570\u636e\u52a0\u5bc6\u5b58\u50a8\n- [ ] \u901a\u4fe1\u6570\u636e\u52a0\u5bc6\u4f20\u8f93\n- [ ] \u5b9e\u73b0\u5f02\u5e38\u884c\u4e3a\u68c0\u6d4b\n- [ ] \u5b9a\u671f\u5b89\u5168\u6f0f\u6d1e\u626b\u63cf\n\n### 5.4 \u7ba1\u7406\u5c42\u68c0\u67e5\n\n- [ ] \u5236\u5b9a\u5b89\u5168\u7b56\u7565\u548c\u89c4\u7a0b\n- [ ] \u5b9a\u671f\u8fdb\u884c\u5b89\u5168\u57f9\u8bad\n- [ ] \u5efa\u7acb\u5e94\u6025\u54cd\u5e94\u8ba1\u5212\n- [ ] \u5b9a\u671f\u8fdb\u884c\u5b89\u5168\u5ba1\u8ba1\n- [ ] \u4fdd\u6301\u7cfb\u7edf\u548c\u8f6f\u4ef6\u66f4\u65b0\n- [ ] \u5efa\u7acb\u53d8\u66f4\u7ba1\u7406\u6d41\u7a0b\n- [ ] \u5b9a\u671f\u8fdb\u884c\u6e17\u900f\u6d4b\u8bd5\n\n## \u516d\u3001\u5b9e\u6218\u6848\u4f8b\uff1a\u5b89\u5168 Modbus \u7f51\u5173\u5b9e\u73b0\n\n### 6.1 \u7cfb\u7edf\u67b6\u6784\n\n```\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510     \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510     \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 Modbus \u8bbe\u5907   \u2502\u2500\u2500\u2500\u2500\u25b6\u2502 \u5b89\u5168\u7f51\u5173         \u2502\u2500\u2500\u2500\u2500\u25b6\u2502 \u5ba2\u6237\u7aef       \u2502\n\u2502 (\u4ece\u7ad9)      \u2502     \u2502 (\u8ba4\u8bc1 + \u52a0\u5bc6 + \u5ba1\u8ba1)\u2502     \u2502 (\u4e3b\u7ad9)      \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518     \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518     \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n                           \u2502\n                           \u25bc\n                    \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n                    \u2502 \u5b89\u5168\u65e5\u5fd7     \u2502\n                    \u2502 \u76d1\u63a7\u7cfb\u7edf     \u2502\n                    \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\n```\n\n### 6.2 \u5b8c\u6574\u5b9e\u73b0\u4ee3\u7801\n\n```\nfrom flask import Flask, request, jsonify\nfrom functools import wraps\nimport jwt\nimport logging\nfrom datetime import datetime\n\napp = Flask(__name__)\napp.config['SECRET_KEY'] = 'your-secret-key'\n\n# \u914d\u7f6e\u65e5\u5fd7\nlogging.basicConfig(\n    level=logging.INFO,\n    format='%(asctime)s - %(name)s - %(levelname)s - %(message)s',\n    handlers=[\n        logging.FileHandler('security_audit.log'),\n        logging.StreamHandler()\n    ]\n)\nlogger = logging.getLogger('modbus-security')\n\n# IP \u767d\u540d\u5355\nWHITELISTED_IPS = ['192.168.1.100', '192.168.1.101']\n\n# \u8bbf\u95ee\u63a7\u5236\ndef require_auth(f):\n    @wraps(f)\n    def decorated(*args, **kwargs):\n        token = request.headers.get('Authorization')\n        if not token:\n            logger.warning(f\"\u672a\u6388\u6743\u8bbf\u95ee\u5c1d\u8bd5\uff1a{request.remote_addr}\")\n            return jsonify({'error': 'Missing token'}), 401\n\n        try:\n            data = jwt.decode(token, app.config['SECRET_KEY'], \n                            algorithms=['HS256'])\n            request.user = data\n        except jwt.InvalidTokenError:\n            logger.warning(f\"\u65e0\u6548 Token\uff1a{request.remote_addr}\")\n            return jsonify({'error': 'Invalid token'}), 401\n\n        if request.remote_addr