Industrial Internet platform access system, method and industrial management system

Abstract

The present invention provides an industrial Internet platform access system, method and industrial management system. In the industrial Internet platform access system, the device management application module sends device configuration information, the platform-side blockchain access application module receives the device configuration information, and adds a key to the device configuration information and then uploads it to the blockchain platform. The edge intelligent gateway receives the device configuration information sent by the device management application module. The controller data access application module uses the key to encrypt the device data uploaded by the access device, and transmits the encrypted device data to the edge intelligent gateway. The edge intelligent gateway obtains the device configuration information and key from the blockchain platform, and uses the key to decrypt the encrypted device data; it also screens out the device data that meets the device configuration information requirements, and uploads the device data that meets the device configuration information requirements to the device management application module. Solve the problem of non-secure access of multiple devices to the traditional industrial Internet platform.

Description

Technical Field

[0001] The present invention relates to the technical industry field, and in particular to an industrial Internet platform access system, method and industrial management system. Background Art

[0002] In the process of managing access devices on the industrial Internet platform, the current mainstream access device access control method is mainly to adopt the general platform CA authentication method. However, there are two main problems with this method. First, the authentication is centralized management, and the access device is easy to be forged to achieve unauthorized device access or attack the platform, and there are certain security defects; second, the device configuration information is stored in the device management application module of the industrial Internet platform, which cannot achieve trust between the industrial Internet platform manufacturers and manufacturers using the industrial Internet platform, especially when it comes to billing and other situations. Summary of the invention

[0003] The present invention provides an industrial Internet platform access system, method and industrial management system to solve the problem of insecure access of multiple devices to the traditional industrial Internet platform.

[0004] In the first aspect, the present invention provides an industrial Internet platform access system, which includes a blockchain platform, an industrial Internet platform, an edge intelligent gateway and a controller data access application module. Among them, the industrial Internet platform runs a device management application module and a platform-side blockchain access application module; the device management application module is used to issue device configuration information; the platform-side blockchain access application module is used to receive device configuration information, and after adding a key to the device configuration information, it is chained to the blockchain platform. The edge intelligent gateway is used to receive the device configuration information issued by the device management application module, and perform device access configuration based on the device configuration information to allow the corresponding device to access. The controller data access application module is used to encrypt the device data uploaded by the access device using a key, and transmit the encrypted device data to the edge intelligent gateway. The edge intelligent gateway is also used to receive the encrypted device data, obtain the device configuration information and key from the blockchain platform, and use the key to decrypt the encrypted device data; the edge intelligent gateway is also used to filter out the device data that meets the device configuration information requirements from the decrypted device data, and upload the device data that meets the device configuration information requirements to the device management application module.

[0005] In the above scheme, the controller data access application module is used to encrypt the device data uploaded by the access device with a key and then transmit it to the edge intelligent gateway. The edge intelligent gateway needs to decrypt and verify the encrypted device data, add an encryption mechanism, solve the problem of insecure access of multiple devices to the traditional industrial Internet platform, and realize the secure access of multiple devices to the industrial Internet platform. By storing device configuration information on the blockchain platform, the authenticity and integrity of various types of data in the industrial Internet can be effectively guaranteed, data rights protection can be realized, and a solid security foundation can be laid for industrial big data operation business. It can also store device configuration information in multiple blockchain nodes based on a decentralized blockchain platform, effectively avoiding industrial manufacturing safety problems caused by malicious tampering of single-point industrial process control programs. The blockchain platform can also reliably record the security information and event logs of the industrial Internet operation, and realize the rapid update of security information and security incident response linkage of the entire network through information sharing, attack tracing and event correlation analysis, and improve the response mechanism of industrial Internet security incidents. In addition, the blockchain platform can also realize rapid consensus and backup of multiple nodes in different locations, reduce the impact of attacks and disasters, and improve the recovery ability of the industrial Internet after being attacked.

[0006] In a specific implementation, the blockchain platform includes: a blockchain main chain, and at least one blockchain subchain with a consensus mechanism with the blockchain main chain. The blockchain main chain is used to receive device configuration information and keys on the blockchain access application module on the platform side. At least one blockchain subchain is used to distribute storage device configuration information and keys. Through a cross-chain interactive blockchain platform composed of a blockchain main chain and a blockchain subchain, the chain code and application of the blockchain platform are realized, and the distributed identity authentication and authorization management of industrial equipment are realized.

