A Protection Method and System for Core Data of Industrial Internet Based on SM4

Abstract

The present disclosure provides a method and system for protecting core data of industrial Internet based on national cryptography, which relates to the field of data processing. The protection system includes a Certificate Authority (CA), an edge computing gateway, a cloud platform, a user platform, and a cryptographic service platform. The cryptographic service platform includes a secret key management subsystem. The method includes: based on the digital certificate USB-KEY and the CA certificate based on the national cryptography SM2 algorithm issued by the CA, the cloud platform and each edge computing gateway perform two-way authentication to construct an SSL data channel; the user platform logs in to the cloud platform based on the user ID and the national cryptography dynamic password; when the user platform transmits the data plaintext of the core data of the industrial Internet to the cloud platform, the cloud platform transmits the data plaintext to the secret key management subsystem; the secret key management subsystem encrypts the data plaintext and transmits the obtained data ciphertext to the cloud platform for storage. Through the present disclosure, the national cryptography algorithm can be fully used to provide a complete set of solutions and systems for data security protection, and improve data security.

Description

Technical Field

[0001] The present invention relates to the field of data processing, and in particular, to a method and system for protecting core data of industrial Internet based on national cryptography. Background Art

[0002] The industrial Internet is in a period of vigorous development. The core data generated in the industrial production process will go through multiple stages such as data generation, data collection, data transmission, data analysis, and data display. During the life cycle of the data, ensuring the security of the data is particularly important.

[0003] In the current industrial Internet field, the core data is mainly encrypted through international key standards such as RSA and DES. There is no complete solution based on national cryptography to protect the core data in the industrial production process to be secure and reliable throughout the life cycle. Therefore, there is an urgent need for a data protection method based on national cryptography. Summary of the Invention

[0004] According to one aspect of the present disclosure, there is provided a method for protecting core data of industrial Internet based on national cryptography. The method for protecting core data of industrial Internet based on national cryptography is implemented by a protection system for core data of industrial Internet based on national cryptography. The protection system includes a Certificate Authority (CA), an edge computing gateway, a cloud platform, a user platform, and a password service platform. The password service platform includes a key management subsystem.

[0005] The method includes:

[0006] Based on the digital certificate USB-KEY and CA certificate based on the national cryptography SM2 algorithm issued by the CA, the cloud platform performs two-way authentication with each edge computing gateway to construct an SSL data channel for data transmission.

[0007] The user platform logs in to the cloud platform based on the user ID and the national cryptography dynamic password.

[0008] When the user platform transmits the data plaintext of the core data of the industrial Internet to the cloud platform, the cloud platform transmits the data plaintext to the key management subsystem.

[0009] The key management subsystem encrypts the data plaintext and transmits the encrypted data ciphertext to the cloud platform for storage, thereby completing the storage protection operation of the core data of the industrial Internet.

[0010] According to another aspect of the present disclosure, a protection system for core data of the industrial Internet based on national cryptography is provided. The protection system includes a Certificate Authority (CA), edge computing gateways, a cloud platform, a user platform, and a cryptographic service platform. The cryptographic service platform includes a secret key management subsystem. Among them:

[0011] The CA is used to issue digital certificate USB-KEYs and CA certificates based on the national cryptography SM2 algorithm to the cloud platform and each edge computing gateway.

[0012] The edge computing gateways are used to perform two-way authentication with the cloud platform, build an SSL data channel with the cloud platform for data transmission, and provide the user platform to log in to the cloud platform.

[0013] The user platform is used to log in to the cloud platform and transmit the plaintext of the core data of the industrial Internet to the cloud platform.

[0014] The cloud platform is used to perform two-way authentication with the edge computing gateways, build an SSL data channel with the edge computing gateways for data transmission, receive the plaintext of the data sent by the user platform, send the plaintext of the data to the secret key management subsystem, receive the ciphertext of the data sent by the secret key management subsystem, and store the ciphertext of the data.

[0015] The secret key management subsystem is used to receive the plaintext of the data sent by the cloud platform, encrypt the plaintext of the data, and send the encrypted ciphertext of the data to the cloud platform.

[0016] The cryptographic service platform is used to distribute entity password tokens to the cloud platform, verify the user identity of the user platform, and send an authentication passed instruction or an authentication failed instruction to the cloud platform.

[0017] According to another aspect of the present disclosure, a protection device for core data of the industrial Internet based on national cryptography is provided. The device is set in the protection system for core data of the industrial Internet based on national cryptography. The protection system includes a Certificate Authority (CA), edge computing gateways, a cloud platform, a user platform, and a cryptographic service platform. The cryptographic service platform includes a secret key management subsystem.

[0018] The device includes:

[0019] A construction module, which is used to perform two-way authentication between the cloud platform and each edge computing gateway based on the digital certificate USB-KEYs and CA certificates issued by the CA based on the national cryptography SM2 algorithm, and build an SSL data channel for data transmission.

