Lightweight industrial control network transmission encryption method
By employing a lightweight stream encryption method in industrial control systems, negotiating random keys and generating stream ciphers, the security protection problem of resource-constrained devices in industrial control systems is solved, achieving a balance between data transmission security and real-time performance.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-09-29
- Publication Date
- 2026-04-10
AI Technical Summary
Existing industrial control systems lack lightweight cryptographic communication encryption systems, making it impossible to provide security protection for resource-constrained micro embedded devices while meeting real-time requirements.
A lightweight stream encryption method is adopted. By negotiating a random key Rkey between the industrial control host and the device, and using the public and private keys to generate a stream cipher SC, the XOR encryption and decryption of data bits are realized to ensure the security of data transmission.
While ensuring security, it reduces computation and resource consumption, thus meeting the real-time requirements of industrial control systems.
Smart Images
Figure CN115801311B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application belongs to the field of industrial control information security, and particularly relates to a lightweight industrial control network transmission encryption method. BACKGROUND
[0002] Data transmission between an industrial control host and an industrial control device is carried out through an industrial control communication protocol. Since the real-time requirement of an industrial control system is very high, in order to protect the data transmission security of the industrial control host and the industrial control device and prevent illegal intrusion, the communication encryption between the industrial control host and the industrial control device should use a lightweight cryptographic algorithm, while the real-time requirement of processing is also met. In addition, a large number of micro-embedded devices are contained in the industrial control system, and these micro devices need to realize the functions of calculation and communication under the conditions of limited computing power, storage space and energy source. In order to provide suitable security protection for the information accessed and transmitted by such resource-limited devices, a lightweight cryptographic algorithm is needed to find a balance between performance and security, so that it occupies less resources on the premise of security. At present, there is still a lack of lightweight cryptographic communication encryption system in the industrial control system. Therefore, a lightweight stream encryption system is needed to meet the real-time requirement of the industrial control system and overcome the shortcomings of device limitation. SUMMARY
[0003] The technical problem to be solved by the present application is to provide a lightweight industrial control network transmission encryption method to provide security protection for the data transmitted between an industrial control host and an industrial control device of an industrial control system.
[0004] To solve the above technical problem, an embodiment of the present application provides a lightweight industrial control network transmission encryption method for communication encryption between an industrial control host and an industrial control device, which comprises the following steps:
[0005] S1, the industrial control host selects a random key R key , and then uses the public key PcKey of the industrial control device to encrypt to generate ciphertext enc(R key , PcKey);
[0006] S2, the encrypted key enc(R key , PcKey) is sent to the industrial control device, and the industrial control device uses its own private key PsKey to decrypt to obtain the random key R key of the stream cipher, and notifies the industrial control host;
[0007] S3, the stream cipher machines on the industrial control host and the industrial control device side generate the same 2 key bit stream cipher SC according to the random key R n ;
[0008] S4, each time of processing transmits m times of data, and the data to be transmitted for the jth time is represented as dj b1d j b2…d j b nj , where nj represents the number of bits of the data of the jth transmission, the industrial host computer randomly selects a number i between 1 and (n-1) before each transmission of data j , and simultaneously randomly generates a number s j , indicating that the starting bit of the key used in the current data transmission in the SC is 2 ij +s j ;
[0009] S5, the encryption service module encrypts i j +s j using the public key PcKey of the industrial control device to generate ciphertext enc(i j +s j ), and simultaneously encrypts the encrypted data into e(d j b1)e(d j b2)…e(d j b nj ) using the stream key SC, and merges to obtain the encrypted information to be transmitted enc(i j +s j )e(d j b1)e(d j b2)…e(d j b nj ); then the industrial host computer transmits the jth encrypted information to the industrial control device, and then transmits the j+1th encrypted information, until the mth information transmission is completed;
[0010] S6, after the industrial control device receives the information sent by the industrial host computer, it first determines whether it is a new data, if so, the ciphertext information enc(i j +s j )e(d j b1)e(d j b2)…e(d j b nj ) is split to obtain the ciphertext information header enc(i j +s j ), which is decrypted by the decryption service module using the private key PsKey of the industrial control device to obtain i j , s j , and calculate 2 ij +s j to obtain the starting position of the decryption key of the subsequent ciphertext body in the SC, and the decryption service module decrypts the subsequent processed data enc(i j +s j )e(d j b1)e(d j b2)…e(d jb nj ) Perform stream decryption to obtain the decrypted data d. j b1d j b2…d j b nj .
[0011] In step S4, if the number of bits transmitted exceeds 2... n The cipher continues to be used starting from the first position of the stream cipher.
[0012] In step S5, when transmitting new processing information, it is necessary to regenerate the stream key.
[0013] The beneficial effects of the above-described technical solution of the present invention are as follows:
[0014] This invention provides a lightweight industrial control network transmission encryption method, which provides security protection for data transmitted between the industrial control host and industrial control equipment in an industrial control system, i.e., communication encryption. Attached Figure Description
[0015] Figure 1 This is a flowchart of the present invention. Detailed Implementation
[0016] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.
[0017] like Figure 1 As shown, this invention provides a lightweight industrial control network transmission encryption method, which mainly uses lightweight cryptographic technology to protect the network transmission data between the industrial control host and the industrial control equipment, i.e., communication encryption.
[0018] An industrial control host is a device that controls industrial control equipment, such as a CNC system. Typically, an industrial control host runs an industrial operating system and an industrial control system. Industrial control equipment refers to the specific equipment responsible for manufacturing and processing, including CNC machine tools, robots, PLCs, conveyor belts, AGVs, etc. Industrial control equipment and the industrial control host communicate using industrial control protocols. Currently, there is no unified industrial control protocol; each equipment manufacturer has its own independent protocol, the core of which is to ensure real-time processing.
