Numerical control system password infrastructure based on domestic password algorithm and control method

Abstract

The application belongs to the technical field of numerical control processing, and discloses a numerical control system password infrastructure based on a domestic password algorithm and a control method, which comprises: basic password services, including system management, key management, certificate services, gateway management, data transmission, protocol management, system logs, security audits, system monitoring, middleware services, trusted modules, and external interfaces; certificate application, acquisition, and query are carried out based on MQTT lightweight certificate services and in line with the NC-Link protocol of the numerical control system, and attributes are embedded in identity certificates for communication encryption, identity authentication, and authorization. The application meets basic security service requirements, greatly reduces repeated development of password services, avoids unknown security vulnerabilities, and realizes independent controllability in key application scenarios; the certificate services designed through the MQTT protocol provide low communication overhead and efficient certificate application services for small and miniature machines, support attribute embedding in certificates, and the NC-Link security system adopted provides basic security service support for the numerical control system.

Description

Technical Field

[0001] This invention belongs to the field of CNC machining technology, and particularly relates to a cryptographic infrastructure and control method for a CNC system based on domestically developed cryptographic algorithms. Background Technology

[0002] With the development of networked CNC systems, these systems are facing serious security threats, and currently, CNC systems as a whole lack security guarantees. Transforming the network security problems of complex CNC systems into high-strength cryptographic countermeasures is an important and scientific method for solving CNC security issues. Cryptographic technology is a core technology in the field of information security, effectively solving problems related to the confidentiality, integrity, and authenticity of information; its importance is self-evident. Cryptographic technology, as a fundamental security protection measure, permeates the entire process of the Industrial Internet. Domestic cryptography, also known as commercial cryptography, includes widely used symmetric encryption algorithms such as SM4, elliptic curve asymmetric encryption algorithms such as SM2, and hash algorithms such as SM3. Domestic cryptographic technology is mature. Using domestic cryptography as the security foundation for information security protection of CNC systems can serve as the technical basis for identity authentication, data storage, data transmission, data auditing, and trusted computing. It is essential to use domestic cryptography for CNC system security protection to break away from dependence on foreign technologies and achieve secure, independent, and controllable CNC systems. The first priority is to develop certificate services that support TLS and identity authentication and design a public key infrastructure. However, the commonly used HTTP protocol has too many headers, which can easily lead to bandwidth waste in small and lightweight device applications. Therefore, a public key infrastructure based on the MQTT protocol for communication was designed.

[0003] Because CNC systems require multi-layered and multi-faceted security protection—for example, providing security protection for the underlying bus layer and the middle layer of the CNC system host, as well as security authentication for PLCs and terminal machines—and considering the storage security, communication security, access control, and identity authentication of multiple systems, each system needs to build its own cryptographic system, including key management, key distribution, key negotiation, digital signatures, identity authentication, encryption and decryption. If each system were to build its own cryptographic infrastructure, it would result in redundant construction and increased system complexity. Therefore, a domestically developed cryptographic infrastructure for CNC systems was designed and implemented to provide a unified security foundation for the entire CNC system, reducing system complexity and improving reliability.

[0004] Cryptographic infrastructure consists of public key infrastructure (PKI) and cryptographic management services, providing services including digital certificate services, key generation and management services, gateway management services, and protocol management services. Currently, digital certificates, as a crucial foundation for TLS and identity authentication, are widely used in various encryption protocols and authentication mechanisms. PKI uses asymmetric cryptographic algorithms and hash algorithms to sign X.509 format certificates carrying user information, ensuring the immutability of the certificates, and provides certificate revocation status services to external parties through a certificate query interface. PKI consists of three main components: RA (Registered Access Provider), CA (Certificate Authority), and digital certificate store. The CA is responsible for generating certificates based on certificate requests and signing them with its private key, while also providing an online certificate status query service, allowing users to check whether their certificates are valid or have been revoked by the CA. The RA is responsible for receiving and reviewing user certificate applications and sending approved applications to the CA. The digital certificate store stores issued certificates and provides certificate distribution services based on this. Users apply for and obtain certificates through PKI, which provides end-to-end certificate management services from generation and issuance to revocation. For the certificates it issues, users can use the certificates provided by the CA to verify the signature source and certificate validity.

[0005] Besides communication encryption, user-obtained certificates are commonly used for identity authentication. The authentication service determines system access permission by extracting the user's identity information from the certificate body, and then authorizes access according to the permission policy. In attribute-based authorization scenarios, after verifying identity through the certificate, the service also needs to extract the user's corresponding attributes from the attribute database to determine their access permissions to various services within the system. Certificate-related password management services support encryption and decryption processes within the system, including key generation, acquisition, storage, and revocation; encryption / decryption algorithm calling interfaces; and interfaces for extracting information from certificates for subsequent authentication and authorization. Additionally, there are protocol management and security gateway management services for network security within the system.

[0006] Based on the above analysis, the problems and shortcomings of the existing technology are as follows:

[0007] (1) In the prior art, public key infrastructure provides services based on the HTTP protocol. The HTTP protocol is too heavy in the scenario of CNC system where the sending and receiving targets are clear and the equipment is relatively fixed. It is not suitable for small equipment that requires lightweight communication. Moreover, most of the equipment in the existing CNC system uses non-HTTP protocol for communication, making it difficult to adapt to public key infrastructure that provides services based on HTTP.

[0008] (2) The existing cryptographic services are complex, with problems of redundant construction of encryption and decryption, key management and certificate parsing systems, and lack of a unified cryptographic service platform.

[0009] (3) In the scenario of attribute-based permission management, an attribute library needs to be added to realize the permission allocation after user authentication, which increases the complexity of the system. Summary of the Invention

[0010] To address the problems existing in the prior art, this invention provides a cryptographic infrastructure and control method for numerical control systems based on domestically developed cryptographic algorithms.