[0020] A login module, which is used for the user platform to log in to the cloud platform through the edge computing gateway based on the user ID and the national cryptography dynamic password.

[0021] A transmission module, when the user platform transmits the clear text of the core data of the industrial Internet to the cloud platform, the cloud platform transmits the clear text of the data to the key management subsystem;

[0022] An encryption module, which is used for the key management subsystem to encrypt the clear text of the data, and transmit the encrypted data ciphertext to the cloud platform for storage, so as to complete the storage protection operation of the core data of the industrial Internet.

[0023] According to another aspect of the present disclosure, there is provided an electronic device, including:

[0024] A processor; and

[0025] A memory for storing programs,

[0026] wherein, the program includes instructions, and when the instructions are executed by the processor, the processor executes the above-mentioned method for protecting the core data of the industrial Internet based on national cryptography.

[0027] According to another aspect of the present disclosure, there is provided a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to execute the above-mentioned method for protecting the core data of the industrial Internet based on national cryptography.

[0028] One or more technical solutions provided in the embodiments of the present application can fully use national cryptography algorithms, provide a complete set of solutions and systems for data security protection, and improve the security of the core data of the industrial Internet. Description of the Drawings

[0029] In the following description of the exemplary embodiments in conjunction with the drawings, more details, features and advantages of the present disclosure are disclosed. In the drawings:

[0030] Figure 1 A flowchart showing a method for protecting the core data of the industrial Internet based on national cryptography according to an exemplary embodiment of the present disclosure;

[0031] Figure 2 A flowchart showing the identity authentication of an edge computing gateway based on national cryptography according to an exemplary embodiment of the present disclosure;

[0032] Figure 3 A flowchart showing the identity authentication of a user platform based on national cryptography according to an exemplary embodiment of the present disclosure;

[0033] Figure 4 A flowchart showing the encrypted storage of core data based on national cryptography according to an exemplary embodiment of the present disclosure;

[0034] Figure 5Shows a schematic block diagram of a protection system for core data of an industrial Internet based on national cryptography according to an exemplary embodiment of the present disclosure;

[0035] Figure 6 Shows a schematic block diagram of a protection device for core data of an industrial Internet based on national cryptography according to an exemplary embodiment of the present disclosure;

[0036] Figure 7 Shows a structural block diagram of an exemplary electronic device that can be used to implement the embodiments of the present disclosure. Detailed implementation manners

[0037] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although some embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. On the contrary, these embodiments are provided to more thoroughly and completely understand the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not used to limit the protection scope of the present disclosure.

[0038] It should be understood that the various steps recorded in the method embodiments of the present disclosure can be executed in different orders and / or executed in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this regard.

[0039] The term "including" and its variations used herein are open-ended, that is, "including but not limited to". The term "based on" is "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description. It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different systems, modules or units, and are not used to limit the order of functions executed by these systems, modules or units or their interdependence.

[0040] It should be noted that the modifications of "one" and "multiple" mentioned in the present disclosure are illustrative rather than restrictive. Those skilled in the art should understand that unless otherwise clearly stated in the context, it should be understood as "one or more".

[0041] The names of the messages or information exchanged between multiple systems in the embodiments of the present disclosure are only for illustrative purposes and are not used to limit the scope of these messages or information.

[0042] An embodiment of the present disclosure provides a method for protecting core data of an industrial Internet based on national cryptography. This method can be implemented by a protection system for core data of an industrial Internet based on national cryptography. The protection system may include a CA (Certificate Authority), an edge computing gateway, a cloud platform, a user platform, and a cryptographic service platform. The cryptographic service platform may include a key management subsystem. As Figure 1 shown in the flowchart of the method for protecting core data of an industrial Internet based on national cryptography, the processing flow of this method may include the following steps:

[0043] Step 101: Based on the digital certificate USB-KEY and CA certificate based on the national cryptography SM2 algorithm issued by the CA, the cloud platform performs two-way authentication with each edge computing gateway, and constructs an SSL data channel for data transmission;

[0044] Step 102: The user platform logs in to the cloud platform based on the user ID and the national cryptography dynamic password;

[0045] Step 103: When the user platform transmits the data plaintext of the core data of the industrial Internet to the cloud platform, the cloud platform transmits the data plaintext to the key management subsystem;

[0046] Step 104: The key management subsystem encrypts the data plaintext, and transmits the encrypted data ciphertext to the cloud platform for storage, thereby completing the storage protection operation of the core data of the industrial Internet.

[0047] Optionally, based on the digital certificate USB-KEY and CA certificate based on the national cryptography SM2 algorithm issued by the CA, the cloud platform performs two-way authentication with each edge computing gateway, and constructs an SSL data channel for data transmission, including:

[0048] The CA issues the digital certificate USB-KEY and CA certificate based on the national cryptography SM2 algorithm to the cloud platform and each edge computing gateway respectively;

[0049] The cloud platform exchanges the digital certificate USB-KEY with each edge computing gateway for two-way authentication;

[0050] When the two-way authentication between the cloud platform and the edge computing gateway passes, the edge computing gateway establishes a connection with the cloud platform, and constructs an SSL data channel for data transmission.

