Industrial fieldbus encrypted communication method, device and equipment, and storage medium

Abstract

The application provides an industrial fieldbus encryption communication method and device, equipment and a storage medium, wherein the industrial fieldbus comprises at least one multicast network, the multicast network comprises a sending node and at least one receiving node; the method is applied to the sending node and comprises the following steps: obtaining sensitive information corresponding to the sending node in a sensitive information table, encrypting a to-be-sent message according to the sensitive information to obtain an encrypted message; the sensitive information table is stored in each node of the same multicast network; and the encrypted message is broadcasted on the industrial fieldbus, so that the receiving node obtains the sensitive information corresponding to the sending node in the sensitive information table and decrypts the encrypted message according to the sensitive information. The application simultaneously supports unicast encryption and multicast encryption, realizes network encryption communication of the industrial fieldbus, and guarantees data transmission safety.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of industrial fieldbus communication, and in particular to an industrial fieldbus encryption communication method and device, equipment and a storage medium. BACKGROUND

[0002] Industrial fieldbus has advantages of multi-node, high bandwidth, high real-time and long-distance transmission, and is widely used in industrial control systems. However, as a relatively new bus, the encryption mechanism of the industrial fieldbus is not perfect, and since no network encryption communication is adopted, the data in the network communication process will face a greater security risk.

[0003] In the existing network bus encryption method, the sending end usually encrypts the to-be-sent message according to a key, and then sends the key and the encrypted message to the receiving end through the bus, so that the receiving end decrypts the encrypted message according to the key. In the network bus encryption method, the encrypted message and the key are sent through the bus, and when the bus is attacked, the encrypted message can be cracked by the attacker after the encrypted message and the key are obtained, or the message can be maliciously modified to attack the receiving end device.

[0004] Therefore, there is an urgent need for a method for realizing network encryption communication of the industrial fieldbus, so as to encrypt the broadcast data in the industrial fieldbus and ensure the data security in the industrial fieldbus transmission network. SUMMARY

[0005] Therefore, the present application provides an industrial fieldbus encryption communication method and device, equipment and a storage medium, which simultaneously supports unicast encryption and multicast encryption, realizes network encryption communication of the industrial fieldbus, and ensures data transmission security.

[0006] In a first aspect, the present application provides an industrial fieldbus encryption communication method, wherein the industrial fieldbus includes at least one multicast network, and the multicast network includes one sending node and at least one receiving node; the method is applied to the sending node and includes the following steps.

[0007] Obtaining sensitive information corresponding to the sending node in a sensitive information table, encrypting a to-be-sent message according to the sensitive information to obtain an encrypted message; the sensitive information table is stored in each node in the same multicast network;

[0008] Broadcasting the encrypted message on the industrial fieldbus, so that the receiving node obtains sensitive information corresponding to the sending node in the sensitive information table and decrypts the encrypted message according to the sensitive information.

[0009] According to the above, the sensitive information table is constructed and stored in each node of the multicast network. When the sending node sends data, the sensitive information corresponding to the sending node is obtained in the sensitive information table, and the to-be-sent message is encrypted according to the sensitive information, and the encrypted message is broadcasted through the industrial field bus, so that the plurality of receiving nodes in the multicast network receive the encrypted message. After the receiving node receives the encrypted message, the sensitive information corresponding to the sending node is obtained in the sensitive information table, and the encrypted message is decrypted according to the same sensitive information. The industrial field bus encryption communication method of the application stores the sensitive information table constructed in each node of the multicast network, so as to ensure that when the encrypted message is broadcasted through the industrial field bus, even if the encrypted message is intercepted, the attacker cannot decrypt the encrypted message due to the lack of sensitive information, thereby ensuring the data transmission security of the industrial field bus multicast network.

[0010] Optionally, the sensitive information includes a group key corresponding to the multicast network and an initial vector corresponding to the node.

[0011] According to the above, the sensitive information can include a group key corresponding to the multicast network and an initial vector corresponding to the node. Each node of the same multicast network has the same group key and different initial vectors. The initial vector usually uses a random number or a pseudo-random number. The initial vectors of different nodes are all different. Therefore, when the to-be-sent message of the sending node is encrypted by the group key and the initial vector, the encryption effect can be enhanced, and the encrypted message cannot be cracked.

[0012] Optionally, the method further comprises:

[0013] allocating a group ID to the multicast network, and allocating different node IDs to each node of the multicast network;

[0014] generating a group key of the multicast network according to the group ID, generating an initial vector of each node according to the node ID, and storing the group key and the initial vector of each node in the sensitive information table.