[0011] This invention is implemented as follows: a cryptographic infrastructure for CNC systems based on domestically developed cryptographic algorithms. This infrastructure provides basic cryptographic services, including system management, key management, certificate services, gateway management, data transmission, protocol management, system logs, security auditing, system monitoring, middleware services, trusted modules, and external interfaces. It utilizes a lightweight MQTT certificate service, conforming to the NC-Link protocol of CNC systems, for certificate application, acquisition, and querying. Simultaneously, it embeds attributes into identity certificates for communication encryption, identity authentication, and authorization.

[0012] Furthermore, the cryptographic infrastructure of the CNC system based on domestic cryptographic algorithms includes: a system management front-end operation page, a basic service and management terminal, a CA, RA, MQTT broker, a log collection client, a gateway management client, a certificate application / acquisition call terminal, and a certificate query call terminal;

[0013] The system management front-end operation page is used to access the management page through a browser for operation;

[0014] The basic service and management terminal is used to receive management commands sent by the system management front-end operation page, and to enable, disable, and edit keys and certificates, as well as manage gateways and protocols.

[0015] The CA and RA are used to execute operations according to management commands;

[0016] The MQTT broker is the open-source component Mosquitto, used for communication;

[0017] The log collection client is used to collect logs from each cluster and transmit them to the basic service and management terminal for archiving and storage.

[0018] The gateway management client is used to receive gateway management commands and return the execution results;

[0019] The certificate application / acquisition client is used for applying for and obtaining certificates;

[0020] The certificate query client is used for certificate querying.

[0021] Furthermore, when deploying the basic services and management-side load balancing, a load balancer is added, and the load balancer is adjusted using the open-source Nginx in conjunction with LVS and Keepalived.

[0022] When the MQTT broker performs load balancing, it enables Mosquitto cluster mode for master-slave synchronization and uses LVS for TCP-level MQTT load balancing; the MQTT broker supports Chinese cryptographic SSL communication by replacing the cryptographic packets used in Mosquitto with TASSL cryptographic packets and adding a Chinese cryptographic connection option.

[0023] The log collection client is implemented based on the Filebeat open-source component. After setting the source log file location and the management terminal URL, the source file is transmitted to the basic service and management terminal for archiving via socket.

[0024] Furthermore, the cryptographic infrastructure of the CNC system based on domestic cryptographic algorithms includes: a series of key management interfaces, encryption / decryption interfaces, certificate application interfaces, certificate receiving interfaces, and certificate query interfaces;

[0025] The key management interface series is divided into key generation interface, key acquisition interface, and key recovery acquisition interface. By requesting the relevant interfaces through the HTTP protocol, the basic service and management terminal will perform key mapping operations. Key generation is provided by the TASSL cryptographic package, while key acquisition and key recovery acquisition are performed by querying the required key from the database and returning it.

[0026] The encryption / decryption interface is divided into an encryption interface and a decryption interface. By requesting the relevant interface via the HTTP protocol, the basic service and management terminal will run the specified encryption / decryption algorithm and return the ciphertext / plaintext. The encryption / decryption algorithm is provided by the TASSL cryptographic packet.

[0027] The certificate request interface is deployed in MQTT Topic:certReq / {ca_id} / {balance_id}, and the certificate query interface is deployed in the CA.

[0028] Furthermore, when the management command manages the CA and RA, it publishes the management command via the MQTT protocol and subscribes to the execution results; when the management command manages the gateway, the basic service communicates with the gateway management client via TCP sockets to transmit management commands and receive responses; when the management command applies for, obtains, or queries certificates, it communicates with the CA and RA via the MQTT protocol and uses a database to store certificates, CAs, gateways, keys, and audit information.

[0029] Furthermore, the specific process of issuing management commands via the MQTT protocol is as follows:

[0030] When the basic service and management terminal initiates a command, it publishes the command in JSON format to the specified Topic of the MQTT broker. The execution terminal obtains the message by subscribing to the Topic, parses the JSON message, executes it, and returns the operation result to the basic service and management terminal. The basic service and management terminal then writes the data changes to the database and displays them on the system management front-end operation page.

[0031] Furthermore, the management commands for the CA and RA include:

[0032] When operating on the CA, the browser request is first transmitted to the basic service and management terminal. According to the instructions, the browser sends management commands to the CA and RA using the MQTT protocol. The management of the CA is published on MQTT Topic:caMgmt / {ca_id} based on the CA ID, and the management of the RA is published on MQTT Topic:raMgmt / {ca_id} based on the CA ID. The CA obtains management commands by subscribing to MQTT Topic:caMgmt / {ca_id}, and the RA obtains management commands by subscribing to MQTT Topic:raMgmt / {ca_id}.

[0033] After the CA and RA perform corresponding operations according to the management command, they publish the execution results to MQTT Topic:caRes and MQTT Topic:raRes respectively. The basic service and management terminal obtain the success or failure of the command execution by subscribing to MQTT Topic:caRes and MQTTTopic:raRes, write the information changes to the database and logs, and display the execution results on the system management front-end operation page.

[0034] Furthermore, the execution process of the management command for certificate application, acquisition, and query includes:

[0035] The certificate request client generates a signing private key and a public key locally, and publishes a Certificate Request File (CSR) in PEM format, which contains the public key, the certificate subject, and the attributes of the applicant, to a Topic. `ca_id` is the ID of the target CA, and `balance_id` is the ID of the specified server in the cluster, used for load balancing. These attributes are embedded as extensions in X509V3, and the certificate request is received and checked by the RA corresponding to the CA.

[0036] After receiving a client request by subscribing to certReq, the RA receiving the request has the same ID as the target CA. It verifies whether the CSR signature comes from the declared client and determines the CA certificate approval status based on the basic service and management terminal. If it is enabled, the CSR is stored in the database. If it is not enabled, the CSR and RA approval information are published to MQTTTopic:raToken / {ca_id} / {balance_id}, where ca_id and balance_id remain unchanged. When certificate approval is enabled, the RA will query the database for the certificate request approval status through a scheduled task and publish the approved CSR.