[0051] Optionally, after the cloud platform exchanges the digital certificate USB-KEY with each edge computing gateway for two-way authentication, it further includes:

[0052] When the mutual authentication between the cloud platform and the edge computing gateway fails, the CA re-issues digital certificate USB-KEYs based on the national cryptographic SM2 algorithm and CA certificates to the cloud platform and each edge computing gateway;

[0053] The cloud platform and each edge computing gateway re-exchange digital certificate USB-KEYs for mutual authentication.

[0054] Optionally, the user platform logs in to the cloud platform based on the user ID and the national cryptographic dynamic password, including:

[0055] When the cloud platform receives a request registration instruction sent by the user platform, the cloud platform applies for an entity password token for the user platform from the password service platform;

[0056] When the user platform sends a request login instruction to the cloud platform, the cloud platform receives the user ID and the national cryptographic dynamic password sent by the user platform;

[0057] The cloud platform verifies the user's identity with the password service platform based on the user ID and the national cryptographic dynamic password;

[0058] When the cloud platform receives a verification passed instruction sent by the password service platform, the cloud platform sends a login success instruction to the user platform.

[0059] Optionally, after the cloud platform verifies the user's identity with the password service platform based on the user ID and the national cryptographic dynamic password, it further includes:

[0060] When the cloud platform receives a verification failed instruction sent by the password service platform, the cloud platform sends a login failed instruction to the user platform, prompting the user platform to re-enter the user ID and the national cryptographic dynamic password.

[0061] Optionally, the cloud platform transmits the data plaintext to the key management subsystem, including:

[0062] After the cloud platform establishes an SSL channel with the key management subsystem, the cloud platform sends a key application instruction to the key management subsystem;

[0063] When the key management subsystem receives the key application instruction, the key management subsystem generates a key and a key identifier, and sends the key identifier to the cloud platform;

[0064] After receiving the key identifier, the cloud platform transmits the data plaintext and the key identifier to the key management subsystem.

[0065] Optionally, the key management subsystem encrypts the data plaintext and transmits the encrypted data ciphertext to the cloud platform for storage, including:

[0066] When the key management subsystem receives the data plaintext and the key identifier, it obtains the corresponding key through the key identifier;

[0067] The key management subsystem encrypts the data plaintext with a key to obtain the data ciphertext corresponding to the data plaintext, and sends the data ciphertext to the cloud platform;

[0068] The cloud platform stores the received data ciphertext.

[0069] Optionally, the method further includes:

[0070] When the cloud platform receives a data plaintext acquisition instruction sent by the user platform, the cloud platform transmits the data ciphertext corresponding to the data plaintext acquisition instruction to the key management subsystem;

[0071] The key management subsystem decrypts the data ciphertext to obtain the data plaintext and the key identifier;

[0072] The key management subsystem sends the data plaintext and the key identifier to the cloud platform;

[0073] The cloud platform sends the data plaintext to the user platform.

[0074] In the embodiments of the present disclosure, by fully using national cryptographic algorithms, in the field of industrial Internet, from the production site data collection, the data transmission from the edge computing gateway to the cloud platform, the data encryption and decryption processing and data disk storage on the cloud platform, to the data display and other data life cycle processes, a complete set of solutions and systems for data security protection are provided, improving the security of the industrial Internet core data storage, and providing a good practice for the application and promotion of national cryptographic algorithms in the field of industrial Internet.

[0075] The embodiments of the present disclosure provide a method for authenticating the identity of an edge computing gateway based on national cryptography. This method can be implemented by the CA, edge computing gateway, and cloud platform in the protection system of industrial Internet core data based on national cryptography, as Figure 2 shown in the flowchart of the identity authentication of the edge computing gateway based on national cryptography. The processing flow of this method can include the following steps:

[0076] Step 201, the CA issues digital certificate USB-KEY and CA certificate based on the national cryptographic SM2 algorithm to the cloud platform and each edge computing gateway respectively.

[0077] Step 202, the cloud platform exchanges digital certificate USB-KEY with each edge computing gateway for two-way authentication.

[0078] Step 203, when the two-way authentication between the cloud platform and the edge computing gateway passes, the edge computing gateway establishes a connection with the cloud platform to construct an SSL data channel for data transmission.

[0079] Step 204: When the mutual authentication between the cloud platform and the edge computing gateway fails, the CA re-issues the digital certificate USB-KEY and the CA certificate based on the national cryptography SM2 algorithm to the cloud platform and each edge computing gateway.

