Method for establishing an industrial internet platform architecture

Abstract

The application relates to the technical field of industrial internet platforms, and discloses a method for establishing an industrial internet platform architecture. In the method, nodes are established, the established nodes correspond to devices in the platform one by one, a secret key pair and resource information are generated, a mapping relationship between a resource name and a node ID is established, resource allocation is performed on the nodes according to the mapping relationship, the distance from a target node to a current node in the nodes is calculated, the target node is positioned in a routing table according to the calculated distance, storage nodes in the nodes are connected in the form of a block chain, and the hash value of the table header of a current block is placed into the table header of a next block, and a record node is determined in the nodes to write the information of newly-added nodes into the record.

Description

Technical Field

[0001] This invention relates to the field of industrial IoT platform technology, and in particular to a method for establishing an industrial IoT platform architecture. Background Technology

[0002] In recent years, the Internet of Things (IoT), communication technologies, and blockchain technologies have penetrated various industries. To promote enterprise production, improve efficiency, and enhance the reliability and security of factory equipment, industrial IoT platforms have emerged. Currently, commonly used industrial IoT platform architectures mainly consist of a data acquisition layer, a storage layer, a computing layer, and a presentation layer.

[0003] With the rapid increase in the number of devices in the Internet of Things (IoT), the continuous increase in service demand, and the access of massive numbers of node devices, existing industrial IoT platforms face enormous challenges. The resulting information security issues, data center infrastructure construction and maintenance costs, digital certificate lifecycle management issues for massive numbers of devices, and security vulnerabilities and performance bottlenecks of centralized industrial IoT platforms all directly affect and restrict the development of the Industrial IoT. Summary of the Invention

[0004] This invention provides a method for establishing an industrial IoT platform architecture, which can solve the technical problems in the prior art.

[0005] This invention provides a method for establishing an industrial IoT platform architecture, wherein the method includes:

[0006] Establish nodes, each corresponding one-to-one with a device in the platform. A node includes a node header, a node body, and a node route. The node header is used to connect devices in the platform, the node body is used to record the node's resource and service information, and the node route is used to provide services and search for resources for the node. The connected devices use a point-to-point communication method.

[0007] Generate key pairs and resource information;

[0008] Establish a mapping relationship between resource names and node IDs, and allocate resources to nodes according to the mapping relationship;

[0009] Calculate the distance from the target node to the current node, and locate the target node in the routing table based on the calculated distance;

[0010] The storage nodes in the node are connected in the form of a blockchain, and the hash value of the current block's header is put into the header of the next block;

[0011] Determine the record node within the node to write the information of the newly added node into the record.

[0012] Preferably, the method further includes:

[0013] The sending node in the node performs data signing;

[0014] The receiving node in the node verifies the received data based on the data signature.

[0015] Preferably, the node header includes the hash value of the previous node header, the creation timestamp, the Merkle tree, the current difficulty, and a random number. The node body includes the node ID, identity ID, communication information, its own resource information, service information that can be provided, and service information that can be consumed. There is a mapping relationship between the node ID and the identity ID. The node route includes node information for the resource name and the storage resource name.

[0016] Preferably, generating key pairs includes:

[0017] The private key is generated using an elliptic curve cryptography algorithm;

[0018] Use the identity ID as the public key.

[0019] Preferably, the distance from the target node to the current node in the computation node includes:

[0020] The distance from the target node to the current node is obtained by performing an XOR operation on the node ID of the target node and the node ID of the current node using the Kad algorithm.

[0021] Preferably, the routing table is a K-bucket routing table, and locating the target node in the routing table based on the calculated distance includes:

[0022] When the calculated distance is within the range of [2(i-1), 2i], the target node is located to K-bucket i.

[0023] Preferably, determining the record node in the node includes:

[0024] For all nodes, change the random number in the node header;

[0025] The hash value is obtained by performing two hash calculations on the node header after changing the random number;

[0026] Compare the calculated hash value with the preset target value;

[0027] The record node is determined based on the comparison results.

[0028] Preferably, the record nodes determined based on the comparison results include:

[0029] The node corresponding to the smallest hash value among the calculated hash values ​​that is less than the preset target value is determined as the record node.

