Data verification method, device, storage medium and computer program product

Abstract

The application provides a data verification method and device, a storage medium and a computer program product, relates to the technical field of information security, and can improve the security of data transmission. The method comprises the following steps: receiving first ciphertext, second ciphertext and first signature information sent by an Internet of Things device; decrypting the second ciphertext to obtain a first AES key; decrypting the first ciphertext based on the first AES key to obtain decrypted first request data; and performing data verification based on the first signature information and the decrypted first request data. The application can solve the problem of low data transmission security in an industrial gateway.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, and particularly relates to a data verification method, device, storage medium and computer program product. BACKGROUND

[0002] An industrial gateway is an important device for connecting industrial equipment and a cloud platform. On one hand, the industrial gateway is configured with a cloud platform, and on the other hand, the industrial gateway is connected with industrial equipment, and can realize uploading and issuing of information. The industrial gateway is mainly used for processing information interaction between two systems or products with different communication protocols, data formats or languages, or between a product and a cloud platform.

[0003] As an important medium for connecting sensors, equipment and a cloud platform, the industrial gateway is one of the key technologies for realizing industrial Internet of Things. However, due to its strong connectivity and processing capability, the industrial gateway has become an attack target of network attackers, resulting in a security risk that data is stolen or leaked. SUMMARY

[0004] The present application provides a data verification method, device, storage medium and computer program product, which can realize improving the security of data transmission.

[0005] In a first aspect, the present application provides a data verification method, comprising: receiving first ciphertext, second ciphertext and first signature information sent by an Internet of Things device; the first ciphertext is ciphertext obtained by performing AES encryption on first request data based on a first AES key; the second ciphertext is ciphertext obtained by performing encryption on the first AES key based on an asymmetric encryption algorithm (RSA) algorithm; the first signature information is information obtained by encrypting first digest information, and the first digest information is obtained by processing the first request data by using a preset digest algorithm; decrypting the second ciphertext to obtain the first AES key; based on the first AES key, decrypting the first ciphertext to obtain decrypted first request data; and based on the first signature information and the decrypted first request data, performing data verification.

[0006] The data verification method provided in the application receives the first ciphertext, the second ciphertext and the first signature information sent by the Internet of Things device, then decrypts the second ciphertext to obtain the first AES key, and then decrypts the first ciphertext based on the first AES key to obtain the decrypted first request data, and further performs data verification based on the first signature information and the decrypted first request data. The method encrypts the request data sent by the Internet of Things device by using AES, and then performs asymmetric encryption on the AES key by using RSA, thereby ensuring the security of the key and data transmission. Meanwhile, the digest information is generated by using the digest algorithm, and the digest information is encrypted to form the signature information. After the data is decrypted, the decrypted data and the signature information are checked, thereby realizing security verification and integrity check, and improving the security of the industrial gateway in the data transmission process.

[0007] In a possible implementation, the first signature information is decrypted to obtain first digest information; the decrypted first request data is processed by using a preset digest algorithm to obtain second digest information; and the check result of the decrypted first request data is determined based on the first digest information and the second digest information.

[0008] In another possible implementation, the first signature information and the decrypted first request data are sent to a server, so that the server performs data verification on the decrypted first request data based on the first signature information; and the check result of the first request data sent by the server is received.

[0009] In a possible implementation, the second request data sent by the server is received; the second request data is AES encrypted based on the second AES key to obtain third ciphertext; the second AES key is encrypted based on the RSA algorithm to obtain fourth ciphertext; and the second signature information is obtained by encrypting the third digest information; the third digest information is obtained by processing the second request data based on a preset digest algorithm; and the third ciphertext, the fourth ciphertext and the second signature information are sent to the Internet of Things device, so that the Internet of Things device obtains the decrypted second request data based on the third ciphertext and the fourth ciphertext, and performs data verification on the decrypted second request data based on the second signature information.

[0010] In another possible implementation, the second request data is evenly divided into N plaintext blocks according to a rated byte number, N is an integer greater than 0; each plaintext block in the N plaintext blocks is iteratively encrypted according to the second AES key to obtain N ciphertext blocks; and the N ciphertext blocks are merged to obtain the third ciphertext.

[0011] In another possible implementation, for the first plaintext block of the N plaintext blocks, the first plaintext block is XORed with an initial vector, and the operation result is encrypted by using the second AES key to obtain the first ciphertext block; for the i th plaintext block of the plaintext blocks, the i th plaintext block is XORed with the (i-1) th ciphertext block, and the operation result is encrypted by using the second AES key to obtain the i th ciphertext block; i is an integer greater than 0 and less than or equal to N.

[0012] In another possible implementation, the AES key is a Base64 encoded string.

[0013] In a second aspect, the present application provides a data verification apparatus, which comprises a receiving module, a processing module and a verification module.

