Internet of Things sensor monitoring data encryption and storage processing method

Abstract

The invention relates to an Internet of Things sensor monitoring data encryption and storage processing method, and belongs to the field of Internet of Things sensor monitoring data acquisition, storage and application. The method comprises the following steps: establishing enterprise identification information, equipment identification information and data identification information, and adding identification information to acquired monitoring data information; the monitoring data information is encrypted through a multi-confusion encryption method, and finally a confusion ciphertext is output; establishing a time sequence database to store real-time monitoring data, and establishing a relational database to store abnormal monitoring data and related data; when decryption is needed, multiple confusion encryption is carried out on the real-time monitoring value in an enumeration mode according to the enterprise identification information, the equipment identification information and the data identification information, and the real-time monitoring value before encryption is determined according to a ciphertext. Aiming at the problems that the ciphertext is easy to repeat and high in regularity, the data storage and retrieval efficiency is improved, the data is prevented from being randomly tampered by means of the ciphertext information, and the data security protection capability is improved.

Description

Technical Field

[0001] The present invention belongs to the field of Internet of Things sensor monitoring data collection, storage and application, and relates to an Internet of Things sensor monitoring data encryption and storage processing method. Background Art

[0002] With the continuous advancement of intelligent mine construction across the country, various IoT sensors such as toxic and harmful gas monitoring, personnel location and health information monitoring, and electromechanical equipment condition monitoring have been widely used, and coal mine monitoring data has shown explosive growth. Especially for some large coal enterprise groups, the real-time monitoring data generated by sensors ranges from tens of thousands to hundreds of thousands per second. The existing mainstream relational databases are difficult to meet the requirements of data collection, processing, storage, query and analysis.

[0003] Coal mining companies are responsible for ensuring safe production and the owners of corporate data assets. They have the highest authority over various information systems, databases, and data management platforms, and cannot fundamentally prevent companies from illegally tampering with data. Some companies produce illegally for economic benefits, maliciously tamper with sensor monitoring data, evade industry supervision, and cause various safety accidents, resulting in major casualties and economic losses, with very bad effects. Therefore, it is particularly important to improve the processing efficiency of IoT sensor monitoring data and prevent data from being tampered with at will.

[0004] Due to the performance bottleneck of relational databases in processing massive sensor time series data and the requirement for efficient processing of monitoring services, most of the database's built-in encryption functions, MD5 or RSA and other encryption algorithms are used to perform simple encryption processing on a few fields. There are weaknesses such as repeated ciphertext and strong regularity. The ciphertext is likely to be cracked, records are often tampered with and difficult to detect, the encryption effect is poor, and the query efficiency is low. Summary of the invention

[0005] In view of this, the purpose of the present invention is to provide an Internet of Things sensor monitoring data encryption and storage processing method, which adopts a data obfuscation encryption method based on the combination of MD5 information digest algorithm, array re-arrangement calculation and CRC cyclic redundancy check algorithm to generate sensor monitoring data ciphertext information. The TDengine time series database super table solution is used to store the massive real-time monitoring data and ciphertext information of the sensor, and MySQL and other relational databases are used to store abnormal monitoring data and ciphertext information, equipment definition data and dictionary code tables and other data. Solve the problems of easy duplication and strong regularity of ciphertext in existing encryption methods, while improving the efficiency of data storage and retrieval, and use ciphertext information to prevent data from being tampered with at will, thereby improving data security protection capabilities.

[0006] In order to achieve the above object, the present invention provides the following technical solutions:

[0007] A method for encrypting and storing monitoring data of an Internet of Things sensor comprises the following steps:

[0008] S1. Establish enterprise identification information, equipment identification information and data identification information, and add identification information to the acquired monitoring data information;

[0009] S2, encrypt the monitoring data information through multiple obfuscation encryption methods, and finally output the obfuscated ciphertext;

[0010] S3. Establish a time series database to store real-time monitoring data, and establish a relational database to store abnormal monitoring data and related data;

[0011] S4. When decryption is required, the real-time monitoring value is encrypted multiple times in an enumerated manner according to the enterprise identification information, device identification information and data identification information, and the ciphertext is compared to see whether it is consistent, thereby determining the real-time monitoring value before encryption.

[0012] Further, in step S1, the enterprise identification information established includes the enterprise name, unified social credit code, coal mine code and globally unique identifier, wherein the globally unique identifier is a digital identifier generated by an algorithm, and the globally unique identifier is used as the first key in the subsequent encryption process;

[0013] The established device identification information includes the system number to which the sensor device belongs, the device code and the installation address of the sensor device;

[0014] The established data identification information includes at least real-time monitoring data identification information and abnormal monitoring data identification information.

[0015] Furthermore, the real-time monitoring data identification information includes the timestamp generated by the sensor device data, the real-time monitoring value, and the real-time status value, wherein the timestamp is represented in the format of "yyyy-MM-dd HH:mm:ss.fff", wherein "yyyy" represents the year, "MM" represents the month, "dd" represents the day, "HH" represents the hour part, "mm" represents the minute part, "ss" represents the second part, and "fff" represents the millisecond part;

[0016] The abnormal monitoring data identification information is calculated from the real-time data generated by the sensor equipment, and includes the abnormal start time, abnormal end time, abnormal status value, maximum value during the abnormal period, maximum value time, minimum value during the abnormal period, minimum value time, average value, and the timestamp of the corresponding record generation.

