A flexible and configurable data security transmission method based on the edge side

Abstract

The present invention discloses a flexible and configurable data security transmission method based on the edge side, which is characterized in that it specifically includes the following steps: a trusted access management module in the gateway creates a trust center database to form a trusted connection device whitelist; after matching the MAC address with the trusted connection device whitelist, the gateway encrypts the data message of the trusted access device and transmits it to a remote receiving server, which performs a decryption operation. At present, the security of the industrial Internet is an important prerequisite for the healthy development of the industrial Internet. Plaintext data transmission is easily intercepted by hackers and brings unpredictable security risks. The information and data exchange between industrial equipment must be based on data security encrypted transmission. The gateway often does not have a step to encrypt the native data on the edge side, and lacks the verification of trusted access. The present invention adds these two requirements to ensure the security of network transmission.

Description

Technical Field

[0001] The present invention relates to a flexible and configurable data security transmission method based on an edge side, and belongs to the fields of Internet of Things technology, network security, and industrial automation. Background Art

[0002] With the development of the Internet of Things, there are more and more demands in the fields of smart power, smart grid, industrial automation, etc., with equipment communication control as the core, to expand intelligent information interaction to machine-to-machine, human-to-machine, machine-to-human, mobile network-to-machine, etc., to achieve end-to-end reliable networking and communication. This requires data access, forwarding, and storage.

[0003] At the same time, industrial Internet security is an important prerequisite for the healthy development of the industrial Internet, including equipment security, control security, network security, platform security and data security. Plain text data transmission is easily intercepted by hackers, which brings unpredictable security risks. The information and data exchange between industrial equipment must be based on data security and encrypted transmission. However, existing gateways generally send data in plain text for forwarding to the cloud platform, and mainly rely on manual identification operations for edge devices.

[0004] The invention patent No. 201510846844.2 discloses a data parallel encryption communication method and system based on the Modbus protocol, and the communication system includes: a data acquisition site and a central monitoring system. The data acquisition site includes a site configuration module, a data acquisition module, an improved SM4 parallel encryption module and a data transmission module; the central monitoring system includes a data receiving module, an improved SM4 parallel decryption module and a data display monitoring module. The communication system of the invention can improve the security of industrial data transmission, improve the encryption speed of real-time industrial data, and thus reduce the encryption processing delay. In addition, the system disclosed in the invention has a disconnection reconnection mechanism to ensure uninterrupted monitoring of the equipment. The method disclosed in the invention encrypts the traditional industrial protocol based on the edge side by improving the SM4 encryption model, but the invention does not involve encryption operations for data forwarding and remote transmission with remote receiving services or other devices.

[0005] The invention of patent number 201810768616.1 discloses a data packet forwarding method, device and system, wherein a device link aggregation group includes at least two switches, and the method includes: electing a switch as a host in the device link aggregation group, and setting a peer-link port of the elected host as a blocked port; performing bitmap negotiation in the device link aggregation group in which the host and the blocked port are elected to determine the positional relationship of each switch in the device link aggregation group; when the source switch sends a data packet to the device link aggregation group, the uplink port to be forwarded is determined in the device link aggregation group according to the positional relationship of each switch according to a preset forwarding mode, so as to forward the data packet from the determined uplink port to the target switch. The invention prevents data packet loss and improves the reliability of data forwarding. However, the invention does not involve remote transmission with a remote receiving service or other device.

[0006] The invention of patent number 202010299089.1 provides a method and system for forwarding data of an IoT device. The method for forwarding data of an IoT device includes: obtaining device data uploaded by an IoT device; processing the device data according to the configuration information of the client; and forwarding the device data to the destination configured by the client. The solution of this invention can realize the dynamic configuration of message routing, which is highly flexible. It encrypts various traditional industrial protocols based on the edge side, but does not involve the setting of access authentication for access devices. The device does not integrate industrial communication protocols and has no configuration for edge access device authentication. Summary of the invention

[0007] The purpose of the present invention is to provide a trusted access and data forwarding method based on the edge side.