[0080] Step 205: The cloud platform and each edge computing gateway re-exchange the digital certificate USB-KEY for mutual authentication.

[0081] In the embodiments of the present disclosure, through the process of mutual certificate authentication based on the national cryptography SM2 algorithm, it is ensured that the edge computing gateway is a legitimate platform user authenticated by the CA, preventing malicious users from connecting to the cloud platform. The subsequent data transmission of the edge computing gateway passes through the SSL (Secure Sockets Layer) channel, and the data is encrypted by the national cryptography symmetric key SM4 during the transmission process, preventing data leakage and tampering during the end-to-end transmission process.

[0082] The embodiments of the present disclosure provide a method for authenticating the identity of a user platform based on national cryptography. This method can be implemented by the user platform, cloud platform, and password service platform in the protection system for core data of the industrial Internet based on national cryptography, as Figure 3 shown in the flowchart of the method for authenticating the identity of the user platform based on national cryptography. The processing flow of this method can include the following steps:

[0083] Step 301: When the cloud platform receives a request registration instruction sent by the user platform, the cloud platform applies to the password service platform for an entity password token for the user platform.

[0084] Step 302: When the user platform sends a request login instruction to the cloud platform, the cloud platform receives the user ID and the national cryptography dynamic password sent by the user platform.

[0085] Step 303: The cloud platform verifies the user identity to the password service platform based on the user ID and the national cryptography dynamic password.

[0086] Step 304: When the cloud platform receives a verification passed instruction sent by the password service platform, the cloud platform sends a login success instruction to the user platform.

[0087] Step 305: When the cloud platform receives a verification failed instruction sent by the password service platform, the cloud platform sends a login failed instruction to the user platform, prompting the user platform to re-enter the user ID and the national cryptography dynamic password.

[0088] In the embodiments of the present disclosure, the identity of the user platform is authenticated through the user ID and the national cryptography dynamic password. The dynamic password has a short time limit, reducing the probability that malicious users log in to the cloud platform, view, and operate the core data in industrial production due to password leakage.

[0089] An embodiment of the present disclosure provides a method for encrypting and storing core data based on national cryptography. This method can be implemented by a user platform, a cloud platform, and a key management subsystem in a protection system for industrial Internet core data based on national cryptography. As Figure 4 shown in the flowchart of encrypting and storing core data based on national cryptography, the processing flow of this method can include the following steps:

[0090] Step 401: When the user platform transmits the plaintext of industrial Internet core data to the cloud platform, after the cloud platform establishes an SSL channel with the key management subsystem, the cloud platform sends a key application instruction to the key management subsystem.

[0091] Step 402: When the key management subsystem receives the key application instruction, the key management subsystem generates a key and a key identifier, and sends the key identifier to the cloud platform.

[0092] Step 403: After receiving the key identifier, the cloud platform transmits the data plaintext and the key identifier to the key management subsystem.

[0093] Step 404: When the key management subsystem receives the data plaintext and the key identifier, it obtains the corresponding key through the key identifier.

[0094] Step 405: The key management subsystem encrypts the data plaintext with the key to obtain the data ciphertext corresponding to the data plaintext, and sends the data ciphertext to the cloud platform.

[0095] Step 406: The cloud platform stores the received data ciphertext.

[0096] Step 407: When the cloud platform receives a data plaintext acquisition instruction sent by the user platform, the cloud platform transmits the data ciphertext corresponding to the data plaintext acquisition instruction to the key management subsystem.

[0097] Step 408: The key management subsystem decrypts the data ciphertext to obtain the data plaintext and the key identifier.

[0098] Step 409: The key management subsystem sends the data plaintext and the key identifier to the cloud platform.

[0099] Step 410: The cloud platform sends the data plaintext to the user platform.

[0100] In the embodiment of the present disclosure, the life cycle of the encryption key is handed over to the key management subsystem for management. The security level of the key management subsystem is much higher than that of the cloud platform. The advantage of this processing is that even if the cloud platform is breached and the core data ciphertext is leaked, the core data plaintext can still be guaranteed not to be cracked, improving the security of industrial Internet core data.

[0101] The embodiments of the present disclosure provide a protection system for core data of industrial Internet based on national cryptography, and the protection system is used to implement the protection method for core data of industrial Internet based on national cryptography as described above. As Figure 5 shown in the schematic block diagram of the protection system for core data of industrial Internet based on national cryptography, the protection system 500 includes a Certificate Authority (CA) 510, an edge computing gateway 520, a cloud platform 530, a user platform 540, and a key management subsystem 550, and the key management subsystem 550 belongs to the cryptographic service platform 560; wherein:

[0102] The CA 510 is used to issue digital certificates USB-KEY and CA certificates based on the national cryptography SM2 algorithm to the cloud platform and each edge computing gateway;

[0103] The edge computing gateway 520 is used to perform two-way authentication with the cloud platform, build an SSL data channel with the cloud platform for data transmission, and provide a way for the user platform to log in to the cloud platform;