[0017] Further, in step S2, the enterprise identification information, the device identification information and the data identification information are concatenated and combined into the original plain text, and the encryption process includes at least six encryptions, wherein:

[0018] The first encryption process is: using the MD5 information digest algorithm to generate the original plaintext into a digest ciphertext; the first encryption takes the original plaintext as input, takes the globally unique identifier as the first key, and outputs a 32-bit hexadecimal digital string after the digest encryption;

[0019] The second encryption process is as follows: according to the randomly generated 32-bit obfuscated integer array, the characters in the 32-bit MD5 ciphertext string are rearranged according to the integers corresponding to each index in the array; the second encryption takes the 32-bit hexadecimal digital string after the first encryption as input, takes the randomly generated 32-bit obfuscated integer array consisting of non-repeating integers from 0 to 31 as the second key, and outputs the rearranged 32-bit ciphertext string;

[0020] The third encryption process is as follows: according to the random integer corresponding to the 4-bit complement obfuscated integer array, select the characters at the corresponding 4 random integer positions from the 128-bit binary string, and add them to the end of the 128-bit binary string to form a 132-bit string; the third encryption uses the rearranged 32-bit ciphertext string as input, uses the randomly generated 4-bit complement obfuscated integer array consisting of non-repeating integers from 0 to 127 as the third key, and outputs a 132-bit binary digital string;

[0021] The fourth encryption process is as follows: the string consisting of 132 binary digits is subjected to array rearrangement calculation according to the index order of the obfuscation array; the fourth encryption uses the 132 binary digit string as input, uses a randomly generated 132-bit obfuscated integer array consisting of non-repeating integers from 0 to 131 as the fourth key, and outputs the 132-bit binary digit string after obfuscation sorting;

[0022] The fifth encryption process is as follows: adopt the CRC cyclic redundancy check algorithm, select a 12-bit CRC check code, obtain a 12-bit binary remainder through an XOR operation, and add it to the end of the 132-bit binary digital string after the obfuscation order to form a 144-bit binary digital string; the fifth encryption uses the 132-bit binary digital string after the obfuscation order as input, uses the 12-bit CRC check code as the fifth key, and outputs a 144-bit binary digital string with a CRC check result;

[0023] The sixth encryption process is: use the array rearrangement calculation method to re-arrange the characters in the Base64 encoding reference table to form a private encoding dictionary, and then use the Base64 encoding method to convert the 144-bit binary digital string with the CRC check result into a 24-bit visible string; the sixth encryption uses the 144-bit binary digital string with the CRC check result as input, and randomly generates a 64-bit obfuscated integer array consisting of non-repeating integers from 0 to 63 as the sixth key, and outputs the final obfuscated ciphertext.

[0024] Furthermore, the array rearrangement in the multiple encryption process is as follows: for array a = [a0, a1, ..., a n-1 ], a random algorithm is used to generate a non-repeating n-bit random index array b = [b0, b1, ..., b n-1 ], then the new array after rearrangement is represented as c=[c0,c1,…,c n-1 ], where for the element c in the array i ,have:

[0025]

[0026] In the formula, i∈[0,n-1], i is an integer.

[0027] Further, in step S3, a real-time monitoring data super table is designed, wherein the real-time monitoring data super table includes a label column and a data column, the label column includes the sensor device code and installation address, and the data column includes the collection time, monitoring value, value meaning, value status, and ciphertext field.

[0028] Furthermore, the data column of the real-time monitoring data super table includes CipherText as a ciphertext field, and its encrypted input data identification information includes data generation time DataGenTime, real-time monitoring value RealtimeValue, monitoring value meaning MeaningValue and monitoring value state StateId as well as their corresponding data types, and the label column includes the equipment installation location InstallAddr, the system number SystemId and its corresponding data type.

[0029] Further, in step S3, a relational database is established, wherein the relational database stores at least abnormal monitoring data, sensor equipment definition data, code table dictionary data, measuring point definition data, and abnormal handling measures, wherein the sensor equipment definition data includes its corresponding manufacturer, specification model, monitored physical quantity and its unit, and equipment type; the code table dictionary data includes an equipment system coding dictionary table, an equipment type coding dictionary table, a measuring point abnormal state coding dictionary table, and a measuring point relationship table; the measuring point definition data includes a measuring point state change record data table and a measuring point abnormal monitoring data table generated by secondary analysis and statistics of the equipment state; and the abnormal handling measures refer to the processing schemes taken in response to the abnormal monitoring data.

[0030] Furthermore, the abnormal monitoring data table includes a ciphertext field CipherText, and its encrypted input data identification information includes data generation time DataGenTime, abnormal start time StartTime, abnormal end time EndTime, abnormal status value StatusId, maximum value MaxValue during the abnormal period, maximum value time MaxTime, minimum value MinValue during the abnormal period, minimum value time MinTime, average value AvgValue, equipment measurement point code DeviceCode, self-increment field RowId and its corresponding data type and column category.

[0031] Further, in step S4, when all the keys are known, the real-time monitoring values ​​are enumerated and obfuscated encryption calculations are performed according to the enterprise identification information, device identification information and data identification information, and the obfuscated ciphertexts are cyclically compared to see if they are the same. If the obfuscated ciphertexts are the same, the currently enumerated monitoring value is the sensor monitoring data value before encryption; if the obfuscated ciphertexts are not the same, the obfuscated encryption comparison is repeated until the obfuscated ciphertexts are the same.