[0008] In order to achieve the above object, the technical solution of the present invention is to provide a flexible and configurable data security transmission method based on the edge side, which is characterized by specifically comprising the following steps:

[0009] Step 1: The trusted access management module in the gateway creates a trust center database. The user writes the MAC address of the edge device that needs to forward data into the trust center database through the host computer software, thereby forming a whitelist of trusted connection devices in the trust center database;

[0010] Step 2: Configure the gateway to establish modbus-tcp communication with the edge device to be connected, and let the gateway data acquisition module in the gateway actively collect data from the edge device. Before completing the TCP connection between the gateway and the edge device, obtain the MAC address of the current edge device from the ARP packet sent by the edge device through the trusted access management module inside the gateway, and match the MAC address with the trusted connection device whitelist formed in step 1. If the match is successful, send a trusted access message of successful matching to the remote receiving server, notifying the remote receiving server that the current edge device of this communication is a trusted access device, and there is no restriction on its reading and writing, and then go to step 3;

[0011] If the MAC address fails to match the trusted connection device whitelist formed in step 1, the remote receiving server is notified that the current edge device of this communication is an untrusted access device, and the remote receiving server marks the current edge device as an untrusted access device in its local database;

[0012] Step 3: After the data message encryption and forwarding module of the gateway encrypts the data message of the trusted access device packet by packet to form ciphertext, the ciphertext is forwarded to the remote receiving server, completing the main functions of the gateway, including the following steps:

[0013] Step 3.1: After receiving the trusted access message, the remote receiving server creates a trusted device list in its local database and uses the MAC address of the current trusted access device and the current system time to form a 128-byte key K, which is the public key used for AES encryption;

[0014] Step 3.2: The remote receiving server replies the key K to the gateway with which it communicates;

[0015] Step 3.3: The data message encryption forwarding module of the gateway uses the key K to encrypt the data message using the AES128 encryption algorithm. After the ciphertext is formed, the gateway transmits the ciphertext to the remote receiving server; the key K is always stored on the gateway side and is used to bind all trusted access devices for current communication;

[0016] After any trusted access device ends communication and performs a TCP close operation, the remote receiving server and the gateway clear the key K corresponding to the trusted access device;

[0017] Step 4: The remote receiving server has a built-in Python interpreter that runs the AES-128 decryption algorithm to decrypt the sent data packets.

[0018] Preferably, in step 1, the MAC address of the edge side device is processed by the MD5 encryption algorithm, and the ciphertext is then stored in the trust center database.

[0019] Preferably, in step 2, after obtaining the MAC address of the current edge side device from the ARP packet sent by the edge side device through the trusted access management module inside the gateway, the trusted access management module performs MD5 encryption on the MAC address and matches the ciphertext obtained in real time with the ciphertext of the trusted connection device whitelist in the trust center database.

[0020] Preferably, in step 3.3, before the data message encryption forwarding module encrypts the received data message, it groups the data message of the current frame, each group is 128 bits long, and the groups with a length less than 128 bits are filled with characters using the ISO10126 filling algorithm.

[0021] At present, industrial Internet security is an important prerequisite for the healthy development of the industrial Internet, including equipment security, control security, network security, platform security and data security. Plaintext data transmission is easily intercepted by hackers, which brings unpredictable security risks. The information and data exchange between industrial equipment must be based on data security and encrypted transmission. This requirement is easily overlooked by gateway design. The gateway often does not have the steps to encrypt the native data on the edge side, and lacks the verification of trusted access. The present invention adds these two requirements to ensure the security of network transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 is a system architecture diagram of the present invention;

[0023] Figure 2 Schematic diagram of the process of edge devices passing authentication and entering the whitelist;

[0024] Figure 3 The edge side device can enter the whitelist data flow diagram through authentication;

[0025] Figure 4 This is a schematic diagram of the gateway encryption-transmission-decryption process;

[0026] Figure 5 Data flow diagram for key exchange between the gateway and the remote receiving server. DETAILED DESCRIPTION

[0027] The present invention will be further described below in conjunction with specific embodiments. It should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention. In addition, it should be understood that after reading the content taught by the present invention, those skilled in the art can make various changes or modifications to the present invention, and these equivalent forms fall within the scope limited by the appended claims of the application equally.

[0028] The method provided by the present invention is based on Figure 1 The system shown includes an edge-side device, a gateway, and a remote receiving server.

[0029] In the above system, edge-side devices include industrial automation equipment such as programmable logic controllers, temperature sensors, and smart meters. All edge-side devices need to have RJ45 network ports and support the MODBUS TCP protocol.

[0030] In the above system, the gateway needs to have the modbus acquisition function, and use the optional external network RJ45 interface and 3G / 4G module to interact with the external edge devices that support the protocol using the MODBUS TCP communication protocol, collect data from the edge devices, and forward the collected data to the remote receiving server. At the same time, the gateway can deploy a trusted center database to support the installation of trusted access function modules. The network also has a data message encryption forwarding module that can run Python to implement data AES-128 encryption.