[0014] The receiving module is configured to receive first ciphertext, second ciphertext and first signature information sent by an Internet of Things device; the first ciphertext is ciphertext obtained by performing AES encryption on first request data based on a first AES key; the second ciphertext is ciphertext obtained by performing encryption on the first AES key based on an RSA algorithm; the first signature information is information obtained by performing encryption on first digest information; the first digest information is obtained by performing processing on the first request data based on a preset digest algorithm; the processing module is configured to decrypt the second ciphertext to obtain the first AES key; the processing module is further configured to decrypt the first ciphertext based on the first AES key to obtain decrypted first request data; and the verification module is configured to perform data verification based on the first signature information and the decrypted first request data.

[0015] In a possible implementation, the verification module is specifically configured to decrypt the first signature information to obtain first digest information; perform processing on the decrypted first request data based on a preset digest algorithm to obtain second digest information; and determine a verification result of the decrypted first request data based on the first digest information and the second digest information.

[0016] In another possible implementation, the verification module is specifically further configured to send the first signature information and the decrypted first request data to a server, so that the server performs data verification on the decrypted first request data based on the first signature information; and receive a verification result of the first request data sent by the server.

[0017] In another possible implementation, the receiving module is further configured to receive second request data sent by the server; the processing module is further configured to perform AES encryption on the second request data based on a second AES key to obtain third ciphertext; the processing module is further configured to encrypt the second AES key based on an RSA algorithm to obtain fourth ciphertext; the processing module is further configured to encrypt third digest information to obtain second signature information; the third digest information is obtained by processing the second request data based on a preset digest algorithm; the processing module is further configured to send the third ciphertext, the fourth ciphertext, and the second signature information to the Internet of Things device, so that the Internet of Things device obtains decrypted second request data based on the third ciphertext and the fourth ciphertext, and performs data verification on the decrypted second request data based on the second signature information.

[0018] In another possible implementation, the processing module is specifically configured to divide the second request data into N plaintext blocks according to a nominal byte number, N being an integer greater than 0; and perform iteration encryption on each plaintext block in the N plaintext blocks based on the second AES key to obtain N ciphertext blocks; and combine the N ciphertext blocks to obtain the third ciphertext.

[0019] In another possible implementation, the processing module is specifically configured to, for the first plaintext block in the N plaintext blocks, perform an exclusive or operation on the first plaintext block and an initial vector, and perform encryption on an operation result by using the second AES key to obtain the first ciphertext block; and for the i th plaintext block in the N plaintext blocks, perform an exclusive or operation on the i th plaintext block and the (i-1) th ciphertext block, and perform encryption on an operation result by using the second AES key to obtain the i th ciphertext block; i being an integer greater than 0 and less than or equal to N.

[0020] In another possible implementation, the AES key is a Base64 encoded string.

[0021] In a third aspect, the present application provides an electronic device, comprising a processor and a memory; the memory stores instructions executable by the processor; and the processor is configured to execute the instructions, so that the electronic device implements the method of the first aspect.

[0022] In a fourth aspect, the present application provides a computer readable storage medium, comprising computer software instructions; when the computer software instructions run in an electronic device, the electronic device implements the method of the first aspect.

[0023] In a fifth aspect, the present application provides a computer program product, when the computer program product runs on a computer, the computer executes the steps of the related method described in the first aspect, so as to implement the method of the first aspect.

[0024] The beneficial effects of the second aspect to the fifth aspect are described with reference to the corresponding description of the first aspect, and will not be repeated. BRIEF DESCRIPTION OF DRAWINGS

[0025] Figure 1 A structural schematic diagram of a communication system provided by an embodiment of the present application is shown in the figure.

[0026] Figure 2 A flowchart of a data verification method provided by an embodiment of the present application is shown in the figure.

[0027] Figure 3 A flowchart of another data verification method provided by an embodiment of the present application is shown in the figure.

[0028] Figure 4 A flowchart of another data verification method provided by an embodiment of the present application is shown in the figure.

[0029] Figure 5 A flowchart of another data verification method provided by an embodiment of the present application is shown in the figure.

[0030] Figure 6 A flowchart of another data verification method provided by an embodiment of the present application is shown in the figure.

[0031] Figure 7 A flowchart of another data verification method provided by an embodiment of the present application is shown in the figure.

[0032] Figure 8 A flowchart of another data verification method provided by an embodiment of the present application is shown in the figure.

[0033] Figure 9 A structural schematic diagram of a data verification device provided by an embodiment of the present application is shown in the figure.

