Water conservancy industrial control data transmission encryption and decryption method and system

Abstract

The application discloses a water conservancy industrial control data transmission encryption and decryption method and system, and relates to the field of data encryption transmission. The method comprises the following steps: connecting an encryption gateway to a system network to realize network port communication encryption and serial port communication encryption, encrypting an external incoming plaintext message, and decrypting an external incoming ciphertext message. The method realizes identity authentication between encryption and decryption gateways, protects the confidentiality, integrity and authenticity of field bus data transmission, protects the confidentiality, integrity and authenticity of industrial Ethernet data transmission, and guarantees the safety of a communication process in a water conservancy industrial control scene.

Description

Technical Field

[0001] This invention relates to the field of data transmission encryption and decryption, and in particular to a method and system for encrypting and decrypting data transmission in water conservancy industrial control systems. Background Technology

[0002] Industrial Control Systems (ICS) are a core component of water conservancy projects. With the accelerated integration of industrial control systems and information technology, these previously independent and closed systems face increasing external threats. Historically, industrial control network systems have prioritized functionality and business continuity, neglecting security, particularly in data transmission, leading to numerous security vulnerabilities. A typical water conservancy industrial control system comprises a process monitoring layer, a field control layer, and a field device layer. The process monitoring layer is primarily responsible for supervising and controlling the physical processes of each stage of the system, including operator stations, engineer stations, and database servers. The field control layer typically consists of multiple local control units, including programmable logic controllers (PLCs). The field device layer contains various sensors and actuators, such as level gauges, flow meters, and gate hoists. The process monitoring layer and field control layer generally communicate using the Industrial Ethernet protocol. The field control layer and field device layer generally communicate using the Fieldbus protocol.

[0003] Currently, the industrial Ethernet protocols used in water conservancy industrial control systems are mostly Modbus TCP and Profinet, and the fieldbus protocols used are mostly Modbus and Modbus Plus. These protocols were designed several years ago and did not consider protocol security issues. Attackers can easily eavesdrop, tamper with, and forge communication messages by exploiting protocol vulnerabilities, thereby controlling the PLC and causing damage to the water conservancy project site. Furthermore, water conservancy industrial control systems are mostly deployed on a single local area network (LAN), and existing security gateways are mostly used to implement encrypted communication between network domains, which is difficult to adapt to the encryption requirements between devices within the LAN. The number of existing water conservancy industrial control systems is huge, and it is costly and time-consuming to upgrade or rebuild the communication network of all systems, which would affect the stable operation of the system. Therefore, large-scale transformation is not yet feasible. Summary of the Invention

[0004] The purpose of this invention is to provide a method and system for encrypting and decrypting data transmission in water conservancy industrial control systems, which can improve the security of data transmission in water conservancy industrial control systems.

[0005] To achieve the above objectives, the present invention provides the following solution:

[0006] A method for encrypting and decrypting data transmitted in water conservancy industrial control systems, the method comprising:

[0007] When the communication type of the user equipment connection is network interface communication:

[0008] Obtain plaintext communication messages; plaintext communication messages are data generated by process monitoring layer devices or field control layer devices;

[0009] A symmetric encryption algorithm is used to encrypt plaintext communication messages based on a first initialization vector and a session key to generate encrypted messages; the first initialization vector and the session key are determined by negotiation parameters negotiated between the first encryption gateway and the second encryption gateway; the first encryption gateway is a client encryption gateway, and the second encryption gateway is a server encryption gateway;

[0010] The first checksum, the first header information, the encrypted message, and the new IP address are concatenated to obtain a ciphertext communication message, which is then sent to the industrial Ethernet network. The first checksum is generated from the encrypted message, the first header information, and the verification key. The first header information includes security index parameters and a sequence number.

[0011] When a ciphertext message corresponding to a ciphertext communication message is detected in an industrial Ethernet network, the ciphertext message is verified. If the verification is successful, a symmetric encryption algorithm is used to decrypt the encrypted message based on the first initialization vector and the session key to obtain the plaintext message, which is then sent to the target device. The target device includes process monitoring layer devices or field control layer devices.

