Industrial data security control method and system based on block chain

Abstract

The invention discloses an industrial data security management and control method and system based on a block chain, and the system comprises an edge device access module which is used for requesting to access on-chain data, carrying out the encryption transmission of original data, and cooperatively collecting the original data under the chain; the distributed key management module is used for realizing public key information negotiation of edge devices, realizing original data encryption, storing public key information of the edge devices to a block chain network and binding edge device identifiers; the block chain network module is used for verifying the identity of the edge equipment and storing data; the dynamic access control module is used for acquiring a preset role permission strategy library, judging the legality of the access request in real time, intercepting illegal operation and recording an audit log to a block chain network; and the data integrity verification module is used for generating a hash value for the original data, uploading the hash value to the block chain network, and verifying the consistency through a chain code when the data is read. According to the invention, the security and reliability of industrial data circulation can be improved.

Description

Technical Field

[0001] The present invention belongs to the field of the intersection of blockchain technology and industrial Internet security, and specifically relates to an industrial data security management and control method and system based on blockchain. Background Art

[0002] With the deep integration of information technology and industrial production, the Industrial Internet has become a key force driving industrial upgrading and transformation. However, industrial data security has become increasingly prominent, becoming a bottleneck restricting the development of the Industrial Internet. Industrial data runs through every aspect of industrial production, from equipment status monitoring and production process control to supply chain management. Its security is directly related to the core interests and production safety of enterprises. Therefore, building a secure and reliable industrial data flow framework is crucial to ensuring the stable operation of the Industrial Internet.

[0003] Industrial data flow primarily involves data collection, transmission, storage, and processing. During the data collection phase, industrial equipment uses sensors and other devices to collect production data in real time. This data contains the company's core technologies and trade secrets, and its leakage could result in significant losses. During the data transmission phase, industrial data must be transferred between different devices and systems. This transmission process can lead to data leakage, tampering, and interruptions, impacting production efficiency and potentially causing safety incidents. During the data storage phase, large amounts of industrial data require long-term storage, and the security of the storage system is directly related to the integrity and availability of the data. During the data processing phase, industrial data is analyzed and mined to support production decisions and optimization. Data security issues during this processing process can impact the accuracy and reliability of decision-making.

[0004] Although the importance of industrial data security is becoming increasingly prominent, existing industrial data security technologies still have many problems and defects, making it difficult to meet the security needs in industrial Internet scenarios. Summary of the Invention

[0005] In order to solve the above problems existing in the prior art, the present invention provides a blockchain-based industrial data security management and control method and system. The technical problem to be solved by the present invention is achieved through the following technical solutions:

[0006] In a first aspect, the present invention provides an industrial data security management and control system based on blockchain, comprising:

[0007] Edge device access module, used to access the blockchain network through industrial routers and gateways, to request access to on-chain data, as well as encrypted transmission of raw data and collaborative collection of raw data off-chain;

[0008] Distributed key management module, used to implement shared private key information negotiation of edge devices, implement original data encryption, store the public key information of edge devices in the blockchain network through smart contracts, and bind the edge device identification;

[0009] The blockchain network module is used to verify the identity of edge devices, store data processed by the edge device access module, and store data processed by the distributed key management module;

[0010] Dynamic access control module, used to deploy access control chain code, obtain the preset role permission policy library, determine the legitimacy of access requests in real time, intercept illegal operations and record audit logs to the blockchain network;

[0011] The data integrity verification module is used to generate a hash value for the original data and upload it to the blockchain network, and verify the consistency through the chain code when reading the data.

[0012] In a second aspect, the present invention further provides a blockchain-based industrial data security management and control method, comprising:

[0013] Collect the original data and encrypt it using the shared private key information negotiated by the edge device to obtain the encrypted data; obtain the true hash value based on the original data; store the encrypted data and the true hash value in the blockchain network;

[0014] When an edge device requests access to on-chain data, the access control chain code is used to determine the legitimacy of the access request in real time. It then manages permissions based on the preset role permission policy library, intercepts illegal operations, and records audit logs.