[0030] The above technical solution establishes nodes that correspond one-to-one with each device. Data encryption and decryption are achieved through key generation, avoiding the cumbersome management of encrypting information transmission using digital certificates. Furthermore, it provides all nodes with unified resource allocation, node location and search, secure and reliable information transmission between nodes, identity authentication of information sources and verification of original information, and tamper-proof and decentralized storage. In other words, by employing peer-to-peer transmission, consensus mechanisms, and tamper-proof technology, a decentralized industrial IoT platform is constructed, resulting in a lightweight and secure communication platform. Attached Figure Description

[0031] The accompanying drawings, which form part of this specification, are provided to further illustrate embodiments of the invention and, together with the textual description, explain the principles of the invention. It is obvious that the drawings described below are merely some embodiments of the invention, and those skilled in the art can obtain other drawings based on these drawings without any creative effort.

[0032] Figure 1 A flowchart illustrating a method for establishing an industrial IoT platform architecture according to an embodiment of the present invention is shown;

[0033] Figure 2 An example of a K-bucket routing table according to an embodiment of the present invention is shown;

[0034] Figure 3 An example diagram of a platform network topology according to an embodiment of the present invention is shown;

[0035] Figure 4 An example diagram of another platform network topology according to an embodiment of the present invention is shown;

[0036] Figure 5 An example diagram of a Merkle tree according to an embodiment of the present invention is shown. Detailed Implementation

[0037] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. The following description of at least one exemplary embodiment is merely illustrative and is in no way intended to limit the present invention or its application or use. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0038] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments according to this application. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0039] Unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps set forth in these embodiments do not limit the scope of the invention. It should also be understood that, for ease of description, the dimensions of the various parts shown in the drawings are not drawn to actual scale. Techniques, methods, and devices known to those skilled in the art may not be discussed in detail, but where appropriate, such techniques, methods, and devices should be considered part of the specification. In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limitations. Therefore, other examples of exemplary embodiments may have different values. It should be noted that similar reference numerals and letters in the following figures denote similar items; therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.

[0040] Figure 1 A flowchart illustrating a method for establishing an industrial IoT platform architecture according to an embodiment of the present invention is shown.

[0041] like Figure 1 As shown, this embodiment of the invention provides a method for establishing an industrial IoT platform architecture, wherein the method includes:

[0042] S100, Establish a node. The established node corresponds one-to-one with the device in the platform. The node includes a node header, a node body, and a node route. The node header is used to connect the device in the platform. The node body is used to record the node's resource information and service information. The node route is used to provide services and search for resources for the node. The connected devices use a point-to-point communication method.

[0043] In other words, all devices connected to the platform network can act as nodes within the platform. The platform network can employ distributed hash table technology, enabling fast and accurate data routing and location in a distributed environment.

[0044] S102, Generate key pairs and resource information;

[0045] S104, Establish a mapping relationship between resource names and node IDs, and allocate resources to nodes according to the mapping relationship;

[0046] S106, Calculate the distance from the target node to the current node, and locate the target node in the routing table based on the calculated distance;

[0047] S108, connect the storage nodes in the node through the blockchain, and put the hash value of the current block header into the header of the next block;

[0048] This step ensures that stored information is tamper-proof.

[0049] S110, determine the record node in the node so that the information of the newly added node can be written into the record.

[0050] Decentralization can be achieved through this step.

[0051] For example, a new node can broadcast a joining request to the platform. Nodes with write permissions (i.e., record nodes) write the relevant information of the new node (e.g., identity ID, node information, etc., as described below) into the node route, and other nodes synchronize and update according to the written route. At the same time, the new node is added to the resource chain.

[0052] The above technical solution establishes nodes that correspond one-to-one with each device. Data encryption and decryption are achieved through key generation, avoiding the cumbersome management of encrypting information transmission using digital certificates. Furthermore, it provides all nodes with unified resource allocation, node location and search, secure and reliable information transmission between nodes, identity authentication of information sources and verification of original information, and tamper-proof and decentralized storage. In other words, by employing peer-to-peer transmission, consensus mechanisms, and tamper-proof technology, a decentralized industrial IoT platform is constructed, resulting in a lightweight and secure communication platform.

[0053] More specifically, using point-to-point technology can reduce the burden on central services and shorten communication distances; at the same time, it can distribute computing and storage capabilities to various parts of the IoT network, effectively avoiding the problem of the entire network collapsing due to the failure of a single node.

[0054] Those skilled in the art should understand that the above Figure 1 The order of the steps shown is merely exemplary and is not intended to limit the invention.