[0034] Figure 10 A structural schematic diagram of an electronic device provided by an embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0035] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0036] It should be noted that in the embodiments of the present application, the words such as "exemplarily" or "for example" are used to represent an example, illustration or description. Any embodiment or design scheme described as "exemplarily" or "for example" in the embodiments of the present application should not be interpreted as more preferred or more advantageous than other embodiments or design schemes. Rather, the words such as "exemplarily" or "for example" are intended to present the relevant concept in a specific manner.

[0037] In order to clearly describe the technical solutions of the embodiments of the present application, in the embodiments of the present application, the words such as "first", "second" are used to distinguish the same items or similar items with basically the same function and role. Those skilled in the art can understand that the words such as "first", "second" are not used to limit the quantity and execution order.

[0038] As described in the background, data leakage is one of the main security risks faced by industrial gateways. Industrial gateways connect a large number of industrial devices and sensors, which contain a large amount of sensitive data such as business secrets, intellectual property, production data, etc. If the data is stolen or leaked, it will bring immeasurable loss to enterprises and users. In addition, industrial gateways are vulnerable to remote attacks. Since industrial gateways are often accessed remotely, they are vulnerable to malware, viruses and hacking. Such attacks can cause devices to malfunction, data to be tampered with or destroyed, and in severe cases, even cause industrial devices to perform dangerous malicious operations such as shutting down power, polluting water sources, etc. In addition, network service interruption is also a major security risk for industrial gateways. Industrial gateways are usually responsible for the network connection of all devices within a factory or building. Once subjected to a network attack, it will cause the entire production and business system to be paralyzed, not only affecting production efficiency, but also having the risk of causing safety accidents, causing immeasurable losses.

[0039] In summary, there is an urgent need for a data verification method with higher security. Based on this, the embodiments of the present application provide a data verification method, which receives the first ciphertext, the second ciphertext and the first signature information sent by the Internet of Things device, then decrypts the second ciphertext to obtain the first AES key, and then decrypts the first ciphertext based on the first AES key to obtain the decrypted first request data, and further, based on the first signature information and the decrypted first request data, data verification is performed. The method encrypts the request data sent by the Internet of Things device using AES, and then combines RSA to asymmetrically encrypt the AES key, ensuring the security of the key and data transmission. At the same time, the digest information is generated by the digest algorithm, and the digest information is encrypted to form the signature information. After data decryption, the decrypted data and the signature information are checked to realize security verification and integrity check, thereby improving the security of the industrial gateway in the data transmission process.

[0040] Figure 1 This is a schematic diagram of the structure of a communication system provided in an embodiment of this application. Figure 1 As shown, the communication system includes an industrial gateway 101, an IoT device 102, and a server 103. The industrial gateway 101 and the IoT device 102 can be connected via wired or wireless network, and the industrial gateway 101 and the server 103 can also be connected via wired or wireless network.

[0041] The server 103 can be a single server or a server cluster consisting of multiple servers. In some embodiments, the server cluster can also be a distributed cluster. Optionally, the server can also be implemented on a cloud platform, such as a private cloud, public cloud, hybrid cloud, community cloud, distributed cloud, inter-cloud, and multi-cloud, or any combination thereof. This application does not limit this aspect.

[0042] In some embodiments, server 103 is used to store, analyze, or further process data received from industrial gateway 101.

[0043] In some embodiments, the industrial gateway 101 receives data sent by the IoT device 102, performs data encryption, decryption, and verification, and forwards the data to the server 103 for further processing. The industrial gateway can simultaneously connect to multiple industrial devices or sensors, handle data processing and forwarding, and support different communication protocols and data exchange with multiple servers.

[0044] In some embodiments, the IoT device 102 may correspond to one or more industrial devices, used to collect device data around the industrial devices and communicate with the industrial gateway 101. The IoT device 102 may be various sensors, controllers or other devices, which are not limited in this embodiment.

[0045] In addition, the above Figure 1 The schematic diagram of the communication system shown is illustrated by taking the example of an industrial gateway 101 encrypting, decrypting, and verifying data sent by an IoT device 102, and then forwarding the processed data to a server 103.

[0046] It should be understood that Figure 1 This is an exemplary structural diagram. Figure 1 The number of devices included in the illustrated communication system is unlimited; for example, the number of industrial gateways 101 and the number of IoT devices 102 are unlimited. Furthermore, except... Figure 1 In addition to the equipment shown, Figure 1 The communication system shown may also include other devices, which are not limited thereto.

[0047] Figure 2 A flowchart of a data verification method provided by an embodiment of the present application is shown in FIG. 1. As shown in FIG. 1, the data verification method provided by the present application can be implemented by the industrial gateway described above, and specifically includes the following steps: Figure 2

[0048] S201, receiving a first ciphertext, a second ciphertext and first signature information sent by an Internet of Things device.