[0012] When the communication type of the user equipment connection is serial communication:

[0013] Acquire application data units; application data units are data generated by field control layer devices or field device layer devices;

[0014] The application data unit is verified; if the verification is successful, the application data unit is encrypted using a symmetric encryption algorithm based on the second initial vector and the pre-made encryption key to obtain the encrypted data unit; the second initial vector is calculated from a pseudo-random number generated by the timestamp seed;

[0015] A second header and a tail information are added to the encrypted data unit to generate a new application data unit, and the new application data unit is sent to the bus network; the second header information includes an encryption identifier, a pseudo-random number, and a data length identifier; the tail information is determined by the application data unit, the pre-made encryption key, the second header information, and the encrypted data unit;

[0016] When a new application data unit corresponding to a ciphertext data unit is detected in the bus network, the ciphertext data unit is verified. After the verification is successful, a symmetric encryption algorithm is used to decrypt the encrypted data unit according to the second initial vector and the pre-made encryption key to obtain the plaintext data unit.

[0017] The plaintext data unit is verified, and if the verification passes, the plaintext data unit is sent to the target device.

[0018] Optionally, before obtaining the plaintext communication message, the method further includes:

[0019] Based on digital certificates, authentication is performed through a first encryption gateway and a second encryption gateway; once authentication is successful, a session key, a verification key, and a first initialization vector are generated according to the negotiated parameters.

[0020] Optionally, the encrypted message is verified, specifically including:

[0021] A second verification value is generated using a hash algorithm based on the encrypted message, the verification key, and the header information of the ciphertext message;

[0022] The encrypted message is verified based on the first verification value and the second verification value.

[0023] Optionally, a second header and footer information are added to the encrypted data unit to generate a new application data unit, specifically including:

[0024] A hash algorithm is used to generate a message authentication code based on the application data unit and the pre-made shared key;

[0025] A second header information is added to the header of the encrypted data unit to obtain an updated encrypted data unit.

[0026] A new verification code is calculated based on the updated encrypted data unit and the message authentication code;

[0027] The message authentication code and the new verification code are added as tail information to the tail of the updated encrypted data unit to obtain a new application data unit.

[0028] Optionally, the encrypted data unit is verified, specifically including:

[0029] A temporary verification code is calculated using the verification code generation function based on the updated encrypted data unit and the message authentication code.

[0030] The encrypted data unit is verified based on the temporary check code and the new check code.

[0031] Optionally, the plaintext data unit is verified, specifically including:

[0032] A temporary message authentication code is calculated using a hash algorithm based on the plaintext data unit and the pre-made shared key.

[0033] The plaintext data unit is verified based on the temporary message authentication code and the message authentication code.

[0034] Optionally, sending the plaintext data unit to the target device specifically includes:

[0035] The plaintext data unit is sent to the target device according to the destination address in the plaintext data unit.

[0036] The present invention also provides a system for encrypting and decrypting data transmission in water conservancy industrial control systems to implement the above-mentioned encryption and decryption method for water conservancy industrial control data transmission. The system includes an encryption gateway group, a process monitoring layer device, a field control layer device, and a field device layer device.

[0037] The encryption gateway group includes a first encryption gateway and a second encryption gateway.

[0038] The process monitoring layer equipment is used to supervise and control the physical processes of each link in the water conservancy industrial control system, and to collect and monitor the operation data of the field control layer equipment and issue instructions.

[0039] The field control layer device is used for data acquisition, field control, and receiving instructions from the process monitoring layer device;

[0040] The field equipment layer is used to collect data on the field conditions, respond to instructions from the field control layer, and transmit monitoring data back.

[0041] According to specific embodiments provided by the present invention, the following technical effects are disclosed: The present invention provides a method and system for encrypting and decrypting data transmission in water conservancy industrial control systems. The method includes: when the communication type of the user equipment connection is network port communication: acquiring plaintext communication messages; the plaintext communication messages are data generated by process monitoring layer devices or field control layer devices; encrypting the plaintext communication messages using a symmetric encryption algorithm based on a first initialization vector and a session key to generate an encrypted message; the first initialization vector and the session key are determined by negotiation parameters negotiated between a first encryption gateway and a second encryption gateway; the first encryption gateway is a client encryption gateway. The second encryption gateway is a server-side encryption gateway; it concatenates the first checksum, the first header information, the encrypted message, and the new IP address to obtain a ciphertext communication message, and sends the ciphertext communication message to the industrial Ethernet network; the first checksum is generated from the encrypted message, the first header information, and the verification key; the first header information includes security index parameters and a sequence number; when the ciphertext message corresponding to the ciphertext communication message is detected in the industrial Ethernet network, the ciphertext message is verified; if the verification passes, a symmetric encryption algorithm is used to decrypt the encrypted message according to the first initialization vector and the session key to obtain the plaintext message, which is then erased. The information is sent to the target device; the target device includes process monitoring layer devices or field control layer devices; when the communication type of the user equipment connection is serial communication: The application data unit is obtained; the application data unit is data generated by the field control layer device or field device layer device; the application data unit is verified; after verification, the application data unit is encrypted using a symmetric encryption algorithm based on the second initial vector and a pre-made encryption key to obtain an encrypted data unit; the second initial vector is calculated from a pseudo-random number generated by a timestamp seed; second header information and tail information are added to the encrypted data unit to generate a new application data unit. The new application data unit is sent to the bus network. The second header information includes an encryption identifier, a pseudo-random number, and a data length identifier. The tail information is determined by the application data unit, the pre-made encryption key, the second header information, and the encrypted data unit. When a ciphertext data unit corresponding to a new application data unit is detected in the bus network, the ciphertext data unit is verified. If the verification passes, a symmetric encryption algorithm is used to decrypt the encrypted data unit according to the second initialization vector and the pre-made encryption key to obtain the plaintext data unit. The plaintext data unit is then verified, and if the verification passes, the plaintext data unit is sent to the target device. This invention, in the encryption process, not only encrypts the message content itself but also verifies the message, ensuring the confidentiality, integrity, and authenticity of the message. Attached Figure Description

