Communication method and system for binding data authority and communication link

Abstract

The invention discloses a data authority and communication link binding communication method. The communication device is in communication connection with the outside through at least two communication links; corresponding data authority is given to each communication link in advance, and data authority information corresponding to each communication link is stored in the communication device; when the communication device receives a data access request, the communication device firstly identifies a communication link through which the data access request passes, and then judges whether data requested by the data access request is within a data permission range corresponding to the identified communication link, if so, the data access request is sent to the communication device, and if not, the data access request is sent to the communication device. If so, the corresponding data requested by the communication link is returned via the communication link, otherwise, a notification of denying access is returned via the communication link. The invention also discloses a communication system for binding the data authority and the communication link. According to the method and the device, the data access authority is bound with the specific communication link, so that authority control in the data transmission process is realized, and the safety and the efficiency of data transmission are improved.

Description

Technical Field

[0001] The present invention relates to a communication method, in particular to a communication method for binding data authority with a communication link, and belongs to the technical field of industrial communication. Background Art

[0002] With the rapid development of information technology, data transmission in communication networks has become increasingly frequent and important. However, most traditional industrial communications still use serial port protocols, such as modbus-rtu or modbus-tcp, which cannot ensure the security of data access and transmission on the communication link. There are two main ways for the traditional host computer to access the data of the communication device and set the relevant permissions:

[0003] 1. By setting permissions or passwords on the host computer communication software, you can enter different passwords on the host computer communication software to display different interfaces and access different parameters. Figure 1 As shown, the host computer 1 and the host computer 2 are connected to the communication device. When the host computer 1 accesses data to the communication device, the communication software interface of the host computer 1 is as shown in FIG. Figure 2 As shown, enter different passwords to enter different interfaces, such as Figure 3 As shown, access to different data is achieved. The main problem of this method is that the data authority of the host computer 1 to access the communication device is only set on the communication software of the host computer 1. The communication software (generally a special software written by the communication device company) sets the password and authority on the interface and is not bound to the communication link. The host computer 2 can access the data with the communication device through ordinary communication software (generally a general software assistant), and can directly access all data without authority restrictions.

[0004] 2. The communication device has an address that specifically sets the permission content. The communication software of the host computer sets the content of the communication device address to determine the corresponding permission of the current communication device data. Figure 1 As shown, the host computer 1 sends the permission password data to the communication device. When the password data received by the communication device is consistent with the built-in corresponding permission password, as shown in Figure 4 As shown, the communication device receives the same permission password as the super user password, and its internal parameters are set to super user, and the data permission is super user permission, that is, the host computer 1 can access all data of the communication device. The main problem of this method is that the communication device implements user permissions through internal permission password settings, and is not bound to the communication link. After the host computer 1 sets the communication device as a super user, the host computer 2 can access the communication device and directly access all data without permission restrictions.

[0005] In summary, the above methods all ignore the direct relationship between data permissions and communication links, resulting in lax permission control during data transmission and posing major security risks. Summary of the invention

[0006] The technical problem to be solved by the present invention is to overcome the shortcomings of the prior art and provide a communication method for binding data permissions with communication links. By binding the access permissions of data with specific communication links, permission control in the data transmission process is achieved, thereby improving the security and efficiency of data transmission.

[0007] The present invention specifically adopts the following technical solutions to solve the above technical problems:

[0008] A communication method for binding data authority with communication links, wherein a communication device is connected to the outside world through at least two communication links; each communication link is pre-assigned with corresponding data authority, and the data authority information corresponding to each communication link is stored in the communication device; when the communication device receives a data access request, the communication device first identifies the communication link through which the data access request passes, and then determines whether the data requested by the data access request is within the data authority corresponding to the identified communication link. If so, the corresponding data requested is returned via the communication link; otherwise, a notification of access denial is returned via the communication link.

[0009] Preferably, each communication link is pre-assigned with corresponding data permissions through the following permission registration method:

[0010] sending an authorization message to the communication device via the communication link;

[0011] After receiving the permission message, the communication device first searches for the data permission corresponding to the permission message in the built-in permission registration table, and then binds the searched data permission with the communication link information through which the permission message passes, generates corresponding communication link permission binding information and saves it;

[0012] The communication device returns a permission registration success message via the communication link.