[0007] In a specific embodiment, an embedded blockchain sub-chain application module is also running on the edge smart gateway. The embedded blockchain sub-chain application module is used to obtain device configuration information and keys from any blockchain sub-chain, so that each edge smart gateway can obtain the device configuration information and keys assigned to the edge smart gateway from the blockchain platform.

[0008] In a specific implementation, the platform-side blockchain access application module uploads the device configuration information after adding the key to the blockchain platform by calling the smart contract of the blockchain main chain. The blockchain platform realizes mutual confirmation between the service provider of the industrial Internet platform and the manufacturer using the industrial Internet platform through the consensus mechanism. The embedded blockchain sub-chain application module obtains the device configuration information and key by calling the smart contract of any blockchain sub-chain.

[0009] In a specific embodiment, a first embedded data layer application module is also running on the edge intelligent gateway. The first embedded data layer application module is communicated with the embedded blockchain sub-chain application module to receive device configuration information and keys, and use the keys to decrypt the encrypted device data, so that the edge intelligent gateway can decrypt and verify the encrypted device data.

[0010] In a specific implementation, the industrial Internet platform access system further includes an edge acquisition gateway, which is used to receive device data uploaded by access devices; wherein the controller data access application module runs on the edge acquisition gateway. This facilitates the collection of device data uploaded by multiple access devices and facilitates the management of multiple access devices accessing the industrial Internet platform.

[0011] In a specific embodiment, a second embedded data layer application module is run on the edge acquisition gateway, and the second embedded data layer application module is communicatively connected to the controller data access application module to receive encrypted device data and transmit the encrypted device data to the first embedded data layer application module, so that the edge acquisition gateway can transmit the encrypted device data to the edge intelligent gateway.

[0012] In a specific implementation, the device configuration information includes access requirement information. When the access device initially uploads device data to the edge intelligent gateway, the edge intelligent gateway determines whether the access device meets the access requirement information, and if so, sends a request message to the device management application to allow the access device to access the industrial Internet platform. After receiving the request message, the device management application module allows the access device to access the industrial Internet platform. When the access device first accesses the industrial Internet platform, security is improved through the encryption and decryption security mechanism.

[0013] In the second aspect, the present invention also provides an industrial Internet platform access method, which is applied to the edge intelligent gateway of any one of the above-mentioned industrial Internet platform access systems, and the industrial Internet platform access method includes: receiving device configuration information issued by the device management application module, and performing device access configuration based on the device configuration information to allow corresponding device access; receiving device data after the controller data access application module uses a key to encrypt the device data uploaded by the access device; obtaining the device configuration information and key on the blockchain access application module on the platform side from the blockchain platform, and using the key to decrypt the encrypted device data; screening out device data that meets the requirements of the device configuration information from the decrypted device data, and uploading the device data that meets the requirements of the device configuration information to the device management application module.

[0014] In the above scheme, the controller data access application module is used to encrypt the device data uploaded by the access device with a key and then transmit it to the edge intelligent gateway. The edge intelligent gateway needs to decrypt and verify the encrypted device data, add an encryption mechanism, solve the problem of insecure access of multiple devices to the traditional industrial Internet platform, and realize the secure access of multiple devices to the industrial Internet platform. By storing device configuration information on the blockchain platform, the authenticity and integrity of various types of data in the industrial Internet can be effectively guaranteed, data rights protection can be realized, and a solid security foundation can be laid for industrial big data operation business. It can also store device configuration information in multiple blockchain nodes based on a decentralized blockchain platform, effectively avoiding industrial manufacturing safety problems caused by malicious tampering of single-point industrial process control programs. The blockchain platform can also reliably record the security information and event logs of the industrial Internet operation, and realize the rapid update of security information and security incident response linkage of the entire network through information sharing, attack tracing and event correlation analysis, and improve the response mechanism of industrial Internet security incidents. In addition, the blockchain platform can also realize rapid consensus and backup of multiple nodes in different locations, reduce the impact of attacks and disasters, and improve the recovery ability of the industrial Internet after being attacked.