[0032] The beneficial effects of the present invention are:

[0033] The present invention groups and improves coal mine enterprise identification information, sensor equipment identification information and data identification information, uses 6 groups of keys, integrates MD5 information digest algorithm, array rearrangement calculation method, Base64 encoding method and CRC cyclic redundancy check algorithm, generates coal mine sensor monitoring data obfuscated ciphertext, and prevents data from being tampered with at will.

[0034] According to the data volume and usage scenarios, the present invention designs a super table based on the time series database to store sensor time series data, and uses a relational database to store sensor abnormal data, definition information, dictionary code table and other non-real-time monitoring data. Based on the obfuscation encryption method, ciphertext fields are added to the real-time monitoring data table and the abnormal data table to store monitoring data and obfuscated ciphertext, increase data tampering prevention and inspection means, and improve system operation efficiency and system security.

[0035] Other advantages, objectives and features of the present invention will be described in the following description to some extent, and to some extent, will be obvious to those skilled in the art based on the following examination and study, or can be taught from the practice of the present invention. The objectives and other advantages of the present invention can be realized and obtained through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention will be described in detail below in conjunction with the accompanying drawings, wherein:

[0037] Figure 1The overall process diagram for obfuscated encryption;

[0038] Figure 2 A schematic diagram of the specific process of multiple encryption in the obfuscated encryption process;

[0039] Figure 3 It is a schematic diagram of the data reorganization process in the multiple encryption process;

[0040] Figure 4 This is a schematic diagram of the encrypted data storage architecture;

[0041] Figure 5 Schematic diagram of the data decryption process. DETAILED DESCRIPTION

[0042] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments only illustrate the basic concept of the present invention in a schematic manner, and the following embodiments and features in the embodiments can be combined with each other without conflict.

[0043] Among them, the drawings are only used for illustrative explanations, and they only represent schematic diagrams rather than actual pictures, and should not be understood as limitations on the present invention. In order to better illustrate the embodiments of the present invention, some parts of the drawings may be omitted, enlarged or reduced, and do not represent the size of actual products. For those skilled in the art, it is understandable that some well-known structures and their descriptions in the drawings may be omitted.

[0044] The same or similar numbers in the drawings of the embodiments of the present invention correspond to the same or similar parts; in the description of the present invention, it should be understood that if the terms "upper", "lower", "left", "right", "front", "rear", etc. indicate the orientation or position relationship, they are based on the orientation or position relationship shown in the drawings, which is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operate in a specific orientation. Therefore, the terms describing the position relationship in the drawings are only used for illustrative purposes and cannot be understood as limiting the present invention. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to specific circumstances.

[0045] See also Figure 1 to Figure 5 , which is a method for encrypting and storing monitoring data of Internet of Things sensors.

[0046] Example 1

[0047] This embodiment proposes a method for encrypting and storing monitoring data of IoT sensors for smart mines, which includes the following steps:

[0048] S1. Establish enterprise identification information, equipment identification information and data identification information, and add identification information to the acquired monitoring data information;

[0049] S2, encrypt the monitoring data information through multiple obfuscation encryption methods, and finally output the obfuscated ciphertext;

[0050] S3. Establish a time series database to store real-time monitoring data, and establish a relational database to store abnormal monitoring data and related data;

[0051] S4. When decryption is required, the real-time monitoring value is encrypted multiple times in an enumerated manner according to the enterprise identification information, the device identification information and the data identification information, and the real-time monitoring value before encryption is determined by comparing whether the encrypted ciphertext is consistent.

[0052] In step S1, the coal mine sensor monitoring data has typical time series data characteristics. The data is continuously generated in real time, fast, orderly, stable, and massive, and is uploaded to the ground monitoring system through the underground ring network. The sensors used in the mine mainly include methane, carbon monoxide, carbon dioxide, hydrogen sulfide, oxygen, temperature, smoke, support working resistance, anchor (cable) stress, dust, water level, water inflow, and other gas, fire, roof, dust, hydrology and other disaster monitoring sensors, as well as equipment start and stop, voltage, current, vibration, fault and other types of electromechanical equipment working condition monitoring sensors.

[0053] According to the needs of coal mine enterprise safety production and national mine safety supervision and management, as well as relevant regulations, coal mine enterprises must save monitoring data in real time and in full in accordance with standard specifications, and upload it to the superior company and supervision and management department in a timely manner. Completely record the sensor measurement point number, installation address, measurement point type, real-time data, data generation timestamp and measurement point data status, as well as measurement point abnormality statistics, including abnormality start time, abnormality end time, abnormal period maximum value, maximum value generation time, abnormal period minimum value, minimum value generation time, abnormal period average value, abnormality type and other information.

