Authorization binding method and communication system

Abstract

The invention provides an authorization binding method and a communication system, and relates to the technical field of communication, the method is applied to a server, and the method comprises the following steps: obtaining a byte sequence table and an equipment sequence code sent by an injection molding machine; and performing byte confusion on the byte sequence table based on the equipment sequence code to generate an encryption table and a decryption table. And the decryption table is sent to the injection molding machine, so that the injection molding machine activates the authorization state. And obtaining a binding request sent by the security gateway, calling the corresponding encryption table and the equipment sequence code based on the binding request, and performing ciphertext communication verification with the target injection molding machine by using the encryption table through an unvarnished transmission channel with the target injection molding machine established by the security gateway. And if the verification is passed, sending the encryption table and the equipment sequence code to the security gateway to complete one-to-one binding of the security gateway and the target injection molding machine, thereby realizing reliable operation and data security of the injection molding machine networking system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, in particular to an authorization binding method and a communication system. BACKGROUND

[0002] As a key production equipment for plastic product forming, the injection molding machine has an increasing demand for networking, remote monitoring and centralized management with the rapid development of industrial internet and intelligent manufacturing technology.

[0003] The existing injection molding machine networking method has the following problems: Since the injection molding machine is directly or through a router connected with an external control center, there is a lack of effective protection mechanism against network attacks, which leads to the control data of the injection molding machine being easily tampered with, or the data port of the injection molding machine being unable to work normally due to frequent malicious access. In addition, since the communication protocol of the injection molding machine is not encrypted, a third-party data acquisition card (i.e. a non-authorized data acquisition card) can directly collect the parameters of the injection molding machine by bypassing the manufacturer's server authorization after knowing the communication protocol, resulting in the leakage of technical data and process information.

[0004] In summary, how to design a safe and reliable injection molding machine networking scheme to prevent network attacks and protect the security of data communication is a technical problem to be solved by those skilled in the art. SUMMARY

[0005] The purpose of the present application is to provide an authorization binding method and a communication system to design a safe and reliable injection molding machine networking scheme to prevent network attacks and protect the security of data communication.

[0006] In order to achieve the above-mentioned purpose, the technical scheme adopted by the present application is as follows: On the one hand, the present application provides an authorization binding method applied to a server, which comprises: obtaining a byte order table and a device serial code sent by an injection molding machine; based on the device serial code, performing byte confusion on the byte order table to generate an encryption table and a decryption table; sending the decryption table to the injection molding machine to activate an authorization state; obtaining a binding request sent by a security gateway, based on the binding request, calling the corresponding encryption table and device serial code, and using the encryption table to perform ciphertext communication verification with a target injection molding machine through a transparent channel established between the security gateway and the target injection molding machine; if the verification is passed, sending the encryption table and the device serial code to the security gateway to complete one-to-one binding between the security gateway and the target injection molding machine.

[0007] Further, after the step of byte scrambling the byte order table based on the device serial code, generating an encryption table and a decryption table, the method further comprises: obtaining the body code sent by the injection molding machine; storing the body code, the device serial code and the encryption table of the injection molding machine in the database in association, and taking the body code as the index primary key.

[0008] Further, the binding request comprises: the target body code of the target injection molding machine connected with the security gateway in transparent transmission; Based on the binding request, the corresponding encryption table and device serial code are called, and the step of using the encryption table to perform ciphertext communication verification with the target injection molding machine through the transparent transmission channel established between the security gateway and the target injection molding machine comprises: Based on the target body code, the corresponding encryption table and device serial code are called from the database; Based on the encryption table, ciphertext instructions are generated and sent to the target injection molding machine through the transparent transmission channel; Receiving and processing the verification response returned by the target injection molding machine through the transparent transmission channel to read the device serial code of the target injection molding machine; Comparing and verifying the read device serial code with the device serial code called from the database; If they are consistent, it is confirmed that the target injection molding machine is a legal device that has completed authorization, and the verification is passed.