[0042] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0043] Figure 1 This is a schematic diagram of the network communication encryption and decryption process in the water conservancy industrial control data transmission encryption and decryption method provided in Embodiment 1 of the present invention;

[0044] Figure 2 This is a schematic diagram of the serial communication encryption and decryption process in the water conservancy industrial control data transmission encryption and decryption method provided in Embodiment 1 of the present invention;

[0045] Figure 3 This is a block diagram of a water conservancy industrial control data transmission encryption and decryption system provided in Embodiment 2 of the present invention. Detailed Implementation

[0046] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0047] The purpose of this invention is to provide a method and system for encrypting and decrypting data transmission in water conservancy industrial control scenarios. The method is applied to a terminal encryption gateway, which is connected to the system network. The method includes: implementing encryption for network port communication and serial port communication; encrypting incoming plaintext messages; decrypting incoming ciphertext messages; and implementing authentication between encryption and decryption gateways based on symmetric cryptography, asymmetric cryptography, and hash algorithms. It also protects the confidentiality, integrity, and authenticity of fieldbus data transmission and industrial Ethernet data transmission, ensuring the security of communication processes in water conservancy industrial control scenarios.

[0048] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0049] Example 1

[0050] like Figure 1 As shown, this invention provides a method for encrypting and decrypting data transmission in water conservancy industrial control systems. The method includes:

[0051] When the communication type of the user equipment connection is network interface communication:

[0052] Obtain plaintext communication messages; plaintext communication messages are data generated by process monitoring layer devices or field control layer devices.

[0053] A symmetric encryption algorithm is used to encrypt plaintext communication messages based on a first initialization vector and a session key to generate encrypted messages. The first initialization vector and the session key are determined by negotiation parameters negotiated between the first encryption gateway and the second encryption gateway. The first encryption gateway is a client encryption gateway, and the second encryption gateway is a server encryption gateway.

[0054] The first checksum, the first header information, the encrypted message, and the new IP address are concatenated to obtain a ciphertext communication message, which is then sent to the industrial Ethernet network. The first checksum is generated from the encrypted message, the first header information, and the verification key. The first header information includes security index parameters and a sequence number.

[0055] When a ciphertext message corresponding to a ciphertext communication message is detected in an industrial Ethernet network, the ciphertext message is verified. If the verification is successful, a symmetric encryption algorithm is used to decrypt the encrypted message based on the first initial vector and the session key to obtain the plaintext message, which is then sent to the target device. The target device includes process monitoring layer devices or field control layer devices.

[0056] When the communication type of the user equipment connection is serial communication:

[0057] Acquire application data units; application data units are data generated by field control layer devices or field device layer devices.

[0058] The application data unit is verified; when the verification is successful, the application data unit is encrypted using a symmetric encryption algorithm based on the second initial vector and the pre-made encryption key to obtain the encrypted data unit; the second initial vector is calculated from a pseudo-random number generated by the timestamp seed.

[0059] A second header and a tail are added to the encrypted data unit to generate a new application data unit, which is then sent to the bus network. The second header includes an encryption identifier, a pseudo-random number, and a data length identifier. The tail is determined by the application data unit, the pre-made encryption key, the second header, and the encrypted data unit.

[0060] When a new application data unit corresponding to a ciphertext data unit is detected in the bus network, the ciphertext data unit is verified. If the verification is successful, a symmetric encryption algorithm is used to decrypt the encrypted data unit based on the second initial vector and the pre-made encryption key to obtain the plaintext data unit.