[0104] The user platform 530 is used to log in to the cloud platform and transmit the data plaintext of the core data of the industrial Internet to the cloud platform;

[0105] The cloud platform 540 is used to perform two-way authentication with the edge computing gateway, build an SSL data channel with the edge computing gateway for data transmission, receive the data plaintext sent by the user platform, send the data plaintext to the key management subsystem, receive the data ciphertext sent by the key management subsystem, and store the data ciphertext;

[0106] The key management subsystem 550 is used to receive the data plaintext sent by the cloud platform, encrypt the data plaintext, and send the encrypted data ciphertext to the cloud platform;

[0107] The cryptographic service platform 560 is used to distribute entity password tokens to the cloud platform, verify the user identity of the user platform, and send an authentication passed instruction or an authentication failed instruction to the cloud platform.

[0108] In the embodiments of the present disclosure, by fully using national cryptography algorithms, in the field of industrial Internet, from data collection at the production site, data transmission from the edge computing gateway to the cloud platform, data encryption and decryption processing and data disk storage on the cloud platform, to data display and other data life cycle processes, a complete set of solutions and systems for data security protection are provided, improving the security of core data storage in the industrial Internet, and providing a good practice for the application and promotion of national cryptography algorithms in the field of industrial Internet.

[0109] An embodiment of the present disclosure provides a protection device for core data of an industrial Internet based on national cryptography. The protection device for core data of an industrial Internet based on national cryptography is disposed in the above-mentioned protection system for core data of an industrial Internet based on national cryptography. The protection system includes a Certificate Authority (CA), an edge computing gateway, a cloud platform, a user platform, and a cryptographic service platform. The cryptographic service platform includes a secret key management subsystem.

[0110] As Figure 6 shown in the schematic block diagram of the protection device for core data of an industrial Internet based on national cryptography, the protection device 600 for core data of an industrial Internet based on national cryptography includes: a construction module 601, a login module 602, a transmission module 603, and an encryption module 604.

[0111] The construction module 601 is configured to, based on the digital certificate USB-KEY and the CA certificate based on the national cryptography SM2 algorithm issued by the CA, perform two-way authentication between the cloud platform and each edge computing gateway, and construct an SSL data channel for data transmission;

[0112] The login module 602 is configured to enable the user platform to log in to the cloud platform based on the user ID and the national cryptography dynamic password;

[0113] The transmission module 603 is configured to, when the user platform transmits the data plaintext of the core data of the industrial Internet to the cloud platform, the cloud platform transmits the data plaintext to the secret key management subsystem;

[0114] The encryption module 604 is configured to encrypt the data plaintext by the secret key management subsystem, and transmit the encrypted data ciphertext to the cloud platform for storage, thereby completing the storage protection operation of the core data of the industrial Internet.

[0115] Optionally, the construction module 601 is configured to:

[0116] The CA respectively issues a digital certificate USB-KEY and a CA certificate based on the national cryptography SM2 algorithm to the cloud platform and each edge computing gateway;

[0117] The cloud platform exchanges the digital certificate USB-KEY with each edge computing gateway for two-way authentication;

[0118] When the two-way authentication between the cloud platform and the edge computing gateway passes, the edge computing gateway establishes a connection with the cloud platform and constructs an SSL data channel for data transmission.

[0119] Optionally, the construction module 601 is further configured to:

[0120] When the mutual authentication between the cloud platform and the edge computing gateway fails, the CA re-issues digital certificate USB-KEYs and CA certificates based on the national cryptography SM2 algorithm to the cloud platform and each edge computing gateway;

[0121] The cloud platform and each edge computing gateway re-exchange digital certificate USB-KEYs for mutual authentication.

[0122] Optionally, the login module 602 is used for:

[0123] When the cloud platform receives a request registration instruction sent by the user platform, the cloud platform applies for an entity password token for the user platform from the password service platform;

[0124] When the user platform sends a request login instruction to the cloud platform, the cloud platform receives the user ID and the national cryptography dynamic password sent by the user platform;

[0125] The cloud platform verifies the user identity based on the user ID and the national cryptography dynamic password to the password service platform;

[0126] When the cloud platform receives a verification passed instruction sent by the password service platform, the cloud platform sends a login success instruction to the user platform.

[0127] Optionally, the login module 602 is further used for:

[0128] When the cloud platform receives a verification failed instruction sent by the password service platform, the cloud platform sends a login failure instruction to the user platform, prompting the user platform to re-enter the user ID and the national cryptography dynamic password.

[0129] Optionally, the transmission module 603 is used for:

[0130] After the cloud platform establishes an SSL channel with the key management subsystem, the cloud platform sends a key application instruction to the key management subsystem;

[0131] When the key management subsystem receives the key application instruction, the key management subsystem generates a key and a key identifier, and sends the key identifier to the cloud platform;

[0132] After receiving the key identifier, the cloud platform transmits the data plaintext and the key identifier to the key management subsystem.