[0049] The first ciphertext is a ciphertext obtained by performing AES encryption on first request data based on a first AES key; the second ciphertext is a ciphertext obtained by performing encryption on the first AES key based on an RSA algorithm; and the first signature information is information obtained by performing encryption on first digest information, and the first digest information is obtained by processing the first request data using a preset digest algorithm.

[0050] Optionally, the AES key is a randomly generated binary string, which can be converted into a Base64 encoded string for convenient transmission and storage. Base64 encoding can convert binary data into plain text characters, so that data can be safely transmitted in different systems and networks.

[0051] In some embodiments, AES is a symmetric key encryption technology, meaning that the same key is used for both encryption and decryption. The Internet of Things device will first generate a first AES key, which is used to perform AES encryption on the first request data to obtain the first ciphertext. At the same time, in order to securely transmit the AES key, the Internet of Things device will also use the RSA algorithm to encrypt the AES key to generate the second ciphertext. The RSA algorithm is an asymmetric encryption algorithm that can ensure the secure transmission of the key in a public network environment. In addition, the Internet of Things device will also perform digest processing on the first request data to generate the first digest information. This digest information is obtained by processing the first request data using a preset digest algorithm, such as MD5, and it can uniquely represent the data. Then, the Internet of Things device will encrypt the digest information to generate the first signature information. This signature information can be used to verify the integrity and authenticity of the data.

[0052] It should be noted that the digest algorithm, also known as the hash algorithm, can convert data of any length into a fixed-length data string, which is used for verifying data integrity and generating digital signatures and other security applications. In digital signatures, the digest algorithm can be used to generate a unique representation of the message, and then encrypt the digest to ensure that the message has not been tampered with.

[0053] ​Exemplarily, the first request data is sorted in alphabetical order. Then, the request data name and the request data value are concatenated into a string A. Next, the appSecret is appended to the end of the string A to form a new string B. Finally, the MD5 hash operation is performed on the string B to obtain the first signature information with 32-bit lowercase.

[0054] It should be understood that the appSecret is a key, usually a string of randomly generated characters, used to verify the origin of the request and ensure the integrity of the request data.

[0055] In some embodiments, the IoT device sends the first ciphertext, the second ciphertext and the first signature information to the industrial gateway. The sending process of these information can be ensured by a secure communication protocol, such as HTTPS, to ensure the security of data transmission.

[0056] S202, decrypt the second ciphertext to obtain the first AES key.

[0057] In some embodiments, the industrial gateway uses the RSA private key to decrypt the second ciphertext to obtain the first AES key. The RSA private key can be stored in a secure storage device, such as a hardware security module or a password-protected key store. The industrial gateway can load the private key from these storages.

[0058] It should be understood that the RSA algorithm uses two keys, one public key and one private key. The public key is used to encrypt data, and the private key is used to decrypt data.

[0059] S203, based on the first AES key, decrypt the first ciphertext to obtain the decrypted first request data.

[0060] In some embodiments, the industrial gateway uses the first AES key decrypted in step S202 to perform AES decryption on the first ciphertext, thereby obtaining the decrypted first request data, which can be used for further processing or analysis.

[0061] It should be understood that AES is a symmetric encryption algorithm, so the same key can be used for encryption and decryption of data.

[0062] S204, based on the first signature information and the decrypted first request data, perform data verification.

[0063] In some embodiments, the industrial gateway processes the decrypted first request data using a digest algorithm to obtain second digest information, and then compares the second digest information with the first digest information decrypted from the first signature information. If the two are consistent, it means that the data has not been tampered with during transmission; if they are inconsistent, it means that there is a problem with the data, and the industrial gateway will discard it or request retransmission. In addition, the industrial gateway can check the timestamp in the request data to ensure that the request is not expired. This helps prevent replay attacks, i.e., attackers repeatedly using historical legitimate requests.

[0064] In an implementation, by comparing the digest information generated from the decrypted data and the digest information in the signature information, it can be determined whether the data has been tampered with. Specifically, as shown in FIG. 2B, S204 can be implemented as S204a-S204c as follows: Figure 3

[0065] S204a, decrypt the first signature information to obtain the first digest information.

[0066] In some embodiments, the industrial gateway decrypts the first signature information using the public key sent by the IoT device, and after decryption, obtains the first digest information, which is the output of the original request data processed by the preset digest algorithm.

[0067] It should be understood that the first signature information contains digest information encrypted with the IoT device private key, which is generated by the IoT device and used to represent the signature of the original request data.

[0068] S204b, process the decrypted first request data using a preset digest algorithm to obtain second digest information.

[0069] In some embodiments, the industrial gateway uses a preset digest algorithm, such as MD5, to calculate the digest of the decrypted first request data to obtain the second digest information. This process is to generate the hash value of the decrypted data in order to compare with the first digest information.

[0070] S204c, determine the verification result of the decrypted first request data based on the first digest information and the second digest information.

