A data security system and use method of a smart factory

Abstract

The present invention discloses a data security system and a method for using a smart factory, including a data management platform installed in a cloud service, wherein the data port of the data management platform is respectively connected to a database, a rights management module, a data interaction module, a vulnerability repair module, a data transceiver terminal, a manual review module, and a delayed encryption and decryption module, wherein the data end of the data interaction module transmits data bidirectionally with the database through the rights management module, and the rights management module includes an operation authentication unit and a rights classification unit, and the operation authentication unit is used to identify the identity ID of the operator through a feature code or a login password. The present invention, through the setting of the delayed encryption and decryption module and the data implantation unit, enables the data implantation unit to effectively post-manage, post-track, post-edit and post-limit the data after the data is sent.

Description

Technical Field

[0001] The present invention relates to the technical field of data security management, and in particular to a data security system for a smart factory and a method for using the same. Background Art

[0002] Mobile media (including USB flash drives, mobile hard drives, floppy disks, optical disks, and memory cards) are small in size and large in capacity. As a carrier for storing data, they are widely used in a variety of industries.

[0003] Due to business needs, factory production lines often involve copying data with suppliers and customers through mobile media such as U disks. However, due to the lack of effective management of mobile media, mobile media are easily infected with viruses, causing factory equipment to be infected with viruses, which can easily lead to serious production accidents and property losses. In the prior art, a patent document with publication number CN116881908A discloses a mobile data security scanning management system applied to factories, including a virus pre-scanning module, an operation authentication module and a medium data module. The virus pre-scanning module is used to perform a preliminary virus scan on the connected mobile medium, allowing the scanned mobile medium to perform the next operation, and prohibiting and alarming the mobile medium that fails the scan. However, when the above-mentioned data management system manages data, on the one hand, it is not convenient to effectively post-manage and post-authorization edit the data after the factory data is issued, and on the other hand, it is not convenient to realize efficient mining of factory data security system vulnerabilities, and then the security of the factory data security system cannot be guaranteed. Based on this, the present invention provides a data security system and a method for using a smart factory to solve the technical problems raised in the above-mentioned background technology. Summary of the invention

[0004] 1. Technical issues to be resolved

[0005] In view of the deficiencies in the prior art, the object of the present invention is to provide a data security system for a smart factory and a method of use. The present invention, through the setting of a delayed encryption and decryption module and a data implantation unit, enables the data implantation unit to effectively post-manage, post-track, post-edit and post-limit the data after it is issued. By achieving the above-mentioned full-process data management and full-process tracking effects, the data security of the data security system is effectively guaranteed.

[0006] (II) Technical solution

[0007] To achieve the above-mentioned purpose, the present invention provides the following technical solutions: a data security system for a smart factory, the technical solution adopted is: comprising a data management platform carried in a cloud service, the data ports of the data management platform are respectively connected to a database, a rights management module, a data interaction module, a vulnerability repair module, a data transceiver terminal, a manual review module and a delayed encryption and decryption module, and the data end of the data interaction module transmits data bidirectionally with the database through the rights management module;

[0008] The authority management module includes an operation authentication unit and an authority classification unit, wherein the operation authentication unit is used to identify the identity ID of the operator through a feature code or a login password;

[0009] The authority classification unit collects user identity IDs and issues a specified level of data operation authority to each user identity ID. The authority classification unit defines the corresponding data operable and editable behaviors and scopes within each level of data operation authority;

[0010] The data interaction module includes a data transceiver unit and a data implantation unit. The data transceiver unit is used to interact with the database and upload and send data to the database. The data transceiver unit uploads or sends data of a specified range or a specified level from the database according to the authority identification result of the authority classification unit.

[0011] After uploading data on the external medium, the data implantation unit implants a user IP acquisition algorithm in the external medium. After sending and receiving data on the external medium, the implantation unit implants a data post-processing program in the external medium synchronously with the acquired data.

[0012] The delayed encryption and decryption module remotely outputs the central control instruction to the data post-processing program according to the delayed encryption and decryption rules.