[0009] Further, the step of byte scrambling the byte order table based on the device serial code, generating an encryption table and a decryption table comprises: The byte order table is constructed into an initial byte matrix of 16 rows × 16 columns; According to the device serial code, row exchange and column exchange operations are performed on the initial byte matrix to obtain an intermediate byte matrix; Using the SM3 cryptographic hash algorithm, the device serial code is operated to obtain an SM3 hash value, and the device serial code and the SM3 hash value are combined to obtain a scrambling code; According to the scrambling code, an element transposition operation is performed on the intermediate byte matrix to obtain an encryption table; Inverse mapping operation is performed on the encryption table to obtain the decryption table.

[0010] Further, the device serial code comprises 2n bytes; and the step of performing row exchange and column exchange operations on the initial byte matrix based on the device serial code to obtain an intermediate byte matrix comprises: sequentially traversing the first n bytes in the device serial code, for each byte, taking the value of the high 4 bits and the value of the low 4 bits as the first row number and the second row number respectively, and performing a row exchange operation on the corresponding two rows in the initial byte matrix according to the first row number and the second row number, until all the first n bytes in the device serial code are traversed, to obtain the first byte matrix after n times of row exchange; sequentially traversing the last n bytes in the device serial code, for each byte, taking the value of the high 4 bits and the value of the low 4 bits as the first column number and the second column number respectively, and performing a column exchange operation on the corresponding two columns in the first byte matrix according to the first column number and the second column number, until all the last n bytes in the device serial code are traversed, to obtain the intermediate byte matrix after n times of column exchange.

[0011] Further, the obfuscated code contains x bytes; and the step of performing an element exchange operation on the intermediate byte matrix according to the obfuscated code to obtain an encryption table comprises: sequentially traversing all the bytes in the obfuscated code, for the kth byte currently traversed, extracting the serial number k of the byte and the value v of the byte, and exchanging the kth element and the vth element in the intermediate byte matrix, until all the bytes in the obfuscated code are traversed, to obtain the encryption table after x times of element exchange; wherein 0≤k≤x-1.

[0012] Further, the injection molding machine comprises a main control chip and a storage chip; and the device serial code is formed by combining the serial number of the main control chip and the serial number of the storage chip.

[0013] On the other hand, the application also provides a communication system, which comprises a server, a security gateway and a target injection molding machine; the server is used to execute the authorization binding method according to any one of the preceding embodiments.

[0014] Further, after the security gateway and the target injection molding machine are successfully bound, the security gateway is used to generate a security level change request and send it to the target injection molding machine in response to a set target security level; The target injection molding machine is used to generate a change success instruction and send it to the security gateway to change the current security level of the security gateway to the target security level in response to the security level change request and a change request confirmation instruction.

[0015] Further, the security levels of the security gateway comprise: Security level 0, indicating that the data is not readable and writable; Security level 1, indicating that the device data is read-only; Security Level 2, indicating that the read-write device applies data; Security Level 3, indicating that the upgradeable device program.

[0016] Compared with the prior art, the present application has the following beneficial effects: The authorization binding method provided by the present application is applied to a server, and the method comprises the following steps: obtaining a byte order table and a device serial code sent by an injection molding machine; performing byte confusion on the byte order table based on the device serial code to generate an encryption table and a decryption table; sending the decryption table to the injection molding machine to activate an authorization state; obtaining a binding request sent by a security gateway, calling the corresponding encryption table and the device serial code based on the binding request, and performing ciphertext communication verification with a target injection molding machine through a transparent channel between the security gateway and the target injection molding machine. If the verification is passed, the encryption table and the device serial code are sent to the security gateway to complete one-to-one binding between the security gateway and the target injection molding machine. The present application realizes hardware-level anti-counterfeiting protection, a multi-layer encryption system and end-to-end security verification in terms of security performance; realizes strict authorization control and a one-to-one binding mechanism in terms of industrial application, thereby comprehensively solving the security risks in injection molding machine networking and realizing a safe, reliable, efficient and manageable device networking and communication protection system. BRIEF DESCRIPTION OF DRAWINGS