[0015] According to the above, the multicast network of the industrial field bus includes a sending node and a plurality of receiving nodes. The group ID is allocated to the multicast network, and different node IDs are allocated to each node, so that each node of the multicast network has the same group ID and different node IDs. Each node can be identified according to the group ID and the node ID, so that the encrypted message of the sending node can be received by each receiving node in the same group when the encrypted message is broadcasted on the industrial field bus.

[0016] Optionally, the encrypted message carries the group ID of the multicast network and the node ID of the sending node.

[0017] According to the above, since the receiving node needs to use the same sensitive information when decrypting the encrypted message, and in order to ensure the security of the encrypted message, the sensitive information cannot be directly transmitted through the industrial field bus, therefore, by adding the group ID of the multicast network and the node ID of the sending node in the encrypted message, when the receiving node receives the encrypted message through broadcasting, the corresponding sensitive information of the sending node can be found in the sensitive information table according to the group ID and the node ID, so as to facilitate the sensitive information to decrypt the encrypted message.

[0018] Optionally, the sensitive information table comprises a group key information table and an initial vector information table.

[0019] The dimension address of the group key information table is the group ID, and the dimension address of the initial vector information table is the group ID and the node ID.

[0020] According to the above, the sensitive information table can specifically comprise a group key information table and an initial vector information table, the group ID and the corresponding group key are stored in the group key information table, and the group ID, the node ID and the corresponding initial vector are stored in the initial vector information table, in the process of encrypting and decrypting the message, the node needs to find the corresponding group key in the group key information table and find the initial vector in the initial vector information table, so as to realize the encryption or decryption of the message, and the use of two information tables can further improve the security in the process of data encryption and decryption.

[0021] Optionally, the obtaining of the sensitive information corresponding to the sending node in the sensitive information table comprises:

[0022] finding the group key corresponding to the multicast network in the group key information table according to the group ID of the multicast network;

[0023] finding the initial vector corresponding to the sending node in the initial vector information table according to the group ID and the node ID of the sending node.

[0024] According to the above, when encrypting the to-be-sent message, the sending node needs to find the group key corresponding to the multicast network in the group key information table according to the group ID, and find the initial vector corresponding to the sending node in the initial vector information table according to the group ID and the node ID of the sending node, so as to obtain the complete sensitive information, thereby realizing the encryption of the to-be-sent message, and similarly, when decrypting the encrypted message, the receiving node needs to find the group key corresponding to the multicast network in the group key information table according to the group ID, and find the initial vector corresponding to the sending node in the initial vector information table according to the group ID and the node ID of the sending node, so as to obtain the complete sensitive information, thereby realizing the decryption of the encrypted message.

[0025] In a second aspect, the application provides an industrial fieldbus encryption communication method, an industrial fieldbus comprising at least one multicast network, the multicast network comprising a sending node and at least one receiving node; the method is applied to the receiving node and comprises the following steps:

[0026] receiving an encrypted message broadcast on the industrial fieldbus, the encrypted message being obtained by encrypting a to-be-sent message according to sensitive information corresponding to the sending node in a sensitive information table; the sensitive information table is stored in each node of the same multicast network;

[0027] obtaining the sensitive information corresponding to the sending node in the sensitive information table, and decrypting the encrypted message according to the sensitive information.

[0028] According to the above, the application constructs a sensitive information table and stores the sensitive information table in each node of the multicast network. When the receiving node receives the encrypted message, the sensitive information corresponding to the sending node is obtained in the sensitive information table, and the encrypted message is decrypted according to the sensitive information. The application stores the constructed sensitive information table in each node of the multicast network, so that when the encrypted message is broadcast on the industrial fieldbus, even if the encrypted message is intercepted, the attacker cannot decrypt the encrypted message due to the lack of sensitive information, thereby ensuring the safety of data transmission in the industrial fieldbus multicast network.

[0029] In a third aspect, the application provides an industrial fieldbus encryption communication device, an industrial fieldbus comprising at least one multicast network, the multicast network comprising a sending node and at least one receiving node; the device comprises:

[0030] an encryption module, configured to obtain sensitive information corresponding to the sending node in a sensitive information table, and encrypt a to-be-sent message according to the sensitive information to obtain an encrypted message; the sensitive information table is stored in each node of the same multicast network;

[0031] a sending module, configured to broadcast the encrypted message on the industrial fieldbus, so that the receiving node obtains sensitive information corresponding to the sending node in the sensitive information table, and decrypts the encrypted message according to the sensitive information.