[0013] As a preferred solution, the data transceiver terminal is used to connect to the external medium data, and the external medium uploads and downloads data through the data transceiver terminal. The data transceiver terminal obtains the device ID of the external medium and the user identity ID bound to the external medium device ID in real time.

[0014] As a preferred solution, after the data transceiver terminal obtains the uploaded data from the external medium, it uploads the uploaded data to the manual review module. The manual review module manually reviews the uploaded data and adds permissions. After manually reviewing the uploaded data, the manual review module binds the uploaded data with the user identity ID.

[0015] As a preferred solution, the data post-processing program customizes data encryption rules, automatically edits data and limits processing permissions, self-records data operation logs, and automatically adds and deletes data for the data collected by the external medium;

[0016] The data post-processing program is connected to the delayed encryption and decryption module remotely when the network is available, and receives the remote central control command of the delayed encryption and decryption module and the upload data decryption request command;

[0017] After the data collector collects the data, the data post-processing program records the data collector's operation records on the data in real time. The data operation log data collected by the data post-processing program is output to the delayed encryption and decryption module in real time during networking.

[0018] As a preferred solution, after the delayed encryption and decryption module obtains the data decryption request instruction, it automatically customizes the delayed decryption time after the data is sent, the data decryption code or data decryption rule after the delayed decryption time is reached according to the authority identification result of the authority classification unit;

[0019] The data decryption code or data decryption rule is customized in combination with the data delayed decryption time;

[0020] The delayed encryption and decryption module sends a specified data decryption code or data decryption rule to the data post-processing program in the external medium under the specified device ID after the delayed decryption time is reached;

[0021] After obtaining the specified data decryption code or data decryption rule, the data post-processing program automatically decrypts the downloaded data in the external connection medium.

[0022] As a preferred solution, during the delayed decryption waiting period, the delayed encryption and decryption module conducts a re-examination of data permissions in combination with the data operation log uploaded by the data post-processing program and the data permissions of the external media under the specified device ID;

[0023] The delayed encryption and decryption module outputs data automatic addition and deletion instructions, data self-editing and permission modification instructions, and data encryption rule customization instructions to the data post-processing program based on the audit results;

[0024] The delayed encryption and decryption module manually re-edits the delayed decryption time, data decryption code or data decryption rule after the data is sent according to the audit result;

[0025] The delayed encryption and decryption module manually re-limits the data operable permissions and operable behaviors after decryption of the external media data under the specified device ID based on the audit results.

[0026] The database stores various types of production and processing data in the smart factory. The database has a built-in virus scanning and encryption engine, which performs virus scanning, virus processing and data encryption on the data uploaded to the database in sequence.

[0027] As a preferred solution, the vulnerability repair module includes an AI acquisition unit, an AI editing unit, an AI exhaustive attack unit and a repair unit;

[0028] The AI ​​acquisition unit collects device attributes of terminals at all levels in the data processing platform and vulnerability attack rules and vulnerability attack algorithms corresponding to the device attributes through the network data disclosure platform, search engine or vulnerability attack unit;

[0029] The AI ​​editing unit randomly combines, adds or deletes the attack rules and vulnerability attack algorithms collected by the AI ​​collection unit, and finally generates a plurality of vulnerability attack rules;

[0030] The AI ​​exhaustive attack unit executes the vulnerability attack rules generated in the AI ​​editing unit one by one or in disordered combination, and then implements an AI exhaustive attack on terminal devices at all levels in the data processing platform;

[0031] After the AI ​​exhaustive attack unit performs an exhaustive attack, the repair unit collects attack feedback from terminal devices at all levels in the data processing platform. The repair unit identifies effective attack rules specified by the AI ​​editing unit based on the attack feedback from terminal devices at all levels. After collecting the effective attack rules, the repair unit formulates vulnerability repair means or vulnerability repair measures through manual assistance based on the effective attack rules.

[0032] As a preferred solution, a method for using a data security system for a smart factory uploads various types of production and processing data in the smart factory to a database in a data management platform and executes a data security system for a smart factory as described in any one of the above.