[0015] In the third aspect, the present invention also provides an industrial management system, which includes: an access device, and any one of the above industrial Internet platform access systems, wherein the access device is connected to the industrial Internet platform access system. Through the controller data access application module, the device data uploaded by the access device is encrypted using a key and then transmitted to the edge intelligent gateway. The edge intelligent gateway needs to decrypt and verify the encrypted device data, add an encryption mechanism, solve the problem of non-safe access of multiple devices to the traditional industrial Internet platform, and realize the safe access of multiple devices to the industrial Internet platform. By storing device configuration information on the blockchain platform, the authenticity and integrity of various types of data in the industrial Internet can be effectively guaranteed, data rights protection can be realized, and a solid security foundation can be laid for industrial big data operation business. It can also store device configuration information in multiple blockchain nodes based on a decentralized blockchain platform, effectively avoiding industrial manufacturing safety problems caused by malicious tampering of a single point of industrial process control program. The blockchain platform can also make reliable records of industrial Internet operation security information and event logs, and realize the rapid update of security information and security incident response linkage of the entire network through information sharing, attack tracing and event correlation analysis, and improve the response mechanism of industrial Internet security incidents. In addition, the blockchain platform can also achieve rapid consensus and backup of multiple nodes in different locations, reduce the impact of attacks and disasters, and enhance the recovery capabilities of the industrial Internet after attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A schematic block diagram of an industrial Internet platform access system provided by an embodiment of the present invention;

[0017] Figure 2 A schematic block diagram of another industrial Internet platform access system provided by an embodiment of the present invention;

[0018] Figure 3 A flowchart of an industrial Internet platform access method provided by an embodiment of the present invention;

[0019] Figure 4 A structural block diagram of an industrial management system provided by an embodiment of the present invention.

[0020] Reference numerals:

[0021] 10-Industrial Internet Platform 11-Equipment Management Application Module

[0022] 12-Platform-side blockchain access application module 20-Blockchain platform

[0023] 21-Blockchain main chain 22-Blockchain sub-chain 30-Edge intelligent gateway

[0024] 31-Embedded blockchain sub-chain application module 32-First embedded data layer application module

[0025] 40-Edge Collection Gateway 41-Controller Data Access Application Module

[0026] 42-Second embedded data layer application module 50-Access device DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application.

[0029] It can be understood that the terms "first", "second", etc. used in the present application can be used in this article to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from another element.

[0030] When used herein, the singular forms "a", "an", and "said / the" may also include plural forms, unless the context clearly indicates otherwise. It should also be understood that the terms "include / comprise" or "have" etc. specify the presence of stated features, wholes, steps, operations, components, parts or combinations thereof, but do not exclude the possibility of the presence or addition of one or more other features, wholes, steps, operations, components, parts or combinations thereof.

[0031] In order to facilitate understanding of the industrial Internet platform access system provided by the embodiment of the present invention, the following first describes the application scenario of the industrial Internet platform access system provided by the embodiment of the present invention, and the industrial Internet platform access system is applied to the management process of industrial equipment. The industrial Internet platform access system is described in detail below in conjunction with the accompanying drawings.

[0032] refer to Figure 1 , Figure 2 and Figure 4 , the industrial Internet platform access system provided by the embodiment of the present invention includes a blockchain platform 20, an industrial Internet platform 10, an edge intelligent gateway 30 and a controller data access application module 41. Among them, the industrial Internet platform 10 runs a device management application module 11 and a platform-side blockchain access application module 12; the device management application module 11 is used to issue device configuration information; the platform-side blockchain access application module 12 is used to receive device configuration information, and add a key to the device configuration information and then upload it to the blockchain platform 20. The edge intelligent gateway 30 is used to receive the device configuration information issued by the device management application module 11, and perform device access configuration based on the device configuration information to allow the corresponding device to access. The controller data access application module 41 is used to encrypt the device data uploaded by the access device 50 using a key, and transmit the encrypted device data to the edge intelligent gateway 30. The edge intelligent gateway 30 is also used to receive encrypted device data, obtain device configuration information and keys from the blockchain platform 20, and use the keys to decrypt the encrypted device data; the edge intelligent gateway 30 is also used to filter out device data that meets the device configuration information requirements from the decrypted device data, and upload the device data that meets the device configuration information requirements to the device management application module 11.