[0015] When reading data, the encrypted data is decrypted to obtain the decrypted data; a hash value is generated based on the decrypted data; the consistency between the real hash value and the generated hash value is verified, and if they are consistent, the data is read; if they are inconsistent, a warning is triggered;

[0016] At the same time, when edge devices request access to on-chain data, off-chain collaborative collection of original data is achieved.

[0017] Beneficial effects of the present invention:

[0018] First, the distributed key management module enables secure generation and transparent management of shared private keys between edge devices, improving the security and efficiency of key management.

[0019] Second, the dynamic access control module can determine the legitimacy of access requests in real time, improving the flexibility and security of permission management;

[0020] Third, the data integrity verification module ensures that data cannot be tampered with throughout its life cycle, thus guaranteeing data integrity.

[0021] Fourth, it supports secure access and collaborative operation of edge devices, solving the problem of difficulty in edge device collaboration in industrial Internet scenarios.

[0022] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 This is a flowchart of the blockchain-based industrial data security management and control method provided by an embodiment of the present invention;

[0024] Figure 2 This is a schematic diagram of a blockchain-based industrial data security management and control method provided by an embodiment of the present invention;

[0025] Figure 3 This is a flow chart of a distributed key management module provided by an embodiment of the present invention;

[0026] Figure 4 This is a flow chart of a dynamic access control module provided by an embodiment of the present invention;

[0027] Figure 5 This is a flow chart of a data integrity verification module provided by an embodiment of the present invention;

[0028] Figure 6 This is a flow chart of an edge device access module provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0029] The present invention will be further described in detail below with reference to specific examples, but the embodiments of the present invention are not limited thereto.

[0030] Traditional industrial data security architectures typically employ centralized key management, with a single central organization responsible for key generation, distribution, and storage. This centralized key management approach presents a significant single point of failure risk. If the central organization is attacked or the key database is compromised, the security of the entire system is severely compromised. Furthermore, centralized key management suffers from inefficiencies in key distribution and transparency, making it difficult to meet the high-concurrency key requirements of a large number of devices in the Industrial Internet.

[0031] Existing industrial data access control mechanisms are mostly based on static policies, where permission allocation is determined at system deployment and is difficult to adjust dynamically. In industrial internet scenarios, device and user permission requirements frequently change, such as with temporary device access and user role changes. Static permission control cannot respond promptly, resulting in rigid permission control, impacting production efficiency and potentially introducing security vulnerabilities. Furthermore, static permission control lacks real-time monitoring and auditing of user behavior, making it difficult to detect and prevent illegal operations by insiders.

[0032] Industrial data is vulnerable to cyberattacks and physical failures during transmission and storage, making data integrity crucial for industrial data security. Existing data integrity verification technologies primarily rely on single hashing algorithms or digital signatures, which have limitations when facing complex cyberattacks. For example, while hashing algorithms can detect data tampering, they cannot prevent data from being intercepted and replayed during transmission. Furthermore, existing data integrity verification mechanisms lack efficient traceability mechanisms, making it difficult to quickly locate and remediate issues once data has been tampered with. For example, an industrial enterprise's production data was intercepted and tampered with by an attacker during transmission, leading to errors in the production process. However, due to the lack of an effective traceability mechanism, the enterprise was unable to promptly identify and remedy the issue, resulting in production delays and financial losses.

[0033] The Industrial Internet is home to a large number of edge devices, such as autonomous vehicles and robotic arms. These devices must work collaboratively to complete complex production tasks. However, existing edge device collaboration mechanisms present numerous challenges, including insufficient data transmission security and the vulnerability of collaborative operation instructions to tampering. Furthermore, existing edge device collaboration mechanisms lack device identity authentication and authorization, making it difficult to prevent unauthorized devices from accessing the network.

[0034] Through the above analysis, the problems and defects of the existing technology are as follows:

[0035] (1) Key management risk: Traditional industrial data security architecture uses a centralized key management approach, which poses a single point of failure risk. Once the central organization is attacked or the key database is leaked, the security of the entire system will be seriously threatened. In addition, centralized key management has deficiencies in key distribution efficiency and transparency, making it difficult to meet the high-concurrency key requirements of a large number of devices in the Industrial Internet.