[0133] Optionally, the encryption module 604 is used for:

[0134] When the key management subsystem receives the data plaintext and the key identifier, it obtains the corresponding key through the key identifier;

[0135] The key management subsystem encrypts the cleartext data with the key to obtain the ciphertext data corresponding to the cleartext data, and sends the ciphertext data to the cloud platform;

[0136] The cloud platform stores the received ciphertext data.

[0137] Optionally, the transmission module 603 is further configured to:

[0138] When the cloud platform receives the cleartext data acquisition instruction sent by the user platform, the cloud platform transmits the ciphertext data corresponding to the cleartext data acquisition instruction to the key management subsystem;

[0139] The key management subsystem decrypts the ciphertext data to obtain the cleartext data and the key identifier;

[0140] The key management subsystem sends the cleartext data and the key identifier to the cloud platform;

[0141] The cloud platform sends the cleartext data to the user platform.

[0142] In the embodiments of the present disclosure, by fully using the national cryptographic algorithm, in the field of industrial Internet, from the production site data collection, the data transmission from the edge computing gateway to the cloud platform, the data encryption and decryption processing and data disk storage on the cloud platform, to the data display and other data life cycle processes, a complete set of solutions and systems for data security protection are provided, improving the security of the core data storage in the industrial Internet, and providing a good practice for the application and promotion of the national cryptographic algorithm in the field of industrial Internet.

[0143] The exemplary embodiment of the present disclosure further provides an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor. The memory stores a computer program that can be executed by the at least one processor, and when the computer program is executed by the at least one processor, it is used to cause the electronic device to execute the method according to the embodiment of the present disclosure.

[0144] The exemplary embodiment of the present disclosure further provides a non-transitory computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor of a computer, it is used to cause the computer to execute the method according to the embodiment of the present disclosure.

[0145] The exemplary embodiment of the present disclosure further provides a computer program product, including a computer program, wherein when the computer program is executed by a processor of a computer, it is used to cause the computer to execute the method according to the embodiment of the present disclosure.

[0146] ReferenceFigure 7 , the structural block diagram of the electronic device 700 that can be used as the server or client of the present disclosure will now be described. It is an example of a hardware device that can be applied to various aspects of the present disclosure. The electronic device is intended to represent various forms of digital electronic computer devices, such as, laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as, personal digital processors, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0147] As Figure 7 shown, the electronic device 700 includes a computing unit 701, which can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 702 or the computer program loaded from the storage unit 708 into the random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the device 700 can also be stored. The computing unit 701, the ROM 702, and the RAM 703 are connected to each other through a bus 704. The input / output (I / O) interface 705 is also connected to the bus 704.

[0148] Multiple components in the electronic device 700 are connected to the I / O interface 705, including: an input unit 706, an output unit 707, a storage unit 708, and a communication unit 709. The input unit 706 can be any type of device that can input information into the electronic device 700. The input unit 706 can receive input digital or character information, and generate key signal inputs related to the user settings and / or function controls of the electronic device. The output unit 707 can be any type of device that can present information, and can include but is not limited to a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. The storage unit 704 can include but is not limited to a magnetic disk, an optical disk. The communication unit 709 allows the electronic device 700 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks, and can include but is not limited to a modem, a network card, an infrared communication device, a wireless communication transceiver, and / or a chipset, such as a Bluetooth™ device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.

[0149] The computing unit 701 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 701 executes the various methods and processes described above. For example, in some embodiments, the method for protecting the core data of the industrial Internet based on national cryptography can be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as the storage unit 708. In some embodiments, part or all of the computer program can be loaded and / or installed onto the electronic device 700 via the ROM 702 and / or the communication unit 709. In some embodiments, the computing unit 701 can be configured to execute the method for protecting the core data of the industrial Internet based on national cryptography in any other suitable manner (e.g., by means of firmware).

[0150] The program code for implementing the methods of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing devices, such that when the program codes are executed by the processor or controller, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The program code can be executed entirely on the machine, partially on the machine, as an independent software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0151] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in connection with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0152] As used in this disclosure, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, apparatus, and / or device that provides machine instructions and / or data to a programmable processor (e.g., a magnetic disk, an optical disk, a memory, a programmable logic device (PLD)), including a machine-readable medium that receives machine instructions as a machine-readable signal. The term "machine-readable signal" refers to any signal that provides machine instructions and / or data to a programmable processor.

[0153] In order to provide for interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the computer. Other kinds of devices can also be used to provide for interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic, speech, or tactile input).

[0154] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer having a graphical user interface or a web browser through which the user can interact with an implementation of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0155] A computer system can include a client and a server. The client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other.