[0013] Further preferably, after receiving the permission message, the communication device also binds the current time information with the queried data permission and the communication link information through which the permission message passes.

[0014] Furthermore, if the time during which the communication device is connected to the outside world through a certain communication link exceeds a preset time, the communication device will reduce or cancel the data authority corresponding to the communication link.

[0015] Preferably, the transmitted data in the permission registration process is encrypted.

[0016] Further preferably, the encryption is performed using elliptic curve cryptography.

[0017] Preferably, the communication device also records and stores data access information.

[0018] Based on the same inventive concept, the following technical solutions can also be obtained:

[0019] A communication system in which data authority is bound to a communication link, comprising at least one communication device, wherein the communication device is connected to the outside world through at least two communication links; the communication system communicates using the communication method described in any of the above technical solutions.

[0020] Compared with the prior art, the technical solution of the present invention has the following beneficial effects:

[0021] Improve the security of data transmission: By binding data permissions with communication links, the present invention can realize permission control during data transmission and effectively prevent security risks such as data leakage.

[0022] Enhance the scalability and flexibility of the system: The present invention supports a variety of communication links and data permission types, and can be flexibly configured and expanded according to actual needs. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 A typical system architecture diagram of an existing communication solution;

[0024] Figure 2 , Figure 3 This is an example of the communication software interface of the host computer 1 in the existing first communication solution;

[0025] Figure 4 This is an example of the communication software interface of the host computer 1 in the second existing communication solution;

[0026] Figure 5 is a structural block diagram of a communication device;

[0027] Figure 6 is a schematic diagram of the structure of the link management module;

[0028] Figure 7 This is a structural diagram of the data permission module;

[0029] Figure 8 It is a schematic diagram of the permission registration process in a specific embodiment;

[0030] Fig. 9 It is a schematic diagram of the data access process in a specific embodiment. DETAILED DESCRIPTION

[0031] In view of the deficiencies in the prior art, the solution of the present invention is to bind the access rights of data to a specific communication link to achieve permission control during data transmission and improve the security and efficiency of data transmission.

[0032] The present invention specifically adopts the following technical solutions to solve the above technical problems:

[0033] A communication method for binding data authority with communication links, wherein a communication device is connected to the outside world through at least two communication links; each communication link is pre-assigned with corresponding data authority, and the data authority information corresponding to each communication link is stored in the communication device; when the communication device receives a data access request, the communication device first identifies the communication link through which the data access request passes, and then determines whether the data requested by the data access request is within the data authority corresponding to the identified communication link. If so, the corresponding data requested is returned via the communication link; otherwise, a notification of access denial is returned via the communication link.

[0034] Preferably, each communication link is pre-assigned with corresponding data permissions through the following permission registration method:

[0035] sending an authorization message to the communication device via the communication link;

[0036] After receiving the permission message, the communication device first searches for the data permission corresponding to the permission message in the built-in permission registration table, and then binds the searched data permission with the communication link information through which the permission message passes, generates corresponding communication link permission binding information and saves it;

[0037] The communication device returns a permission registration success message via the communication link.

[0038] Further preferably, after receiving the permission message, the communication device also binds the current time information with the queried data permission and the communication link information through which the permission message passes.

[0039] Furthermore, if the time during which the communication device is connected to the outside world through a certain communication link exceeds a preset time, the communication device will reduce or cancel the data authority corresponding to the communication link.

[0040] Preferably, the transmitted data in the permission registration process is encrypted.

[0041] Further preferably, the encryption is performed using elliptic curve cryptography.

[0042] Preferably, the communication device also records and stores data access information.

[0043] Based on the same inventive concept, the following technical solutions can also be obtained:

[0044] A communication system in which data authority is bound to a communication link, comprising at least one communication device, wherein the communication device is connected to the outside world through at least two communication links; the communication system communicates using the communication method described in any of the above technical solutions.