[0036] (2) Rigid permission control: Existing industrial data access control mechanisms are mostly based on static policies. Permission allocation is determined at system deployment time, making it difficult to dynamically adjust according to actual production needs. In industrial Internet scenarios, the permission requirements of devices and users frequently change. Static permission control cannot respond to these changes in a timely manner, resulting in rigid permission control, which affects production efficiency and may introduce security vulnerabilities. In addition, static permission control lacks real-time monitoring and auditing capabilities for user behavior, making it difficult to detect and prevent illegal operations by internal personnel.

[0037] (3) Data integrity risks: Industrial data is vulnerable to cyberattacks and physical failures during transmission and storage. Data integrity is the key to industrial data security. Existing data integrity verification technologies mainly rely on single hash algorithms or digital signature technologies, which have limitations in the face of complex network attacks. For example, hash algorithms can detect tampering but cannot prevent data from being intercepted and replayed. In addition, existing data integrity verification mechanisms lack efficient traceability mechanisms, making it difficult to quickly locate and repair problems after data tampering.

[0038] The difficulty of solving the above problems and defects is:

[0039] (1) Traditional centralized key management has a single point of failure risk. Once attacked or leaked, the system security will be seriously damaged. At the same time, it is insufficient in key distribution efficiency and transparency, making it difficult to meet the high concurrent key requirements of a large number of devices in the Industrial Internet. Building a decentralized, efficient and transparent key management system is technically difficult. It is necessary to overcome the complexity of key generation, distribution and storage in distributed systems and ensure the security and reliability of the system.

[0040] (2) Existing industrial data access control is based on static policies, which determine permissions at deployment time and are difficult to adjust dynamically, resulting in rigidity. In the Industrial Internet, device and user permission requirements frequently change, and static control cannot respond in a timely manner. In addition, the lack of real-time monitoring and auditing makes it difficult to prevent internal violations. Developing a dynamic permission adjustment mechanism is technically difficult and requires real-time monitoring and analysis of user behavior to ensure accurate and timely adjustments.

[0041] (3) Industrial data is vulnerable to attacks and failures during transmission and storage, and data integrity is key to security. Existing verification technologies rely on single hashes or signatures, which are limited in the face of complex attacks and lack efficient traceability mechanisms, making it difficult to quickly locate and repair tampering. Developing a verification mechanism that combines multiple technologies is difficult and requires the comprehensive use of encryption, hashing, signatures, and other technologies to ensure efficiency and accuracy.

[0042] In view of this, the present invention provides a blockchain-based industrial data security management and control method and system, which solves the problems of fragile key management, rigid authority control and insufficient data integrity in the industrial Internet scenario through key technologies such as distributed key management, dynamic access control, data encryption and integrity verification, and significantly improves the security and reliability of industrial data flow.

[0043] The present invention provides a blockchain-based industrial data security management and control system, comprising:

[0044] Edge device access module, used to access the blockchain network through industrial routers and gateways, to request access to on-chain data, as well as encrypted transmission of raw data and collaborative collection of raw data off-chain;

[0045] Distributed key management module, used to implement shared private key information negotiation of edge devices, implement original data encryption, store the public key information of edge devices in the blockchain network through smart contracts, and bind the edge device identification;

[0046] The blockchain network module is used to verify the identity of edge devices, store data processed by the edge device access module, and store data processed by the distributed key management module;

[0047] Dynamic access control module, used to deploy access control chain code, obtain the preset role permission policy library, determine the legitimacy of access requests in real time, intercept illegal operations and record audit logs to the blockchain network;

[0048] The data integrity verification module is used to generate a hash value for the original data and upload it to the blockchain network, and verify the consistency through the chain code when reading the data.

[0049] In an optional embodiment of the present invention, the blockchain network module is built based on Hyperledger Fabricv2.5, including a Peer node cluster, an Orderer node cluster and a chain code container, supporting multi-channel data isolation and dynamic deployment of smart contracts.

[0050] In an optional embodiment of the present invention, the edge device includes an unmanned vehicle or a robotic arm.