[0032] In a fourth aspect, the application provides an industrial fieldbus encryption communication device, an industrial fieldbus comprising at least one multicast network, the multicast network comprising a sending node and at least one receiving node; the device comprises:

[0033] a receiving module, configured to receive an encrypted message broadcast on the industrial field bus, wherein the encrypted message is obtained by the sending node encrypting the message to be sent according to the sensitive information of the sending node in the sensitive information table; the sensitive information table is stored in each node of the same multicast network;

[0034] The decryption module is used to obtain the sensitive information corresponding to the sending node in the sensitive information table and decrypt the encrypted message according to the sensitive information.

[0035] In a fifth aspect, the present application provides a computing device, comprising:

[0036] one or more processors;

[0037] a memory for storing one or more programs;

[0038] When the one or more programs are executed by the one or more processors, the one or more processors implement the above-mentioned industrial field bus encryption communication method.

[0039] In a sixth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which implements the above-mentioned industrial field bus encryption communication method when executed by a computer.

[0040] These and other aspects of the present application will become more apparent from the following description of the embodiment(s). BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 A flowchart of the first industrial field bus encryption communication method provided in an embodiment of the present application;

[0042] Figure 2 A flowchart of a second industrial field bus encryption communication method provided in an embodiment of the present application;

[0043] Figure 3 A schematic diagram of an industrial fieldbus communication network provided in an embodiment of the present application;

[0044] Figure 4 A structural diagram of an industrial field bus encryption communication device provided in an embodiment of the present application;

[0045] Figure 5 A structural diagram of a computing device provided in an embodiment of the present application.

[0046] It should be understood that the sizes and shapes of the blocks in the above structural diagrams are for reference only and should not constitute an exclusive interpretation of the embodiments of this application. The relative positions and inclusion relationships between the blocks presented in the structural diagrams are only schematic representations of the structural relationships between the blocks, and do not limit the physical connection methods of the embodiments of this application. DETAILED DESCRIPTION

[0047] In order to make the objectives, technical solutions and advantages of the present invention more clear, the present invention will be further described in detail below with reference to the accompanying drawings.

[0048] The embodiments of the present application can be applicable to any industrial field bus, such as AUTBUS, EtherCAT, Interbus, PROFIBUS, POWERLINK, etc.

[0049] An embodiment of the present application provides an industrial fieldbus encryption communication method. By constructing a sensitive information table and storing it in each node of a multicast network, before sending data, a sending node first needs to obtain the sensitive information corresponding to the sending node from the sensitive information table, and encrypt the message to be sent based on the sensitive information. The encrypted message is then broadcasted via the industrial fieldbus so that multiple receiving nodes in the multicast network receive the encrypted message. After receiving the encrypted message, the receiving node also needs to obtain the sensitive information corresponding to the sending node from the sensitive information table, and then decrypt the encrypted message based on the same sensitive information. The industrial fieldbus encryption communication method of the present application can simultaneously support unicast encryption and multicast encryption, ensuring that when an encrypted message is broadcast on the industrial fieldbus, even if the encrypted message is intercepted by an attacker, the attacker cannot decrypt the encrypted message due to the lack of sensitive information, thereby ensuring the security of data transmission in the industrial fieldbus multicast network.

[0050] like Figure 1 As shown, in an industrial field bus encryption communication method provided by an embodiment of the present application, the industrial field bus includes at least one multicast network, and the multicast network includes a sending node and at least one receiving node; the method is applied to the sending node, including:

[0051] S110: Acquire sensitive information corresponding to the sending node in a sensitive information table, and encrypt the message to be sent according to the sensitive information to obtain an encrypted message;

[0052] In the embodiment, the multicast network of the industrial field bus can include one sending node and multiple receiving nodes. The multicast network is assigned a group ID, and each node in the multicast network is assigned a different node ID, so that each node in the multicast network has the same group ID and different node IDs. Each node can identify the identity of each other node according to the group ID and the node ID owned by each node, so that the encrypted message of the sending node can be received by each receiving node in the same group when the encrypted message is broadcast on the industrial field bus.

[0053] In some embodiments, the sensitive information can include a group key corresponding to the group ID and an initial vector corresponding to the node ID. Each node in the same multicast network has the same group key and different initial vectors. According to the assigned group ID and node ID, the embodiment can construct a sensitive information table for storing the sensitive information. The sensitive information table can be a group key information table and an initial vector information table. When generating the sensitive information, the group key of the multicast network can be generated according to the group ID and stored in the group key information table, and the initial vector of each node can be generated according to the node ID of each node and stored in the initial vector information table. Based on this, the dimension address of the group key information table is the group ID, and the dimension address of the initial vector information table is the group ID and the node ID.