[0037] The CA receives the Certificate Signature (CSR) by subscribing to raToken, generates an encrypted private key and a public key, parses the CSR, creates an encrypted certificate and a decryption certificate, and signs the certificate with the CA's private key. It then records the certificate applicant's information, attributes, and PEM format certificate into the certificate store. After converting the encrypted private key to BASE64 format using the signing certificate and SM2 public key encryption, it publishes the encrypted private key, along with the signing certificate and the encrypted certificate, to MQTT Topic:subCert / {client_id}, where client_id is the client ID, which is included in the certificate request. After the certificate is issued, the CA stores the certificate information in the database.

[0038] The certificate receiving client obtains the ciphertext of the signing certificate, encryption certificate, and encryption private key by subscribing to subCert. After decrypting the ciphertext of the encryption private key using the local signing private key, the signing certificate, encryption certificate, and encryption private key are saved.

[0039] An online certificate status query service based on MQTT is provided. The MQTT Topic is `vali_qury / {balance_id}`, where `balance_id` is the load balancer ID. The published content includes the sequence number of the certificate to be queried and the client ID of the API caller. The Certificate Authority (CA) obtains the certificate query request by subscribing to `vali_qury`, retrieves the certificate from the database by its sequence number, obtains the current certificate status (normal or revoked), and publishes the query results to `vali_ret / {client_id}`. The client calling the certificate query obtains the status of the queried certificate by subscribing to `vali_ret / {client_id}`.

[0040] Another objective of this invention is to provide a control method for implementing the cryptographic infrastructure of a CNC system based on domestically developed cryptographic algorithms, wherein the control method for the cryptographic infrastructure of a CNC system based on domestically developed cryptographic algorithms includes:

[0041] The system management front-end operation page is accessed through a browser to perform operations, call encryption / decryption and key generation / acquisition interfaces, send HTTPS requests, parse the JSON-formatted management commands, and perform CA / RA management, gateway management, or certificate application, acquisition, and query.

[0042] Another object of the present invention is to provide a computer device, the computer device including a memory and a processor, the memory storing a computer program, the computer program being executed by the processor causing the processor to perform the steps of the control method for the cryptographic infrastructure of the numerical control system based on domestic cryptographic algorithms.

[0043] Based on the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solution to be protected by this invention are as follows:

[0044] First, addressing the technical problems existing in the prior art and the difficulty in solving them, this paper closely analyzes, in conjunction with the technical solution to be protected by this invention and the results and data obtained during the research and development process, how the technical solution of this invention solves the technical problems, and the inventive technical effects brought about by solving these problems. The specific description is as follows:

[0045] To address the technical issue of excessively heavy HTTP headers in lightweight scenarios, this invention provides certificate services based on the MQTT protocol. Certificate application for small and micro-sized devices becomes effortless, without consuming excessive communication resources. By specifying MQTT topics for receiving and sending messages, efficient delivery to the target machine is ensured. Each topic has a fixed function, the message sending and receiving chain is clear and concise, and server-side load balancing is supported through specific IDs. While utilizing MQTT, this invention also aligns with domestic CNC system applications. The certificates issued by this invention can be used for encryption, decryption, and authentication in the NC-Link protocol for CNC system interconnection. Adapting to the NC-Link protocol and using MQTT as the communication protocol, this invention can be easily integrated into the NC-Link security service chain. CNC system-related devices can directly perform certificate application, acquisition, and query operations via the MQTT protocol.

[0046] Second, considering the technical solution as a whole or from a product perspective, the technical effects and advantages of the technical solution to be protected by this invention are specifically described as follows:

[0047] The cryptographic infrastructure proposed in this invention integrates basic cryptographic services, meeting the fundamental security service needs of various systems and significantly reducing redundant development of cryptographic services. It provides various cryptographic services based on domestically developed cryptographic algorithms, avoiding unknown security vulnerabilities of foreign cryptographic algorithms and achieving independent control in critical application scenarios. The certificate service, designed using the MQTT protocol with a publish-subscribe communication method, provides low-communication-overhead, high-efficiency certificate application services for small and micro-machines, and supports embedding attributes into certificates, facilitating use in attribute-based access control systems. Simultaneously, it is compatible with the NC-Link protocol for CNC system interconnection, easily integrating into the NC-Link security system and providing basic security service support for CNC systems.

[0048] Third, as supplementary evidence of the inventive step of the claims of this invention, it is also reflected in the following important aspects:

[0049] Does the technical solution of this invention solve a technical problem that people have long desired to solve but have never been able to successfully address?

[0050] The CA designed in this invention supports embedding user-specified attributes as X509V3 extensions into the certificate during certificate issuance. This effectively solves the technical problem that attribute-based access control systems rely on attribute libraries. It can directly rely on the certificate system to securely and reliably read attributes from the certificate and grant users corresponding permissions based on the attributes, thus simplifying the application of attribute-based access control systems. Attached Figure Description

[0051] Figure 1 This is a diagram of the cryptographic infrastructure architecture provided in an embodiment of the present invention;

[0052] Figure 2 This is a command execution flowchart based on the MQTT protocol provided in an embodiment of the present invention;

[0053] Figure 3 This is a schematic diagram of the CA registration file provided in an embodiment of the present invention;

[0054] Figure 4 This is a diagram showing the running result of the CA registration program provided in this embodiment of the invention;

[0055] Figure 5 This is a diagram of the CA management interface provided in an embodiment of the present invention;

[0056] Figure 6 This is a schematic diagram of the CA enabling completion interface provided in an embodiment of the present invention;

[0057] Figure 7 This is a schematic diagram of the certificate application information provided in an embodiment of the present invention;

[0058] Figure 8This is a diagram showing the running result of the certificate request client provided in an embodiment of the present invention;

[0059] Figure 9 This is a schematic diagram of the certificate application and approval interface provided in an embodiment of the present invention;

[0060] Figure 10 This is a diagram showing the certificate acquisition process provided in an embodiment of the present invention.