Claims

1. A protection method for core data of industrial Internet based on national cryptography, characterized in that, The protection method for core data of the industrial Internet based on national cryptography is implemented by the protection system for core data of the industrial Internet based on national cryptography. The protection system includes a Certificate Authority (CA), edge computing gateways, a cloud platform, a user platform, and a cryptographic service platform. The cryptographic service platform includes a key management subsystem. The method includes: Based on the digital certificate USB-KEY and CA certificate based on the national cryptography SM2 algorithm issued by the CA, the cloud platform performs two-way authentication with each edge computing gateway to construct an SSL data channel for data transmission. During the transmission process, the data is encrypted by the national cryptography symmetric key SM4. The user platform logs in to the cloud platform based on the user ID and the national cryptography dynamic password. When the user platform transmits the clear text of the core data of the industrial Internet to the cloud platform, the cloud platform transmits the clear text of the data to the key management subsystem. The key management subsystem encrypts the clear text of the data and transmits the encrypted data ciphertext to the cloud platform for storage, thereby completing the storage protection operation of the core data of the industrial Internet. The cloud platform transmits the clear text of the data to the key management subsystem, including: After the cloud platform establishes an SSL channel with the key management subsystem, the cloud platform sends a key application instruction to the key management subsystem. When the key management subsystem receives the key application instruction, the key management subsystem generates a key and a key identifier, and sends the key identifier to the cloud platform. After receiving the key identifier, the cloud platform transmits the clear text of the data and the key identifier to the key management subsystem. The method further includes: when the cloud platform receives a clear text acquisition instruction sent by the user platform, it transmits the data ciphertext corresponding to the clear text acquisition instruction to the key management subsystem. The key management subsystem decrypts the data ciphertext to obtain the clear text of the data and the key identifier, and sends the clear text of the data and the key identifier to the cloud platform. The cloud platform sends the clear text of the data to the user platform. The user platform logs in to the cloud platform based on the user ID and the national cryptography dynamic password, including: When the cloud platform receives a request registration instruction sent by the user platform, the cloud platform applies for an entity password token for the user platform from the cryptographic service platform. When the user platform sends a request login instruction to the cloud platform, the cloud platform receives the user ID and the national cryptography dynamic password sent by the user platform. The cloud platform verifies the user identity from the cryptographic service platform based on the user ID and the national cryptography dynamic password. When the cloud platform receives a verification passed instruction sent by the cryptographic service platform, the cloud platform sends a login successful instruction to the user platform.

2. The protection method for core data of industrial Internet based on national cryptography as claimed in claim 1, wherein Based on the digital certificate USB-KEY and CA certificate based on the national cryptography SM2 algorithm issued by the CA, the cloud platform performs two-way authentication with each edge computing gateway to construct an SSL data channel for data transmission, including: The CA issues digital certificate USB-KEYs and CA certificates based on the national cryptographic SM2 algorithm to the cloud platform and each edge computing gateway respectively; The cloud platform exchanges digital certificate USB-KEYs with each edge computing gateway for two-way authentication; When the two-way authentication between the cloud platform and the edge computing gateway passes, the edge computing gateway establishes a connection with the cloud platform to construct an SSL data channel for data transmission.

3. The protection method for core data of industrial Internet based on national cryptography as described in claim 1, characterized in that, After the cloud platform exchanges digital certificate USB-KEYs with each edge computing gateway for two-way authentication, it further includes: When the two-way authentication between the cloud platform and the edge computing gateway fails, the CA re-issues digital certificate USB-KEYs and CA certificates based on the national cryptographic SM2 algorithm to the cloud platform and each edge computing gateway; The cloud platform and each edge computing gateway re-exchange digital certificate USB-KEYs for two-way authentication.

4. The protection method for core data of industrial Internet based on national cryptography according to claim 1, wherein, After the cloud platform verifies the user identity with the password service platform based on the user ID and the national cryptographic dynamic password, it further includes: When the cloud platform receives the verification failure instruction sent by the password service platform, the cloud platform sends a login failure instruction to the user platform, prompting the user platform to input the user ID and the national cryptographic dynamic password again.

5. The protection method for core data of industrial Internet based on national cryptography as claimed in claim 1, wherein, The key management subsystem encrypts the data plaintext and transmits the encrypted data ciphertext to the cloud platform for storage, including: When the key management subsystem receives the data plaintext and the key identifier, it obtains the corresponding key through the key identifier; The key management subsystem encrypts the data plaintext with the key to obtain the data ciphertext corresponding to the data plaintext, and sends the data ciphertext to the cloud platform; The cloud platform stores the received data ciphertext.