[0054] In the embodiment, each node in the same multicast network has the same group key and different initial vectors. The initial vector of each node is usually generated by using a random number or a pseudo-random number. The initial vectors of different nodes are all different. Therefore, when the group key and the initial vector are used to encrypt the to-be-sent message of the sending node, the sensitive information, i.e., the key, used by each node in the group to encrypt the message is different, which can enhance the encryption effect and ensure that the encrypted message cannot be cracked. Similarly, by using two information tables to store the group key and the initial vector respectively, it can also be ensured that when an attacker performs a network attack to obtain the sensitive information, the attacker needs to intercept both information tables at the same time, and then find the complete sensitive information according to the group ID and the node ID, thereby increasing the difficulty of decrypting the encrypted message.

[0055] By saving the group key information table and the initial vector information table in each node of the multicast network, when the sending node encrypts the to-be-sent message, the sending node first finds the group key of the multicast network in the group key information table according to the group ID of the multicast network, and then finds the initial vector of the sending node in the initial vector information table according to the group ID and the node ID of the sending node, to obtain the complete sensitive information. The sending node can encrypt the to-be-sent message according to the obtained sensitive information, and send the obtained encrypted message to the industrial field bus for group broadcast.

[0056] S120: broadcasting the encrypted message on the industrial fieldbus, so that the receiving node obtains the sensitive information corresponding to the sending node in the sensitive information table, and decrypts the encrypted message according to the sensitive information;

[0057] In the embodiment, the encrypted message broadcasted on the industrial fieldbus carries the group ID of the multicast network and the node ID of the sending node, so as to facilitate the receiving node located in the same multicast network to receive the encrypted message. When decrypting the encrypted message, the receiving node needs to use the same sensitive information as used by the sending node for encryption. The receiving node can find the group key corresponding to the multicast network and the initial vector corresponding to the sending node in the group key information table and the initial vector information table saved by the receiving node respectively according to the group ID and the node ID carried in the encrypted message, so as to obtain the complete sensitive information, and decrypt the encrypted message according to the sensitive information to obtain the plaintext.

[0058] As shown in Figure 2 The second industrial fieldbus encryption communication method provided by the embodiment of the application includes at least one multicast network on the industrial fieldbus, and the multicast network includes one sending node and at least one receiving node. The method is applied to the receiving node, and includes:

[0059] S210: receiving the encrypted message broadcasted on the industrial fieldbus, the encrypted message being obtained by encrypting the to-be-sent message according to the sensitive information corresponding to the sending node in the sensitive information table by the sending node;

[0060] S220: obtaining the sensitive information corresponding to the sending node in the sensitive information table, and decrypting the encrypted message according to the sensitive information;

[0061] The embodiment allocates the group ID to the multicast network, and allocates different node IDs to the nodes in the multicast network, so that the nodes in the multicast network have the same group ID and different node IDs. The group key information table and the initial vector information table for storing the sensitive information are constructed according to the allocated group ID and node ID. The group key information table and the initial vector information table are saved in the nodes in the multicast network. When the sensitive information is generated, the group key of the multicast network can be generated according to the group ID and stored in the group key information table, and the initial vector of each node can be generated according to the node ID of each node and stored in the initial vector information table. Based on this, the dimension address of the group key information table is the above-mentioned group ID, and the dimension address of the initial vector information table is the group ID and the node ID.

[0062] According to the group key information table and the initial vector information table constructed above, when the sending node encrypts the to-be-sent message, first, the group key corresponding to the multicast network of the sending node is found in the group key information table according to the group ID of the multicast network in which the sending node is located, then the initial vector corresponding to the sending node is found in the initial vector information table according to the group ID and the node ID of the sending node, so as to obtain the complete sensitive information, and the sending node can encrypt the to-be-sent message according to the sensitive information obtained, and send the encrypted message to the industrial field bus for group broadcast. The encrypted message carries the group ID of the multicast network and the node ID of the sending node, and after receiving the encrypted message through broadcast, the receiving node needs to use the same sensitive information as used by the sending node for encryption to decrypt the encrypted message, and the receiving node can find the group key corresponding to the multicast network and the initial vector corresponding to the sending node in the group key information table and the initial vector information table saved by the receiving node respectively according to the group ID and the node ID carried in the encrypted message, so as to obtain the complete sensitive information, and decrypt the encrypted message according to the sensitive information to obtain the plaintext.