[0071] ​In some embodiments, the first digest information decrypted in S204a is compared with the second digest information calculated in S204b. If the two digest information matches, it indicates that the data has not been tampered during transmission, and the industrial gateway can consider the received data as trusted and continue the subsequent processing flow. If the digest does not match, it indicates that the data has been tampered or damaged during transmission, and the industrial gateway will stop processing the data and trigger a security alarm or error handling mechanism. According to the comparison result of the digest information, the industrial gateway can decide to accept the data, request retransmission, or take other security measures.

[0072] In another implementation, the industrial gateway sends the decrypted data and signature information to the server, and the server performs data verification, and then returns the verification result to the industrial gateway. Specifically, as shown in Figure 4 S204d-S204e:

[0073] S204d, the first signature information and the decrypted first request data are sent to the server, so that the server performs data verification on the decrypted first request data based on the first signature information.

[0074] In some embodiments, the industrial gateway sends the first signature information and the decrypted first request data to the server in the micro-service cluster through a secure communication protocol such as HTTPS, TLS, etc. The server uses the HibernateValidate framework to perform data verification on the received request data. If the verification is successful, the server will continue to process the request; if the verification fails, the server will return an error message or a specific exception.

[0075] Among them, Hibernate Validate is a data verification framework that allows developers to define verification rules through annotations. Verification rules include non-nullity of fields, length limit, numerical range, data type matching, custom verification logic, etc.

[0076] S204e, receiving the verification result of the first request data sent by the server.

[0077] In some embodiments, according to the verification result of S204d parameter, the server will execute the corresponding business logic and finally return the processing result to the industrial gateway. Correspondingly, the industrial gateway receives the verification result. Once the response from the server is received, the industrial gateway will be parsed and verified to ensure that the received data is complete and correct. By receiving the verification result sent by the server, the industrial gateway can ensure that only the data that passes the verification will be further processed and used, thereby improving the security and reliability of the data.

[0078] It should be understood that the decryption of the first signature information to obtain the first digest information can be performed before or after the first signature information and the decrypted first request data are sent to the server to enable the server to perform data verification on the decrypted first request data based on the first signature information, that is, S204a-S204c can be performed before or after S204d-S204e, or S204a-S204c can be performed without S204d-S204e, or S204d-S204e can be performed without S204a-S204c, and the embodiments of the present application do not limit this.

[0079] In some embodiments, as shown in FIG. 2B, after S204, the data verification method provided by the embodiments of the present application further includes the following S301-S305: Figure 5

[0080] S301, receiving second request data sent by the server.

[0081] In some embodiments, the industrial gateway receives the second request data from the server and stores it in the local memory or the database for subsequent processing. The second request data can be a response of the server to the previous request of the industrial gateway, or an instruction or data actively sent by the server.

[0082] S302, performing AES encryption on the second request data based on a second AES key to obtain third ciphertext.

[0083] In some embodiments, the industrial gateway performs AES encryption on the second request data using the second AES key to obtain the third ciphertext. In order to improve the flexibility and efficiency of the encryption processing, the second request data can be evenly divided into multiple plaintext blocks according to the rated byte number. Then, each plaintext block is iteratively encrypted using the second AES key to generate a corresponding ciphertext block. Finally, all ciphertext blocks are spliced together to form the third ciphertext.

[0084] In an implementation manner, the second request data is evenly divided according to the rated byte number, and each plaintext block is iteratively encrypted using the AES key, which improves the flexibility of the encryption processing. Specifically, as shown in FIG. 3, S302 can be implemented as the following S3021-S3023: Figure 6

[0085] S3021, dividing the second request data into N plaintext blocks according to the rated byte number, N being an integer greater than 0.

[0086] ​​In some embodiments, the data is divided into fixed-length blocks according to the requirement of the AES encryption algorithm, for example, 128 bits, i.e. 16 bytes. The second request data is then divided into N plaintext blocks. If the number of bytes of the last block of data is less than the rated number of bytes, a padding mechanism, such as the Padding padding, is used to make up to the rated number of bytes.

[0087] It should be understood that N is an integer greater than 0, representing the number of plaintext blocks.

[0088] S3022, iteratively encrypt each of the N plaintext blocks according to the second AES key to obtain N ciphertext blocks.

[0089] In some embodiments, after the second request data is divided into N plaintext blocks, the industrial gateway iteratively encrypts each of the N plaintext blocks using the second AES key. AES is a block cipher that processes a fixed-size block of data at a time. By encrypting each plaintext block using the AES encryption algorithm, N ciphertext blocks are obtained.