6. A protection system for core data of industrial Internet based on national cryptography, characterized in that, The protection system includes a certificate authority CA, edge computing gateways, a cloud platform, a user platform, and a key management subsystem; where: The CA is used to issue digital certificate USB-KEYs and CA certificates based on the national cryptographic SM2 algorithm to the cloud platform and each edge computing gateway; The edge computing gateway is used to perform two-way authentication with the cloud platform, construct an SSL data channel with the cloud platform for data transmission, for the user platform to log in to the cloud platform; during the transmission process, the data is encrypted with the national cryptographic symmetric key SM4; The user platform is used to log in to the cloud platform and transmit the data plaintext of the industrial Internet core data to the cloud platform; The cloud platform is used to perform two-way authentication with the edge computing gateway, build an SSL data channel with the edge computing gateway for data transmission, receive the data plaintext sent by the user platform, send the data plaintext to the key management subsystem, receive the data ciphertext sent by the key management subsystem, and store the data ciphertext; after the cloud platform establishes an SSL channel with the key management subsystem, it sends a key application instruction to the key management subsystem; after receiving the key identifier sent by the key management subsystem, it transmits the data plaintext and the key identifier to the key management subsystem; when the cloud platform receives the data plaintext acquisition instruction sent by the user platform, it transmits the data ciphertext corresponding to the data plaintext acquisition instruction to the key management subsystem; the cloud platform sends the data plaintext to the user platform; when the cloud platform receives the request registration instruction sent by the user platform, the cloud platform applies for an entity password token for the user platform from the password service platform; when the user platform sends a request login instruction to the cloud platform, the cloud platform receives the user ID and the national secret dynamic password sent by the user platform; the cloud platform verifies the user identity to the password service platform based on the user ID and the national secret dynamic password; when the cloud platform receives the verification passed instruction sent by the password service platform, the cloud platform sends a login success instruction to the user platform; The key management subsystem is used to receive the data plaintext sent by the cloud platform, encrypt the data plaintext, and send the encrypted data ciphertext to the cloud platform; when the key management subsystem receives a key application instruction, the key management subsystem generates a key and a key identifier, and sends the key identifier to the cloud platform; the key management subsystem decrypts the data ciphertext to obtain the data plaintext and the key identifier; and sends the data plaintext and the key identifier to the cloud platform.

7. The protection system for core data of industrial Internet based on national cryptography as described in claim 6, characterized in that, The key management subsystem is subordinate to the password service platform; The password service platform is used to distribute entity password tokens to the cloud platform, verify the user identity of the user platform, and send a verification passed instruction or a verification failed instruction to the cloud platform.

8. A protection device for core data of industrial Internet based on national cryptography, characterized in that, The protection device for the core data of the industrial Internet based on national secrets is set in the protection system for the core data of the industrial Internet based on national secrets. The protection system includes a Certificate Authority (CA), an edge computing gateway, a cloud platform, a user platform, and a password service platform. The password service platform includes a key management subsystem; The device includes: A construction module, which is used to perform two-way authentication between the cloud platform and each edge computing gateway based on the digital certificate USB-KEY and the CA certificate based on the national secret SM2 algorithm issued by the CA, build an SSL data channel for data transmission, and the data is encrypted by the national secret symmetric key SM4 during the transmission process; A login module is used for the user platform to log in to the cloud platform based on the user ID and the national secret dynamic password through the edge computing gateway. When the cloud platform receives a request registration instruction sent by the user platform, the cloud platform applies for an entity password token for the user platform from the password service platform. When the user platform sends a request login instruction to the cloud platform, the cloud platform receives the user ID and the national secret dynamic password sent by the user platform. The cloud platform verifies the user identity from the password service platform based on the user ID and the national secret dynamic password. When the cloud platform receives a verification passed instruction sent by the password service platform, the cloud platform sends a login success instruction to the user platform. A transmission module is used for when the user platform transmits the data plaintext of the industrial Internet core data to the cloud platform, the cloud platform transmits the data plaintext to the key management subsystem. The cloud platform transmitting the data plaintext to the key management subsystem includes: after the cloud platform establishes an SSL channel with the key management subsystem, the cloud platform sends a key application instruction to the key management subsystem. When the key management subsystem receives the key application instruction, the key management subsystem generates a key and a key identifier, and sends the key identifier to the cloud platform. After receiving the key identifier, the cloud platform transmits the data plaintext and the key identifier to the key management subsystem. When the cloud platform receives a data plaintext acquisition instruction sent by the user platform, it transmits the data ciphertext corresponding to the data plaintext acquisition instruction to the key management subsystem. The key management subsystem decrypts the data ciphertext to obtain the data plaintext and the key identifier, and sends the data plaintext and the key identifier to the cloud platform. The cloud platform sends the data plaintext to the user platform. An encryption module is used for the key management subsystem to encrypt the data plaintext, and transmits the encrypted data ciphertext to the cloud platform for storage, thereby completing the storage protection operation of the industrial Internet core data.

9. An electronic device, comprising: a processor; and a memory storing a program, wherein the program includes instructions that, when executed by the processor, cause the processor to execute the method according to any one of claims 1-5.

10. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause a computer to execute the method according to any one of claims 1-5.

Images