[0063] As shown in Figure 3 , the embodiment of the present application provides a schematic diagram of an industrial field bus communication network, and as shown in Figure 3 , the industrial field bus shown in the figure is distributed with a node 1, a node 2 and a node 3, and the corresponding node IDs are a node ID1, a node ID2 and a node ID3, wherein the node 1, the node 2 and the node 3 constitute a multicast network 1, and the corresponding group ID is a group ID1; the node 1 and the node 2 constitute a multicast network 2, and the corresponding group ID is a group ID2.

[0064] Based on this, when the industrial field bus networking encryption communication is performed, the group key information table and the initial vector information table of the node 1, the node 2 and the node 3 need to be constructed according to the group ID and the node ID of each node, and are saved in the node 1, the node 2 and the node 3 respectively. Among them, the node 1 and the node 2 are located in the multicast network 1 and the multicast network 2 at the same time, and the node 3 is located in the multicast network 1 only, so the group key information table of the node 1 and the node 2 both contains the group key (group 1 key) of the multicast network 1 and the group key (group 2 key) of the multicast network 2, and the group key information table of the node 3 contains only the group key (group 1 key) of the multicast network 1.

[0065] For example, the group key information table of the node 1 and the node 2 is as follows:

[0066] address Group ID1 Group ID2 data Group 1key Group 2key

[0067] For example, the group key information table of the node 3 is as follows:

[0068] address Group ID1 data Group 1key

[0069] Similarly, node 1 and node 2 are located in both multicast network 1 and multicast network 2, and node 3 is located only in multicast network 1. Therefore, the initial vector information tables of node 1 and node 2 include the initial vectors (1-1-IV, 1-2-IV, 1-3-IV) of node 1, node 2, and node 3 in multicast network 1, and the initial vectors (2-1-IV, 2-2-IV) of node 1 and node 2 in multicast network 2. The initial vector information table of node 3 only includes the initial vectors (1-1-IV, 1-2-IV, 1-3-IV) of node 1, node 2, and node 3 in multicast network 1.

[0070] Exemplarily, the initial vector information tables of node 1 and node 2 are as follows:

[0071] Group ID1 Group ID2 Node ID 1 1-1-IV 2-1-IV Node ID 2 1-2-IV 2-2-IV Node ID 3 1-3-IV

[0072] For example, the initial vector information table of node 3 is as follows:

[0073] Group ID1 Node ID 1 1-1-IV Node ID 2 1-2-IV Node ID 3 1-3-IV

[0074] Based on the group key information table and initial vector information table constructed above, assume that node 1 is the sending node, and node 2 and node 3 are the receiving nodes; when multicast network 1 and multicast network 2 broadcast messages at the same time, node 1 finds the corresponding group key (group 1 key) in the group key information table according to its group ID 1, and finds the corresponding initial vector (1-1-IV) in the initial vector information table according to its group ID 1 and node ID 1, encrypts the message 1 to be sent according to the group 1 key and 1-1-IV, and sends the encrypted message 1 to the working node. The encrypted message 1 is broadcast on the industrial fieldbus, and carries the group ID 1 and node ID 1 of node 1. Node 1 also finds the corresponding group key (group 2key) in the group key information table according to its group ID 2, and finds the corresponding initial vector (2-1-IV) in the initial vector information table according to its group ID 2 and node ID 1. Message 2 to be sent is encrypted according to the group 2key and 2-1-IV, and the obtained encrypted message 2 is broadcast on the industrial fieldbus, and the encrypted message 2 carries the group ID 2 and node ID 1 of node 1.

[0075] Node 2 and node 3 in the multicast network 1 can receive the encrypted message 1 sent by node 1 according to the group ID 1 and node ID 1 of node 1 carried in the encrypted message 1, and find the group key (group 1 key) and initial vector (1-1-IV) of the corresponding node 1 in the group key information table and initial vector information table stored therein according to the group ID 1 and node ID 1 of node 1, respectively, so as to decrypt the encrypted message 1 according to the group key (group 1 key) and initial vector (1-1-IV) to obtain the plaintext;

[0076] Node 2 in the multicast network 2 can receive the encrypted message 2 sent by node 1 based on the group ID 2 and node ID 1 of node 1 carried in the encrypted message 2, and according to the group ID 2 and node ID 1 of node 1, respectively find the group key (group 2key) and initial vector (2-1-IV) corresponding to node 1 in the group key information table and initial vector information table stored therein, so as to decrypt the encrypted message 2 based on the group key (group 2key) and initial vector (2-1-IV) to obtain the plaintext.