[0054] Based on this, in step S1, the present embodiment first establishes enterprise identification information, device identification information and data identification information, specifically:

[0055] The enterprise identification information consists of the enterprise name, unified social credit code, coal mine code and globally unique identifier (GUID). The enterprise name and unified social information code shall be based on the registration and release of the industrial and commercial administration department. The unified social information code consists of 18 Arabic numerals or uppercase English letters, and the code is unique for different enterprises. The coal mine code is consistent with the coal mine code in the coal mine basic data management module in the mine safety production integrated information system of the State Administration of Mine Safety Supervision, which consists of 12 Arabic numerals and each coal mine code is unique. The name of the coal mine enterprise, the unified social information code and the coal mine code have been announced to the public and can be obtained through public channels or coal mine enterprise inquiries. The globally unique identifier is a 32-bit hexadecimal digital identifier generated by an algorithm, in the form of "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX", where each X is a hexadecimal number in the range of 0-9 or AF (does not contain the "-" string when used, and all are converted to uppercase letters). In this scheme, a computer program is used to randomly generate a different globally unique identifier for each coal mine in the country as the first key of the scheme, namely key 1.

[0056] The equipment identification information consists of the system number to which the sensor equipment belongs, the equipment code and the installation address of the sensor equipment. The system number consists of 4 Arabic numerals ranging from 0001 to 9999; the equipment code is customized by the coal mine, with a length of no less than 8 digits and unique in the entire mine, otherwise it is padded with the English letter D on the far left; the installation address of the sensor equipment is customized by the mine, with a length of no less than 4 digits, otherwise it is padded with the English letter A on the far right.

[0057] The data identification information at least includes real-time monitoring data identification information and abnormal monitoring data identification information. Depending on the data type, the composition of the data identification information may also be different.

[0058] The real-time monitoring data identification information consists of the timestamp, real-time monitoring value, and real-time status value generated by the sensor equipment data. The timestamp is expressed in the format of yyyy-MM-dd HH:mm:ss.fff, where "yyyy" represents the year, "MM" represents the month, "dd" represents the day, "HH" represents the hour part, "mm" represents the minute part, "ss" represents the second part, and "fff" represents the millisecond part, such as 2024-08-15 07:22:34.033, which means 7:22:34:33 milliseconds on August 15, 2024. According to actual needs, you can choose whether to use the three-digit millisecond part data of ".fff". Combined with the actual business needs of coal mines and industry identification specifications, the real-time monitoring data retains up to 4 valid digits after the decimal point.

[0059] The abnormal monitoring data identification information is formed by calculating a series of real-time data generated by the sensor device, including the abnormal start time, abnormal end time, abnormal state value, maximum value during the abnormal period, maximum value time, minimum value during the abnormal period, minimum value time, average value, and the timestamp of the record generation. The time field in the abnormal data is represented in the same way as the time field identification method of the real-time monitoring data. The number of significant digits after the decimal point of the maximum value field in the abnormal data is the same as that of the real-time monitoring value field of the real-time monitoring data.

[0060] In order to ensure the uniqueness of each monitoring data of different sensors in different coal mining enterprises, the input monitoring data information consists of enterprise identification information, equipment identification information and data identification information, and each piece of information is connected with a half-width English character “;”.

[0061] In step S2, the MD5 information digest algorithm, random array obfuscation algorithm, CRC checksum and Base64 encoding conversion method are combined to realize multiple encryption of sensor monitoring data, thereby generating obfuscated ciphertext of the data. The encryption process consists of three parts: parameter input, checksum calculation and ciphertext output. The process is as follows: Figure 1 As shown in the figure, the scheme selects a method combining multiple obfuscation encryption to realize obfuscation encryption of sensor monitoring data. The entire encryption process is implemented using the MD5 information digest algorithm, array rearrangement method, Base64 encoding and CRC check algorithm.

[0062] For different coal mines, independent key sets are established. Based on the spliced ​​original plaintext data, the final obfuscated ciphertext is obtained through multiple obfuscation encryption methods. The multiple obfuscation encryption process in step S2 is as follows: Figure 2 As shown, the original plaintext is composed of enterprise identification information, equipment identification information and data identification information. Connectors are used within the identification information and between multiple identification information to form a complete string of plaintext information. The fields such as real-time monitoring data, abnormal monitoring maximum value, minimum value and average value in the data identification information are formatted in a standardized manner before encryption, that is: a maximum of 4 valid digits after the decimal point, if insufficient, add 0 at the end of the data; retain 14 valid digits before the decimal point, if insufficient, add 0 at the front of the data, and the data range meets the safety production needs of coal mines. For example, the real-time monitoring value of the temperature sensor is 23.04℃, and 2 0s are added at the end and 12 0s are added at the front. After standardization, it is: 000000000000 23.04 00 , where the underscore " 0 " indicates the newly added characters. During the calculation process, multiple obfuscation arrays and a 12-bit CRC check code are used as keys to implement obfuscation encryption and verification of ciphertext information. Specifically, it includes at least six encryption processes:

[0063] The first encryption calculation:

[0064] Input: original real-time data or abnormal data with a globally unique identifier (GUID). It includes enterprise identification information, equipment identification information, and data identification information. Multiple pieces of information are concatenated to form a complete string.

[0065] Key 1: Globally unique identifier (GUID).

[0066] Calculation process: Use the MD5 information digest algorithm to generate the input string into a digest ciphertext.

[0067] Output: A string of 32 hexadecimal digits (uppercase).

[0068] Second encryption calculation:

[0069] Input: The result of the first encryption calculation.