[0090] In an implementation, through the iterative encryption of each plaintext block, the encryption of each plaintext block depends on the previous ciphertext block, improving the security of the encryption. Specifically, as shown in Figure 7 S3022a-S3022b can be implemented as follows:

[0091] S3022a, for the first plaintext block of the N plaintext blocks, XOR the first plaintext block with an initialization vector, and encrypt the result of the operation using the second AES key to obtain the first ciphertext block.

[0092] In some embodiments, the industrial gateway XORs the first plaintext block with an initialization vector (IV) to initialize the encryption process. Through the XOR operation, the initialization vector is combined with the first plaintext block, and then the second AES key is used to encrypt the result of the XOR operation to obtain the first ciphertext block.

[0093] It should be understood that the initialization vector is a randomly generated fixed-length byte sequence, which, like the key, is used to increase the security of the encryption. XOR operation is a binary operation that compares two bit values. If they are the same, the result is 0, and if they are different, the result is 1.

[0094] S3022b, for the i-th plaintext block of the plurality of plaintext blocks, XOR the i-th plaintext block with the (i-1)-th ciphertext block, and encrypt the result of the operation using the second AES key to obtain the i-th ciphertext block; i is an integer greater than 0 and less than or equal to N.

[0095] In some embodiments, the industrial gateway encrypts the i-th plaintext block, for the 2nd and subsequent plaintext blocks in the N plaintext blocks (i.e. when i is greater than 1). It XORs the i-th plaintext block with the (i-1)-th ciphertext block, and then encrypts the result using a second AES key to obtain the i-th ciphertext block. This process is iterated until all plaintext blocks are encrypted into corresponding ciphertext blocks.

[0096] It should be noted that by iteratively encrypting each plaintext block, and having the encryption of each plaintext block dependent on the previous ciphertext block, the industrial gateway can improve the security of the encryption. This approach can prevent an attacker from making local modifications to the ciphertext, since each ciphertext block is dependent on the content of the previous ciphertext block. Even if a ciphertext block is tampered with during transmission, it will affect the decryption results of all subsequent ciphertext blocks, making it impossible to correctly restore the original plaintext from the decrypted data, and making it more difficult for an attacker to decipher the encrypted data.

[0097] S3023, merge the N ciphertext blocks to obtain a third ciphertext.

[0098] In some embodiments, after obtaining the N ciphertext blocks, the industrial gateway merges them into a continuous ciphertext data stream, i.e. a third ciphertext, in the original order. The third ciphertext after merging contains information of all plaintext blocks, but has been encrypted by the AES algorithm and cannot be directly read. This third ciphertext will be sent to the IoT device as encrypted second request data, together with the fourth ciphertext obtained by subsequent encryption and the second signature information, for further processing and verification.

[0099] S303, encrypt the second AES key based on the RSA algorithm to obtain a fourth ciphertext.

[0100] In some embodiments, the industrial gateway uses the RSA algorithm to encrypt the second AES key using the RSA public key to obtain the fourth ciphertext. This ensures that only the corresponding RSA private key can decrypt the fourth ciphertext, thereby achieving secure transmission of the second AES key.

[0101] S304, encrypt the third digest information to obtain the second signature information.

[0102] The third digest information is obtained by processing the second request data based on a predetermined digest algorithm.

[0103] In some embodiments, the industrial gateway processes the second request data using a predetermined digest algorithm to generate third digest information. Further, the industrial gateway encrypts the third digest information using an encryption algorithm to obtain the second signature information. This signature information serves as proof of the source and integrity of the data. As described above in relation to obtaining the first signature information in S201, further description is omitted here.

[0104] S305. Send the third ciphertext, the fourth ciphertext, and the second signature information to the IoT device so that the IoT device can obtain the decrypted second request data based on the third ciphertext and the fourth ciphertext, and perform data verification on the decrypted second request data based on the second signature information.

[0105] In some embodiments, the industrial gateway sends the third ciphertext, the fourth ciphertext, and the second signature information to the IoT device via a secure communication protocol. Upon receiving the data packet, the IoT device first decrypts the fourth ciphertext using its private key to obtain the second AES key. Then, it uses the obtained second AES key to decrypt the third ciphertext, obtaining the second request data. Finally, the IoT device processes the decrypted second request data using a preset digest algorithm to obtain new digest information. The IoT device compares the new digest information with the second signature information. If the two digests match, it indicates that the data has not been tampered with.