[0061] Figure 11 This is a diagram of the certificate storage directory structure provided in an embodiment of the present invention;

[0062] Figure 12 This is a schematic diagram of the certificate management interface provided in an embodiment of the present invention;

[0063] Figure 13 This is a schematic diagram of the running result of the certificate query client provided in the embodiment of the present invention. Detailed Implementation

[0064] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0065] To enable those skilled in the art to fully understand how the present invention is specifically implemented, this section provides an explanatory description of the embodiments that expand upon the technical solutions of the claims.

[0066] The cryptographic infrastructure for CNC systems based on domestically developed cryptographic algorithms provided in this invention features a front-end developed using Vue, a management interface developed using Java, and CA, RA, and client programs developed using C. By installing the client on the managed machine, administrators can access the management interface of this infrastructure via a URL. Users can obtain certificates and query certificate status by running the certificate issuance and query function calls. Users can also write their own MQTT-based programs to request certificates and query certificate status via interfaces. Load balancing deployment is supported.

[0067] The architecture of this invention embodiment is as follows Figure 1 As shown, it is mainly divided into system management front-end operation page, basic services and management terminal, CA, RA, MQTT agent, log collection client, gateway management client, certificate application / acquisition call terminal, and certificate query call terminal.

[0068] The basic services and management interface are responsible for receiving HTTPS requests from administrators accessing the management page through a browser, parsing the JSON-formatted management commands, and publishing management commands via the MQTT protocol when the management operation pertains to the certificate issuance module (including CA and RA management) and subscribing to execution results. When managing the gateway, management commands are transmitted directly via sockets, and responses are received. Certificate application, acquisition, and querying all communicate with CA and RA via the MQTT protocol. The system uses a database to store certificates, CAs, gateways, keys, and audit information. Modules retrieve data from the database to ensure synchronization of information modifications, additions, and deletions.

[0069] This invention uses the open-source TASSL package as the support for domestic cryptographic algorithms. All domestic cryptographic algorithms, such as communication encryption and certificate signing, are implemented using this package.

[0070] This invention uses Mosquitto (an open-source component) modified with domestic cryptography as an MQTT broker. By replacing the cryptographic packets used in Mosquitto with TASSL cryptographic packets, a Chinese cryptographic connection option is added to support Chinese cryptographic SSL communication.

[0071] When deploying load balancing for basic services and management, a load balancer needs to be added. The load balancer can be customized; this invention uses the open-source Nginx in conjunction with LVS and Keepalived. When MQTT broker load balancing is required, Mosquitto cluster mode is enabled for master-slave synchronization, and LVS is used for TCP-level MQTT load balancing.

[0072] Infrastructure administrators manage Certificate Authorities (CAs) via a browser-accessed management page. This includes enabling, disabling, modifying (e.g., area identification information), and removing CAs, as well as calling certificate application, retrieval, and query interfaces. Communication uses the MQTT protocol. When basic services and the management end initiate commands, they publish JSON-formatted data on an MQTT Topic. The execution end subscribes to the Topic, retrieves the message, parses it, executes it, and returns the result to the management end. The management end then writes the data changes to its database. Figure 2 As shown. When managing the gateway, management commands are sent to the gateway management client via TCP sockets and responses are received. When managing and using other modules, since they are already integrated with the basic services and management terminal, no external interaction is involved, and control is directly performed internally through state variables.

[0073] Furthermore, the CA and RA management includes:

[0074] When operating on a CA (in this invention, certificate applications are received and checked by the RA corresponding to the CA; the RA and CA share the same ID, forming a one-to-one correspondence), the browser request is first transmitted to the basic service and management end. Then, according to the instructions, management commands are sent to the CA and RA using the MQTT protocol. Management of the CA is published on the MQTT Topic:caMgmt / {ca_id} based on the CA ID, and management of the RA is also published on the MQTT Topic:raMgmt / {ca_id} based on the CA ID. The CA obtains management commands by subscribing to MQTT Topic:caMgmt / {ca_id}, and the RA obtains management commands by subscribing to MQTT Topic:raMgmt / {ca_id}. After the CA and RA perform the corresponding operations according to the management commands, they publish the execution results to MQTT Topic:caRes and MQTT Topic:raRes respectively. The basic service and management end obtains the success or failure of the command execution by subscribing to these two topics, writes the information changes to the database and logs, and displays the execution results on the front-end management page.

[0075] Furthermore, the certificate application, acquisition, and query include:

[0076] The certificate request interface is deployed on the MQTT Topic:certReq / {ca_id} / {balance_id}. The certificate request client generates a signing private key and public key locally, and publishes a PEM format Certificate Request File (CSR) containing the public key, the certificate subject, and the attributes of the subject requesting the certificate (the attributes are embedded as extensions in X509V3) to this Topic. ca_id is the ID of the target CA, and balance_id is the server ID specified in the cluster, determined according to the actual deployment, used for load balancing.

[0077] After receiving a client request by subscribing to certReq (the RA receiving the request must have the same ID as the target CA), the RA verifies whether the CSR signature originates from the declared client. Based on the management's certificate approval status for that CA, if approval is enabled, the CSR is stored in the database; otherwise, the CSR and RA approval information are directly published to MQTTTopic:raToken / {ca_id} / {balance_id}, where ca_id and balance_id remain unchanged. If certificate approval is enabled, the RA will use a scheduled task to query the database for certificate request approval status and publish the approved CSR.

[0078] The Certificate Authority (CA) receives Certificate Requests (CSRs) by subscribing to raTokens, generates encrypted private and public keys, parses the CSR, creates encrypted and decrypted certificates, and signs the certificates using its private key. It then records the certificate applicant's information, attributes, and PEM format certificate in the certificate store. After converting the encrypted private key to BASE64 format using SM2 public key encryption with the signing certificate, it publishes the private key, along with the signing and encrypted certificates, to the MQTT topic:subCert / {client_id}, where client_id is the client ID, which is included in the certificate request. Once the certificate is issued, the CA stores the certificate information in its database.