[0019] This invention employs a lightweight stream encryption method for data transmission between the industrial control host and industrial control equipment. Each bit of transmitted data is encrypted using an XOR method, employing an approximately one-time pad encryption method, i.e., stream encryption.
[0020] This invention places a stream key generation facility and a stream cipher machine on both sides of the industrial control host and the industrial control equipment, respectively. Before each processing, both parties first negotiate the random key R of the stream cipher to be generated for the current processing data transmission. key The process is as follows:
[0021] The industrial control host selects a random key R key Then, the ciphertext enc(R) is generated by encrypting the data using the public key PcKey of the industrial control equipment. key PcKey), the encrypted key enc(R) key The PcKey is sent to the industrial control device, which decrypts it using its own private key PsKey to obtain the random key R for the stream cipher. key And notify the industrial control host.
[0022] Then the two stream cipher machines use the random key R key Simultaneously generate the same 2 n A stream cipher SC with n bits, where n is large enough to ensure that the number of keys required to encrypt the data processed each time is met.
[0023] Each processing step requires the transmission of data m times. Let the data to be transmitted in the j-th step be represented by bits as: d j b1d j b2…d j b nj Where nj represents the number of bits in the j-th data transmission. Before each data transmission, the industrial control host randomly selects a number i between 1 and (n-1). j At the same time, a number s is randomly generated. j This indicates that the key used for this data transmission has a starting bit of 2 in the SC. ij +s j If the number of bits transmitted exceeds 2 n The cipher continues to be used starting from the first position of the stream cipher.
[0024] The encryption service module puts i j +s j The ciphertext enc(i) is generated by encrypting the public key PcKey of the industrial control equipment. j +s j At the same time, the encrypted data is encrypted into e(d) using the stream key SC. j b1)e(d j b2)…e(d j b nj After merging, the encrypted information enc(i) to be transmitted is obtained. j +s j )e(d j b1)e(d j b2)…e(d j b nj The industrial control host then transmits the j-th encrypted message to the industrial control device, followed by the (j+1)-th encrypted message, until the m-th message transmission is complete. A new stream key needs to be generated when transmitting new processing information.
[0025] After the industrial control device receives the information sent by the industrial control host, it first determines whether it is new data, and if it is new data, it first decrypts the ciphertext information enc(i j +s j )e(d j b1)e(d j b2)…e(d j b nj ) to obtain the ciphertext information header enc(i j +s j ) and decrypts i j , s j using its own private key PsKey and the decryption service module to calculate 2 ij +s j , obtain the starting position of the decryption key of the subsequent ciphertext body in the SC, and then decrypt the subsequent processing data enc(i j +s j )e(d j b1)e(d j b2)…e(d j b nj ) to obtain the decrypted data d j b1d j b2…d j b nj , and then perform processing operations.
[0026] The entire encryption and decryption process is provided by the system bottom layer and is transparent to the user.
[0027] The above describes the preferred embodiments of the present application. It should be noted that for those skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, and these improvements and refinements should also be considered within the scope of protection of the present application.
Claims
1. A lightweight industrial control network transmission encryption method, characterized in that, The application relates to a method for encrypting communication between an industrial control host computer and an industrial control device, comprising the following steps: S1, the industrial control host selects a random key R key Then the ciphertext enc(R, PcKey) is generated by encrypting R using the public key PcKey of the industrial control device. key , PcKey) S2, the encrypted key enc(R key , PcKey) is sent to the industrial control device, and the industrial control device decrypts the encrypted key with its own private key PsKey to obtain the random key R key of the stream cipher and notifies the industrial control host. S3, the stream cipher machine on the side of the industrial control host and industrial control equipment, generates the random key R according to the random number R key At the same time, the same 2 n bit stream cipher SC is generated. S4, transmit m times data each time, suppose the data to be transmitted in the jth time is represented by bit d j b1d j b2...d j b nj wherein nj represents the number of bits of the data to be transmitted in the jth time, before transmitting data each time, the industrial host computer randomly selects a number i between 1 and (n-1) j and simultaneously randomly generates a number s j , indicating that the starting bit of the key used in the present data transmission in the SC is S5, the encryption service module encrypts i j + j with the public key PcKey of the industrial control device to generate ciphertext enc(i j + j ), and encrypts the encrypted data into e(d j b1)e(d j b2)...e(d j b nj ) with the stream key SC, and merges to obtain the encrypted information enc(i j + j )e(d j b1)e(d j b2)...e(d j b nj ) to be transmitted; then the industrial control host transmits the jthencrypted information to the industrial control device, and then transmits the j+1thencrypted information, until the mthinformation transmission is completed; S6, the industrial control device receives the information sent by the industrial control host, first determines whether it is a new data, if so, the new data first splits the ciphertext information enc(i j +s j )e(d j b1)e(d j b2)...e(d j b nj ) to obtain the ciphertext information header enc(i j +s j ), using the private key PsKey of the industrial control device to decrypt i j , s j , calculate get the start position of the decryption key of the subsequent ciphertext body in the SC, the decryption service module carries out stream decryption to the subsequent processing data enc(i j +s j )e(d j b1)e(d j b2)...e(d j b nj ), finally get the decrypted data d j b1d j b2...d j b nj .
2. The lightweight industrial network transmission encryption method of claim 1, wherein, In step S4, if the number of bits transmitted exceeds 2 n bits, then the cipher is continued from the first bit of the stream cipher.
3. The lightweight industrial network transmission encryption method of claim 1, wherein, In step S5, the new processing information needs to be re-generated into a stream key when being transmitted.