[0051] Based on the same inventive concept, see Figure 1 and Figure 2 , Figure 1 This is a flowchart of the blockchain-based industrial data security management method provided by an embodiment of the present invention. Figure 2: This is a schematic diagram of a blockchain-based industrial data security management method provided by an embodiment of the present invention. The present invention also provides a blockchain-based industrial data security management method, which is applied to the system provided by the above embodiment of the present invention. The embodiment of the system can be referred to above and will not be repeated here. The method includes:

[0052] S101. Collect original data, encrypt the original data using the shared private key information negotiated by the edge device to obtain encrypted data; obtain a true hash value based on the original data; store the encrypted data and the true hash value in the blockchain network; optionally, the original data is industrial data;

[0053] S102: When an edge device requests access to on-chain data, the access control chain code is used to determine the legitimacy of the access request in real time. The access control chain code then manages permissions based on the preset role permission policy library, intercepts illegal operations, and records audit logs.

[0054] S103. When reading data, decrypt the encrypted data to obtain the decrypted data; generate a hash value based on the decrypted data; verify the consistency between the real hash value and the generated hash value. If they are consistent, read the data; if they are inconsistent, trigger a warning;

[0055] S104. At the same time, when the edge device requests access to the on-chain data, the off-chain collaborative collection of original data is realized.

[0056] In an optional embodiment of the present invention, obtaining a true hash value according to the original data includes:

[0057] The original data is processed using the SHA-256 algorithm to obtain the true hash value.

[0058] In an optional embodiment of the present invention, an elliptic curve algorithm is used to negotiate the shared private key information of the edge device.

[0059] In an optional embodiment of the present invention, the preset role authority policy library includes edge device roles, edge device types, and edge device operation types.

[0060] In an optional embodiment of the present invention, when an edge device requests access to on-chain data, an access request is sent to the blockchain network, where the access request includes the edge device identity information, the identifier of the required original data, and the access operation type.

[0061] In an optional embodiment of the present invention, when an edge device requests access to on-chain data, off-chain collaborative collection of raw data is implemented, including:

[0062] The edge device sends a digital certificate and edge device identification to the blockchain network for identity authentication to ensure the legitimacy and uniqueness of the access device.

[0063] In an optional embodiment of the present invention, it also includes:

[0064] The edge device generates public key information and uploads it to the blockchain network;

[0065] The control chain code verifies the validity of the public key information at a preset period.

[0066] In summary, the blockchain-based industrial data security management and control method provided by the present invention has the following beneficial effects:

[0067] First, the distributed key management module enables secure generation and transparent management of shared private keys between edge devices, improving the security and efficiency of key management.

[0068] Second, the dynamic access control module can determine the legitimacy of access requests in real time, improving the flexibility and security of permission management;

[0069] Third, the data integrity verification module ensures that data cannot be tampered with throughout its life cycle, thus guaranteeing data integrity.

[0070] Fourth, it supports secure access and collaborative operation of edge devices, solving the problem of difficulty in edge device collaboration in industrial Internet scenarios.

[0071] In an optional embodiment of the present invention, the following is further described in detail, including:

[0072] 1. Build an industrial data security framework based on blockchain.

[0073] 1.1. Build blockchain network module;

[0074] 1.1.1、Environment construction;

[0075] Operating system: Use Ubuntu 20.04LTS as the operating system.

[0076] Containerized deployment: Use Docker 20.10.7 and Docker Compose to orchestrate the Peer node cluster, Orderer node cluster, and CA node.

[0077] Blockchain platform: built on Hyperledger Fabric v2.5, with multiple channels (Channel 1 for device management and Channel 2 for data transactions).

[0078] 1.1.2 Network configuration;

[0079] Peer node cluster: deploy multiple peer nodes, responsible for data storage and smart contract execution.

[0080] Orderer node cluster: deploy multiple Orderer nodes, responsible for transaction sorting and consensus.

[0081] Chaincode container: Deploy chaincode containers to support dynamic deployment and execution of smart contracts.

[0082] 1.2, Distributed key management module;

[0083] 1.2.1、Key information generation;

[0084] like Figure 3 As shown, Figure 3 This is a flow chart of the distributed key management module provided by an embodiment of the present invention. Edge device A and edge device B respectively generate a public key-private key pair: edge device A generates a public key Pub_A, and edge device B generates a public key Pub_B.