[0033] In the above scheme, the controller data access application module 41 is used to encrypt the device data uploaded by the access device 50 using a key and then transmit it to the edge intelligent gateway 30. The edge intelligent gateway 30 needs to decrypt and verify the encrypted device data, add an encryption mechanism, solve the problem of multiple devices accessing the traditional industrial Internet platform 10 in an unsafe manner, and realize the safe access of multiple devices to the industrial Internet platform 10. By storing device configuration information on the blockchain platform 20, the authenticity and integrity of various types of data in the industrial Internet can be effectively guaranteed, data rights protection can be achieved, and a solid security foundation can be laid for industrial big data operation services. It is also possible to store device configuration information in multiple blockchain nodes based on the decentralized blockchain platform 20, effectively avoiding industrial manufacturing safety problems caused by malicious tampering of single-point industrial process control programs. The blockchain platform 20 can also reliably record the industrial Internet operation security information and event logs, and realize the rapid update of security information and security incident response linkage across the entire network through information sharing, attack tracing, and event correlation analysis, and improve the response mechanism for industrial Internet security incidents. The blockchain platform 20 can also achieve fast consensus and backup of multiple nodes in different locations, reduce the impact of attacks and disasters, and improve the recovery ability of the industrial Internet after being attacked. The following is a detailed introduction to each of the above modules in conjunction with the accompanying drawings.

[0034] First, refer to Figure 1 and Figure 2 , the industrial Internet platform access system includes an industrial Internet platform 10 and a blockchain platform 20, and the industrial Internet platform 10 runs a device management application module 11 and a platform-side blockchain access application module 12. Among them, the device management application module 11 is used to send device configuration information, and the platform-side blockchain access application module 12 is used to receive the device configuration information, and add a key to the device configuration information and then upload it to the blockchain platform 20. The industrial Internet platform access system also includes an edge intelligent gateway 30, which is used to receive the device configuration information sent by the device management application module 11, and perform device access configuration based on the device configuration information to allow the corresponding device to access. The industrial Internet platform 10 may include a device layer, an edge layer, a platform layer, and an application layer. The device management application module 11 may be the application layer of the industrial Internet platform 10, responsible for sending device configuration information, including enterprise, gateway, device, device indicator device information. The platform-side blockchain access application module 12 runs on the industrial Internet platform 10, realizes the extraction of enterprise, gateway, equipment, equipment index and equipment configuration information in the equipment management application module 11, realizes the corresponding management of signature and equipment configuration information, realizes the establishment of a local database and the storage of equipment configuration information signature encryption information, and calls the API interface provided by the blockchain platform 20 to realize data on the chain. Specifically, Figure 1As shown, the device management application module 11 on the industrial Internet platform 10 can use the MQTT protocol to send the device configuration information of the access device 50 (i.e., the MQTT device access message) to the edge intelligent gateway 30, and at the same time, it is also synchronously sent to the platform-side blockchain access application PBA, which receives the device configuration information and adds a key to the device configuration information before uploading it to the blockchain platform 20.

[0035] After the configuration information transmission is completed, the device data of the access device 50 can be uploaded. Figure 1 and Figure 2 As shown, the access device 50 regularly uploads device data according to the configuration requirements. Figure 1 and Figure 2 As shown, a controller data access application module 41 is also provided, and the controller data access application module 41 is used to encrypt and sign the device data uploaded by the access device 50 using a key, and transmit the encrypted device data to the edge intelligent gateway 30. Specifically, the controller data access application module 41 can call the encrypted U shield driver to implement key verification to obtain the signature.

[0036] refer to Figure 1 and Figure 2 The edge intelligent gateway 30 is also used to receive encrypted device data, obtain device configuration information and keys from the blockchain platform 20, and use the keys to decrypt the encrypted device data. After the edge intelligent gateway 30 obtains the encrypted device data, the edge intelligent gateway 30 is also used to filter out device data that meets the device configuration information requirements from the decrypted device data, and upload the device data that meets the device configuration information requirements to the device management application module 11. The edge intelligent gateway 30 reports data to the device management application module 11 in a normal data stream.

[0037] When setting up the blockchain platform 20, refer to Figure 1 and Figure 2, the blockchain platform 20 includes a blockchain main chain 21, and at least one blockchain subchain 22 with a consensus mechanism with the blockchain main chain 21. Among them, the blockchain main chain 21 is used to receive the device configuration information and keys on the chain of the platform-side blockchain access application module 12. At least one blockchain subchain 22 is used for distributed storage of device configuration information and keys. Through the cross-chain interactive blockchain platform 20 composed of the blockchain main chain 21 and the blockchain subchain 22, the chain code and application of the blockchain platform 20 are realized, and the distributed identity authentication and authorization management of industrial equipment are realized. Among them, when the platform-side blockchain access application puts the device configuration information and keys on the chain, it can call the smart contract of the blockchain main chain 21 to put the configuration information on the chain, and realize the confirmation of the industrial Internet platform 10 service provider and the manufacturer using the industrial Internet platform 10 through the consensus mechanism. Afterwards, the blockchain main chain 21 synchronizes the device configuration information and keys of the corresponding edge intelligent gateway 30 to the corresponding blockchain subchain 22.