[0061] The plaintext data unit is verified, and if the verification passes, the plaintext data unit is sent to the target device.

[0062] This embodiment describes the above-mentioned encryption and decryption method for water conservancy industrial control data transmission in four parts:

[0063] Part 1: Initial Configuration

[0064] In this embodiment, initialization configuration is required before the encrypted terminal runs. The initialization configuration process includes serial communication configuration such as baud rate, parity bit, encryption algorithm, and pre-made key for serial encrypted communication, and network communication configuration such as CA digital certificate upload, gateway digital certificate upload, encryption algorithm selection, key update cycle, and client / server configuration for network encrypted communication.

[0065] Part Two: Determining the Communication Type of the User's Device Connection

[0066] After the device starts and initializes, it enters the running monitoring state, waiting for the user to connect the device to the network. It determines whether the user is using network port communication or serial port communication. If it is network port communication, proceed to the third part; if it is serial port communication, proceed to the fourth part.

[0067] Part Three: Encrypted Communication Process via Ethernet Port

[0068] This embodiment further includes the following before obtaining the plaintext communication message:

[0069] Based on digital certificates, authentication is performed through a first encryption gateway and a second encryption gateway; once authentication is successful, a session key, a verification key, and a first initialization vector are generated according to the negotiated parameters.

[0070] It should be noted that, regardless of whether it is network port communication or serial port communication, for a one-way transmitted message, the encryption process is completed by the first gateway, and the decryption process is completed by the second gateway.

[0071] Specifically, it consists of the following steps:

[0072] S1: Encryption gateways perform authentication and key negotiation based on asymmetric cryptography, symmetric cryptography, and hash cryptography algorithms. This process consists of two phases: In the first phase, authentication is completed between gateways, and a working key is generated. In the second phase, two sets of symmetric keys are negotiated. If the negotiation is successful, the process proceeds to S2; if the negotiation fails, it is renegotiated.

[0073] It should be noted that, in this embodiment, the symmetric cryptography algorithm includes, but is not limited to, the SM1 algorithm and the SM4 algorithm, the asymmetric algorithm includes, but is not limited to, the SM2 algorithm, and the hash algorithm includes, but is not limited to, the SM3 algorithm.

[0074] S1-1: Handshake negotiation occurs between the first encryption gateway (client encryption gateway) and the second encryption gateway (server encryption gateway). The first encryption gateway sends its first digital certificate. After the second encryption gateway verifies the first digital certificate using its CA certificate and passes the verification, it sends its second digital certificate and second negotiation parameters. After the first encryption gateway verifies the second digital certificate using its CA certificate and passes the verification, it confirms receipt of the second negotiation parameters and sends its first negotiation parameters. All negotiation parameters are encrypted using a temporary key, which is protected by the sender's public key. Based on the above negotiation parameters, both parties use the Diffie-Hellman algorithm (a key exchange algorithm) to generate the first-stage negotiation working key (WK). Based on the above negotiation parameters, both parties use a hash algorithm to generate the initialization vector IV.

[0075] S1-2: The first encryption gateway sends negotiation parameters and identity data, etc., to the second encryption gateway for generating the symmetric key during the encryption transmission phase. It encrypts the payload using the working key WK, calculates a message digest for the payload, and sends both the encrypted data and the message digest to the second encryption gateway. After verifying the message digest, the second encryption gateway sends the negotiation parameters and identity data, etc., to the first encryption gateway. It encrypts the payload using the working key WK, calculates a message digest for the payload, and sends both the encrypted data and the message digest to the first encryption gateway. After verifying the message digest, the negotiation ends. Both parties use the exchanged negotiation parameters and identity data as input, calculate a digest value using a hash function, and extract the session key (SK) and authentication key (AK) sequentially from this value according to the length requirements of the symmetric encryption algorithm.

[0076] S2: After negotiation between gateways is completed, the device enters a message listening state, listening for plaintext communication messages (Message, MSG) from process monitoring layer devices or field control layer devices, as well as encrypted messages from industrial Ethernet. (The process monitoring layer devices include, but are not limited to, operator workstations and engineer workstations; the field control layer devices include, but are not limited to, PLCs, RTUs, and data acquisition terminals.)

[0077] S2-1: When a plaintext communication message MSG is detected from a field control layer device or a process monitoring layer device, the MSG is encrypted.

[0078] S2-1-1: Input the plaintext communication message MSG, the first initialization vector IV (IV), and the session key SK generated in S1-2 into the symmetric encryption algorithm to generate the encrypted message E-MSG.

[0079] S2-1-2: Add a first header to the encrypted message E-MSG. The first header includes a security index parameter and a sequence number.