[0055] According to one embodiment of the present invention, the method further includes:

[0056] The sending node in the node performs data signing;

[0057] The receiving node in the node verifies the received data based on the data signature.

[0058] By using key pairs and signatures, we can ensure the secure and reliable transmission of information between nodes, as well as the authentication of the information source and the verification of the original information.

[0059] For example, when device A sends data M to device B, the signature on the data can verify that the data M received by B was sent by device A and that the data M has not been tampered with.

[0060] According to one embodiment of the present invention, the node header includes the hash value (Pre-Hash) of the previous node header, the creation timestamp (timeStamp), the Merkle Tree, the current difficulty (DTH), and the nonce. The node body includes the node ID, the identity ID, communication information, its own resource information, the service information that can be provided, and the service information that can be consumed. There is a mapping relationship between the node ID and the identity ID. The node route includes the resource name and the node information that stores the resource name.

[0061] For node routing, the node information for resource names and storage resource names is adopted.<Key,Value> The data is stored in the following format: Key: Hash (resource name), Value: node information. The node header provides the logical structural foundation for the platform's consensus mechanism.

[0062] According to one embodiment of the present invention, in S104, a hash calculation can be performed on the resource name, and the calculated hash value can be used as an index to establish a mapping between the node ID and the node ID.

[0063] For example, if the hash value of a resource name is 000110, then the resource will be assigned to the node with node ID 000110. Furthermore, copies of the resource can be stored on several nodes with node IDs closest to 000110 to avoid the problem of the resource becoming unavailable if the node holding the resource goes offline or leaves the network.

[0064] According to one embodiment of the present invention, generating a key pair includes:

[0065] The private key is generated using an elliptic curve cryptography algorithm;

[0066] Use the identity ID as the public key.

[0067] Among these features, the use of elliptic curve cryptography allows for security levels comparable to or higher than RSA with shorter keys. Furthermore, the adoption of an identity-based cryptography system eliminates the cumbersome management of massive numbers of device digital certificates, making communication between devices within the platform much easier.

[0068] For example, after a device is added to an industrial IoT platform, its private key can be generated using the elliptic curve cryptography algorithm secp256k1 and the G-point constant, with its identity ID used as the public key. For instance, device A generates private key K. a and identity ID (public key) P a Device B's private key K b and identity ID (public key) P b ;

[0069] Device A encrypts data m to obtain ciphertext M, and sends it to device B. Device B receives ciphertext M and decrypts it using its private key to obtain data m. The main process is as follows:

[0070] 1. Device A finds the identity ID (i.e., B's public key) of device B through its own routing table;

[0071] 2. Device A uses the public key of Device B to encrypt data m, obtaining ciphertext M;

[0072] 3. Device A sends the encrypted message M to device B;

[0073] 4. After receiving the ciphertext M, device B uses its private key to decrypt the ciphertext and obtain the data m.

[0074] In this invention, the following signature function can be used for signing data, and the following signature verification function can be used for verifying data:

[0075] The signature function sign() = sign(hash(M), K) a )

[0076] The signature verification function verify() = verify(M, sign(), P) a ) = true / false

[0077] True:

[0078] 1) This indicates that the owner of the signature M and the public key P are involved. a The owner of the keys is the same private key;

[0079] 2) This indicates that the signature is for message M and has not been modified;

[0080] Return true if both 1) and 2) are satisfied;

[0081] Device A possesses: Private Key K a and public key P a Device B possesses: Private Key K b and public key P b .

[0082] Sign() execution process:

[0083] 1) The system randomly generates a public-private key pair, K and P, where P = KG

[0084] 2) r = x p

[0085] 3) s = K -1 ·(hash(M)+K a ·r)

[0086] K -1 ·K=1

[0087] The result of Sign() is (r, s), which is a two-dimensional array consisting of r and s.

[0088] Vetify() execution process:

[0089] 1) α=s -1 ·hash(M)

[0090] 2) β=s -1 ·r

[0091] 3) a·G+β·P a =α·G+β·K a ·G=(α+β·K a )·G=s -1 ·(hash(M)+K a ·r)·G

[0092] Let s = K -1 ·(hash(M)+K a ·r) K·s on both sides simultaneously -1 get:

[0093] K·s -1 ·s=K·s -1 K -1 ·(hash(M)+K a ·r).