[0038] like Figure 1 As shown, an embedded blockchain sub-chain application module 31 can also be run on the edge intelligent gateway 30. The embedded blockchain sub-chain application module 31 is used to obtain device configuration information and keys from one of the at least one blockchain sub-chains 22. That is, the embedded blockchain sub-chain application module 31 running on the edge intelligent gateway 30 can call the smart contract of the blockchain sub-chain 22 to obtain the corresponding device configuration information and keys of its own gateway, so that each edge intelligent gateway 30 can obtain the device configuration information and keys assigned to the edge intelligent gateway 30 from the blockchain platform 20.

[0039] Among them, when the platform-side blockchain access application module 12 uploads the device configuration information and the added key to the blockchain platform 20, the platform-side blockchain access application module 12 can upload the device configuration information after adding the key to the blockchain platform 20 by calling the smart contract of the blockchain main chain 21. The blockchain platform 20 can also realize mutual confirmation between the service provider of the industrial Internet platform 10 and the manufacturer using the industrial Internet platform 10 through a consensus mechanism. When the embedded blockchain sub-chain application module 31 obtains the device configuration information and key from the blockchain platform 20, the embedded blockchain sub-chain application module 31 can obtain the device configuration information and key by calling the smart contract of any blockchain sub-chain 22.

[0040] Continue to refer Figure 1 and Figure 2, the edge intelligent gateway 30 can also run a first embedded data layer application module 32, which is connected to the embedded blockchain sub-chain application module 31 in communication to receive device configuration information and keys, and use the keys to decrypt the encrypted device data, so that the edge intelligent gateway 30 can decrypt and verify the encrypted device data. In specific implementation, the embedded blockchain sub-chain application module 31 can periodically pass the keys contained in the device configuration information to the embedded data layer application module.

[0041] In addition, refer to Figure 1 and Figure 2 In the process of uploading the respective device data to the edge intelligent gateway 30, the access devices 50 may adopt different transmission processes depending on the number of access devices 50. For example, Figure 1 As shown, when the number of access devices 50 is at least two, the industrial Internet platform access system may further include an edge acquisition gateway 40, which is used to receive device data uploaded by each access device 50 of at least two access devices 50; wherein the controller data access application module 41 runs on the edge acquisition gateway 40. It is convenient to collect device data uploaded by multiple access devices 50 and to manage the access of multiple access devices 50 to the industrial Internet platform 10. Figure 2 In actual applications, some enterprises may only need a single access device 50, and in this case, the edge acquisition gateway 40 is not needed to uniformly collect data from multiple devices. Since the edge intelligent gateway 30 takes into account the data acquisition capability of the edge acquisition gateway 40, it is only necessary to directly connect the single access device 50 to the edge intelligent gateway 30. Of course, when an enterprise only needs a single access device 50, the edge acquisition gateway 40 shown above can also be used, and the edge acquisition gateway 40 receives the device data uploaded by the single access device 50, that is, whether the edge acquisition gateway 40 is set has nothing to do with the number of access devices 50.

[0042] like Figure 1 As shown, a second embedded data layer application module 42 can also run on the edge acquisition gateway 40. The second embedded data layer application module 42 is communicatively connected to the controller data access application module 41 to receive encrypted device data and transmit the encrypted device data to the first embedded data layer application module 32, so that the edge acquisition gateway 40 can transmit the encrypted device data to the edge intelligent gateway 30.

[0043] In addition, the above-mentioned device configuration information may include access requirement information. When the access device 50 initially uploads device data to the edge intelligent gateway 30, the edge intelligent gateway 30 determines whether the access device 50 meets the access requirement information, and if so, sends a request message to the device management application to allow the access device 50 to access the industrial Internet platform 10. After receiving the request message, the device management application module 11 allows the access device 50 to access the industrial Internet platform 10. When the access device 50 first accesses the industrial Internet platform 10, security is mentioned through the encryption and decryption security mechanism. Of course, it should be noted that the above-mentioned device configuration information is not limited to the access requirement information, and in addition, it can also be other types of configuration information.