[0070] Key 2: 32-bit obfuscated integer array. Since the 32-bit hexadecimal ciphertext string generated by the MD5 message digest algorithm is prone to brute force cracking such as exhaustive search and dictionary search, a 32-bit random array consisting of non-repeating integers from 0 to 31 is randomly generated to increase the difficulty of cracking.

[0071] Calculation process: Based on the randomly generated 32-bit obfuscated integer array, the characters in the 32-bit MD5 ciphertext string are rearranged and calculated according to the integers corresponding to each index in this array.

[0072] Output: The rearranged 32-bit ciphertext string.

[0073] The third encryption calculation:

[0074] Input: The result of the second encryption calculation, the rearranged 32-bit ciphertext string.

[0075] Key 3: 4-bit complement obfuscated integer array. To facilitate transcoding using the Base64 encoding method, the 32-bit hexadecimal ciphertext string is converted into a 128-bit binary string consisting of 0s and 1s, and a 4-bit binary string is added to form a 132-bit binary string. The scheme randomly generates a 4-bit random array consisting of non-repeating integers from 0 to 127.

[0076] Calculation process: According to the random integers corresponding to the 4-bit complement confusion integer array, select the characters at the corresponding 4 random integer positions from the 128-bit binary string, and add them to the end of the 128-bit binary string to form a 132-bit string.

[0077] Output: 132 binary digits string.

[0078] The fourth encryption calculation:

[0079] Input: The result of the third encryption calculation, a 132-bit binary string

[0080] Key 4: 132-bit obfuscated integer array. A 132-bit random array consisting of non-repeating integers from 0 to 131 is randomly generated.

[0081] Calculation process: The string consisting of 132 binary digits is arranged in the order of the index of the obfuscated array and the array is rearranged.

[0082] Output: A 132-bit binary string that is obfuscated and sorted.

[0083] Fifth encryption calculation:

[0084] Input: The result of the fourth encryption calculation, a 132-bit binary number string that has been obfuscated and sorted.

[0085] Key 5: 12-bit CRC check code, that is, the highest power of the check code generating polynomial G(x) is 12.

[0086] Calculation process: In order to enhance the anti-tampering capability of the obfuscated ciphertext while meeting the Base64 encoding and decoding requirements and timely verifying whether the ciphertext has been tampered with, the scheme adopts the CRC cyclic redundancy check algorithm and selects a 12-bit CRC check code. The 12-bit binary remainder is obtained through XOR operation and added to the end of the string to form a 144-bit binary digital string.

[0087] Output: A 144-bit binary string with CRC check result.

[0088] The sixth encryption calculation:

[0089] Input: The result of the fifth encryption calculation, a 144-bit binary string with a CRC checksum result.

[0090] Key: 64-bit obfuscated integer array, that is, a 64-bit random array consisting of non-repeating integers from 0 to 63 is randomly generated, and the characters in the Base64 encoding comparison table are rearranged using the array rearrangement calculation method to form a private encoding dictionary.

[0091] Calculation process: The Base64 encoding table is sorted according to the index order of the obfuscated array, and the characters corresponding to the encoding table are re-sorted to generate a new encoding dictionary table. On this basis, the Base64 encoding method is used to convert the 144-bit binary digital string with the CRC check result into a 24-bit visible string to form the final obfuscated ciphertext.

[0092] Output: 24-bit ciphertext string.

[0093] The Base64 encoding comparison table is shown in Table 1 below:

[0094] Table 1

[0095] Code value character Code value character Code value character Code value character 0 A 16 Q 32 g 48 w 1 B 17 R 33 h 49 x 2 C 18 S 34 i 50 y 3 D 19 T 35 j 51 z 4 E 20 U 36 k 52 0 5 F 21 V 37 l 53 1 6 G 22 W 38 m 54 2 7 H 23 X 39 n 55 3 8 I 24 Y 40 o 56 4 9 J 25 Z 41 p 57 5 10 K 26 a 42 q 58 6 11 L 27 b 43 r 59 7 12 M 28 c 44 s 60 8 13 N 29 d 45 t 61 9 14 O 30 e 46 u 62 + 15 P 31 f 47 v 63 /

[0096] The entire multi-confusion encryption calculation process is completed. The composition, number of bits, and number of keys of each key are shown in Table 2 below:

[0097] Table 2

[0098]

[0099] In the above multiple encryption process, in order to increase the difficulty of cracking the ciphertext, the array rearrangement method is used to encrypt the string.

[0100] For an array a=[a0,a1,…,a n-1 ], a random algorithm is used to generate a non-repeating n-bit random index array b = [b0, b1, ..., b n-1 ], then the new array after rearrangement is represented as c=[c0,c1,…,c n-1 ], where for the element c in the array i ,have:

[0101]

[0102] In the formula, i∈[0,n-1], i is an integer.

[0103] This embodiment takes an array of length 4 [a, b, c, d] as an example, and its obfuscation process is:

[0104] If a random algorithm is used to generate a 4-bit random index array [3,0,2,1] consisting of non-repeating integers from 0 to 3, the array is rearranged in this order:

[0105] The value corresponding to the index 0 of the obfuscated array is 3, so the character "d" with index 3 in the original array is placed at index 0 of the newly generated obfuscated array;

[0106] The value corresponding to the index 1 of the obfuscated array is 0, so the character "a" with index 0 in the original array is placed at index 1 of the newly generated obfuscated array;

[0107] The value corresponding to index 2 of the obfuscated array is 2, so the character "c" with index 2 in the original array is placed at index 2 of the newly generated obfuscated array;

[0108] The value corresponding to the obfuscated array index 3 is 1, so the character "b" with index 1 in the original array is placed at index 3 of the newly generated obfuscated array. Figure 3 As shown, the larger the array length, the more difficult it is to crack after obfuscation.