[0080] The verification of the encrypted message using a hash algorithm specifically includes:

[0081] A hash algorithm is used to generate a first verification value based on the encrypted message, the first header information, and the verification key; the first header information includes a security index parameter and a serial number; the verification key is determined by the negotiation parameters negotiated between the first encryption gateway and the second encryption gateway.

[0082] The first verification value, the first header information, the encrypted message, and the new IP address are concatenated to obtain a ciphertext communication message, which is then sent to the industrial Ethernet network.

[0083] S2-1-3: Input the encrypted message E-MSG, the first header information, and the verification key AK into the hash algorithm to generate the integrity verification value (Authentication Data, AD), which is the first verification value.

[0084] S2-1-4: Concatenate the header information, E-MSG and the first check value AD in sequence, and add a new IP address before the header information to form the encrypted communication message N-MSG;

[0085] S2-1-5: Send the N-MSG to the industrial Ethernet network.

[0086] S2-2: When an IP communication ciphertext (i.e., ciphertext message) from an industrial Ethernet is detected, the encrypted message E-MSG is decrypted.

[0087] S2-2-1: Examine the header information of the ciphertext message and obtain the encryption mode of the ciphertext message through the security index parameter.

[0088] S2-2-2: Input the header information of the ciphertext message, the encrypted message E-MSG, and the verification key AK into the hash algorithm to generate a temporary integrity check value T-AD. The temporary integrity check value is the second check value. If T-AD is consistent with AD, the verification passes and proceeds to S2-2-3; otherwise, the message is discarded and the process returns to the listening state.

[0089] S2-2-3: Input the encrypted message E-MSG, the initialization vector IV, and the session key SK generated in S1-2 into the symmetric encryption function to decrypt and obtain the plaintext message MSG.

[0090] Sending the plaintext message to the target device specifically includes:

[0091] The plaintext message is sent to the target device according to the destination address in the plaintext message.

[0092] S2-2-4: Send the decrypted plaintext message MSG to the process monitoring layer device or the field control layer device. Send it to the designated device according to the original destination IP address in the MSG header. If the address cannot be found, discard the data packet.

[0093] Part Four: Serial Port Encrypted Communication Process

[0094] S1: After successful gateway initialization, it enters a message listening state, listening for Application Data Units (ADUs) from field control layer devices or field device layer devices, as well as encrypted data units from the bus network. The field control layer devices include, but are not limited to, PLCs, RTUs, and data acquisition terminals; the field device layer devices include, but are not limited to, temperature and humidity instruments, water level gauges, and flow meters.

[0095] S1-1: When an Application Data Unit (ADU) is detected from a field control layer device or a field device layer device.

[0096] S1-1-1: Perform CRC check on the message. Use the pre-built CRC generation function to calculate the ADU content except for the tail CRC code to obtain the temporary check code (Temporary CRC, T-CRC). If the T-CRC is consistent with the CRC, the check passes and proceeds to S1-1-2. Otherwise, discard the message (the message refers to the application data unit ADU) and return to the listening state.

[0097] S1-1-2: Input the Application Data Unit (ADU), the Second Initialization Vector (IV), and the Prefabricated Encryption Keys (PEK) into the symmetric encryption algorithm to generate the Encrypted Data Unit (E-ADU). (The symmetric encryption algorithm includes, but is not limited to, SM1 and SM4).

[0098] The step of adding second header and footer information to the encrypted data unit to generate a new application data unit specifically includes:

[0099] A hash algorithm is used to generate a message authentication code based on the application data unit and the pre-made shared key.

[0100] A second header information is added to the header of the encrypted data unit to obtain an updated encrypted data unit; the second header information includes an encryption identifier, a pseudo-random number, and a data length identifier.

[0101] A new verification code is calculated based on the updated encrypted data unit and the message authentication code.

[0102] The message authentication code and the new verification code are added as tail information to the tail of the updated encrypted data unit to obtain a new application data unit. Specifically, this includes steps S1-1-3 to S1-1-7.

[0103] S1-1-3: Input the ADU and the prefabricated shared key (PSK) into the hash algorithm to generate a message authentication code (MAC). It should be noted that the hash algorithm described in this embodiment includes, but is not limited to, SM3.

[0104] S1-1-4: Adding a second header to the E-ADU header yields an updated encrypted data unit. This second header includes an encryption identifier, a pseudo-random number, and a data length identifier. The encryption identifier is randomly generated by the system, ranging from 1 to 247, and is divided into two categories: identifiers from 1 to 127 indicate plaintext data, while identifiers from 128 to 247 indicate ciphertext data. The pseudo-random number is used to generate the initialization vector for symmetric encryption. The data length identifier records the byte length of the E-ADU.