[0079] The certificate receiving client obtains the ciphertext of the signing certificate, encryption certificate, and encryption private key by subscribing to subCert. After decrypting the ciphertext of the encryption private key using the previously stored local signing private key, the client saves the signing certificate, encryption certificate, and encryption private key.

[0080] The certificate query interface is deployed in the CA module. This service is an online certificate status query service based on MQTT, MQTT Topic:vali_qury / {balance_id}, where balance_id is the load balancer ID, specified by the system administrator. The published content includes the serial number of the certificate to be queried and the client_id of the interface caller. The CA obtains certificate query requests by subscribing to vali_qury, retrieves the certificate from the database by its serial number, obtains the current certificate status (normal or revoked), and publishes the query results to MQTT Topic:vali_ret / {client_id}. The caller can obtain the status of the queried certificate by subscribing to vali_ret / {client_id}.

[0081] Furthermore, the basic services and management interface include:

[0082] When enabling, disabling, or editing keys and certificates, the basic services and management end directly operate on the infrastructure database to complete data updates. The various modules of this invention synchronize information through the database.

[0083] When performing gateway and protocol management operations, the basic service and management terminal will use sockets to communicate with the gateway management client to transmit management commands. The client will call the corresponding interface of the gateway according to the commands to perform management operations, including adjusting the allowed protocols, and return the execution results as a response to the management terminal.

[0084] The log collection client is deployed on each server in each cluster. It is responsible for collecting the logs generated by each module and transmitting them to the basic service and management terminal for archiving. The client is based on the Filebeat open source component. After setting the source log file location and the management terminal URL, the source file is transmitted to the management terminal for archiving via socket.

[0085] This invention provides a series of interfaces for key management, encryption / decryption middleware, certificate application, certificate receiving, and certificate query.

[0086] The key management interface series is divided into key generation interface, key acquisition interface, and key recovery acquisition interface. The caller requests the relevant interface through the HTTP protocol. The basic service and management end will perform key matching operations. Key generation is provided by TASSL cryptographic package, while key acquisition and key recovery acquisition query the required key from the database and return it.

[0087] The encryption / decryption interface is divided into encryption and decryption interfaces. The caller requests the relevant interface through the HTTP protocol. The basic service and management end will run the specified encryption / decryption algorithm and return the ciphertext / plaintext. The encryption / decryption algorithm is provided by the TASSL cipher packet.

[0088] The certificate application interface, certificate receiving interface, and certificate receiving interface have been described in the section on certificate issuance, acquisition, and query.

[0089] This invention provides a control method for a cryptographic infrastructure of a numerical control system based on domestically developed cryptographic algorithms, including:

[0090] The system management front-end operation page is accessed through a browser to perform operations, call encryption / decryption and key generation / acquisition interfaces, send HTTPS requests, parse the JSON-formatted management commands, and perform CA / RA management, gateway management, or certificate application, acquisition, and query.

[0091] The system management front-end is accessed via a browser, and HTTPS requests are sent to parse the JSON-formatted management commands for CA, RA, gateway, or certificate management. The system management front-end is a web page code that can be parsed by a browser and is deployed in Nginx, an open-source web server capable of processing and forwarding HTTP requests. When an administrator accesses the system management front-end via a browser, Nginx sends the page code to the browser, which then parses it and presents the management page to the administrator. Nginx's cryptographic packet has been replaced with a TASSL cryptographic packet, supporting Chinese national cryptographic SSL. If the administrator uses a browser that supports Chinese cryptographic protocols, a Chinese national cryptographic SSL connection will be established with Nginx to complete encrypted communication, enabling front-end and back-end communication based on the HTTPS protocol.

[0092] When the administrator performs specific operations, the management command is parsed into a JSON format message by the system management front end and encapsulated into an HTTPS request body. Then, the request is sent to Nginx through the browser. According to the load balancing settings, Nginx will distribute the traffic evenly to the basic services and the instances in the management cluster for processing. After receiving the JSON format message, the instance parses it and performs the corresponding operation according to the message content.

[0093] When performing CA and RA management, the basic service and management end extract the JSON format message from the HTTPS request body. Based on the target item in the message, if it is "CA", it is determined that it is managing the CA, and if it is "RA", it is managing the RA. The JSON format message is then published as the payload in the MQTT protocol to the CA management interface MQTT Topic: caMgmt / {ca_id} or the RA management interface MQTT Topic: raMgmt / {ca_id} to complete the transmission of management commands, which are then executed by the CA and RA.

[0094] When performing gateway management, the basic service and management end extract the JSON format message from the HTTPS request body. Based on the target item in the message, if it is "Gateway", it is determined that it is a gateway management. The JSON format message is then transmitted to the gateway management client as socket transmission content without modification, and the client finally executes the command.

[0095] When performing certificate management, the basic service and management terminal extract JSON format messages from the HTTPS request body. Based on the target field in the message, if it is "Cert", it is determined that it is certificate management. The JSON format message is directly parsed, and the certificate being operated on is obtained from the certId field in the message. The purpose of the operation is obtained from the cmd field in the message. If it is "Open", it means the certificate is enabled; if it is "Stop", it means the certificate is disabled; if it is "Revoke", it means the certificate is removed; if it is "Recovery", it means the certificate key is recovered. After obtaining the information, the basic service and management terminal directly write the information into the certificate database to complete the certificate management.

[0096] The control method for the cryptographic infrastructure of a numerical control system based on domestic cryptographic algorithms provided in the application embodiment of the present invention is applied to a computer device. The computer device includes a memory and a processor. The memory stores a computer program. When the computer program is executed by the processor, the processor performs the steps of the control method for the cryptographic infrastructure of a numerical control system based on domestic cryptographic algorithms.