[0033] (III) Beneficial effects

[0034] Compared with the prior art, the present invention provides a data security system and method for use in a smart factory, which has the following beneficial effects:

[0035] 1. The present invention sets a delayed encryption and decryption module and a data implantation unit so that after the data is sent, the data implantation unit can effectively post-manage, post-track, post-edit and post-limit the data. By achieving the above-mentioned full-process data management and full-process tracking effects, the data security of the data security system is effectively guaranteed.

[0036] 2. Through the setting of the vulnerability repair module, the present invention can use AI means to exhaustively mine, exhaustively attack or exhaustively simulate repairs the possible vulnerabilities in the data security system. By achieving the above-mentioned technical effects, the vulnerability rate of the system is effectively reduced and the safety of use of the system is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is a principle block diagram of a data security system for a smart factory according to the present invention;

[0038] Figure 2 This is a principle block diagram of the rights management module of the present invention;

[0039] Figure 3 It is a principle block diagram of the data interaction module of the present invention;

[0040] Figure 4 It is a structural schematic diagram of the vulnerability repair module of the present invention.

[0041] In the figure: 1. Data management platform; 2. Database; 3. Permission management module; 4. Data interaction module; 5. Vulnerability repair module; 6. Data sending and receiving terminal; 7. Delay encryption and decryption module; 8. Manual review module. DETAILED DESCRIPTION

[0042] The present invention will be further described and illustrated below in conjunction with specific embodiments and accompanying drawings:

[0043] See also Figure 1-4 , the present invention: a data security system for a smart factory, the technical solution adopted is: comprising a data management platform 1 mounted in a cloud service, the data port of the data management platform 1 is respectively connected with a database 2, a rights management module 3, a data interaction module 4, a vulnerability repair module 5, a data transceiver terminal 6, a manual review module 8 and a delayed encryption and decryption module 7, the data end of the data interaction module 4 transmits data bidirectionally with the database 2 through the rights management module 3;

[0044] Database 2 stores various production and processing data in the smart factory. Database 2 has a built-in virus scanning and encryption engine, which performs virus scanning, virus processing and data encryption on the data uploaded to Database 2 in turn.

[0045] The authority management module 3 includes an operation authentication unit and an authority classification unit. The operation authentication unit is used to identify the identity ID of the operator through a feature code or a login password;

[0046] The authority classification unit collects user identity IDs and issues a specified level of data operation authority to each user identity ID. The authority classification unit limits the corresponding data operable and editable behaviors and scope within each level of data operation authority;

[0047] The data interaction module 4 includes a data transceiver unit and a data implantation unit. The data transceiver unit is used to interact with the database 2 and upload and send data to the database 2.

[0048] The data transceiver unit uploads or sends data of a specified range or a specified level from the database 2 according to the authority identification result of the authority classification unit;

[0049] After uploading data on the external medium, the data implantation unit implants the user IP acquisition algorithm in the external medium. After sending and receiving data on the external medium, the implantation unit implants the data post-processing program in the external medium synchronously with the acquired data.

[0050] The data transceiver terminal 6 is used to connect with the external medium data. The external medium uploads and downloads data through the data transceiver terminal 6. The data transceiver terminal 6 obtains the device ID of the external medium and the user identity ID bound to the external medium device ID in real time.

[0051] After the data transceiver terminal 6 obtains the uploaded data from the external medium, it uploads the uploaded data to the manual review module 8. The manual review module 8 manually reviews and adds permissions to the uploaded data. After manually reviewing the uploaded data, the manual review module 8 binds the uploaded data with the user identity ID.

[0052] The data post-processing program customizes data encryption rules, automatically edits data, limits processing permissions, self-records data operation logs, and automatically adds and deletes data for the data collected by the external media;

[0053] The data post-processing program is connected to the delayed encryption and decryption module 7 remotely when the network is available, and receives the remote central control command and the upload data decryption request command of the delayed encryption and decryption module 7;

[0054] After the data collector collects the data, the data post-processing program records the data collector's operation records on the data in real time. The data operation log data collected by the data post-processing program is output to the delayed encryption and decryption module 7 in real time during networking.