[0085] Public key storage: The public key is stored in the blockchain network through smart contracts and bound to the device's unique identifier (such as MAC address).

[0086] 1.2.2. Negotiation of shared private key;

[0087] Edge device A and edge device B negotiate a shared private key Shared_Key through the elliptic curve (Diffie-Hellman, ECDH) algorithm.

[0088] Chaincode verification: The chaincode periodically verifies the validity of the public key to prevent key leakage or expiration.

[0089] 1.3, dynamic access control module, such as Figure 4 As shown, Figure 4 This is a flow chart of a dynamic access control module provided by an embodiment of the present invention;

[0090] 1.3.1、Definition of permission strategy;

[0091] Role definition: Define roles (such as administrator, operator) and their permissions.

[0092] Permission policy library: defines the role permission policy library, including the allowed operation types and device types.

[0093] 1.3.2 Access request processing;

[0094] Edge device submits access request: The edge device submits an access request to the blockchain network.

[0095] Chaincode triggering: Triggering the access control chaincode to determine the legitimacy of the access request in real time.

[0096] Permission determination: Permission determination is performed based on the preset permission policy library. Legitimate requests decrypt data and authorize operations, while illegal requests are recorded in the blockchain audit log.

[0097] 1.4, data integrity verification module, such as Figure 5 As shown, Figure 5 This is a flow chart of a data integrity verification module provided by an embodiment of the present invention;

[0098] 1.4.1. Data encryption and hash calculation;

[0099] Original data encryption: Use the AES-256 algorithm to encrypt original data.

[0100] Hash value calculation: Use the SHA-256 algorithm to process the original data and generate a true hash value.

[0101] 1.4.2. Encrypted data is uploaded to the blockchain;

[0102] The encrypted data and the real hash value are written into the blockchain network through the smart contract.

[0103] 1.4.3. Reading and verifying encrypted data;

[0104] Reading decrypted data: When the edge device requests to read data, it decrypts the encrypted data and processes the decrypted data using the SHA-256 algorithm to generate a hash value.

[0105] Consistency verification: Compare the generated hash value with the real hash value stored in the blockchain network to verify data consistency.

[0106] 1.5, edge device access module, such as Figure 6 As shown, Figure 6 This is a flow chart of an edge device access module provided by an embodiment of the present invention;

[0107] 1.5.1. Edge device identity authentication;

[0108] Digital certificate authentication: Edge devices use digital certificates for identity authentication.

[0109] Edge device unique identification binding: Bind the edge device unique identification (such as MAC address) with the identity information on the blockchain.

[0110] 1.5.2、Data encryption transmission;

[0111] Data collection: Edge devices collect data through sensors.

[0112] Data encryption: The collected data is encrypted using the shared private key generated by the distributed key management module.

[0113] Data transmission: Encrypted data is transmitted to the blockchain network through industrial routers and gateways.

[0114] 1.5.3. Off-chain collaborative operations;

[0115] Collaborative instruction transmission: collaborative operation instructions are transmitted through blockchain.

[0116] Collaborative operation execution: After receiving the instruction, the edge device decrypts and executes the corresponding operation. The data generated during the operation is encrypted again and uploaded to the chain.

[0117] 2. Based on the established blockchain-based industrial data security framework, the industrial data process is realized, specifically:

[0118] 2.1. Original data collection and encryption;

[0119] 2.1.1. Raw data collection;

[0120] Edge devices such as unmanned vehicles and robotic arms collect industrial data through sensors.

[0121] 2.1.2, original data encryption;

[0122] The original data is encrypted using the shared private key generated by the distributed key management module to ensure the confidentiality and security of the data during transmission.

[0123] 2.2. Encrypted data is uploaded to the blockchain and stored;

[0124] 2.2.1. Encrypted data is uploaded to the blockchain;

[0125] The encrypted data is transmitted to the blockchain network, and the tamper-proof nature of the blockchain is used to ensure the integrity and traceability of the data.