[0097] It should be noted that embodiments of the present invention can be implemented in hardware, software, or a combination of both. The hardware portion can be implemented using dedicated logic; the software portion can be stored in memory and executed by a suitable instruction execution system, such as a microprocessor or dedicated-design hardware. Those skilled in the art will understand that the above-described devices and methods can be implemented using computer-executable instructions and / or included in processor control code, for example, such code provided on a carrier medium such as a disk, CD, or DVD-ROM, a programmable memory such as read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The devices and modules of the present invention can be implemented by hardware circuitry such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field-programmable gate arrays, programmable logic devices, etc., or by software executed by various types of processors, or by a combination of the above-described hardware circuitry and software, such as firmware.

[0098] The embodiments of the present invention have achieved some positive results during the research and development or use process, and have indeed great advantages compared with the prior art. The following content describes them in conjunction with the data, charts and other information of the experimental process.

[0099] (1) Add CA.

[0100] If a new CA is added, the program will generate a new certificate for RA and CA registration. Each RA corresponds one-to-one with a CA, and the RA is bound using the CA's ID. After starting the infrastructure and management programs, place the CA package on the server where the CA is to be deployed. Edit the `enrollType` in the `[mgmt]` section of the registration file to 1 and add the `subject` (certificate subject) information. Run the registration program `CA_RA_ENROLL` to obtain the registration information. Then start the RA and CA programs. The RA, CA, and registration files must be run in the same folder. The content of the registration file is as follows: Figure 3 As shown, the registration process will complete and display a message indicating that the process is finished. Figure 4 As shown.

[0101] If an existing CA is used, the program will use the specified certificate for RA and CA registration. After starting the infrastructure and management program, place the CA package on the server where you want to deploy the CA, edit the enrollType in the [mgmt] section of the registration file to 2, and fill in the [exist_ca] section. If the CA private key is enabled with PEM encryption, you need to fill in the caKeyPassword field. Run the registration program, and after the registration is complete, start the CA and RA programs.

[0102] (2) CA management.

[0103] After logging into the infrastructure management platform, you will enter the CA management interface, such as... Figure 5 As shown, you can view all CAs. The CA with caId 993daa05-6d64-49c4-b83b-456e3ca503ba that was just registered is in a closed state by default. You can use the operation bar to perform corresponding management operations.

[0104] After enabling certificate request approval for a CA, all certificate requests from that CA will be intercepted by the RA (Registry Authorization Officer). Administrators can then approve these requests in Certificate Issuance Management - Certificate Request Approval. Without this feature, the RA will directly forward certificate requests to the CA. First, enable the CA: 993daa05-6d64-49c4-b83b-456e3ca503ba and activate its certificate approval function. After activation... Figure 6 As shown, the CA's status is normal, and the certificate application approval is enabled.

[0105] (3) Apply for a certificate through the client program.

[0106] Place the certificate client package on the machine that needs to apply for the certificate, and edit the certificate application configuration file cert_req.ini within the package, with the following content: Figure 7 As shown, the [mgmt] field contains information about connecting to Mosquitto. The [req_info] field requires the subject, the expected certificate validity period (in years), and the caId, where the caId determines which CA will generate the certificate. The [attribute] field contains the attributes embedded in the certificate. Each attribute is a name-content pair, with the suffix -Name indicating the attribute name and -Content indicating the attribute content. Names and contents with the same prefix before the suffix are considered a pair, such as... Figure 7 The Sec_level-Name and Sec_level-Content are shown in the image. After filling them in, launch client-pubCertReq. This program will generate a certificate request and send it to the RA corresponding to the CA. Here, set the target CA to the newly added CA: 993daa05-6d64-49c4-b83b-456e3ca503ba. Enter the variable common name in the [alt_name] field. The [client] field serves as the identifier for the certificate owner. clientId identifies the recipient of this certificate issuance and is generally set to a UUID. sigPriKeyPath is the directory where the locally generated signing private key is stored, which will be generated and stored by the client program. Setting the password allows the client program and the CA program to generate an encrypted PEM private key.

[0107] After completing the information, run the certificate request client program. It will generate an encrypted private key and a Certificate Request (CSR) in PEM format locally based on the information provided, and then send the CSR to the RA. Figure 8 As shown, the certificate subject, alternative name, and custom certificate attribute My Test Sec_level are all correctly represented in the generated CSR.

[0108] (4) Certificate generation.

[0109] With certificate application approval enabled, certificate applications initiated by the corresponding CA can be viewed in Certificate Authority Management - Approve Certificate Applications. You can then select whether to approve or not. Once approved, the CA will generate and sign the certificate. Figure 9 As shown, the interface displays the previous certificate application, which is now pending approval. After clicking "Approved," the CA will generate the encryption certificate and encryption private key, and sign the applicant's signature and the encryption certificate.

[0110] (5) Certificate acquisition.

[0111] The certificate client package includes a certificate retrieval client program. This program uses the clientId configured in cert_req.ini as a feature for certificate reception, listens to a specified topic to retrieve the certificate corresponding to the previously sent certificate request, such as... Figure 10 As shown, the client has successfully obtained the certificate from the server and saved it to the same directory as the signing private key (configured in cert_req.ini as sigPriKeyPath). Figure 11 As shown, the signature, encryption certificate, and private key have been successfully saved.

[0112] (6) Revoke / deactivate the certificate.

[0113] The management platform displays successfully issued certificates. If an unexpected situation occurs (such as key loss) and the certificate needs to be discontinued, you can disable or remove it via the page. Disabling the certificate does not remove it from the list, allowing it to be reactivated. Removing the certificate will delete it, meaning it is revoked. Disabling a newly issued encryption certificate will put it in a disabled state. Figure 12 As shown.

[0114] (7) Check the status through the certificate query client.