[0106] like Figure 8 As shown in the diagram, this application provides a flowchart of a data verification method. First, a first AES key is generated using the AES algorithm and converted into a Base64 encoded string. Then, the first request data is symmetrically encrypted using the first AES key to obtain the first ciphertext. Next, the first AES key byte[] is converted into a hexadecimal string and asymmetrically encrypted using an RSA private key to generate the second ciphertext. Simultaneously, the first signature information required for gateway verification is generated to ensure the authenticity and integrity of the data. For a detailed description, please refer to the relevant description in S201 above; this application will not repeat it here. After receiving the encrypted first request data and second ciphertext, the gateway decrypts the second ciphertext using the RSA public key to obtain the first AES key and uses it to decrypt the first request data. For a detailed description, please refer to the relevant descriptions in S202-S203 above; this application will not repeat it here. Finally, the decrypted content is sent to the microservice cluster according to the agreed format. After receiving the request information, the microservice performs data verification according to the agreement. If the verification passes, the service forwards the request, completing the distribution request. For a detailed description, please refer to the relevant description in S204 above, which will not be repeated here.

[0107] The data verification method provided in the application comprises the following steps: receiving the first ciphertext, the second ciphertext and the first signature information sent by the Internet of Things device, then decrypting the second ciphertext to obtain the first AES key, then decrypting the first ciphertext based on the first AES key to obtain the decrypted first request data, and further performing data verification based on the first signature information and the decrypted first request data. The method encrypts the request data sent by the Internet of Things device by using AES, and then performs asymmetric encryption on the AES key by using RSA, thereby ensuring the security of the key and data transmission. Meanwhile, the digest information is generated by using the digest algorithm, and the digest information is encrypted to form the signature information. After the data is decrypted, the decrypted data and the signature information are verified, thereby realizing security verification and integrity check, and improving the security of the industrial gateway in the data transmission process.

[0108] Further, each plaintext block is iteratively encrypted by block encryption of the second request data and XOR operation of the previous ciphertext block and the current plaintext block. The chain encryption mode enhances the confidentiality of the data, makes it difficult to recover the complete plaintext data even if part of the ciphertext block is cracked, and also makes the encryption process more efficient.

[0109] The above mainly introduces the scheme provided by the embodiments of the application from the perspective of the method. In order to realize the above functions, it contains the hardware structure and / or software module corresponding to the execution of each function. The skilled in the art should easily realize that the units and algorithm steps of each example described in combination with the embodiments disclosed in the present application can be realized in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed in hardware or computer software driven hardware depends on the specific application and design constraints of the technical solution. The skilled in the art can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the application.

[0110] In an exemplary embodiment, the application further provides a data verification device. The data verification device can comprise one or more functional modules for implementing the data verification method of the above method embodiments.

[0111] For example, Figure 9 A composition schematic diagram of a data verification device provided by the embodiments of the application is shown in FIG. 9. As shown in the figure, the device comprises a receiving module 901, a processing module 902 and a verification module 903. Figure 9

[0112] ​The receiving module 901 is configured to receive the first ciphertext, the second ciphertext and the first signature information sent by the Internet of Things device; the first ciphertext is ciphertext obtained by performing AES encryption on the first request data based on the first AES key; the second ciphertext is ciphertext obtained by performing encryption on the first AES key based on the RSA algorithm; the first signature information is information obtained by performing encryption on the first digest information, and the first digest information is obtained by processing the first request data by using a preset digest algorithm; the processing module 902 is configured to decrypt the second ciphertext to obtain the first AES key; the processing module 902 is further configured to decrypt the first ciphertext based on the first AES key to obtain the decrypted first request data; and the verification module 903 is configured to perform data verification based on the first signature information and the decrypted first request data.

[0113] In some embodiments, the verification module 903 is specifically configured to decrypt the first signature information to obtain the first digest information; process the decrypted first request data by using a preset digest algorithm to obtain second digest information; and determine a verification result of the decrypted first request data based on the first digest information and the second digest information.

[0114] In other embodiments, the verification module 903 is specifically further configured to send the first signature information and the decrypted first request data to a server, so that the server performs data verification on the decrypted first request data based on the first signature information; and receive a verification result of the first request data sent by the server.

[0115] In still other embodiments, the receiving module 901 is further configured to receive second request data sent by the server; the processing module 902 is further configured to perform AES encryption on the second request data based on a second AES key to obtain third ciphertext; the processing module 902 is further configured to perform encryption on the second AES key based on the RSA algorithm to obtain fourth ciphertext; the processing module 902 is further configured to encrypt third digest information to obtain second signature information; the third digest information is obtained by processing the second request data based on a preset digest algorithm; and the processing module 902 is further configured to send the third ciphertext, the fourth ciphertext and the second signature information to the Internet of Things device, so that the Internet of Things device obtains decrypted second request data based on the third ciphertext and the fourth ciphertext, and performs data verification on the decrypted second request data based on the second signature information.

[0116] In still other embodiments, the processing module 902 is specifically further configured to divide the second request data into N plaintext blocks according to a nominal byte number, N being an integer greater than 0; perform iterative encryption on each plaintext block in the N plaintext blocks according to the second AES key to obtain N ciphertext blocks; and merge the N ciphertext blocks to obtain the third ciphertext.