[0094] Therefore, we get:

[0095] K = s -1 ·(hash(M)+K a ·r).

[0096] Therefore, α·G+β·P a =K·G=P.

[0097] Therefore, it can be seen that Verify() is actually used to verify α·G+β·P a Check if it is a random public key P. If it is equal, return true; otherwise, return false.

[0098] Each time sign() is called, the system generates a random private key K to ensure that K is guaranteed. a Security.

[0099] According to one embodiment of the present invention, calculating the distance from the target node to the current node includes:

[0100] The distance from the target node to the current node is obtained by performing an XOR operation on the node ID of the target node and the node ID of the current node using the Kad algorithm.

[0101] In the Kad algorithm, the distance between nodes is a logical distance, which can be obtained by performing an XOR operation on the node IDs as described above.

[0102] According to one embodiment of the present invention, such as Figure 2 As shown, the routing table is a K-bucket routing table. Locating the target node in the routing table based on the calculated distance includes:

[0103] When the calculated distance is within the range of [2(i-1), 2i], the target node is located to K-bucket i.

[0104] The K-bucket routing table stores routing information for nodes, locating (classifying) nodes by distance within the table. Figure 2 In this context, node represents a node.

[0105] More specifically, in this invention, the platform network topology is organized into a binary prefix tree, with nearby nodes distributed on the leaf nodes of the binary prefix tree. This organization is equivalent to classifying each node by its distance according to its identity ID. Figure 3 As shown, taking node number 110 in the figure as an example, its 000, 001, and 010 are assigned to "K-bucket 3" of node 110, nodes 100 and 101 are assigned to "K-bucket 2" of node 110, and finally node ID 111 is assigned to "K-bucket 1" of node 110.

[0106] In this invention, S108 can achieve tamper-proof storage of information. The entire storage node can be divided into two parts: a node header and a node body, and all storage nodes are connected via a blockchain, specifically as follows: Figure 4 As shown. In Figure 4 In this context, Block represents a block, Head represents the header, and Body represents the block body.

[0107] In S108, SHA256(SHA256(the Head of the current block)) = the hash value of the header of the current block, and this hash value is put into the header of the next block (the Head of the next block).

[0108] If the content of the current block is modified (such as the content of the block header), the hash value of the current block header will change, and the pre-hash of the next block will change accordingly, resulting in an overall hash change, which in turn changes the subsequent hash values. This is how the tamper-proof property is demonstrated.

[0109] Similarly, modifying the information in the block body will also change this hash value, primarily reflected in the Merkle tree, such as... Figure 5 As shown. For example, in the body of a blockchain, there are 8 specific information contents B1, B2, ..., B8. Each information content is nested twice using the SHA256() function. The result of SHA256(SHA256(B1)) is H1, H2, ..., H8.

[0110] Merkle Root:H12345678

[0111] The entire tree is a Merkle Tree;

[0112] If a transaction is modified, such as H3, all parent nodes related to that node will be affected, including H34, H1234, and H12345678 (i.e., the Merkle Root). Since the Merkle Root is written in the block header, it also affects the block header's hash value; thus, changes to the block body affect the block header. According to the consensus mechanism, nodes with write permissions (record nodes) synchronize all linked list information. Therefore, even if a node's block body content is tampered with, it will be synchronized back by the writing node.

[0113] By employing the tamper-proof features of distributed record nodes, the risk of information leakage and malicious manipulation caused by malicious attacks and control of any single node device in the industrial IoT platform is effectively reduced.

[0114] According to one embodiment of the present invention, determining a record node in a node includes:

[0115] For all nodes, change the random number in the node header;

[0116] The hash value is obtained by performing two hash calculations on the node header after changing the random number;

[0117] Compare the calculated hash value with the preset target value;

[0118] The record node is determined based on the comparison results.

[0119] According to one embodiment of the present invention, determining the recording node based on the comparison result includes:

[0120] The node corresponding to the smallest hash value among the calculated hash values ​​that is less than the preset target value is determined as the record node.

[0121] For example, the platform described in this invention uses a Proof-of-Work (PoW) mechanism to establish a consensus mechanism. By setting a preset target value, it searches for targets whose Pre-Hash is smaller than the preset target value.

[0122] Specifically, for the node header of all nodes, only the fifth random number Nonce is changed, and then two hash operations are performed. The node corresponding to the smallest hash value that is smaller than Target gets the right to record transactions (i.e. the right to write). If other nodes verify that the new node is correct, then the new node can join the main chain.