[0126] 2.2.2, Generating real hash values;

[0127] The SHA-256 algorithm is used to generate a true hash value for the original data, which is used to subsequently verify the integrity and consistency of the data; and the true hash value is transmitted to the blockchain network, using the tamper-proof nature of the blockchain to ensure the integrity and traceability of the data.

[0128] 2.3 Access control and authority determination;

[0129] 2.3.1. Receive access requests;

[0130] The edge device sends a data access request to the blockchain network. The access request contains user identity information, the identifier of the required data, and the access operation type.

[0131] 2.3.2, Access control chain code trigger;

[0132] After the blockchain network receives an access request, it triggers the access control chaincode deployed on the chain, which is responsible for determining the legitimacy of the request.

[0133] 2.3.3、Authority determination;

[0134] The access control chaincode determines the legitimacy of access requests in real time based on the preset role permission policy library, combined with factors such as user role, device type, and operation type.

[0135] 2.3.4. Intercept illegal operations;

[0136] If an access request is judged to be illegal, the access control chaincode will intercept the operation and record a detailed audit log to the blockchain for subsequent tracing and auditing.

[0137] 2.3.5. Authorize legitimate requests;

[0138] For legitimate access requests, the access control chain code will authorize the edge device to perform corresponding data access operations and decrypt the data through the chain code to ensure the security and integrity of the data.

[0139] 2.4. Data integrity verification;

[0140] 2.4.1、Data read request;

[0141] After obtaining access authorization, the edge device sends a data read request to the data integrity verification module through the blockchain network.

[0142] 2.4.2, Chaincode trigger;

[0143] After receiving the read request, the data integrity verification module triggers the corresponding chain code to process the data reading and verification operations.

[0144] 2.4.3, data decryption;

[0145] The chain code uses the shared private key generated by the distributed key management module to decrypt the encrypted data and restore the original data.

[0146] 2.4.4, Hash value calculation;

[0147] The chain code uses the SHA-256 algorithm to recalculate the hash value of the decrypted original data to obtain the generated hash value.

[0148] 2.4.5, consistency verification;

[0149] The generated hash value is compared with the real hash value stored on the chain. If the two are consistent, the verification is successful, indicating that the data has not been tampered with during transmission and storage; if they are inconsistent, the verification fails, indicating that the data integrity is compromised.

[0150] 2.4.6. Result feedback;

[0151] The verification result is fed back to the requester through the chain code. If the verification fails, the corresponding alarm mechanism can be triggered to notify relevant personnel for processing.

[0152] 2.5. Collaborative operation of edge devices;

[0153] 2.5.1. Device identity authentication;

[0154] When edge devices (such as unmanned vehicles and robotic arms) access the blockchain network through industrial routers and gateways, identity authentication is performed using digital certificates and device unique identifiers (such as MAC addresses) to ensure the legitimacy and uniqueness of the access devices.

[0155] 2.5.2、Data encryption transmission;

[0156] After authentication, the data collected by the edge device is encrypted using the shared private key generated by the distributed key management module and transmitted to the blockchain network layer through a secure channel to ensure the confidentiality and integrity of the data during transmission.

[0157] 2.5.3. Off-chain collaborative operations;

[0158] Edge devices collaborate with each other through the blockchain network. Collaborative instructions and data are transmitted and processed off-chain. Logical control and data interaction of collaborative operations are achieved through smart contracts, ensuring the security and reliability of collaborative work between devices.

[0159] It should be noted that, in this document, relational terms such as first and second are used solely to distinguish one entity or operation from another, and do not necessarily require or imply any actual relationship or order between these entities or operations. Furthermore, the terms "comprise," "include," or any other variations thereof are intended to encompass non-exclusive inclusion, such that an article or device comprising a list of elements includes not only those elements but also other elements not explicitly listed. Without further limitation, an element defined by the phrase "comprising a..." does not preclude the presence of additional identical elements in the article or device comprising the element. Terms such as "connected" or "connected" are not limited to physical or mechanical connections but may include electrical connections, whether direct or indirect. References to orientations or positional relationships, such as "upper," "lower," "left," and "right," are based on the orientations or positional relationships shown in the accompanying drawings and are intended solely to facilitate description and simplify the description of the present invention. They do not indicate or imply that the device or element referred to must have, be constructed, or operate in a specific orientation, and are therefore not to be construed as limiting the present invention.