[0109] According to the above method, there are currently about 3,000 coal mines in production in China. From the above analysis, it can be seen that the number of the smallest number of keys 5 is 4,096, which meets the demand for one coal mine to correspond to one different key. The number of the other five keys is much larger than the number of existing coal mines in the country. Coal mining enterprises can use different keys to complete the encryption calculation process of data, realizing the uniqueness and universal applicability of all keys. Even for industrial and mining enterprises across the country, due to the huge number of the other five groups of keys, they still have very good global uniqueness and universal applicability.

[0110] The distribution and storage of six different sets of keys can be managed in sections by multiple parties including superior regulatory authorities, coal mining enterprises themselves and information system contractors to ensure the security of the keys.

[0111] In step S3, in order to meet the requirements of storing and utilizing time series data of massive sensor devices, the solution adopts a storage architecture that combines time series database with relational database, and combines the obfuscated ciphertext of monitoring data to design a coal mine sensor monitoring data storage solution with tamper-proof capability. Its overall architecture is as follows Figure 4 As shown in the figure, the time series database and relational database are combined to realize the integrated fusion storage of massive IoT sensor real-time monitoring data, abnormal monitoring data and other data. The real-time monitoring data of sensors with obvious time series characteristics are stored in the time series database, and the abnormal monitoring data and its corresponding processing measures after statistical analysis of real-time monitoring data, basic definition information of sensor equipment measuring points, and code table dictionary libraries such as system number, measuring point type, measuring point abnormal state, measuring point monitoring physical quantity unit, measuring point relationship, etc. are stored in the relational database.

[0112] Real-time monitoring data is the time series data continuously generated by the coal mine IoT sensors, which is stored in a TDengine-based time series database table. A real-time monitoring data super table is designed, which consists of a label column and a data column. The label (TAG) column includes the sensor device code and installation address, and the data column (COLUMN) consists of the collection time, monitoring value, value meaning, value status, and ciphertext field. The specific structure is shown in Table 3 below:

[0113] Table 3

[0114]

[0115] In the TDengine database, a super table represents a set of sensor device data collection points with the same attributes. It contains the common attributes of all device measurement points (such as measurement point number, address, system number, etc.) and collection quantities (such as real-time monitoring value, value status, etc.). When TDengine stores data, it only stores the tag (TAG) attribute column once, and stores the collection quantity data (COLUMN) column in real time according to different timestamps. This design not only simplifies table management and facilitates aggregation operations across sensor device measurement points, but also reduces the repeated storage of static attributes and improves data processing efficiency. The super table creation statement is as follows:

[0116]

[0117] The CipherText in the table is a ciphertext field, and the encrypted input data identification information includes data generation time, real-time monitoring value, monitoring value meaning and monitoring value status.

[0118] Taking the gas sensor monitoring point numbered MN001A01 under the safety monitoring system (system code 1001) as an example, the subtable corresponding to the monitoring point is constructed based on the super table. The creation statement is as follows:

[0119]

[0120]

[0121] "MN001A01" is the equipment code of the gas sensor monitoring point, which is also the table name of the subtable. The TAG columns are the installation address of the measuring point and the subsystem number to which it belongs. When querying statistics, you can perform multi-point queries based on the generation time, status, and system of the equipment measuring point data. You can also specify a specific sensor equipment code to query one or more data at a certain time point (or time period) and status.

[0122] Based on the real-time monitoring data generated by sensor equipment, according to business needs, in addition to sensor time series data, there is also definition information of sensor equipment, including its corresponding manufacturer, specification model, monitored physical quantity and its unit, equipment type, and related equipment system coding dictionary table, equipment type coding dictionary table, measuring point abnormal state coding dictionary table, measuring point relationship table and other basic tables. In addition, there are also measuring point state change record data tables and measuring point abnormal monitoring data tables generated by secondary analysis and statistics of equipment status. Since the amount of data stored in these data tables is relatively small, they are designed to be stored in relational databases such as MySQL, SQL Server or Oracle to facilitate data association query and analysis. Taking the abnormal monitoring data table as an example, its data table structure is shown in Table 4 below:

[0123] Table 4

[0124]

[0125] The statement to create the exception monitoring table is as follows:

[0126]

[0127] MaxTime DATETIME,

[0128] MinValue FLOAT,

[0129] MinTime DATETIME,

[0130] AvgValue FLOAT,

[0131] DataGenTime DATETIME not null,

[0132] CipherText CHAR(24) not null )

[0134] The CipherText in Table 4 is a ciphertext field, and the encrypted input data identification information includes data generation time, abnormal start time, abnormal end time, abnormal status value, maximum value during the abnormal period, maximum value time, minimum value during the abnormal period, minimum value time and average value.