[0055] After the delayed encryption and decryption module 7 obtains the data decryption request instruction, it automatically customizes the delayed decryption time after the data is sent, the data decryption code or data decryption rule after the delayed decryption time is reached according to the authority identification result of the authority classification unit;

[0056] Data decryption code or data decryption rule is customized in combination with data delayed decryption time;

[0057] The delayed encryption and decryption module 7 remotely outputs the central control instruction to the data post-processing program according to the delayed encryption and decryption rules.

[0058] After the delayed decryption time is reached, the delayed encryption and decryption module 7 sends a specified data decryption code or data decryption rule to the data post-processing program in the external medium under the specified device ID;

[0059] After the data post-processing program obtains the specified data decryption code or data decryption rule, it automatically decrypts the downloaded data in the external connection medium.

[0060] During the delayed decryption waiting period, the delayed encryption and decryption module 7 reviews the data permissions in combination with the data operation log uploaded by the data post-processing program and the data permissions of the external media under the specified device ID;

[0061] The delayed encryption and decryption module 7 outputs data automatic addition and deletion instructions, data self-editing and permission modification instructions, and data encryption rule customization instructions to the data post-processing program based on the audit results;

[0062] The delayed encryption and decryption module 7 manually re-edits the delayed decryption time, data decryption code or data decryption rule after the data is sent according to the audit results;

[0063] The delayed encryption and decryption module 7 manually re-limits the data operable permissions and operable behaviors after decryption of the external media data under the specified device ID based on the audit results.

[0064] The vulnerability repair module 5 includes an AI acquisition unit, an AI editing unit, an AI exhaustive attack unit and a repair unit;

[0065] The AI ​​collection unit collects device attributes of terminals at all levels in the data processing platform and the vulnerability attack rules and vulnerability attack algorithms corresponding to the device attributes through the network data disclosure platform, search engine or vulnerability attack unit;

[0066] The AI ​​editing unit randomly combines, adds or deletes the attack rules and vulnerability attack algorithms collected by the AI ​​collection unit, and finally generates several vulnerability attack rules;

[0067] The AI ​​exhaustive attack unit executes the vulnerability attack rules generated in the AI ​​editing unit one by one or in disordered combination, and then implements AI exhaustive attacks on terminal devices at all levels in the data processing platform;

[0068] After the AI ​​exhaustive attack unit conducts an exhaustive attack, the repair unit collects attack feedback from terminal devices at all levels in the data processing platform. The repair unit identifies the effective attack rules specified by the AI ​​editing unit based on the attack feedback from terminal devices at all levels. After collecting the effective attack rules, the repair unit formulates vulnerability repair means or vulnerability repair measures based on the effective attack rules through manual assistance.

[0069] A method for using a data security system for a smart factory, uploading various types of production and processing data in the smart factory to a database 2 in a data management platform 1 and executing any one of the above data security systems for a smart factory.

[0070] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention, rather than to limit the scope of protection of the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the essence and scope of the technical solution of the present invention.

Claims

1. A data security system for a smart factory, characterized in that: It comprises a data management platform (1) installed in a cloud service, wherein the data port of the data management platform (1) is respectively connected to a database (2), a rights management module (3), a data interaction module (4), a vulnerability repair module (5), a data transceiver terminal (6), a manual review module (8) and a delayed encryption and decryption module (7), and the data end of the data interaction module (4) performs bidirectional data transmission with the database (2) via the rights management module (3); The authority management module (3) comprises an operation authentication unit and an authority classification unit, wherein the operation authentication unit is used to identify the identity ID of the operator through a feature code or a login password; The authority classification unit collects user identity IDs and issues a specified level of data operation authority to each user identity ID. The authority classification unit defines the corresponding data operable and editable behaviors and scopes within each level of data operation authority; The data interaction module (4) comprises a data transceiver unit and a data implantation unit, the data transceiver unit being used to perform data interaction with the database (2) and to upload data to and send data to the database (2), the data transceiver unit uploading or sending data of a specified range or a specified level from the database (2) according to the authority identification result of the authority classification unit; After uploading data on the external medium, the data implantation unit implants a user IP acquisition algorithm in the external medium. After sending and receiving data on the external medium, the implantation unit implants a data post-processing program in the external medium synchronously with the acquired data. The delayed encryption and decryption module (7) remotely outputs the central control instruction to the data post-processing program according to the delayed encryption and decryption rules; The vulnerability repair module (5) includes an AI acquisition unit, an AI editing unit, an AI exhaustive attack unit and a repair unit; The AI ​​acquisition unit collects device attributes of terminals at all levels in the data processing platform and vulnerability attack rules and vulnerability attack algorithms corresponding to the device attributes through the network data disclosure platform, search engine or vulnerability attack unit; The AI ​​editing unit randomly combines, adds or deletes the attack rules and vulnerability attack algorithms collected by the AI ​​collection unit, and finally generates a plurality of vulnerability attack rules; The AI ​​exhaustive attack unit executes the vulnerability attack rules generated in the AI ​​editing unit one by one or in disordered combination, and then implements an AI exhaustive attack on terminal devices at all levels in the data processing platform; After the AI ​​exhaustive attack unit performs an exhaustive attack, the repair unit collects attack feedback from terminal devices at all levels in the data processing platform. The repair unit identifies effective attack rules specified by the AI ​​editing unit based on the attack feedback from terminal devices at all levels. After collecting the effective attack rules, the repair unit formulates vulnerability repair means or vulnerability repair measures through manual assistance based on the effective attack rules.