[0077] It should be noted that node 3 is only located in multicast network 1, so it can only receive and decrypt encrypted message 1 from multicast network 1, but cannot receive and decrypt encrypted message 2 from multicast network 2. This embodiment implements broadcast communication of multiple multicast networks on the industrial fieldbus by storing a group key information table corresponding to the group ID and an initialization vector information table corresponding to the group ID and node ID at each node. The embodiment also encrypts the outgoing message at the sending node and decrypts the encrypted message at the receiving node based on different sensitive information, thereby achieving networked encrypted communication on the industrial fieldbus.

[0078] like Figure 4 As shown, the embodiment of the present application provides an industrial field bus encryption communication device, which can be used to implement any step of the above industrial field bus encryption communication method and its optional embodiments. Figure 4 As shown, the device includes an encryption module 310, a sending module 320, a receiving module 330, and a decryption module 340;

[0079] The encryption module 310 is used to obtain the sensitive information corresponding to the sending node in the sensitive information table, and encrypt the message to be sent according to the sensitive information to obtain an encrypted message; the sending module 320 is used to broadcast the encrypted message on the industrial field bus; the receiving module 330 is used to receive the encrypted message broadcast on the industrial field bus; the decryption module 340 is used to obtain the sensitive information corresponding to the sending node in the sensitive information table, and decrypt the encrypted message according to the sensitive information.

[0080] It should be understood that the devices or modules in the embodiments of the present application can be implemented by software, for example, they can be implemented by computer programs or instructions having the above functions, and the corresponding computer programs or instructions can be stored in the memory inside the terminal, and the processor reads the corresponding computer programs or instructions in the memory to implement the above functions. Alternatively, the devices or modules in the embodiments of the present application can also be implemented by hardware. Alternatively, the devices or modules in the embodiments of the present application can also be implemented by a combination of a processor and a software module.

[0081] It should be understood that the processing details of the devices or modules in the embodiments of the present application can be referred to Figure 1-Figure 3 The related expressions of the embodiments and related extended embodiments will not be repeated.

[0082] Figure 5 is a structural schematic diagram of a computing device 1000 provided by an embodiment of the present application. The computing device 1000 includes a processor 1010, a memory 1020, a communication interface 1030, and a bus 1040.

[0083] It should be understood that, Figure 5 The communication interface 1030 in the computing device 1000 shown can be used for communication with other devices.

[0084] The processor 1010 can be connected with the memory 1020. The memory 1020 can be used for storing program codes and data. Therefore, the memory 1020 can be a storage unit inside the processor 1010, can be an external storage unit independent of the processor 1010, or can be a component including the storage unit inside the processor 1010 and the external storage unit independent of the processor 1010.

[0085] Optionally, the computing device 1000 can further include the bus 1040. The memory 1020 and the communication interface 1030 can be connected with the processor 1010 through the bus 1040. The bus 1040 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus 1040 can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, Figure 5 In the figure, only one line is used to represent the bus, but it does not mean that there is only one bus or only one type of bus.

[0086] It should be appreciated that in the embodiments of the present application, the processor 1010 can be a central processing unit (CPU). The processor can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic components, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. Alternatively, the processor 1010 can be one or more integrated circuits for performing related programs to implement the technical solutions provided by the embodiments of the present application.

[0087] The memory 1020 can include read-only memory and random access memory, and provide instructions and data to the processor 1010. Part of the processor 1010 can also include non-volatile random access memory. For example, the processor 1010 can also store device type information.

[0088] When the computing device 1000 is running, the processor 1010 executes computer execution instructions in the memory 1020 to perform the operation steps of the above method.

[0089] It should be understood that the computing device 1000 according to the embodiments of the present application can correspond to the execution of the corresponding subject in the method according to the embodiments of the present application, and the above-mentioned other operations and / or functions of each module in the computing device 1000 are respectively for realizing the corresponding process of each method of the embodiments, and for the sake of brevity, will not be repeated here.

[0090] Those of ordinary skill in the art can realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be realized in electronic hardware or a combination of computer software and electronic hardware. Whether the functions are performed in hardware or software depends on the specific application and design constraints of the technical solutions. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0091] Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working processes of the above-described system, device and unit can refer to the corresponding processes in the foregoing method embodiments, which will not be repeated here.

[0092] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other manners. For example, the described device embodiments are merely schematic. The division of the units is merely a logical function division. There can be another division manner for the actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections can be indirect couplings or communication connections through some interfaces, devices or units, and can be in electrical, mechanical or other forms.