[0031] In Gateway 2, the trusted access function module is one of the core devices in the data collection security service. It is built into the gateway service and is used to perform security authentication on edge devices that join the network. The trusted access function module performs network access, authorization, and verification steps for edge devices that need to forward data. The verified device identifier is added to the trusted center database to form a whitelist of trusted devices. A new edge device only joins the network temporarily after joining the network but before obtaining security authentication from the trusted access function module. Only when the new edge device is authenticated by the trusted access function module can the new edge device be considered to have fully joined the network and obtained permission to write data.

[0032] The data message encryption and forwarding module is also one of the core devices in the gateway security service. The gateway encrypts the collected data, encrypts the data to form ciphertext data, and then sends the ciphertext data to the remote receiving server. After receiving the ciphertext data, the remote receiving server decrypts it and sends the original data to the specified port. The data message encryption and forwarding module uses the key and AES function to encrypt the modbus-tcp message packet by packet and sends it to the remote receiving server. The remote receiving server uses the key and decryption function to decrypt the transmitted ciphertext to obtain the plaintext.

[0033] The present invention also provides a gateway host computer software for configuring the security policy of the accessed edge side device, that is, after the MAC address of the accessible edge side device is entered, a white list of access devices managed by the gateway is formed and stored in the trusted center database. The data configured by the gateway host computer software interacts with the gateway through the UDP protocol.

[0034] A mapping relationship needs to be established between the intranet IP and port of the remote receiving server and the public network. The port mapping can be configured through the NAT function on the router to complete the communication with the gateway. The remote receiving server receives the data packet sent by the gateway, analyzes the message data through the trusted device management module in the remote receiving server, and divides the message into trusted access messages and data messages. If the result of the data packet parsing is a trusted access message, the trusted device information is written into the trusted device list database. If the result of the data packet parsing is a data message, it is decrypted and forwarded to the application layer interface. The remote receiving server has a built-in Python interpreter that can run the AES-128 decryption algorithm to decrypt the sent data packets.

[0035] Based on the above system, the present invention provides a flexible and configurable data security transmission method based on the edge side, which specifically includes the following steps:

[0036] Step 1: The trusted access management module in the gateway creates a trust center database. The user writes the MAC address of the edge device that needs to forward data into the trust center database through the host computer software, thereby forming a whitelist of trusted connection devices in the trust center database.

[0037] In this embodiment, the MAC address of the edge device is processed using the MD5 encryption algorithm, and after forming a ciphertext, it is stored in the trust center database.

[0038] Step 2: Configure the modbus-tcp communication between gateway 2 and the edge device to be connected, so that the gateway data acquisition module in the gateway can actively collect data from the edge device. Figure 3 As shown, before completing the TCP connection between the gateway and the edge device, the MAC address of the current edge device is obtained from the ARP packet sent by the edge device through the trusted access management module inside the gateway. After the trusted access management module performs MD5 encryption on the obtained MAC address, the ciphertext obtained in real time is matched with the ciphertext of the trusted connection device whitelist in the trust center database. If the match is successful, the trusted access message of the successful match is sent to the remote receiving server, notifying the remote receiving server that the current edge device of this communication is a trusted access device, and there are no restrictions on its reading and writing, and then proceed to step 3;

[0039] If the ciphertext obtained in real time fails to match the ciphertext of the trusted connection device whitelist in the trust center database, the remote receiving server is notified that the current edge device of this communication is an untrusted access device. The remote receiving server marks the current edge device as an untrusted access device in its local database. Then, the write commands in all communication messages sent by the untrusted access device cannot reach the remote receiving server, that is, the messages with function codes 0x06 and 0x10 in modbustcp are filtered, and the gateway does not forward them. At the same time, it replies that the untrusted access device instruction is illegal, and the error code is set to 0x03, that is, illegal data value, and goes to step 3.

[0040] Step 3: The data message encryption and forwarding module of the gateway encrypts the data message of the trusted access device packet by packet to form a ciphertext, and then forwards the ciphertext to the remote receiving server, completing the main function of the gateway.

[0041] Step 3 includes the following steps:

[0042] Step 3.1: After receiving the trusted access message, the remote receiving server creates a trusted device list in its local database and uses the MAC address of the current trusted access device and the current system time to form a 128-byte key K, which is the public key used for AES encryption;

[0043] Step 3.2: The remote receiving server replies the key K to the gateway with which it communicates;

[0044] Step 3.3: The data message encryption forwarding module of the gateway uses the key K to encrypt the data message using the AES128 encryption algorithm. After the ciphertext is formed, the gateway transmits the ciphertext to the remote receiving server, such as Figure 5 As shown. The key K is always stored on the gateway side and is used to bind all trusted access devices in the current communication. After any trusted access device ends the communication and performs a TCP close operation, the remote receiving server and the gateway clear the key K corresponding to the trusted access device. This key acquisition method not only ensures the security of the cryptographic system but also takes into account the rapidity of computing power.