[0017] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme of the embodiments of the present application will be described clearly and completely below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all the embodiments. The components of the embodiments of the present application described and shown in the drawings herein can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the claimed present application, but only represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0018] Figure 1 One of the flowcharts of the authorization binding method provided by the embodiments of the present application; Figure 2 The second flowchart of the authorization binding method provided by the embodiments of the present application; Figure 3 The server verification flowchart provided by the embodiments of the present application; Figure 4 The third flowchart of the authorization binding method provided by the embodiments of the present application; Figure 5This is one of the flowcharts illustrating the generation of encryption and decryption tables provided in an embodiment of this application; Figure 6 This is a second schematic diagram illustrating a process for generating an encryption table and a decryption table, provided as an embodiment of this application. Figure 7 This is a schematic diagram of a process for generating an intermediate byte matrix, provided as an embodiment of this application. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0020] It should be noted that relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0021] The following detailed description of some embodiments of this application is provided in conjunction with the accompanying drawings. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0022] As described in the background section, existing methods for networking injection molding machines involve connecting the machine directly or via a router to an external control center. However, this method presents significant security vulnerabilities: firstly, the communication link lacks security mechanisms against network attacks, making the injection molding machine's control data susceptible to tampering, or causing the machine to malfunction due to frequent malicious access to the data port. Secondly, the injection molding machine's communication protocol is unencrypted, allowing any third-party device familiar with the protocol format to directly access and read / write the machine's critical process parameters, leading to the leakage of core technical data and completely bypassing the equipment manufacturer's authorization and management system.

[0023] Therefore, how to design a safe and reliable network solution for injection molding machines to prevent network attacks and protect the security of data communication is a technical problem that urgently needs to be solved by those skilled in the art.

[0024] To address the aforementioned technical issues, this application provides an authorization binding method applied to a server. It should be noted that the server in this application refers to a central control and authentication server deployed and managed by the injection molding machine manufacturer or authorized operator. This server possesses capabilities for device identity management, key generation and distribution, and centralized control of security policies, and is the core trust node for building a trusted device access system.

[0025] Specifically, please refer to Figure 1 The authorization binding method provided in this application includes the following steps: Step S100: Obtain the byte order table and the device serial number sent by the injection molding machine.

[0026] Optionally, the injection molding machine includes a main control chip and a memory chip. The equipment serial number is formed by combining the serial number of the main control chip and the serial number of the memory chip.

[0027] Step S200: Obfuscate the byte order table based on the device serial number to generate an encryption table and a decryption table.

[0028] Step S400: Send the decryption table to the injection molding machine to activate the authorization state of the injection molding machine.

[0029] Understandably, since the encryption and decryption tables generated in this application are based on the injection molding machine's equipment serial number, which is composed of a combination of the main control chip serial number and the storage chip serial number—a dual hardware identifier—it possesses physical uncopyability and cannot be counterfeited through software. Furthermore, the hardware serial number itself is difficult to tamper with, thus fundamentally ensuring the authenticity and anti-counterfeiting capabilities of the injection molding machine's identity, achieving hardware-level anti-counterfeiting protection.

[0030] Step S500: Obtain the binding request sent by the security gateway, retrieve the corresponding encryption table and device serial number based on the binding request, and use the encryption table to perform encrypted communication verification with the target injection molding machine through the transparent transmission channel established by the security gateway and the target injection molding machine.

[0031] Understandably, the security gateway connects to the target injection molding machine that needs to be bound, and shakes hands with the server to send a binding request. Subsequently, the security gateway switches to transparent transmission mode. In transparent transmission mode, the security gateway acts as a transparent transmission channel (i.e., a transparent transmission channel), without parsing or modifying the forwarded data, and only forwards the communication data between the server and the target injection molding machine as is, to ensure that the server can perform end-to-end encrypted verification with the target injection molding machine.

[0032] The server retrieves the corresponding encryption table and device serial number based on the received binding request, and uses the encryption table to communicate encrypted with the target injection molding machine through the transparent transmission channel to verify whether the target injection molding machine is an authorized and legitimate device.

[0033] In step S600, if the verification is successful, the encryption table and device serial number are sent to the security gateway to complete the one-to-one binding between the security gateway and the target injection molding machine.

[0034] Understandably, if the verification fails, it indicates that the target injection molding machine may be an unauthorized device, the decryption table may not match, or there may be an anomaly in the communication process. In this case, the server will terminate the binding process and return a binding failure message to the security gateway.