[0044] In the various embodiments shown above, the controller data access application module 41 is used to encrypt the device data uploaded by the access device 50 using a key and then transmit it to the edge intelligent gateway 30. The edge intelligent gateway 30 needs to decrypt and verify the encrypted device data, add an encryption mechanism, solve the problem of multiple devices accessing the traditional industrial Internet platform 10 in an unsafe manner, and realize the safe access of multiple devices to the industrial Internet platform 10. By storing device configuration information on the blockchain platform 20, the authenticity and integrity of various types of data in the industrial Internet can be effectively guaranteed, data rights protection can be achieved, and a solid security foundation can be laid for industrial big data operation services. It is also possible to store device configuration information in multiple blockchain nodes based on the decentralized blockchain platform 20, effectively avoiding industrial manufacturing safety problems caused by malicious tampering of single-point industrial process control programs. The blockchain platform 20 can also reliably record the industrial Internet operation safety information and event logs, and realize the rapid update of security information and security incident response linkage across the entire network through information sharing, attack tracing, and event correlation analysis, and improve the response mechanism for industrial Internet security incidents. In addition, the blockchain platform 20 can also achieve rapid consensus and backup of multiple nodes in different locations, reduce the impact of attacks and disasters, and enhance the recovery ability of the industrial Internet after being attacked.

[0045] In addition, the embodiment of the present invention also provides an industrial Internet platform access method, referring to Figure 1 , Figure 2 , Figure 3 and Figure 4 The industrial Internet platform access method is applied to the edge intelligent gateway 30 of any of the above industrial Internet platform access systems, and the industrial Internet platform access method includes:

[0046] Step 10: receiving the device configuration information sent by the device management application module 11, and performing device access configuration based on the device configuration information to allow corresponding devices to access;

[0047] Step 20: receiving the device data after the controller data access application module 41 encrypts the device data uploaded by the access device 50 using the key;

[0048] Step 30: Obtain the device configuration information and key on the blockchain of the platform-side blockchain access application module 12 from the blockchain platform 20, and use the key to decrypt the encrypted device data;

[0049] Step 40: Filter out device data that meets the device configuration information requirements from the decrypted device data, and upload the device data that meets the device configuration information requirements to the device management application module 11.

[0050] Through the controller data access application module 41, the device data uploaded by the access device 50 is encrypted using a key and then transmitted to the edge intelligent gateway 30. The edge intelligent gateway 30 needs to decrypt and verify the encrypted device data, add an encryption mechanism, solve the problem of multiple devices accessing the traditional industrial Internet platform 10 in an unsafe manner, and realize the safe access of multiple devices to the industrial Internet platform 10. By storing device configuration information through the blockchain platform 20, the authenticity and integrity of various types of data in the industrial Internet can be effectively guaranteed, data rights protection can be realized, and a solid security foundation can be laid for industrial big data operation business. It is also possible to store device configuration information in multiple blockchain nodes based on the decentralized blockchain platform 20, effectively avoiding industrial manufacturing safety problems caused by malicious tampering of single-point industrial process control programs. The blockchain platform 20 can also make reliable records of industrial Internet operation safety information and event logs, and realize the rapid update of security information and security incident response linkage of the entire network through information sharing, attack tracing and event correlation analysis, and improve the response mechanism of industrial Internet security incidents. In addition, the blockchain platform 20 can also realize rapid consensus and backup of multiple nodes in different locations, reduce the impact of attacks and disasters, and improve the recovery ability of the industrial Internet after being attacked.

[0051] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0052] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0053] Furthermore, the embodiment of the present invention also provides an industrial management system, such as Figure 1 , Figure 2 and Figure 4As shown, the industrial management system includes: an access device 50, and any one of the above industrial Internet platform access systems, wherein the access device 50 is connected to the industrial Internet platform access system. Through the controller data access application module 41, the device data uploaded by the access device 50 is encrypted using a key and then transmitted to the edge intelligent gateway 30. The edge intelligent gateway 30 needs to decrypt and verify the encrypted device data, and add an encryption mechanism to solve the problem of multiple devices accessing the traditional industrial Internet platform 10 in an unsafe manner, and realize the safe access of multiple devices to the industrial Internet platform 10. By storing device configuration information on the blockchain platform 20, the authenticity and integrity of various types of data in the industrial Internet can be effectively guaranteed, data rights protection can be achieved, and a solid security foundation can be laid for industrial big data operation services. It is also possible to store device configuration information in multiple blockchain nodes based on the decentralized blockchain platform 20, effectively avoiding industrial manufacturing safety problems caused by malicious tampering of single-point industrial process control programs. The blockchain platform 20 can also reliably record the industrial Internet operation safety information and event logs, and realize the rapid update of security information and security incident response linkage across the entire network through information sharing, attack tracing, and event correlation analysis, and improve the response mechanism for industrial Internet security incidents. In addition, the blockchain platform 20 can also achieve rapid consensus and backup of multiple nodes in different locations, reduce the impact of attacks and disasters, and enhance the recovery capabilities of the industrial Internet after being attacked.