[0045] In order to facilitate public understanding, the technical solution of the present invention is described in detail below with reference to the accompanying drawings:

[0046] The communication system of the present invention includes at least one communication device, and the communication device is connected to the outside world through at least two communication links; each communication link is pre-assigned with corresponding data permissions, and different levels of data permissions mean that different data in the communication device can be accessed. The way to distinguish communication links needs to be determined according to the specific communication protocol used by the communication system. For example, for the modbus-RTU protocol, different communication port numbers for communicating with the host computer are different communication links; for the modbus-TCP protocol, host computers with different IP addresses connected to this machine are different communication links.

[0047] like Figure 5 As shown, the communication device of the present invention is provided with a link management module, a data permission module, and a link permission module; the link management module is used to identify different communication links and obtain their access rights; the data permission module is used to determine whether to allow or deny access based on the communication link through which the data access request passes and the data access rights of the communication link; the link permission module is used to determine the access rights of the communication link based on its registration information and bind and record them.

[0048] like Figure 6 As shown, the link management module includes a link identification unit and a link authorization unit, wherein the link identification unit is used to identify the link information of the scanned communication link, and the link authorization unit is used to search for the data access rights corresponding to the communication link in the data permission information corresponding to each communication link recorded in the link permission module (for example, which can be stored in the form of a communication link permission table) according to the link information identified by the link identification unit.

[0049] like Figure 7 As shown, the data permission module includes a data storage unit and a permission storage unit. The data storage unit is a mapping table between data content and data storage address, and the permission storage unit is used to store the data storage address in the corresponding access permission table. The data permission module searches for the data address in the access permission table of the permission storage unit according to the access permission, and then finds the corresponding data content according to the mapping table of the data address in the data storage unit.

[0050] The technical solution of the present invention is further described in detail below through a specific embodiment:

[0051] First, each communication link is pre-assigned with corresponding data permissions through the following permission registration method:

[0052] sending an authorization message to the communication device via the communication link;

[0053] After receiving the permission message, the communication device first searches for the data permission corresponding to the permission message in the built-in permission registration table, and then binds the searched data permission with the communication link information through which the permission message passes, generates corresponding communication link permission binding information and saves it;

[0054] The communication device returns a permission registration success message via the communication link.

[0055] In order to further improve the communication security, the transmission data in the permission registration process of this embodiment is encrypted using the elliptic curve encryption method. Of course, other types of encryption methods can also be used. In addition, after receiving the permission message, the communication device also binds the current time information with the queried data permission and the communication link information through which the permission message passes, so that the data permission of the communication link can be dynamically adjusted according to the communication connection time. For example, if the time when the communication device communicates with the outside world through a certain communication link exceeds the preset time, the communication device will reduce or cancel the data permission corresponding to the communication link.

[0056] The correspondence between the various levels of data permissions and registration messages in this embodiment is shown in Table 1.

[0057] Table 1

[0058] Built-in storage registration message Permissions (3,28) Superuser privileges (3,27) Advanced User Rights (3,26) Normal user permissions

[0059] The process of permission registration is as follows Figure 8 As shown, the details are as follows:

[0060] Step 1: Host computer 1 uses elliptic curve encryption method to encrypt, assuming that the elliptic curve E 11 (1,6), generator G = (2,7), private key n of host computer 1 s =7, then the public key P s =n s G = 7G = (7, 2), the host computer 1 sends the elliptic curve E to the communication device 11 (1,6), generator G = (2,7) and public key P s ;

[0061] Step 2: The communication link of the communication device receives the public key P sAfter checking the internal communication link permission table, the communication link is not registered. The communication device uses elliptic curve encryption method to encrypt. Suppose the elliptic curve E 29 (4,20), generator G = (13,23), private key n of the communication device t =25, then the public key P t =n t G = 25G = (14, 6), the communication device sends E to the upper computer 1 29 (4,20), G = (13,23) and the public key P t ;

[0062] Step 3: Host computer 1 receives the public key P returned by the communication device t Then, the public key P of the communication device is used for the authority message M = (3, 28) t To encrypt, select a random positive integer k = 6, calculate C1 = kG = 6G = (5,7) and