[0035] If the verification passes, it indicates that the target injection molding machine is an authorized and legitimate device, and its decryption table matches the encryption table stored on the server. The server then sends the encryption table and its corresponding device serial number to the security gateway to establish a unique encrypted communication relationship between the security gateway and the target injection molding machine. After successful binding, the security gateway exits the pass-through mode and switches to normal communication mode. Thereafter, the security gateway uses the encryption table to encrypt all commands sent to the target injection molding machine and uses corresponding decryption logic to process the response data from the target injection molding machine. This achieves end-to-end encryption of communication, tamper-proof command protection, strong device authentication, and prevents unauthorized third-party devices from accessing the security control target.

[0036] As can be seen, this application adopts a key separation storage mechanism, with the encryption table and decryption table physically stored in the security gateway and the injection molding machine respectively, and each injection molding machine has its own exclusive key pair - the encryption table and decryption table are generated based on the unique device serial number of the injection molding machine. Therefore, the encryption tables used by different injection molding machines are different from each other, realizing the "one machine, one key" security isolation, effectively improving the overall anti-attack capability of the system and the independence of communication between devices.

[0037] In one alternative implementation, please refer to Figure 2 After step S200, which involves obfuscating the byte order table based on the device serial number to generate an encryption table and a decryption table, the authorization binding method provided in this application further includes the following steps: Step S310: Obtain the machine body code sent by the injection molding machine.

[0038] Step S320: The injection molding machine's body code, equipment serial number, and encryption table are associated and stored in the database, with the body code as the primary key of the index.

[0039] It should be noted that the machine identification code is a readable number set on the injection molding machine body to uniquely identify the device. The device serial number is a hardware fingerprint generated by combining the hardware serial numbers of the main control chip and the storage chip inside the injection molding machine, possessing hardware uniqueness. During the injection molding machine authorization phase, the injection molding machine sends both its device serial number and machine identification code to the server. The server obfuscates the byte order table based on the device serial number, generating an encryption table and a decryption table, and sends the decryption table to the injection molding machine. At the same time, the server stores the encryption table, machine identification code, and device serial number in association in the database, using the machine identification code as the index primary key. That is, the machine identification code is used as a unique identifier in the database to establish and manage a complete information file for the injection molding machine.

[0040] Furthermore, the binding request sent by the security gateway includes the target machine body code of the target injection molding machine that is transparently connected to the security gateway.

[0041] For a better understanding of the server verification process, please refer to Figure 3 The step S500, which involves retrieving the corresponding encryption table and device serial number based on the binding request, and using the encryption table to perform encrypted communication verification with the target injection molding machine through the transparent transmission channel established by the security gateway, includes sub-steps S510 to S550.

[0042] Step S510: Retrieve the corresponding encryption table and device serial number from the database based on the target device code.

[0043] Step S520: Generate encrypted instructions based on the encryption table and send them to the target injection molding machine via the transparent transmission channel.

[0044] Step S530: Receive and process the verification response returned by the target injection molding machine via the transparent transmission channel to read the device serial number of the target injection molding machine.

[0045] Step S540: Verify the read device serial number against the device serial number retrieved from the database.

[0046] Step S550: If the two are consistent, the target injection molding machine is confirmed to be a legitimate device that has been authorized, and the verification is successful.

[0047] Therefore, the authorization binding method provided in this application is mainly divided into an injection molding machine authorization stage and a security gateway binding stage. In the injection molding machine authorization stage, the server generates a unique key pair (i.e., an encryption table and a decryption table) based on the device's unique hardware identifier (i.e., the device serial number) to complete device authentication and key distribution. In the security gateway binding stage, after confirming the device's legitimacy through end-to-end encrypted verification, the server sends the encryption table and the device serial number to the security gateway, thereby completing a one-to-one secure binding between the security gateway and the target injection molding machine.

[0048] To better understand, the following will be combined with... Figure 4 The entire authorization binding process is explained in detail.

[0049] The injection molding machine hands over to the server, reading the serial numbers of its internal main control chip and storage chip, and merging them into a device serial number. The injection molding machine sends the device serial number and machine code to the server. The server obfuscates the byte order table based on the device serial number to generate an encryption table and a decryption table. The server saves the injection molding machine's machine code, device serial number, and encryption table to its database, using the machine code as the primary key. The server sends the decryption table to the injection molding machine, which saves the decryption table and activates its authorization status.