[0160] In the description of this specification, the reference terms "one embodiment," "some embodiments," "example," "specific example," or "some examples" mean that the specific features or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features or characteristics described can be combined in any suitable manner in any one or more embodiments or examples. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification.

[0161] The above is a further detailed description of the present invention in conjunction with specific preferred embodiments, and the specific implementation of the present invention should not be considered to be limited to these descriptions. For those skilled in the art of the present invention, without departing from the concept of the present invention, several simple deductions or substitutions can be made, which should be considered to fall within the scope of protection of the present invention.

Claims

1. An industrial data security management and control system based on blockchain, characterized in that: include: Edge device access module, used to access the blockchain network through industrial routers and gateways, to request access to on-chain data, as well as encrypted transmission of raw data and collaborative collection of raw data off-chain; Distributed key management module, used to implement shared private key information negotiation of edge devices, implement original data encryption, store the public key information of edge devices in the blockchain network through smart contracts, and bind the edge device identification; A blockchain network module, configured to verify the identity of edge devices, store data processed by the edge device access module, and store data processed by the distributed key management module; Dynamic access control module, used to deploy access control chain code, obtain the preset role permission policy library, determine the legitimacy of access requests in real time, intercept illegal operations and record audit logs to the blockchain network; The data integrity verification module is used to generate a hash value for the original data and upload it to the blockchain network, and verify the consistency through the chain code when reading the data.

2. The industrial data security management and control system based on blockchain according to claim 1 is characterized in that: The blockchain network module is built based on Hyperledger Fabric v2.5, including peer node clusters, orderer node clusters and chain code containers, supporting multi-channel data isolation and dynamic deployment of smart contracts.

3. The blockchain-based industrial data security management and control system according to claim 1 is characterized in that: The edge device includes an unmanned vehicle or a robotic arm.

4. A blockchain-based industrial data security management and control method, characterized in that: include: Collecting original data, and encrypting the original data using the shared private key information negotiated by the edge device to obtain encrypted data; Obtaining a true hash value based on the original data; Storing the encrypted data and the real hash value in the blockchain network; When an edge device requests access to on-chain data, the access control chain code is used to determine the legitimacy of the access request in real time. It then manages permissions based on the preset role permission policy library, intercepts illegal operations, and records audit logs. When reading data, the encrypted data is decrypted to obtain decrypted data; a hash value is generated based on the decrypted data; Verify the consistency between the real hash value and the generated hash value, if they are consistent, read the data, if they are inconsistent, trigger a warning; At the same time, when edge devices request access to on-chain data, off-chain collaborative collection of original data is achieved.

5. The industrial data security management and control method based on blockchain according to claim 4 is characterized in that: The method of obtaining the true hash value based on the original data includes: The original data is processed using the SHA-256 algorithm to obtain a true hash value.

6. The industrial data security management and control method based on blockchain according to claim 4 is characterized in that: The shared private key information of the edge device is negotiated using an elliptic curve algorithm.

7. The industrial data security management and control method based on blockchain according to claim 4 is characterized in that: The preset role authority policy library includes edge device roles, edge device types and edge device operation types.

8. The industrial data security management and control method based on blockchain according to claim 4 is characterized in that: When an edge device requests access to on-chain data, it sends an access request to the blockchain network, where the access request includes the edge device identity information, the identifier of the required original data, and the access operation type.

9. The industrial data security management and control method based on blockchain according to claim 4 is characterized in that: When the edge device requests access to on-chain data, off-chain collaborative collection of raw data is achieved, including: The edge device sends a digital certificate and an edge device identifier to the blockchain network for identity authentication to ensure the legitimacy and uniqueness of the access device.

10. The industrial data security management and control method based on blockchain according to claim 4 is characterized in that: It is characterized by further comprising: The edge device generates public key information and uploads it to the blockchain network; The control chain code verifies the validity of the public key information at a preset period.

Images