[0054] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0055] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. An industrial Internet platform access system, characterized in that: include: Blockchain platform; An industrial Internet platform, wherein the industrial Internet platform runs a device management application module and a platform-side blockchain access application module; The device management application module is used to issue device configuration information; the platform-side blockchain access application module is used to receive the device configuration information and upload the information to the blockchain platform after adding a key to the device configuration information; The edge intelligent gateway is used to receive the device configuration information sent by the device management application module, and perform device access configuration based on the device configuration information to allow corresponding devices to access; A controller data access application module, used to encrypt the device data uploaded by the access device using the key, and transmit the encrypted device data to the edge intelligent gateway; The edge intelligent gateway is also used to receive the encrypted device data, obtain the device configuration information and the key from the blockchain platform, and use the key to decrypt the encrypted device data; The edge intelligent gateway is also used to filter out device data that meets the device configuration information requirements from the decrypted device data, and upload the device data that meets the device configuration information requirements to the device management application module; The blockchain platform includes: a blockchain main chain, which is used to receive the device configuration information and the key on the blockchain of the platform-side blockchain access application module; At least one blockchain subchain having a consensus mechanism with the blockchain main chain is used for distributed storage of the device configuration information and the key.

2. The industrial Internet platform access system according to claim 1, characterized in that: The edge intelligent gateway also runs an embedded blockchain subchain application module; The embedded blockchain sub-chain application module is used to obtain the device configuration information and the key from any of the blockchain sub-chains.

3. The industrial Internet platform access system according to claim 2, characterized in that: The platform-side blockchain access application module uploads the device configuration information after adding the key to the blockchain platform by calling the smart contract of the blockchain main chain; The blockchain platform realizes mutual confirmation between the service providers of the industrial Internet platform and the manufacturers using the industrial Internet platform through a consensus mechanism; The embedded blockchain sub-chain application module obtains the device configuration information and the key by calling the smart contract of any of the blockchain sub-chains.

4. The industrial Internet platform access system according to claim 2, characterized in that: The edge intelligent gateway also runs a first embedded data layer application module; The first embedded data layer application module is communicatively connected with the embedded blockchain sub-chain application module to receive the device configuration information and the key, and use the key to decrypt the encrypted device data.

5. The industrial Internet platform access system according to claim 4, further comprising: An edge collection gateway, used to receive device data uploaded by the access device; The controller data access application module runs on the edge acquisition gateway.

6. The industrial Internet platform access system according to claim 5, characterized in that: A second embedded data layer application module runs on the edge acquisition gateway; The second embedded data layer application module is in communication with the controller data access application module to receive the encrypted device data and transmit the encrypted device data to the first embedded data layer application module.

7. The industrial Internet platform access system according to any one of claims 1 to 6, characterized in that: The device configuration information includes access requirement information; When the access device initially uploads device data to the edge intelligent gateway, the edge intelligent gateway determines whether the access device meets the access requirement information, and if so, sends a request message to the device management application module to allow the access device to access the industrial Internet platform; After receiving the request message, the device management application module allows the access device to access the industrial Internet platform.

8. An industrial Internet platform access method, applied to the edge intelligent gateway of the industrial Internet platform access system according to any one of claims 1 to 7, characterized in that: include: Receive device configuration information sent by the device management application module, and perform device access configuration based on the device configuration information to allow corresponding devices to access; The receiving controller data access application module encrypts the device data uploaded by the access device using the key; Obtain the device configuration information and the key on the blockchain of the platform-side blockchain access application module from the blockchain platform, and use the key to decrypt the encrypted device data; The device data meeting the device configuration information requirement is screened out from the decrypted device data, and the device data meeting the device configuration information requirement is uploaded to the device management application module.

9. An industrial management system, characterized in that: include: Access equipment; An industrial Internet platform access system as described in any one of claims 1 to 7 connected to the access device.

Images