[0115] The certificate client package includes the certificate query client `client_check`. Running `client_check` with command-line arguments, the first is the `clientId`, used to distinguish the topic from which the request is received; the second is the certificate location of the CA to which the verified certificate belongs, used for public key decryption in the OCSP response; and the third is the location of the verified certificate (must be PEM encoded). The program generates an OCSP request, sends it to the OCSP server, and returns the status of the verified certificate. Figure 13 As shown, the status of the queried encryption certificate is now revoke, which means that the certificate has been deactivated or revoked and is currently unusable.

[0116] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications, equivalent substitutions, and improvements made by those skilled in the art within the scope of the technology disclosed in the present invention, and within the spirit and principles of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A cryptographic infrastructure for a numerical control system based on domestically developed cryptographic algorithms, characterized in that, The CNC system cryptographic infrastructure based on domestic cryptographic algorithms provides basic cryptographic services, including system management, key management, certificate services, gateway management, data transmission, protocol management, system logs, security auditing, system monitoring, middleware services, trusted modules, and external interfaces; it uses a lightweight MQTT certificate service and conforms to the CNC system NC-Link protocol to apply for, obtain, and query certificates, and embeds attributes into identity certificates for communication encryption, identity authentication, and authorization. The execution process of management commands for certificate application and acquisition includes: The certificate request / acquisition client consists of two modules: certificate request and certificate acquisition. The certificate request module generates a signing private key and public key locally, and then publishes a PEM format Certificate Request File (CSR) containing the public key, certificate subject, and attributes of the requesting subject to the MQTT Topic:certReq / {ca_id} / {balance_id}. Here, ca_id is the ID of the target CA, and balance_id is the server ID specified in the cluster, used for load balancing. These attributes are embedded as extensions in X509 V3, and the certificate request is received and checked by the RA corresponding to the CA. After receiving a client request by subscribing to certReq, the RA receiving the request has the same ID as the target CA. It verifies whether the CSR signature comes from the declared client and determines the CA certificate approval status based on the basic service and management terminal. If it is enabled, the CSR is stored in the database. If it is not enabled, the CSR and RA approval information are published to MQTTTopic:raToken / {ca_id} / {balance_id}, where ca_id and balance_id remain unchanged. When certificate approval is enabled, the RA will query the database for the certificate request approval status through a scheduled task and publish the approved CSR. The CA receives the Certificate Signature (CSR) by subscribing to raToken, generates an encrypted private key and a public key, parses the CSR, creates an encrypted certificate and a decryption certificate, and signs the certificate with the CA's private key. It then records the certificate applicant's information, attributes, and PEM format certificate into the certificate store. After converting the encrypted private key to BASE64 format using the signing certificate and SM2 public key encryption, it publishes the encrypted private key, along with the signing certificate and the encrypted certificate, to MQTT Topic:subCert / {client_id}, where client_id is the client ID, which is included in the certificate request. After the certificate is issued, the CA stores the certificate information in the database. The certificate acquisition module in the certificate application / acquisition client obtains the ciphertext of the signing certificate, encryption certificate, and encryption private key by subscribing to subCert. After decrypting the ciphertext of the encryption private key using the local signing private key, the signing certificate, encryption certificate, and encryption private key are saved.

2. The cryptographic infrastructure for CNC systems based on domestically developed cryptographic algorithms as described in claim 1, characterized in that, The cryptographic infrastructure of the CNC system based on domestic cryptographic algorithms includes: a system management front-end operation page, a basic service and management terminal, a CA, RA, MQTT agent, a log collection client, a gateway management client, a certificate application / acquisition call terminal, and a certificate query call terminal; The system management front-end operation page is used to access the management page through a browser for operation; The basic service and management terminal is used to receive management commands sent by the system management front-end operation page, and to enable, disable, and edit keys and certificates, as well as manage gateways and protocols. The CA and RA are used to execute operations according to management commands; The MQTT broker is the open-source component Mosquitto, used for communication; The log collection client is used to collect logs from each cluster and transmit them to the basic service and management terminal for archiving and storage. The gateway management client is used to receive gateway management commands and return the execution results; The certificate application / acquisition client is used for applying for and obtaining certificates; The certificate query client is used for certificate querying.

3. The cryptographic infrastructure for CNC systems based on domestically developed cryptographic algorithms as described in claim 2, characterized in that, When deploying the basic services and management-side load balancer, add a load balancer and use the open-source Nginx in conjunction with LVS and Keepalived to adjust the load balancer. When the MQTT broker performs load balancing, it enables Mosquitto cluster mode for master-slave synchronization and uses LVS for TCP-level MQTT load balancing; the MQTT broker supports Chinese cryptographic SSL communication by replacing the cryptographic packets used in Mosquitto with TASSL cryptographic packets and adding a Chinese cryptographic connection option. The log collection client is implemented based on the Filebeat open-source component. After setting the source log file location and the management terminal URL, the source file is transmitted to the basic service and management terminal for archiving via socket.

4. The cryptographic infrastructure for CNC systems based on domestically developed cryptographic algorithms as described in claim 2, characterized in that, The cryptographic infrastructure of the CNC system based on domestic cryptographic algorithms includes: a series of key management interfaces, encryption and decryption interfaces, certificate application interfaces, certificate acquisition interfaces, and certificate query interfaces; The key management interface series is divided into key generation interface, key acquisition interface, and key recovery acquisition interface. By requesting the relevant interfaces through the HTTP protocol, the basic service and the management terminal will perform key mapping operations. Key generation is provided by the TASSL cryptographic package, while key acquisition and key recovery acquisition are performed by querying the required key from the database and returning it. The encryption / decryption interface is divided into an encryption interface and a decryption interface. By requesting the relevant interface via the HTTP protocol, the basic service and management terminal will run the specified encryption / decryption algorithm and return the ciphertext / plaintext. The encryption / decryption algorithm is provided by the TASSL cryptographic packet. The certificate request interface is deployed in MQTT Topic:certReq / {ca_id} / {balance_id}, the certificate retrieval interface is deployed in MQTT Topic:subCert / {client_id}, and the certificate query interface is deployed in MQTT Topic:vali_qury / {balance_id}.