[0117] In some other embodiments, the processing module 902 is further configured to: for the first plaintext block among N plaintext blocks, perform an XOR operation between the first plaintext block and the initial vector, and encrypt the operation result using the second AES key to obtain the first ciphertext block; for the i-th plaintext block among multiple plaintext blocks, perform an XOR operation between the i-th plaintext block and the (i-1)-th ciphertext block, and encrypt the operation result using the second AES key to obtain the i-th ciphertext block; i is an integer greater than 0 and less than or equal to N.

[0118] In some other embodiments, the AES key is a Base64 encoded string.

[0119] In an exemplary embodiment, this application also provides an electronic device, which may be the data verification device in the above method embodiments. Figure 10 This is a schematic diagram illustrating the composition of an electronic device provided in an embodiment of this application. For example... Figure 10 As shown, the electronic device may include a processor 1001 and a memory 1002; the memory 1002 stores instructions executable by the processor 1001; when the processor 1001 is configured to execute the instructions, it causes the electronic device, network device, or manager to implement the methods described in the foregoing method embodiments.

[0120] In an exemplary embodiment, this application also provides a computer-readable storage medium storing computer program instructions thereon; when the computer program instructions are executed by a computer, the computer causes the computer to implement the method described in the foregoing embodiments. The computer-readable storage medium may be a non-transitory computer-readable storage medium, such as a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device.

[0121] In an exemplary embodiment, this application also provides a computer program product that, when run on a computer, causes the computer to execute the aforementioned related method steps to implement the data verification method described above.

[0122] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A data verification method, characterized by, The application is applied to an industrial gateway; the method comprises: Receiving first ciphertext, second ciphertext and first signature information sent by an Internet of Things device; the first ciphertext is ciphertext obtained by performing AES encryption on first request data based on a first AES key; the second ciphertext is ciphertext obtained by performing encryption on the first AES key based on an RSA algorithm; the first signature information is information obtained by performing encryption on first digest information, and the first digest information is obtained by processing the first request data using a preset digest algorithm; Decrypting the second ciphertext to obtain the first AES key; Based on the first AES key, decrypting the first ciphertext to obtain decrypted first request data; Based on the first signature information and the decrypted first request data, performing data verification; Receiving second request data sent by a server; Dividing the second request data into N plaintext blocks according to a rated byte number, wherein N is an integer greater than 0; According to a second AES key, iteratively encrypting each plaintext block in the N plaintext blocks to obtain N ciphertext blocks; Merging the N ciphertext blocks to obtain third ciphertext; Encrypting the second AES key based on an RSA algorithm to obtain fourth ciphertext; Encrypting third digest information to obtain second signature information; the third digest information is obtained by processing the second request data based on a preset digest algorithm; Sending the third ciphertext, the fourth ciphertext and the second signature information to the Internet of Things device, so that the Internet of Things device obtains decrypted second request data based on the third ciphertext and the fourth ciphertext, and performs data verification on the decrypted second request data based on the second signature information.

2. The method of claim 1, wherein, The data verification based on the first signature information and the decrypted first request data comprises: Decrypting the first signature information to obtain the first digest information; Processing the decrypted first request data using the preset digest algorithm to obtain second digest information; Based on the first digest information and the second digest information, determining a verification result of the decrypted first request data.

3. The method of claim 1, wherein, The data verification based on the first signature information and the decrypted first request data comprises: Sending the first signature information and the decrypted first request data to a server, so that the server performs data verification on the decrypted first request data based on the first signature information; Receiving a verification result of the first request data sent by the server.

4. The method of claim 1, wherein, The iteratively encrypting each plaintext block in the N plaintext blocks based on the second AES key to obtain N ciphertext blocks comprises: For the first plaintext block in the N plaintext blocks, performing XOR operation on the first plaintext block and an initial vector, and encrypting the operation result using the second AES key to obtain a first ciphertext block; For the i-th plaintext block in the N plaintext blocks, the i-th plaintext block is XORed with the i-1-th ciphertext block, and the operation result is encrypted by using the second AES key to obtain the i-th ciphertext block; the i is an integer greater than 0 and less than or equal to N.

5. The method of claim 1, wherein, The AES key is a Base64 encoded string.

6. An electronic device, comprising: The electronic device comprises a processor and a memory; The memory stores instructions executable by the processor; The processor is configured to execute the instructions, so that the electronic device implements the method in any one of claims 1-5.

7. A computer-readable storage medium, characterized in that, The computer readable storage medium comprises computer software instructions; When the computer software instructions are run in the electronic device, the electronic device implements the method in any one of claims 1-5.

8. A computer program product, characterised in that, When the computer program product is run on the computer, the computer executes the method in any one of claims 1-5.

Images