[0050] The security gateway hands over to the server and connects to the target injection molding machine to be bound. The security gateway sends the target injection molding machine's IMEI number to the server and switches to transparent transmission mode. The server uses the received IMEI number as the primary key to retrieve the corresponding encrypted table and device serial number from the database. The server uses the encrypted table to communicate encrypted with the target injection molding machine to read its device serial number and other information. The server verifies the read device serial number against the one retrieved from the database. If they match, the target injection molding machine is confirmed as an authorized and legitimate device, verification is successful, and the server sends the corresponding encrypted table and device serial number to the security gateway. The security gateway saves the encrypted table and device serial number to complete the one-to-one binding with the target injection molding machine. Conversely, if the verification fails, the security gateway binding fails.

[0051] Based on the above design, this application achieves hardware-level anti-counterfeiting protection, multi-layer encryption system and end-to-end security verification in terms of security performance; it achieves strict authorization control and one-to-one binding mechanism in industrial applications; it supports automated deployment and remote maintenance in terms of operational efficiency; and it has fault-tolerant recovery capability and scalable architecture in terms of system reliability. Thus, it comprehensively solves the security risks in the networking of injection molding machines and realizes a safe, reliable, efficient and manageable device networking and communication protection system.

[0052] To better understand the multi-layered encryption system in this application (i.e., how the encryption and decryption tables are generated), please refer to [link to relevant documentation]. Figure 5 and Figure 6 In one optional implementation, step S200, which involves obfuscating the byte order table based on the device serial number to generate an encryption table and a decryption table, includes sub-steps S210 to S250.

[0053] Step S210: Construct the byte order table into an initial byte matrix of 16 rows × 16 columns.

[0054] The byte order table contains 256 unsigned byte values ​​arranged in sequence from 0 to 255.

[0055] Understandably, since a byte is represented by 8 bits, with a value range of 0 to 255, 0-255 covers all possible values ​​of a byte, ensuring that subsequent obfuscation operations can be applied to the entire byte space, laying the foundation for generating a complete encryption table. Furthermore, the byte order table is constructed as an initial byte matrix of 16 rows × 16 columns to facilitate subsequent byte obfuscation operations.

[0056] Step S220: Based on the device serial number, perform row and column swapping operations on the initial byte matrix to obtain the intermediate byte matrix.

[0057] Step S230: The SM3 cryptographic hash algorithm is used to calculate the device serial number to obtain the SM3 hash value, and the device serial number and the SM3 hash value are combined to obtain the obfuscation code.

[0058] For example, assuming the device serial number contains 20 bytes, and the SM3 hash value is calculated by using the SM3 cryptographic hash algorithm, then the 20-byte device serial number and the 32-byte SM3 code (i.e. the SM3 hash value) are combined to finally obtain a 52-byte obfuscation code.

[0059] Step S240: Based on the obfuscation code, perform element swapping on the intermediate byte matrix to obtain the encryption table.

[0060] Step S250: Perform an inverse mapping operation on the encryption table to obtain the decryption table.

[0061] Therefore, by performing row and column swaps on the initial byte matrix, an intermediate byte matrix (equivalent to a transitional byte matrix) is obtained. Element-wise swapping of the intermediate byte matrix yields the encryption table (the final byte matrix). Inverse mapping of the encryption table produces the decryption table. This multi-layered encryption system integrates structural obfuscation and random permutation, significantly enhancing the randomness and uniqueness of the key while ensuring algorithm determinism. It effectively resists attacks based on statistical analysis or pattern guessing, providing device-level, high-strength encryption for industrial field communications.

[0062] To better understand, the following will be combined with... Figure 6 and Figure 7 First, let's explain how the intermediate byte matrix is ​​generated.

[0063] In one optional implementation, the device serial number contains 2n bytes. Step S220, which involves performing row and column swapping operations on the initial byte matrix based on the device serial number to obtain an intermediate byte matrix, includes substeps S221 and S222.

[0064] Step S221: Traverse the first n bytes of the device serial code in sequence. For each byte, use the value of the high 4 bits and the value of the low 4 bits of the byte as the first row number and the second row number, respectively. Then, perform row swapping operations on the corresponding two rows in the initial byte matrix according to the first row number and the second row number, until all the first n bytes of the device serial code have been traversed, and the first byte matrix after n row swaps is obtained.