[0123] In other words, by using computing power and a certain probability, the minimum value among the values ​​less than the target is found first. The node corresponding to the minimum value is designated as a recording node to record information, while other nodes synchronize their information. When a new node joins, the recording node writes the new node information into its record.

[0124] By adopting a consensus mechanism, it can still guarantee information transmission and value transfer between devices without relying on a centralized organizational structure, thereby ensuring consistency and correctness at each device node.

[0125] In the description of this invention, it should be understood that the orientation or positional relationship indicated by directional terms such as "front, back, up, down, left, right", "horizontal, vertical, horizontal" and "top, bottom" is generally based on the orientation or positional relationship shown in the accompanying drawings, and is only for the convenience of describing this invention and simplifying the description. Unless otherwise stated, these directional terms do not indicate or imply that the device or element referred to must have a specific orientation or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation on the scope of protection of this invention; the directional terms "inner" and "outer" refer to the inner and outer contours relative to the outline of each component itself.

[0126] For ease of description, spatial relative terms such as "above," "on top of," "on the upper surface of," "above," etc., are used herein to describe the spatial positional relationship of a device or feature as shown in the figures to other devices or features. It should be understood that spatial relative terms are intended to encompass different orientations in use or operation beyond the orientation of the device as described in the figures. For example, if the device in the figures were inverted, a device described as "above" or "on top of" other devices or structures would subsequently be positioned as "below" or "under" other devices or structures. Thus, the exemplary term "above" can include both "above" and "below." The device may also be positioned in other different ways (rotated 90 degrees or in other orientations), and the spatial relative descriptions used herein will be interpreted accordingly.

[0127] Furthermore, it should be noted that the use of terms such as "first" and "second" to define components is merely for the purpose of distinguishing the corresponding components. Unless otherwise stated, the above terms have no special meaning and therefore should not be construed as limiting the scope of protection of this invention.

[0128] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for establishing an industrial IoT platform architecture, characterized in that, The method includes: Establish nodes, each corresponding one-to-one with a device in the platform. A node includes a node header, a node body, and a node route. The node header is used to connect devices in the platform, the node body is used to record the node's resource and service information, and the node route is used to provide services and search for resources for the node. The connected devices use point-to-point communication, and all devices connected to the platform network are considered nodes in the platform. Generate key pairs and resource information; Establish a mapping relationship between resource names and node IDs, and allocate resources to nodes according to the mapping relationship; Calculate the distance from the target node to the current node, and locate the target node in the routing table based on the calculated distance; The storage nodes in the node are connected in the form of a blockchain, and the hash value of the current block's header is put into the header of the next block; Determine the record node within the nodes to write the information of the newly added node into the record; The method also includes: The sending node in the node performs data signing; The receiving node in the node verifies the received data based on the data signature.

2. The method according to claim 1, characterized in that, The node header includes the hash value of the previous node header, the creation timestamp, the Merkle tree, the current difficulty, and a random number. The node body includes the node ID, identity ID, communication information, its own resource information, the service information that can be provided, and the service information that can be consumed. There is a mapping relationship between the node ID and the identity ID. The node route includes node information for the resource name and the storage resource name.

3. The method according to claim 2, characterized in that, Generating key pairs includes: The private key is generated using an elliptic curve cryptography algorithm; Use the identity ID as the public key.

4. The method according to claim 3, characterized in that, The distance from the target node to the current node in the computation node includes: The distance from the target node to the current node is obtained by performing an XOR operation on the node ID of the target node and the node ID of the current node using the Kad algorithm.

5. The method according to claim 4, characterized in that, The routing table is a K-bucket routing table. Locating the target node in the routing table based on the calculated distance includes: When the calculated distance is within the range of [2(i-1), 2i], the target node is located to K-bucket i.

6. The method according to claim 5, characterized in that, Determining record nodes within a node includes: For all nodes, change the random number in the node header; The hash value is obtained by performing two hash calculations on the node header after changing the random number; Compare the calculated hash value with the preset target value; The record node is determined based on the comparison results.

7. The method according to claim 6, characterized in that, Based on the comparison results, the record nodes include: The node corresponding to the smallest hash value among the calculated hash values ​​that is less than the preset target value is determined as the record node.

Images