[0105] S1-1-5: Using the second header information, E-ADU, and MAC as inputs, calculate the new check code N-CRC. Since the second header information and E-ADU form the updated encrypted data unit, the updated encrypted data unit and the message authentication code MAC can also be used as inputs to calculate the new check code N-CRC.

[0106] S1-1-6: Add tail information to the end of the E-ADU. The tail information includes the Message Authentication Code (MAC) and the Cyclic Redundancy Check Code (N-CRC) (i.e., the new check code).

[0107] S1-1-7: Combine the second header information, E-ADU, and tail information into a new application data unit N-ADU.

[0108] S1-1-8: Send the N-ADU to the bus network.

[0109] S1-2: When a ciphertext data unit from the bus network is detected.

[0110] Verification of the encrypted data unit specifically includes:

[0111] A temporary verification code is calculated using the verification code generation function based on the updated encrypted data unit and the message authentication code.

[0112] The encrypted data unit is verified based on the temporary check code and the new check code. Specifically, this includes step S1-2-1.

[0113] S1-2-1: Use N-CRC to check the message. Use a pre-built check code generation function to calculate the content of the ciphertext data unit except for the tail N-CRC code to obtain the temporary check code TN-CRC. If the TN-CRC is consistent with the N-CRC, the check passes and proceeds to S1-2-2; otherwise, discard the message and return to the listening state.

[0114] S1-2-2: Input the encrypted data unit, initialization vector IV, and pre-made encryption key PEK into the symmetric encryption function to decrypt and obtain the plaintext data unit.

[0115] The verification of the plaintext data unit specifically includes:

[0116] A temporary message authentication code is calculated using a hash algorithm based on the plaintext data unit and the pre-made shared key.

[0117] The plaintext data unit is verified based on the temporary message authentication code and the message authentication code. Specifically, this is step S1-2-3.

[0118] S1-2-3: Use message authentication code to verify integrity and authenticity. Input the decrypted plaintext data unit and the pre-made shared key PSK into the hash algorithm to generate a temporary message authentication code (Temporary MAC, T-MAC). If the T-MAC is consistent with the received MAC, the verification is successful and proceed to S1-2-4; otherwise, discard the message and return to the listening state.

[0119] The step of sending the plaintext data unit to the target device specifically includes:

[0120] The plaintext data unit is sent to the target device according to the destination address in the plaintext data unit.

[0121] S1-2-4: Send the plaintext data unit to the field control layer device or the field device layer device side, and send it to the designated device according to the destination address encoding of the plaintext data unit header. If the address cannot be found, discard the data packet.

[0122] This invention proposes a method for encrypting data transmission in water conservancy industrial control systems, based on existing equipment and wiring conditions, specifically for industrial Ethernet and fieldbus. By connecting an encrypted transmission terminal device in series with the existing interface, secure protection for industrial control data transmission is achieved. This invention is compatible with multiple protocols across two major categories: industrial Ethernet and fieldbus. Industrial Ethernet protocols include, but are not limited to, Modbus TCP, Ethernet IP, and S7Comm, while fieldbus protocols include, but are not limited to, Modbus, Modbus Plus, and Profibus, demonstrating strong protocol compatibility. During the encryption process, not only is the message content itself encrypted, but the message is also verified twice: CRC integrity check and message authentication code authenticity check, achieving protection of message confidentiality, integrity, and authenticity. The encryption and decryption effects of this method are both based on domestically developed cryptographic algorithms, effectively eliminating security risks in water conservancy industrial control data transmission and meeting the requirements of domestically developed cryptography. A single gateway can provide dual-channel encryption; in locations requiring both Ethernet and fieldbus encryption, only one gateway needs to be deployed, reducing equipment deployment and achieving the same encryption effect with fewer devices. It can be seamlessly embedded into existing water conservancy industrial control systems without requiring any changes to the original system usage patterns, networking methods, business methods, or physical interfaces, achieving a plug-and-play effect and enabling low-cost security upgrades to existing systems. It can be applied between different regional LANs and between different devices within the same LAN, demonstrating strong adaptability to various deployment scenarios and meeting the encryption protection needs of diverse business scenarios in the water conservancy industry. Timely key updates reduce key leakage losses and ensure the security of encrypted data.

[0123] Example 2

[0124] like Figure 3 As shown, the present invention also provides a water conservancy industrial control data transmission encryption and decryption system for implementing the above-mentioned water conservancy industrial control data transmission encryption and decryption method. The system includes an encryption gateway group, a process monitoring layer device, a field control layer device, and a field device layer device.