2. The data security system of a smart factory according to claim 1, characterized in that: The data transceiver terminal (6) is used for data connection with the external medium. The external medium uploads and downloads data through the data transceiver terminal (6). The data transceiver terminal (6) obtains the device ID of the external medium and the user identity ID bound to the device ID of the external medium in real time.

3. The data security system of a smart factory according to claim 2 is characterized by: After the data transceiver terminal (6) obtains the uploaded data from the external medium, it uploads the uploaded data to the manual review module (8). The manual review module (8) manually reviews the uploaded data and adds permissions. After the manual review module (8) manually reviews the uploaded data, it binds the uploaded data to the user identity ID.

4. The data security system of a smart factory according to claim 3 is characterized by: The data post-processing program customizes data encryption rules, automatically edits data and limits processing permissions, self-records data operation logs, and automatically adds and deletes data for the data collected by the external medium; The data post-processing program is remotely connected to the delayed encryption and decryption module (7) when the network is available, and receives the remote central control command and the uploaded data decryption request command of the delayed encryption and decryption module (7); After the data collector collects the data, the data post-processing program records the data collector's operation records on the data in real time. The data operation log data collected by the data post-processing program is output to the delayed encryption and decryption module (7) in real time during the networking period.

5. The data security system of a smart factory according to claim 4 is characterized in that: After the delayed encryption / decryption module (7) obtains the data decryption request instruction, it automatically customizes the delayed decryption time after the data is sent, the data decryption code or data decryption rule after the delayed decryption time is reached according to the authority identification result of the authority classification unit; The data decryption code or data decryption rule is customized in combination with the data delayed decryption time; The delayed encryption and decryption module (7) sends a specified data decryption code or data decryption rule to the data post-processing program in the external medium under the specified device ID after the delayed decryption time expires; After obtaining the specified data decryption code or data decryption rule, the data post-processing program automatically decrypts the downloaded data in the external connection medium.

6. The data security system of a smart factory according to claim 5, characterized in that: During the delayed decryption waiting period, the delayed encryption and decryption module (7) conducts a re-examination of the data permissions in combination with the data operation log uploaded by the data post-processing program and the data permissions of the external medium under the specified device ID; The delayed encryption and decryption module (7) outputs data automatic addition and deletion instructions, data self-editing and permission modification instructions, and data encryption rule customization instructions to the data post-processing program according to the audit results; The delayed encryption and decryption module (7) manually re-edits the delayed decryption time, data decryption code or data decryption rule after the data is sent according to the audit result; The delayed encryption and decryption module (7) manually re-limits the data operable permissions and operable behaviors after decryption of the external media data under the specified device ID based on the audit result.

7. The data security system of a smart factory according to claim 6, characterized in that: The database (2) stores various types of production and processing data in the smart factory. The database (2) has a built-in virus scanning and encryption engine. The virus scanning and encryption engine sequentially performs virus scanning, virus processing and data encryption on the data uploaded to the database (2).

Images