[0063] C2=M+kP t =M+6P t =(3,28)+6(14,6)=(3,28)+(27,27)=(6,12) is the encrypted message, and then the encrypted message {C1,C2} is sent to the communication device;

[0064] Step 4: The communication link of the communication device receives the encrypted message {C1, C2} and uses its own private key n t =25 for decryption, authority message M = C2-n t C1=M+kP t -n t C1=M+kP t -n t KP t Substituting into the calculation, we can get

[0065] M=C2-n t C1=(6,12)-25*6G=(6,12)-2G=(6,12)-(27,27)=(6,12)+(27,2)=(3,28);

[0066] Step 5: The above message M=(3,28) detects that the permission in the built-in permission registration table of the communication device is super permission. The communication device inputs the link permission module according to the communication link COM5 communicating with the host computer 1, the super permission and the current time combination. The link permission module performs binding according to the relevant information, generates the communication link permission binding table 2, and generates a permission registration success message N=(3,8);

[0067] Step 6: The communication device's message N = (3, 8) uses the public key P of the host computer 1s To encrypt, select a random positive integer k = 6, calculate C3 = kG = 6G = 6 (2, 7) = (7, 9) and

[0068] C4=N+kP t =N+6P t =(3,8)+6(14,6)=(3,8)+(8,3)=(1,1), send the encrypted message {C3,C4} to the upper computer 1;

[0069] Step 7: Host 1 receives the encrypted message {C3, C4} and uses its own private key n s =7 for decryption, message N = C4-n s C3=N+kP s -n t C3=N+kP s -n s KP s Substituting into the calculation, we can get N = C4-n s C3=(1,1)-7*6G=(1,1)-7(7,9)=(1,1)+(8,8)=(3,8), which is the registration success message. Registration is completed.

[0070] Similarly, each communication link connected to the communication device can complete the permission registration. The communication link permission table generated after the three communication links complete the permission registration in this embodiment is shown in Table 2.

[0071] Table 2

[0072] Communication Link time Permissions COM5 2024.2.1.8:10:20 Superuser privileges COM8 2024.2.1.8:11:20 Advanced User Rights COM9 2024.2.1.8:12:20 Normal user permissions

[0073] After registration is completed, the host computer can communicate normally with the communication device. The host computer sends a read data message to the communication device. The link identification unit in the link management module of the communication device identifies the communication link information connected to the host computer and inputs it into the link authorization unit. The link authorization unit searches for the current user authority in the communication link authority table according to the communication link, and then inputs the obtained user authority and data message address into the data authority module. The authority storage unit in the data authority module has an address authority access table, as shown in Table 3 below. 1000H can be accessed by all users, 1001H can be accessed by advanced users and super users, and 1002H can only be accessed by super users.

[0074] Table 3

[0075] address General user access Premium User Access Superuser access 1000H √ √ √ 1001H × √ √ 1002H × × √

[0076] The data permission module determines whether the access right is granted based on the user rights and the data message address. If the access right is granted, the data message address is input into the data storage unit. The data storage unit has a mapping table of data content and data storage address, as shown in Table 4. The data content is searched based on the data message address, and the data is organized and returned to the host computer. If the access right is denied, the access denial information is returned.

[0077] Table 4

[0078] address data 1000H 0x0100 1001H 0x0200 1002H 0x0300

[0079] There are many situations for the results of data access. The following takes three host computers, the communication link is COM port, and the communication protocol is modbus-rtu as an example to illustrate:

[0080] 1. If Fig. 9 As shown, the host computer 1 sends a communication message 1 (01 03 10 00 00 01 80 CA) to the communication device. After receiving the communication data message, the link management module of the communication device inputs the link authority module to obtain the user authority as the super user authority. According to the super user authority and the access address 1000H, it is confirmed in the authority storage unit of the data authority module that the address 1000H meets the access requirement, and then the data storage unit searches for the address data content 0x0100 according to the access address 1000H, and then organizes it into a communication message 2 (01 03 02 01 00 B9 D4) and sends it to the host computer 1.