[0125] The encryption gateway group includes a first encryption gateway and a second encryption gateway (i.e., a data sending encryption gateway and a data receiving encryption gateway), used to implement the aforementioned encryption and decryption method for water conservancy industrial control data transmission. Specifically, it is used to implement encryption and decryption of Ethernet and bus network data transmission in the system. The devices involved include a data sending encryption gateway and a data receiving encryption gateway.

[0126] The process monitoring layer equipment is used to supervise and control the physical processes of each link in the hydraulic engineering control system, and to collect and monitor operational data from the field control layer equipment, as well as issue commands. Specifically, it is used to supervise and control the physical processes of each link in the system, collect and monitor operational data from the field control layer equipment, and issue commands. The equipment involved includes operator stations, engineer stations, etc.

[0127] The field control layer equipment is used for data acquisition, field control, and receiving instructions from the process monitoring layer equipment. Specifically, it is used to implement field control and data acquisition, issue instructions to equipment, read data from sensors, maintain process history records, etc., and the equipment involved includes programmable logic controllers (PLCs), remote transmission units (RTUs), data transmission units (DTUs), etc.

[0128] The field equipment layer is used to collect data on the field conditions, respond to commands from the field control layer, and transmit monitoring data back. Specifically, it is used to collect data on the field conditions, respond to commands from the field control layer, and transmit monitoring data back. The equipment involved includes temperature and humidity instruments, water level gauges, flow meters, etc.

[0129] The process monitoring layer devices and the field control layer devices are networked via an industrial Ethernet network. By deploying encrypted terminals on both sides, secure uplink and downlink transmission between the process monitoring layer devices and the field control layer devices can be ensured. For the downlink, all command data issued from the process monitoring layer devices enters the encrypted terminal through the plaintext network port. After encrypting the plaintext command data, the IP address of the encrypted network port of the encrypted terminal on the field control layer device side is encapsulated to form a ciphertext command data packet, which is then sent to the industrial Ethernet network through the ciphertext network port. The ciphertext command data packet enters from the encrypted network port of the encrypted terminal on the field control layer device side. After the encrypted device decrypts the ciphertext command data, it is sent out through the plaintext network port to the designated field control layer device. In the uplink section, all monitoring data uploaded from the field control layer devices will enter the encrypted terminal through the plaintext network port. After encrypting the plaintext monitoring data, the IP address of the encrypted network port of the encrypted terminal of the process monitoring layer device is encapsulated to form a ciphertext monitoring data packet, which is sent to the industrial Ethernet network through the ciphertext network port. The ciphertext monitoring data packet enters from the encrypted network port of the encrypted terminal on the process monitoring layer device side. After the encryption device decrypts the ciphertext monitoring data, it is sent out through the plaintext network port and continues to be sent to the designated process monitoring layer device.

[0130] The field control layer devices and field device layer devices are networked via a fieldbus. By deploying encrypted terminals on both sides, secure uplink and downlink transmission between the field control layer devices and field device layer devices can be ensured. For the downlink, control commands issued from the field control layer devices enter the encrypted terminal via a plaintext serial port. The plaintext command data is encrypted, a temporary device identifier is encapsulated, forming a ciphertext command data packet, which is then sent to the bus network via the ciphertext serial port. The ciphertext command data packet enters from the encrypted serial port of the encrypted terminal on the field device layer side. The encrypted device decrypts the encrypted command data and sends it out via the plaintext serial port to the designated field device layer device. For the uplink, monitoring data uploaded from the field device layer devices enters the encrypted terminal via a plaintext serial port. The plaintext monitoring data is encrypted, a temporary device identifier is encapsulated, forming a ciphertext monitoring data packet, which is then sent to the bus network via the ciphertext serial port. The ciphertext monitoring data packet enters from the encrypted serial port of the encrypted terminal on the field control layer side. The encrypted device decrypts the ciphertext monitoring data and sends it out via the plaintext serial port to the designated field control layer device.

[0131] Each embodiment in this specification focuses on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be found in the method section.