[0093] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, i.e., can be located in one place, or can be distributed on multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0094] In addition, each functional unit in the various embodiments of the present application can be integrated into a processing unit, or each unit can exist physically, or two or more units can be integrated into one unit.

[0095] If the functions are realized in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application or the essential part or part of the technical solutions that make contributions to the prior art can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various program codes that can be stored in the medium.

[0096] The embodiments of the present application also provide a computer readable storage medium, which stores a computer program. The program is executed by a processor to perform the above method. The method includes at least one of the schemes described in the various embodiments.

[0097] The computer storage medium of the embodiments of the present application can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may, for example, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any combination thereof. More specific examples (non-exhaustive list) of the computer-readable storage medium include an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus or device.

[0098] The computer-readable signal medium can include a data signal propagated in baseband or propagated as a carrier wave, in which computer-readable program code is embodied. Such propagated data signals can take a wide variety of forms, including but not limited to electro-magnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium that is not a storage medium, that is, that is not a tangible medium, and that can communicate, propagate or transport programming for use by or in connection with an instruction execution system, apparatus or device.

[0099] The program code embodied on the computer-readable media can be transmitted using any appropriate medium, including but not limited to wireless, wired, optical fiber cable, RF, etc., or any suitable combination of the above.

[0100] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, application specific circuitry, or field programmable gate array (FPGA) circuitry can execute the computer program code.

[0101] It is to be understood that the embodiments described herein are merely exemplary of the application made and that various modifications can be made in form, design and details of specific implementation without departing from the scope of the application. Therefore, the above description of the embodiments of the application is not intended to limit the scope of the application, but merely to indicate the selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of the application without creative effort fall within the scope of the application.

[0102] The words "first", "second", "third", etc. or the words "module A", "module B", "module C" and the like used in the description and claims mean only to distinguish similar objects, and do not represent a specific order or sequence of the objects. It is to be understood that the specific order or sequence of steps can be changed, if permitted by the context, without departing from the scope of the application.

[0103] In the above description, the reference signs denoting the steps do not necessarily mean that the steps are performed in the order shown, but can include intermediate steps or can be replaced by other steps, and the order of the steps can be changed or the steps can be performed simultaneously, if permitted.

[0104] The term "comprising" as used in the specification and claims should not be interpreted as limiting to the listed components; it does not exclude other elements or steps. It needs to be interpreted as specifying the presence of the stated features, integers, steps or components as referred to, but does not preclude the presence or addition of one or more other features, integers, steps or components, or groups thereof. Thus, the expression "a device comprising means A and B" does not exclude the presence of other means while the device also contains these.

[0105] The expression "one embodiment" or "an embodiment" as used in the specification means that a particular feature, structure or characteristic described in connection with the embodiment is included in at least one embodiment of the application. Therefore, the appearance of the phrase "in one embodiment" or "in an embodiment" at various places in the specification does not necessarily refer to the same embodiment, but can refer to different embodiments. In addition, the terms and / or descriptions of different embodiments in the application are consistent, if not specially stated, and can be referred to each other, and the technical features of different embodiments can be combined to form new embodiments according to their inherent logical relationship.

[0106] Note that the above merely describes preferred embodiments of the present application and the applied technical principles. Those skilled in the art will understand that the present application is not limited to the specific embodiments described herein, and that various obvious changes, modifications and substitutions can be made without departing from the scope of the present application. Therefore, although the present application has been described in detail through the above embodiments, the present application is not limited to the above embodiments, and can include more other equivalent embodiments without departing from the concept of the present application, and all fall within the scope of the present application.

Claims

1. An industrial field bus encryption communication method, characterized in that: The industrial fieldbus includes at least one multicast network, the multicast network including a sending node and at least one receiving node; assigning a group ID to the multicast network and assigning a different node ID to each node of the multicast network; generating a group key of the multicast network based on the group ID, generating an initialization vector of each node based on the node ID, and storing the group key and the initialization vector of each node in a sensitive information table; The method is applied to a sending node and includes: Obtaining sensitive information corresponding to the sending node from a sensitive information table, and encrypting a message to be sent based on the sensitive information to obtain an encrypted message; the encrypted message carries the group ID of the multicast network and the node ID of the sending node; the sensitive information includes a group key of the corresponding multicast network and an initial vector of the corresponding node; the sensitive information table is stored in each node of the same multicast network; the sensitive information table includes a group key information table and an initial vector information table; obtaining the sensitive information corresponding to the sending node from the sensitive information table includes: searching the group key corresponding to the multicast network in the group key information table based on the group ID of the multicast network; and searching the initial vector corresponding to the sending node in the initial vector information table based on the group ID and the node ID of the sending node; The encrypted message is broadcasted on the industrial field bus, so that the receiving node obtains the sensitive information corresponding to the sending node in the sensitive information table and then decrypts the encrypted message according to the sensitive information.