[0065] For example, assuming the device serial number contains 20 bytes (i.e., n=10), the first 10 bytes (bytes 0 to 9) of the device serial number are traversed sequentially. For instance, when traversing to byte 0 (assuming its value is 0x1F), since the high 4 bits of this byte are 1 (i.e., the decimal value corresponding to 0x1 is 1) and the low 4 bits are 15 (i.e., the decimal value corresponding to 0xF is 15), the first row number is 1 and the second row number is 15. At this point, a row swap operation is performed on the first row and the 15th row of the initial byte matrix (row numbers start counting from 0). This process is repeated until all the first 10 bytes of the device serial number have been traversed, resulting in the first byte matrix after 10 row swaps.

[0066] Step S222: Traverse the last n bytes of the device serial code in sequence. For each byte, use the value of the high 4 bits and the value of the low 4 bits as the first column number and the second column number, respectively. Perform column swap operation on the corresponding two columns in the first byte matrix according to the first column number and the second column number, until all the last n bytes of the device serial code have been traversed, and obtain the intermediate byte matrix after n column swaps.

[0067] For example, assuming the device serial number contains 20 bytes (i.e., n=10), the last 10 bytes (bytes 10 to 19) of the device serial number are traversed sequentially. For instance, when traversing to the 10th byte (assuming its value is 0x0E), since the high 4 bits of this byte are 0 (i.e., the decimal value corresponding to 0x0 is 0) and the low 4 bits are 14 (i.e., the decimal value corresponding to 0xE is 14), the first column number is 0 and the second column number is 14. At this point, a column swap operation is performed on the 0th and 14th columns of the first byte matrix (column numbers start counting from 0). This process is repeated until all the last 10 bytes of the device serial number have been traversed, resulting in an intermediate byte matrix after 10 column swaps.

[0068] Furthermore, please refer again. Figure 6 The following explains how the encrypted table is generated.

[0069] In one optional implementation, the obfuscation code contains x bytes. Step S240, which involves swapping elements of the intermediate byte matrix based on the obfuscation code to obtain the encryption table, includes: Traverse all bytes in the obfuscated code sequentially. For the k-th byte currently being traversed, extract its index k and value v, and swap the k-th and v-th elements in the intermediate byte matrix. Repeat this process until all bytes in the obfuscated code have been traversed, resulting in an encrypted table after x element swaps. Where 0 ≤ k ≤ x - 1.

[0070] For example, assuming the obfuscation code contains 52 bytes (i.e., x=52), all bytes in the obfuscation code (i.e., bytes 0 to 51) are traversed sequentially. For instance, when traversing to byte 0 (assuming its value is 0xEF), since the byte's index (i.e., position) is 0, its value is 239 (i.e., the decimal value corresponding to 0xEF is 239), so k=0, v=239. At this point, the 0th element and the 239th element in the intermediate byte matrix are swapped. This process is repeated until all bytes in the obfuscation code have been traversed, resulting in an encrypted table after 52 element swaps.

[0071] Based on the above design, the multi-layer encryption system constructed in this application has the following security advantages: each device has its own independently generated encryption / decryption table; the encryption process adopts a dual obfuscation algorithm that combines row and column swapping with element swapping (i.e., byte swapping) to effectively disrupt data correlation; the national cryptographic SM3 hash algorithm is introduced to ensure data integrity and immutability; at the same time, the encryption table and decryption table are physically stored in the security gateway and the injection molding machine respectively, and the key separation storage mechanism further enhances the overall anti-attack capability of the system.

[0072] Furthermore, this application also provides a communication system comprising: a server, a security gateway, and a target injection molding machine. The server is used to execute the authorization binding method as described in any of the foregoing embodiments.

[0073] Furthermore, after the security gateway is successfully bound to the target injection molding machine, the security gateway is used to respond to the set target security level, generate a security level change request, and send it to the target injection molding machine.

[0074] The target injection molding machine is used to generate a change success instruction and send it to the security gateway when it receives a security level change request and responds to the change request confirmation instruction, so that the current security level of the security gateway is changed to the target security level.

[0075] Understandably, after the security gateway and the target injection molding machine are successfully bound, both parties can establish normal encrypted communication based on the distributed encryption and decryption tables. At this time, the security gateway supports hierarchical management of communication permissions, that is, different security levels can be set, and changes to the security level require double confirmation from both the security gateway and the target injection molding machine to take effect.