[0132] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. Furthermore, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for encrypting and decrypting data transmission in water conservancy industrial control systems, characterized in that, The method includes: When the communication type of the user equipment connection is network interface communication: Acquire plaintext communication messages; plaintext communication messages are data generated by process monitoring layer devices or field control layer devices; A symmetric encryption algorithm is used to encrypt plaintext communication messages based on a first initialization vector and a session key to generate encrypted messages; the first initialization vector and the session key are determined by negotiation parameters negotiated between the first encryption gateway and the second encryption gateway; the first encryption gateway is a client encryption gateway, and the second encryption gateway is a server encryption gateway; The first checksum, the first header information, the encrypted message, and the new IP address are concatenated to obtain a ciphertext communication message, which is then sent to the industrial Ethernet network. The first checksum is generated from the encrypted message, the first header information, and the verification key. The first header information includes security index parameters and a sequence number. When a ciphertext message corresponding to a ciphertext communication message is detected in an industrial Ethernet network, the ciphertext message is verified. If the verification is successful, a symmetric encryption algorithm is used to decrypt the encrypted message based on the first initialization vector and the session key to obtain the plaintext message, which is then sent to the target device. The target device includes process monitoring layer devices or field control layer devices. When the communication type of the user equipment connection is serial communication: Acquire application data units; application data units are data generated by field control layer devices or field device layer devices; The application data unit is verified; if the verification is successful, the application data unit is encrypted using a symmetric encryption algorithm based on the second initial vector and the pre-made encryption key to obtain the encrypted data unit; the second initial vector is calculated from a pseudo-random number generated by the timestamp seed; A second header and a tail information are added to the encrypted data unit to generate a new application data unit, and the new application data unit is sent to the bus network; the second header information includes an encryption identifier, a pseudo-random number, and a data length identifier; the tail information is determined by the application data unit, the pre-made encryption key, the second header information, and the encrypted data unit; When a new application data unit corresponding to a ciphertext data unit is detected in the bus network, the ciphertext data unit is verified. After the verification is successful, a symmetric encryption algorithm is used to decrypt the encrypted data unit according to the second initial vector and the pre-made encryption key to obtain the plaintext data unit. The plaintext data unit is verified, and if the verification passes, the plaintext data unit is sent to the target device.

2. The method for encrypting and decrypting data transmission in water conservancy industrial control according to claim 1, characterized in that, Before obtaining the plaintext communication message, the method further includes: Based on digital certificates, authentication is performed through a first encryption gateway and a second encryption gateway; once authentication is successful, a session key, a verification key, and a first initialization vector are generated according to the negotiated parameters.

3. The method for encrypting and decrypting data transmission in water conservancy industrial control systems according to claim 1, characterized in that, Verification of the encrypted message specifically includes: A second verification value is generated using a hash algorithm based on the encrypted message, the verification key, and the header information of the ciphertext message; The encrypted message is verified based on the first verification value and the second verification value.

4. The method for encrypting and decrypting data transmission in water conservancy industrial control according to claim 1, characterized in that, Adding second header and footer information to the encrypted data unit to generate a new application data unit specifically includes: A hash algorithm is used to generate a message authentication code based on the application data unit and the pre-made shared key; A second header information is added to the header of the encrypted data unit to obtain an updated encrypted data unit. A new verification code is calculated based on the updated encrypted data unit and the message authentication code; The message authentication code and the new verification code are added as tail information to the tail of the updated encrypted data unit to obtain a new application data unit.

5. The method for encrypting and decrypting data transmission in water conservancy industrial control according to claim 4, characterized in that, Verification of the encrypted data unit specifically includes: A temporary verification code is calculated using the verification code generation function based on the updated encrypted data unit and the message authentication code. The encrypted data unit is verified based on the temporary check code and the new check code.

6. The method for encrypting and decrypting data transmission in water conservancy industrial control according to claim 4, characterized in that, Verification of the plaintext data unit specifically includes: A temporary message authentication code is calculated using a hash algorithm based on the plaintext data unit and the pre-made shared key. The plaintext data unit is verified based on the temporary message authentication code and the message authentication code.

7. The method for encrypting and decrypting data transmission in water conservancy industrial control systems according to claim 1, characterized in that, Sending the plaintext data unit to the target device specifically includes: The plaintext data unit is sent to the target device according to the destination address in the plaintext data unit.

8. A hydraulic engineering control data transmission encryption and decryption system that implements the hydraulic engineering control data transmission encryption and decryption method of claim 1, characterized in that, The system includes an encryption gateway group, process monitoring layer devices, field control layer devices, and field device layer devices; The encryption gateway group includes a first encryption gateway and a second encryption gateway. The process monitoring layer equipment is used to supervise and control the physical processes of each link in the water conservancy industrial control system, and to collect and monitor the operation data of the field control layer equipment and issue instructions. The field control layer device is used for data acquisition, field control, and receiving instructions from the process monitoring layer device; The field equipment layer is used to collect data on the field conditions, respond to instructions from the field control layer, and transmit monitoring data back.

Images