[0081] 2. Host computer 2 sends communication message 1 (01 03 10 01 00 01 D1 0A) to the communication device. After receiving the communication data message, the link management module of the communication device inputs the link permission module to obtain the user permission as advanced user permission. According to the advanced user permission and the access address 1001H, it confirms in the permission storage unit of the data permission module that the address 1001H meets the access requirements. Then, according to the access address 1001H, the data storage unit searches for the address data content as 0x0200, and then organizes it into communication message 3 (01 03 02 02 00 B9 24) and sends it to host computer 2.

[0082] 3. Host computer 2 sends communication message 1 (01 03 10 00 00 01 80 CA) to the communication device. After receiving the communication data message, the link management module of the communication device inputs it into the link permission module to obtain the user permission as advanced user permission. According to the advanced user permission and the access address 1000H, it is confirmed in the permission storage unit of the data permission module that the address 1000H does not meet the access requirements, and the organization rejects the communication message 3 (01 83 02 C0 F1) and sends it to host computer 2.

[0083] 4. The upper computer 3 sends a communication message 1 (01 03 10 01 00 01 D1 0A) to the communication device. After receiving the communication data message, the link management module of the communication device inputs it into the link permission module to obtain the user permission as ordinary user permission. According to the ordinary user permission and the access address 1001H, it is confirmed in the permission storage unit of the data permission module that the address 1001H does not meet the access requirements. The organization rejects the communication message 3 (01 83 02 C0 F1) and sends it to the upper computer 3.

[0084] The above four communication processes between the three host computers and the communication device are stored in the data permission module and in the statistical data table, as shown in Table 5, to facilitate viewing of data access records.

[0085] Table 5

[0086] Serial number event time Communication Link 1 Data received-normal reply 2024.2.1.10：45：30 COM5 2 Data received-normal reply 2024.2.1.10：55：20 COM8 3 Data reception-abnormal response 2024.2.1.10：56：20 COM8 4 Data reception-abnormal response 2024.2.1.10：58：20 COM9

Claims

1. A communication method for binding data authority with communication links, wherein a communication device is connected to the outside world through at least two communication links; characterized in that: Each communication link is pre-assigned with corresponding data permissions, and the data permission information corresponding to each communication link is stored in the communication device; when the communication device receives a data access request, the communication device first identifies the communication link through which the data access request passes, and then determines whether the data requested by the data access request is within the data permission range corresponding to the identified communication link. If so, the corresponding data requested is returned via the communication link; otherwise, a notification of access denial is returned via the communication link.

2. The communication method for binding data authority with communication link as claimed in claim 1, characterized in that: The following permission registration method is used to pre-assign corresponding data permissions to each communication link: sending an authorization message to the communication device via the communication link; After receiving the permission message, the communication device first searches the built-in permission registration table for the data permission corresponding to the permission message, and then binds the searched data permission with the communication link information through which the permission message passes, generates corresponding communication link permission binding information and saves it; The communication device returns a permission registration success message via the communication link.

3. The communication method for binding data authority with communication link as claimed in claim 2, characterized in that: After receiving the permission message, the communication device also binds the current time information with the queried data permission and the communication link information through which the permission message passes.

4. The communication method for binding data authority with communication link as claimed in claim 3, characterized in that: If the time during which the communication device is connected to the outside world through a certain communication link exceeds a preset time, the communication device will reduce or cancel the data authority corresponding to the communication link.

5. The communication method for binding data authority with communication link as claimed in claim 2, characterized in that: The transmitted data in the permission registration process is encrypted.

6. The communication method for binding data authority with communication link as claimed in claim 5, characterized in that: The encryption is performed using elliptic curve cryptography.

7. The communication method for binding data authority with communication link as claimed in claim 1, characterized in that: The communication device also records and stores data access information.

8. A communication system in which data rights are bound to communication links, comprising at least one communication device, wherein the communication device is connected to the outside world through at least two communication links; characterized in that: The communication system performs communication using the communication method according to any one of claims 1 to 7.

Images