[0135] In step S4, when the obfuscated ciphertext needs to be decrypted, Figure 5 As shown, when all the keys are known, according to the enterprise identification information, device identification information and data identification information, the real-time monitoring values ​​are enumerated and obfuscated encryption calculations are performed, and the obfuscated ciphertext is cyclically compared with the ciphertext stored in the database to see if they are the same, so that the sensor monitoring data value before encryption can be obtained.

[0136] Taking the disaster environment monitoring data commonly used in coal mines as an example, the units of methane, oxygen, carbon dioxide, etc. are %, and their values ​​are between 0 and 100; the units of carbon monoxide, hydrogen sulfide, etc. are ppm, and the effective monitoring value range of the sensor is between 0 and 1000; the possible value ranges of other switch quantities and polymorphic quantities are all single digits. According to the obfuscated encryption calculation process, taking the most common methane concentration as an example, its alarm power-off value is set at a maximum of 1.5%, and the real-time monitoring value range is between 0 and 1.5, which is between 000.0000 and 001.5000 after formatting; its maximum possible value range is between 0 and 100, which is between 000.0000 and 100.0000 after formatting. The maximum number of encryption matches is 15,000 and 1,000,000 respectively. After testing, the average time taken for the decryption process is 0.060 seconds and 4.330 seconds respectively. The decryption speed is fast and meets the actual supervision and inspection requirements.

[0137] The test results of 10,000 sensor devices show that the average time for batch storage of 10,000 real-time monitoring data is less than 0.830 seconds, of which data encryption time accounts for less than 10%. When querying and counting large amounts of data, a sensor device monitoring point generates a real-time monitoring data every 5 seconds. The super table of 10,000 sensor device monitoring points stores about 5 billion data in a month (30 days), and a sensor device monitoring point subtable stores about 500,000 data. The trend curve data query result of a monitoring point in one day returns about 17,000 data. Under the same server resource conditions, compared with the MySQL relational database, the query efficiency of the TDengine time series database is nearly 40 times higher, and the storage space is reduced by nearly 90%, which is a significant effect.

[0138] Example 2

[0139] This embodiment proposes a secure and efficient processing system for IoT sensor monitoring data for implementing the above method, such as Figure 5 As shown, it includes: an Internet of Things sensor device / system, a data acquisition module, a data encryption module, a data writing module, a time series database, a relational database and a data service module, wherein the Internet of Things sensor device / system is distributed in various coal mines underground, the data acquisition module is used to collect enterprise identification information, equipment identification information and data identification information, the data encryption module performs multiple obfuscation encryption on the collected enterprise identification information, equipment identification information and data identification information to obtain obfuscated ciphertext, the data writing module writes the encrypted ciphertext information into the time series database and the relational database, and the data service module is used to query the data in the database.

[0140] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the purpose and scope of the technical solution, which should be included in the scope of the claims of the present invention.

Claims

1. A method for encrypting and storing monitoring data of an Internet of Things sensor, characterized in that: It includes the following steps: S1. Establish enterprise identification information, equipment identification information and data identification information, and add identification information to the acquired monitoring data information; S2, encrypt the monitoring data information through multiple obfuscation encryption methods, and finally output the obfuscated ciphertext; S3. Establish a time series database to store real-time monitoring data, and establish a relational database to store abnormal monitoring data and related data; S4. When decryption is required, the real-time monitoring value is encrypted multiple times in an enumerated manner according to the enterprise identification information, device identification information and data identification information, and the ciphertext is compared to see whether it is consistent, thereby determining the real-time monitoring value before encryption.

2. The method for encrypting and storing monitoring data of an Internet of Things sensor according to claim 1 is characterized in that: In step S1, the enterprise identification information established includes the enterprise name, unified social credit code, coal mine code and globally unique identifier, wherein the globally unique identifier is a digital identifier generated by an algorithm, and the globally unique identifier is used as the first key in the subsequent encryption process; The established device identification information includes the system number to which the sensor device belongs, the device code and the installation address of the sensor device; The established data identification information includes at least real-time monitoring data identification information and abnormal monitoring data identification information.

3. The method for encrypting and storing monitoring data of an Internet of Things sensor according to claim 2 is characterized in that: The real-time monitoring data identification information includes the timestamp generated by the sensor device data, the real-time monitoring value, and the real-time status value, wherein the timestamp is expressed in the format of "yyyy-MM-dd HH:mm:ss.fff", wherein "yyyy" represents the year, "MM" represents the month, "dd" represents the day, "HH" represents the hour part, "mm" represents the minute part, "ss" represents the second part, and "fff" represents the millisecond part; The abnormal monitoring data identification information is calculated from the real-time data generated by the sensor equipment, and includes the abnormal start time, abnormal end time, abnormal status value, maximum value during the abnormal period, maximum value time, minimum value during the abnormal period, minimum value time, average value, and the timestamp of the corresponding record generation.