[0076] For example, when an operator selects a target security level by pressing a physical button on the security gateway, the security gateway generates a security level change request containing the target security level information and sends it to the bound target injection molding machine. Upon receiving the request, the target injection molding machine displays the level change information to the administrator on its local operating interface. If the administrator completes authentication and confirms the change through the injection molding machine's interface, the injection molding machine generates a change success command and returns it to the security gateway. Upon receiving this command, the security gateway updates its current security level to the target security level, thus completing the compliant switch of permissions.

[0077] Optionally, the security gateway may have the following four security levels: Security level 0 means that data cannot be read or written; Security level 1 indicates read-only device data; Security level 2 indicates that the device can read and write application data; Security level 3 indicates that the device software can be upgraded.

[0078] Security level 3 is the highest level of privilege, which has the ability to read, write and update device firmware. It is usually only enabled by authorized technicians during device maintenance, function upgrades or fault repairs, and must pass a strict physical and software dual verification process.

[0079] In summary, the embodiments of this application provide an authorization binding method and a communication system, which have significant advantages in terms of security, industrial applicability, operational efficiency and system reliability.

[0080] In terms of security performance: (1) Hardware-level anti-counterfeiting protection is achieved. By integrating the dual hardware identifiers of the main control chip and the storage chip, an uncopyable device fingerprint (i.e., device serial number) is formed, and the authenticity of the device is ensured based on the hardware serial number that is difficult to tamper with; (2) A multi-layer encryption system is constructed, generating an independent encryption table and decryption table for each device. A dual byte obfuscation algorithm combining row and column swapping and byte swapping (i.e., element swapping) is adopted, and the national cryptographic SM3 hash algorithm is introduced to ensure data integrity. At the same time, the physical separation of the encryption table and decryption table further enhances the security of the key; (3) An end-to-end security verification mechanism is established. During the binding process, the two-way authentication and continuous verification between the injection molding machine device and the server are realized through encrypted communication, and the man-in-the-middle attack is effectively defended by the transparent transmission mode.

[0081] At the industrial application level: (1) Strict authorization control is achieved. The manufacturer's server central authorization and the hardware identity-based digital certificate mechanism prevent unauthorized equipment access and clearly manage the activation status of the equipment; (2) A one-to-one binding mechanism is adopted to ensure that the security gateway and the injection molding machine are accurately paired to prevent the equipment from being illegally replaced and to have complete operation traceability capabilities; (3) Centralized management is implemented through a database with the machine body code as the primary key index, which supports rapid verification of the equipment identity and full life cycle audit tracking.

[0082] In terms of operational efficiency: (1) It provides a standardized automated deployment process, greatly reducing manual intervention and enabling device authorization and activation within minutes; (2) It has both remote authorization capabilities and database-based rapid fault recovery capabilities, and improves the convenience of operation and maintenance through a unified management platform.

[0083] In terms of system reliability: (1) It has a complete fault tolerance and recovery mechanism, including verification failure protection, real-time data synchronization and abnormal handling process; (2) Its design has an scalable architecture, supports the rapid integration of new equipment types, subsequent upgrades of encryption algorithms and concurrent management of large-scale equipment, thus providing a comprehensive, reliable and efficient solution for the secure access and control of equipment in the industrial Internet of Things environment.

[0084] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

[0085] It will be apparent to those skilled in the art that this application is not limited to the details of the exemplary embodiments described above, and that this application can be implemented in other specific forms without departing from the spirit or essential characteristics of this application. Therefore, the embodiments should be considered illustrative and non-limiting in all respects, and the scope of this application is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within this application. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. An authorization binding method, characterized by, Applied to a server, the method comprises: Obtaining a byte order table and a device serial code sent by an injection molding machine; Based on the device serial code, byte confusion is performed on the byte order table to generate an encryption table and a decryption table; The decryption table is sent to the injection molding machine to activate the authorization state of the injection molding machine; Obtaining a binding request sent by a security gateway, based on the binding request, calling the corresponding encryption table and device serial code, and through the transparent channel between the security gateway and the target injection molding machine established by the security gateway, using the encryption table to perform ciphertext communication verification with the target injection molding machine; If the verification is passed, the encryption table and the device serial code are sent to the security gateway to complete the one-to-one binding between the security gateway and the target injection molding machine.