2. The method according to claim 1, characterized in that The dimension address of the group key information table is the group ID, and the dimension address of the initial vector information table is the group ID and the node ID.

3. An industrial field bus encryption communication method, characterized in that: The industrial fieldbus includes at least one multicast network, the multicast network including a sending node and at least one receiving node; assigning a group ID to the multicast network and assigning a different node ID to each node of the multicast network; generating a group key of the multicast network based on the group ID, generating an initialization vector of each node based on the node ID, and storing the group key and the initialization vector of each node in a sensitive information table; The method is applied to a receiving node and includes: Receive an encrypted message broadcast on the industrial field bus, the encrypted message being obtained by the sending node encrypting the message to be sent based on the sensitive information of the sending node in the sensitive information table; the encrypted message carrying the group ID of the multicast network and the node ID of the sending node; the sensitive information including the group key of the corresponding multicast network and the initial vector of the corresponding node; the sensitive information table being stored in each node of the same multicast network; the sensitive information table including a group key information table and an initial vector information table; and a process of obtaining the sensitive information corresponding to the sending node in the sensitive information table comprising: searching the group key corresponding to the multicast network in the group key information table based on the group ID of the multicast network; and searching the initial vector corresponding to the sending node in the initial vector information table based on the group ID and the node ID of the sending node; Acquire sensitive information corresponding to the sending node in the sensitive information table, and decrypt the encrypted message according to the sensitive information.

4. An industrial field bus encryption communication device, characterized in that: The industrial fieldbus includes at least one multicast network, the multicast network including a sending node and at least one receiving node; assigning a group ID to the multicast network and assigning a different node ID to each node of the multicast network; generating a group key of the multicast network based on the group ID, generating an initialization vector of each node based on the node ID, and storing the group key and the initialization vector of each node in a sensitive information table; The device comprises: an encryption module, configured to obtain sensitive information corresponding to the sending node from a sensitive information table, and encrypt a message to be sent based on the sensitive information to obtain an encrypted message; the encrypted message carries the group ID of the multicast network and the node ID of the sending node; the sensitive information includes a group key of the corresponding multicast network and an initial vector of the corresponding node; the sensitive information table is stored in each node of the same multicast network; the sensitive information table includes a group key information table and an initial vector information table; obtaining the sensitive information corresponding to the sending node from the sensitive information table includes: searching the group key corresponding to the multicast network in the group key information table based on the group ID of the multicast network; and searching the initial vector corresponding to the sending node in the initial vector information table based on the group ID and the node ID of the sending node; The sending module is used to broadcast the encrypted message on the industrial field bus, so that the receiving node obtains the sensitive information corresponding to the sending node in the sensitive information table and decrypts the encrypted message according to the sensitive information.

5. An industrial field bus encryption communication device, characterized in that: The industrial fieldbus includes at least one multicast network, the multicast network including a sending node and at least one receiving node; assigning a group ID to the multicast network and assigning a different node ID to each node of the multicast network; generating a group key of the multicast network based on the group ID, generating an initialization vector of each node based on the node ID, and storing the group key and the initialization vector of each node in a sensitive information table; The device comprises: A receiving module, configured to receive an encrypted message broadcast on the industrial field bus, wherein the encrypted message is obtained by encrypting the message to be sent by the sending node according to the sensitive information of the sending node in the sensitive information table; the encrypted message carries the group ID of the multicast network and the node ID of the sending node; the sensitive information includes the group key of the corresponding multicast network and the initial vector of the corresponding node; the sensitive information table is stored in each node of the same multicast network; the sensitive information table includes a group key information table and an initial vector information table; a process for obtaining the sensitive information corresponding to the sending node in the sensitive information table includes: searching the group key corresponding to the multicast network in the group key information table according to the group ID of the multicast network; and searching the initial vector corresponding to the sending node in the initial vector information table according to the group ID and the node ID of the sending node; The decryption module is used to obtain the sensitive information corresponding to the sending node in the sensitive information table and decrypt the encrypted message according to the sensitive information.

6. A computing device, characterized in that include: one or more processors; a memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the industrial field bus encryption communication method according to any one of claims 1 to 3.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a computer, the industrial field bus encryption communication method according to any one of claims 1 to 3 is implemented.

Images