4. The method for encrypting and storing monitoring data of an Internet of Things sensor according to claim 1 is characterized in that: In step S2, the enterprise identification information, the device identification information and the data identification information are concatenated and combined into the original plain text. The encryption process includes at least six encryptions, where: The first encryption process is: using the MD5 information digest algorithm to generate the original plaintext into a digest ciphertext; the first encryption takes the original plaintext as input, takes the globally unique identifier as the first key, and outputs a 32-bit hexadecimal digital string after the digest encryption; The second encryption process is as follows: according to the randomly generated 32-bit obfuscated integer array, the characters in the 32-bit MD5 ciphertext string are rearranged according to the integers corresponding to each index in the array; the second encryption takes the 32-bit hexadecimal digital string after the first encryption as input, takes the randomly generated 32-bit obfuscated integer array consisting of non-repeating integers from 0 to 31 as the second key, and outputs the rearranged 32-bit ciphertext string; The third encryption process is as follows: according to the random integer corresponding to the 4-bit complement obfuscated integer array, select the characters at the corresponding 4 random integer positions from the 128-bit binary string, and add them to the end of the 128-bit binary string to form a 132-bit string; the third encryption uses the rearranged 32-bit ciphertext string as input, uses the randomly generated 4-bit complement obfuscated integer array consisting of non-repeating integers from 0 to 127 as the third key, and outputs a 132-bit binary digital string; The fourth encryption process is as follows: the string consisting of 132 binary digits is subjected to array rearrangement calculation according to the index order of the obfuscation array; the fourth encryption uses the 132 binary digit string as input, uses a randomly generated 132-bit obfuscated integer array consisting of non-repeating integers from 0 to 131 as the fourth key, and outputs the 132-bit binary digit string after obfuscation sorting; The fifth encryption process is as follows: adopt the CRC cyclic redundancy check algorithm, select a 12-bit CRC check code, obtain a 12-bit binary remainder through an XOR operation, and add it to the end of the 132-bit binary digital string after the obfuscation order to form a 144-bit binary digital string; the fifth encryption uses the 132-bit binary digital string after the obfuscation order as input, uses the 12-bit CRC check code as the fifth key, and outputs a 144-bit binary digital string with a CRC check result; The sixth encryption process is: use the array rearrangement calculation method to re-arrange the characters in the Base64 encoding reference table to form a private encoding dictionary, and then use the Base64 encoding method to convert the 144-bit binary digital string with the CRC check result into a 24-bit visible string; the sixth encryption uses the 144-bit binary digital string with the CRC check result as input, and randomly generates a 64-bit obfuscated integer array consisting of non-repeating integers from 0 to 63 as the sixth key, and outputs the final encrypted obfuscated ciphertext.

5. The method for encrypting and storing monitoring data of an Internet of Things sensor according to claim 4 is characterized in that: The array is rearranged in the multi-encryption process as follows: For array a=[a0,a1,…,a n-1 ], a random algorithm is used to generate a non-repeating n-bit random index array b = [b0, b1, ..., b n-1 ], then the new array after rearrangement is represented as c=[c0,c1,…,c n-1 ], where for the element c in the array i ,have: In the formula, i∈[0,n-1], i is an integer.

6. The method for encrypting and storing monitoring data of an Internet of Things sensor according to claim 1, characterized in that: In step S3, a real-time monitoring data super table is designed, wherein the real-time monitoring data super table includes a label column and a data column, the label column includes the sensor device code and installation address, and the data column includes the collection time, monitoring value, value meaning, value status, and ciphertext field.

7. The method for encrypting and storing monitoring data of an Internet of Things sensor according to claim 6 is characterized in that: The data column of the real-time monitoring data super table includes CipherText as a ciphertext field, and its encrypted input data identification information includes the data generation time DataGenTime, the real-time monitoring value RealtimeValue, the monitoring value meaning MeaningValue and the monitoring value state StateId as well as their corresponding data types. The label column includes the device installation location InstallAddr, the system number SystemId and its corresponding data type.

8. The method for encrypting and storing monitoring data of an Internet of Things sensor according to claim 1, characterized in that: In step S3, a relational database is established, wherein the relational database at least stores abnormal monitoring data, sensor equipment definition data, code table dictionary data, measuring point definition data, statistical analysis data, and abnormal handling measures. The sensor equipment definition data includes its corresponding manufacturer, specification model, monitored physical quantity and its unit, and equipment type; the code table dictionary data includes an equipment system coding dictionary table, an equipment type coding dictionary table, a measuring point abnormal state coding dictionary table, and a measuring point relationship table; the statistical analysis data includes a measuring point state change record data table and a measuring point abnormal monitoring data table generated by secondary analysis and statistics of the equipment state; and the abnormal handling measures refer to the processing schemes taken in response to the abnormal monitoring data.

9. The method for encrypting and storing monitoring data of an Internet of Things sensor according to claim 8, characterized in that: The abnormal monitoring data table includes a ciphertext field CipherText, and the encrypted input data identification information includes data generation time DataGenTime, abnormal start time StartTime, abnormal end time EndTime, abnormal status value StatusId, maximum value MaxValue during the abnormal period, maximum value time MaxTime, minimum value MinValue during the abnormal period, minimum value time MinTime, average value AvgValue and device measurement point code DeviceCode.

10. The method for encrypting and storing monitoring data of an Internet of Things sensor according to claim 1, characterized in that: In step S4, when all the keys are known, the real-time monitoring values ​​are enumerated and obfuscated encryption calculations are performed according to the enterprise identification information, device identification information and data identification information, and the obfuscated ciphertexts are cyclically compared to see if they are the same. If the obfuscated ciphertexts are the same, the currently enumerated monitoring value is the sensor monitoring data value before encryption; if the obfuscated ciphertexts are not the same, the obfuscated encryption comparison is repeated until the obfuscated ciphertexts are the same.

Images