2. The authorization binding method of claim 1, wherein, After the step of byte confusion on the byte order table based on the device serial code to generate the encryption table and the decryption table, the method further comprises: Obtaining a machine body code sent by the injection molding machine; The machine body code, device serial code and encryption table of the injection molding machine are stored in the database in association, and the machine body code is used as the index primary key.

3. The authorization binding method of claim 2, wherein, The binding request contains the target machine body code of the target injection molding machine connected with the security gateway in a transparent manner; The steps of calling the corresponding encryption table and device serial code based on the binding request, and using the encryption table to perform ciphertext communication verification with the target injection molding machine through the transparent channel between the security gateway and the target injection molding machine established by the security gateway, comprise: Based on the target machine body code, the corresponding encryption table and device serial code are called from the database; Based on the encryption table, a ciphertext instruction is generated and sent to the target injection molding machine via the transparent channel; Receiving and processing the verification response returned by the target injection molding machine via the transparent channel to read the device serial code of the target injection molding machine; The read device serial code is verified with the device serial code called from the database; If they are consistent, it is confirmed that the target injection molding machine is a legal device that has completed authorization, and the verification is passed.

4. The authorization binding method of claim 1, wherein, The step of byte confusion on the byte order table based on the device serial code to generate the encryption table and the decryption table comprises: The byte order table is constructed into an initial byte matrix of 16 rows × 16 columns; According to the device serial code, row exchange and column exchange operations are performed on the initial byte matrix to obtain an intermediate byte matrix; Using the SM3 cryptographic hash algorithm, the device serial code is operated to obtain an SM3 hash value, and the device serial code and the SM3 hash value are combined to obtain a confusion code; According to the confusion code, an element transposition operation is performed on the intermediate byte matrix to obtain an encryption table; Inverse mapping operation is performed on the encryption table to obtain the decryption table.

5. The authorization binding method of claim 4, wherein, The device serial code contains 2n bytes; The step of performing row exchange and column exchange operations on the initial byte matrix according to the device serial code to obtain an intermediate byte matrix comprises: n bytes in the device serial code in sequence, for each byte, the value of the high 4 bits and the value of the low 4 bits of the byte are taken as the first row number and the second row number respectively, and the corresponding two rows in the initial byte matrix are subjected to row exchange operation according to the first row number and the second row number, until all the first n bytes in the device serial code are traversed, to obtain the first byte matrix after n times of row exchange; n bytes in the device serial code in sequence, for each byte, the value of the high 4 bits and the value of the low 4 bits of the byte are taken as the first row number and the second row number respectively, and the corresponding two rows in the initial byte matrix are subjected to row exchange operation according to the first row number and the second row number, until all the first n bytes in the device serial code are traversed, to obtain the first byte matrix after n times of row exchange; 6. The method of claim 4, wherein, The obfuscated code contains x bytes; The step of performing element transposition operation on the intermediate byte matrix according to the obfuscated code to obtain an encryption table comprises: In sequence, all the bytes in the obfuscated code are traversed, for the kth byte currently traversed, the serial number k of the byte and the value v of the byte are extracted, and the kth element and the vth element in the intermediate byte matrix are transposed, until all the bytes in the obfuscated code are traversed, to obtain the encryption table after x times of element transposition; wherein, 0≤k≤x-1.

7. The authorization binding method of claim 1, wherein, The injection molding machine comprises a main control chip and a storage chip; the device serial code is formed by combining the serial number of the main control chip and the serial number of the storage chip.

8. A communication system, characterized by The system comprises a server, a security gateway and a target injection molding machine; the server is used to perform the authorization binding method according to any one of claims 1-7.

9. The communication system of claim 8, wherein, After the security gateway and the target injection molding machine are successfully bound, the security gateway is used to generate a security level change request and send it to the target injection molding machine in response to a set target security level; The target injection molding machine is used to generate a change success instruction and send it to the security gateway to change the current security level of the security gateway to the target security level when the security level change request is received and in response to a change request confirmation instruction.

10. The communication system of claim 9, wherein, The security level of the security gateway comprises: Security level 0, indicating that the data is not readable and writable; Security level 1, indicating that the device data is read-only; Security level 2, indicating that the device application data is readable and writable; Security level 3, indicating that the device program is upgradeable.

Images