not in WHITELISTED_IPS:\n            logger.warning(f\"IP \u4e0d\u5728\u767d\u540d\u5355\uff1a{request.remote_addr}\")\n            return jsonify({'error': 'IP not allowed'}), 403\n\n        return f(*args, **kwargs)\n    return decorated\n\n@app.route('\/api\/modbus\/read', methods=['POST'])\n@require_auth\ndef read_register():\n    data = request.json\n    slave_id = data.get('slave_id')\n    register = data.get('register')\n\n    logger.info(f\"READ | user={request.user['username']} | \"\n               f\"ip={request.remote_addr} | slave={slave_id} | \"\n               f\"register={register}\")\n\n    # \u5b9e\u9645 Modbus \u8bfb\u53d6\u903b\u8f91\n    # value = modbus_client.read_register(slave_id, register)\n\n    return jsonify({'status': 'success', 'value': 0})\n\n@app.route('\/api\/modbus\/write', methods=['POST'])\n@require_auth\ndef write_register():\n    data = request.json\n    slave_id = data.get('slave_id')\n    register = data.get('register')\n    value = data.get('value')\n\n    # \u68c0\u67e5\u5199\u6743\u9650\n    if request.user['role'] == 'operator':\n        logger.warning(f\"\u5199\u64cd\u4f5c\u88ab\u62d2\u7edd\uff1auser={request.user['username']}\")\n        return jsonify({'error': 'Insufficient permissions'}), 403\n\n    logger.info(f\"WRITE | user={request.user['username']} | \"\n               f\"ip={request.remote_addr} | slave={slave_id} | \"\n               f\"register={register} | value={value}\")\n\n    # \u5b9e\u9645 Modbus \u5199\u5165\u903b\u8f91\n    # modbus_client.write_register(slave_id, register, value)\n\n    return jsonify({'status': 'success'})\n\nif __name__ == '__main__':\n    # \u4f7f\u7528 HTTPS\n    app.run(\n        host='0.0.0.0',\n        port=502,\n        ssl_context=('cert.pem', 'key.pem')\n    )\n\n```\n\n## \u4e03\u3001\u5408\u89c4\u6027\u4e0e\u6807\u51c6\n\n### 7.1 \u76f8\u5173\u5b89\u5168\u6807\u51c6\n\n  \u6807\u51c6\n  \u540d\u79f0\n  \u9002\u7528\u8303\u56f4\n\n  IEC 62443\n  \u5de5\u4e1a\u901a\u4fe1\u7f51\u7edc\u5b89\u5168\n  \u5de5\u4e1a\u81ea\u52a8\u5316\u548c\u63a7\u5236\u7cfb\u7edf\n\n  NIST SP 800-82\n  \u5de5\u4e1a\u63a7\u5236\u7cfb\u7edf\u5b89\u5168\u6307\u5357\n  \u7f8e\u56fd\u8054\u90a6\u673a\u6784\n\n  ISO\/IEC 27001\n  \u4fe1\u606f\u5b89\u5168\u7ba1\u7406\u4f53\u7cfb\n  \u901a\u7528\u4fe1\u606f\u5b89\u5168\n\n  NERC CIP\n  \u5173\u952e\u57fa\u7840\u8bbe\u65bd\u4fdd\u62a4\n  \u5317\u7f8e\u7535\u529b\u7cfb\u7edf\n\n### 7.2 \u5408\u89c4\u6027\u68c0\u67e5\u8981\u70b9\n\n- **\u98ce\u9669\u8bc4\u4f30**\uff1a\u5b9a\u671f\u8fdb\u884c\u5b89\u5168\u98ce\u9669\u8bc4\u4f30\n- **\u8bbf\u95ee\u63a7\u5236**\uff1a\u5b9e\u65bd\u6700\u5c0f\u6743\u9650\u539f\u5219\n- **\u5b89\u5168\u5ba1\u8ba1**\uff1a\u4fdd\u7559\u81f3\u5c11 6 \u4e2a\u6708\u7684\u64cd\u4f5c\u65e5\u5fd7\n- **\u4e8b\u4ef6\u54cd\u5e94**\uff1a\u5efa\u7acb\u5b89\u5168\u4e8b\u4ef6\u54cd\u5e94\u6d41\u7a0b\n- **\u6301\u7eed\u76d1\u63a7**\uff1a\u5b9e\u65f6\u76d1\u63a7\u7f51\u7edc\u548c\u8bbe\u5907\u72b6\u6001\n- **\u5b9a\u671f\u6d4b\u8bd5**\uff1a\u6bcf\u5e74\u81f3\u5c11\u8fdb\u884c\u4e00\u6b21\u6e17\u900f\u6d4b\u8bd5\n\n## \u516b\u3001\u603b\u7ed3\u4e0e\u5c55\u671b\n\n### 8.1 \u5b89\u5168\u9632\u62a4\u6838\u5fc3\u539f\u5219\n\n- **\u7eb5\u6df1\u9632\u5fa1**\uff1a\u591a\u5c42\u9632\u62a4\uff0c\u4e0d\u4f9d\u8d56\u5355\u4e00\u5b89\u5168\u63aa\u65bd\n- **\u6700\u5c0f\u6743\u9650**\uff1a\u4ec5\u6388\u4e88\u5fc5\u8981\u7684\u8bbf\u95ee\u6743\u9650\n- **\u9ed8\u8ba4\u62d2\u7edd**\uff1a\u9ed8\u8ba4\u7981\u6b62\u6240\u6709\u8bbf\u95ee\uff0c\u4ec5\u5141\u8bb8\u660e\u786e\u6388\u6743\u7684\u6d41\u91cf\n- **\u6301\u7eed\u76d1\u63a7**\uff1a\u5b9e\u65f6\u76d1\u63a7\u548c\u5ba1\u8ba1\u6240\u6709\u64cd\u4f5c\n- **\u53ca\u65f6\u54cd\u5e94**\uff1a\u5feb\u901f\u68c0\u6d4b\u548c\u54cd\u5e94\u5b89\u5168\u4e8b\u4ef6\n\n### 8.2 \u672a\u6765\u53d1\u5c55\u8d8b\u52bf\n\n- **\u96f6\u4fe1\u4efb\u67b6\u6784**\uff1a\u4e0d\u4fe1\u4efb\u4efb\u4f55\u5185\u90e8\u6216\u5916\u90e8\u7f51\u7edc\n- **AI \u9a71\u52a8\u7684\u5b89\u5168**\uff1a\u4f7f\u7528\u673a\u5668\u5b66\u4e60\u68c0\u6d4b\u5f02\u5e38\u884c\u4e3a\n- **\u533a\u5757\u94fe\u5ba1\u8ba1**\uff1a\u4f7f\u7528\u533a\u5757\u94fe\u786e\u4fdd\u65e5\u5fd7\u4e0d\u53ef\u7be1\u6539\n- **\u91cf\u5b50\u52a0\u5bc6**\uff1a\u5e94\u5bf9\u91cf\u5b50\u8ba1\u7b97\u5e26\u6765\u7684\u5b89\u5168\u6311\u6218\n- **\u81ea\u52a8\u5316\u54cd\u5e94**\uff1a\u81ea\u52a8\u9694\u79bb\u548c\u4fee\u590d\u5b89\u5168\u5a01\u80c1\n\n### 8.3 \u884c\u52a8\u5efa\u8bae\n\n**\u7acb\u5373\u884c\u52a8\uff1a**\n- \u4fee\u6539\u6240\u6709\u9ed8\u8ba4\u5bc6\u7801\n- \u914d\u7f6e\u9632\u706b\u5899\u89c4\u5219\n- \u542f\u7528\u64cd\u4f5c\u65e5\u5fd7\u8bb0\u5f55\n- \u8fdb\u884c\u5b89\u5168\u6f0f\u6d1e\u626b\u63cf\n\n**\u77ed\u671f\u8ba1\u5212 (1-3 \u4e2a\u6708)\uff1a**\n- \u5b9e\u65bd\u7f51\u7edc\u9694\u79bb\n- \u90e8\u7f72\u8eab\u4efd\u8ba4\u8bc1\u7cfb\u7edf\n- \u5efa\u7acb\u5b89\u5168\u76d1\u63a7\u4f53\u7cfb\n- \u5236\u5b9a\u5b89\u5168\u7b56\u7565\n\n**\u957f\u671f\u89c4\u5212 (6-12 \u4e2a\u6708)\uff1a**\n- \u901a\u8fc7\u5b89\u5168\u5408\u89c4\u8ba4\u8bc1\n- \u5efa\u7acb\u5b89\u5168\u8fd0\u8425\u4e2d\u5fc3 (SOC)\n- \u5b9e\u65bd\u96f6\u4fe1\u4efb\u67b6\u6784\n- \u5b9a\u671f\u8fdb\u884c\u7ea2\u84dd\u5bf9\u6297\u6f14\u7ec3\n\n## \u9644\u5f55\uff1a\u5b89\u5168\u5de5\u5177\u63a8\u8350\n\n### A.1 \u626b\u63cf\u5de5\u5177\n\n- **Nmap**: \u7f51\u7edc\u626b\u63cf\u548c\u7aef\u53e3\u68c0\u6d4b\n- **ModbusScan**: \u4e13\u7528 Modbus \u8bbe\u5907\u626b\u63cf\n- **Wireshark**: \u7f51\u7edc\u534f\u8bae\u5206\u6790\n- **Metasploit**: \u6e17\u900f\u6d4b\u8bd5\u6846\u67b6\n\n### A.2 \u76d1\u63a7\u5de5\u5177\n\n- **Snort**: \u5165\u4fb5\u68c0\u6d4b\u7cfb\u7edf\n- **OSSEC**: \u4e3b\u673a\u5165\u4fb5\u68c0\u6d4b\n- **Grafana + Prometheus**: \u76d1\u63a7\u4eea\u8868\u677f\n- **ELK Stack**: \u65e5\u5fd7\u5206\u6790\u5e73\u53f0\n\n### A.3 \u52a0\u56fa\u5de5\u5177\n\n- **Lynis**: \u5b89\u5168\u5ba1\u8ba1\u5de5\u5177\n- **OpenSCAP**: \u5408\u89c4\u6027\u68c0\u67e5\n- **Fail2ban**: \u5165\u4fb5\u9632\u62a4\n- **UFW\/iptables**: \u9632\u706b\u5899\u7ba1\u7406\n\n**\u5173\u952e\u8bcd**: Modbus \u5b89\u5168\uff0c\u5de5\u4e1a\u7f51\u7edc\u5b89\u5168\uff0c\u8bbf\u95ee\u63a7\u5236\uff0c\u6570\u636e\u52a0\u5bc6\uff0c\u5b89\u5168\u5ba1\u8ba1\uff0cIEC 62443\uff0c\u5165\u4fb5\u68c0\u6d4b\n\n**\u5b57\u6570**: \u7ea6 12,000 \u5b57\n\n---\n*modbus.cn*\n"