[0045] In order to meet the real-time transmission of modbus, the present invention selects the AES128 encryption algorithm. The message transmitted between the gateway and the remote receiving server is subjected to the following operation using the key K generated by step 3.1: Let the AES encryption function be E(), then C=E(K,P), where P is plaintext, K is the key, and C is the ciphertext. Let the AES decryption function be D(), then P=D(K,C), where C is the ciphertext, K is the key, and P is the plaintext. Before encryption, the data message encryption forwarding module groups the received modbus message data. Each group is 128 bits long, and groups with a length of less than 128 bits are filled with characters using the ISO10126 filling algorithm.

[0046] Step 4: The remote receiving server has a built-in Python interpreter that runs the AES-128 decryption algorithm to decrypt the sent data packets.

[0047] When the key length is 128 bits, the encryption process of the AES algorithm is divided into ten rounds, and the decryption process of the AES-128 decryption algorithm is also divided into ten rounds, and each round of operation is the inverse operation of the encryption operation. After the decryption operation is completed, the remote receiving server forwards the decrypted message to the port of the corresponding application.

Claims

1. A flexible and configurable data security transmission method based on the edge side, characterized in that: The specific steps include: Step 1: The trusted access management module in the gateway creates a trust center database. The user writes the MAC address of the edge device that needs to forward data into the trust center database through the host computer software, thereby forming a whitelist of trusted connection devices in the trust center database; Step 2: Configure the gateway to establish modbus-tcp communication with the edge device to be connected, and let the gateway data acquisition module in the gateway actively collect data from the edge device. Before completing the TCP connection between the gateway and the edge device, obtain the MAC address of the current edge device from the ARP packet sent by the edge device through the trusted access management module inside the gateway, and match the MAC address with the trusted connection device whitelist formed in step 1. If the match is successful, send a trusted access message of successful matching to the remote receiving server, notifying the remote receiving server that the current edge device of this communication is a trusted access device, and there is no restriction on its reading and writing, and then go to step 3; If the MAC address fails to match the trusted connection device whitelist formed in step 1, the remote receiving server is notified that the current edge device of this communication is an untrusted access device, and the remote receiving server marks the current edge device as an untrusted access device in its local database; Step 3: After the data message encryption and forwarding module of the gateway encrypts the data message of the trusted access device packet by packet to form ciphertext, the ciphertext is forwarded to the remote receiving server, completing the main functions of the gateway, including the following steps: Step 3.1: After receiving the trusted access message, the remote receiving server creates a trusted device list in its local database and uses the MAC address of the current trusted access device and the current system time to form a 128-byte key K, which is the public key used for AES encryption; Step 3.2: The remote receiving server replies the key K to the gateway with which it communicates; Step 3.3: The data message encryption forwarding module of the gateway uses the key K to encrypt the data message using the AES128 encryption algorithm. After the ciphertext is formed, the gateway transmits the ciphertext to the remote receiving server; the key K is always stored on the gateway side and is used to bind all trusted access devices for current communication; After any trusted access device ends communication and performs a TCP close operation, the remote receiving server and the gateway clear the key K corresponding to the trusted access device; Step 4: The remote receiving server has a built-in Python interpreter that runs the AES-128 decryption algorithm to decrypt the sent data packets.

2. A flexible and configurable data security transmission method based on the edge side as described in claim 1, characterized in that: It is characterized in that In step 1, the MAC address of the edge device is processed by the MD5 encryption algorithm, and the ciphertext is stored in the trust center database.

3. A flexible and configurable data security transmission method based on the edge side as described in claim 2, characterized in that: It is characterized in that In step 2, after obtaining the MAC address of the current edge device from the ARP packet sent by the edge device through the trusted access management module inside the gateway, the trusted access management module performs MD5 encryption on the MAC address and matches the ciphertext obtained in real time with the ciphertext of the trusted connection device whitelist in the trust center database.

4. A flexible and configurable data security transmission method based on the edge side as claimed in claim 1, characterized in that: It is characterized in that In step 3.3, before the data message encryption forwarding module encrypts the received data message, it groups the data message of the current frame, each group is 128 bits long, and the groups with a length less than 128 bits are filled with characters using the ISO10126 filling algorithm.

Images