5. The cryptographic infrastructure for CNC systems based on domestically developed cryptographic algorithms as described in claim 2, characterized in that, When the management command manages the CA and RA, it publishes the management command via the MQTT protocol and subscribes to the execution results. When the management command manages the gateway, the basic service communicates with the gateway management client via TCP sockets to transmit management commands and receive responses. When the management command applies for, obtains, or queries certificates, it communicates with the CA and RA via the MQTT protocol and uses a database to store certificates, CAs, gateways, keys, and audit information.

6. The cryptographic infrastructure for CNC systems based on domestically developed cryptographic algorithms as described in claim 5, characterized in that, The specific process for issuing management commands via the MQTT protocol is as follows: When the basic service and management terminal initiates a command, it publishes the command in JSON format to the specified Topic of the MQTT broker. The execution terminal obtains the message by subscribing to the Topic, parses the JSON message, executes it, and returns the operation result to the basic service and management terminal. The basic service and management terminal then writes the data changes to the database and displays them on the system management front-end operation page.

7. The cryptographic infrastructure for CNC systems based on domestically developed cryptographic algorithms as described in claim 5, characterized in that, The management commands for the CA and RA include: When operating on the CA, the browser request is first transmitted to the basic service and management terminal. According to the instructions, the browser sends management commands to the CA and RA using the MQTT protocol. The management of the CA is published on MQTT Topic:caMgmt / {ca_id} based on the CA ID, and the management of the RA is published on MQTT Topic:raMgmt / {ca_id} based on the CA ID. The CA obtains management commands by subscribing to MQTT Topic:caMgmt / {ca_id}, and the RA obtains management commands by subscribing to MQTT Topic:raMgmt / {ca_id}. After the CA and RA perform corresponding operations according to the management command, they publish the execution results to MQTT Topic:caRes and MQTT Topic:raRes respectively. The basic service and management terminal obtain the success or failure of the command execution by subscribing to MQTT Topic:caRes and MQTT Topic:raRes, write the information changes to the database and logs, and display the execution results on the system management front-end operation page.

8. The cryptographic infrastructure for CNC systems based on domestically developed cryptographic algorithms as described in claim 5, characterized in that, The execution process of the management command for certificate query includes: An online certificate status query service based on MQTT is provided. The MQTT Topic is `vali_qury / {balance_id}`, where `balance_id` is the load balancer ID. The published content includes the sequence number of the certificate to be queried and the client ID of the API caller. The Certificate Authority (CA) obtains the certificate query request by subscribing to `vali_qury`, retrieves the certificate from the database by its sequence number, obtains the current certificate status (normal or revoked), and publishes the query results to `vali_ret / {client_id}`. The client calling the certificate query obtains the status of the queried certificate by subscribing to `vali_ret / {client_id}`.

9. A control method for implementing the cryptographic infrastructure of a numerical control system based on domestically developed cryptographic algorithms as described in any one of claims 1-8, characterized in that, The control method for the cryptographic infrastructure of the CNC system based on domestically developed cryptographic algorithms includes: The system management front-end is accessed via a browser, and HTTPS requests are sent to parse the JSON-formatted management commands for CA, RA, gateway, or certificate management. The system management front-end is a web page code that can be parsed by a browser and is deployed in Nginx, an open-source web server capable of processing and forwarding HTTP requests. When an administrator accesses the system management front-end via a browser, Nginx sends the page code to the browser, which then parses it and presents the management page to the administrator. Nginx's cryptographic packet has been replaced with a TASSL cryptographic packet, supporting Chinese national cryptographic SSL. If the administrator uses a browser that supports Chinese cryptographic protocols, a Chinese national cryptographic SSL connection will be established with Nginx to complete encrypted communication, enabling front-end and back-end communication based on the HTTPS protocol. When the administrator performs specific operations, the management command is parsed into a JSON format message by the system management front end and encapsulated into an HTTPS request body. Then, the request is sent to Nginx through the browser. According to the load balancing settings, Nginx will distribute the traffic evenly to the basic services and the instances in the management cluster for processing. After receiving the JSON format message, the instance parses it and performs the corresponding operation according to the message content. When performing CA and RA management, the basic service and management end extract the JSON format message from the HTTPS request body. Based on the target item in the message, if it is "CA", it is determined that it is managing the CA, and if it is "RA", it is managing the RA. The JSON format message is then published as the payload in the MQTT protocol to the CA management interface MQTT Topic: caMgmt / {ca_id} or the RA management interface MQTT Topic: raMgmt / {ca_id} to complete the transmission of management commands, which are then executed by the CA and RA. When performing gateway management, the basic service and management end extract the JSON format message from the HTTPS request body. Based on the target item in the message, if it is "Gateway", it is determined that it is a gateway management. The JSON format message is then transmitted to the gateway management client as socket transmission content without modification, and the client ultimately executes the command. When performing certificate management, the basic service and management terminal extract JSON format messages from the HTTPS request body. Based on the target item in the message, if it is "Cert", it is determined that it is certificate management. The JSON format message is directly parsed, and the certificate being operated on is obtained from the certId item in the message. The purpose of this operation is obtained from the cmd item in the message. If it is "Open", it means the certificate is enabled; if it is "Stop", it means the certificate is disabled; if it is "Revoke", it means the certificate is removed; if it is "Recovery", it means the certificate key is recovered. After obtaining the information, the basic service and management terminal directly write the information to the certificate database to complete the certificate management.

10. A computer device, characterized in that, The computer device includes a memory and a processor. The memory stores a computer program. When the computer program is executed by the processor, the processor performs the steps of the control method for the cryptographic infrastructure of a numerical control system based on a domestically developed cryptographic algorithm as described in claim 9.

Images