Data encryption transmission method and system based on Modbus-RTU protocol

Abstract

The invention provides a data encryption transmission method and system based on a Modbus-RTU protocol, and the method comprises the steps: a Modbus master device generates a random number k, organizes a message based on the Modbus-RTU protocol, and transmits the message to a Modbus slave device; after receiving the message, the slave device performs encryption operation on the collected data m according to the random number k and the slave device private key s, organizes the message for the encrypted collected data c based on the Modbus-RTU protocol, and sends the message to the master device; and after receiving the returned message, the master device decrypts the encrypted acquisition data c according to the random number k and the slave device private key s to obtain an acquisition data plaintext m. According to the invention, the acquired data is encrypted and decrypted according to the random number and the secret key of the slave device, and then the encrypted data is filled into the data segment of the Modbus-RTU protocol, so that the structure of the Modbus-RTU protocol frame does not need to be modified, and the security of data transmission is ensured.

Description

Technical Field

[0001] The present invention relates to the field of secure data transmission, and more specifically, to a data encryption transmission method and system based on the Modbus-RTU protocol. Background Art

[0002] With the development of the Internet of Things and the digital transformation of the industrial control field, more and more wired sensors are connected to the data acquisition terminal through the RS485 bus, and the software protocol layer Modbus-RTU has been widely used. Due to the openness of the RS485 bus, any device that meets the RS485 level standard can be connected to the bus, so the original data transmitted between the data acquisition terminal and the sensor can be monitored by other terminals.

[0003] The Modbus-RTU protocol frame format is shown in Table 1 below:

[0004] Table 1 Modbus-RTU protocol frame format

[0005]

[0006] All data in the standard Modbus-RTU protocol frame are in plain text. For example, the hexadecimal message 010404001400323A 55 has the following corresponding protocol frame format: Figure 1 As shown in the figure, it means that the data acquisition terminal (Modbus master device) reads the values ​​of two input registers (20 and 50) from the sensor (Modbus slave device), and the protocol content is completely exposed. If the monitored data is intercepted and used for sabotage activities, it will cause serious losses.

[0007] Therefore, in order to ensure data security, data encryption transmission is required between the data acquisition terminal (Modbus master) and the sensor (Modbus slave). The sensor core processor is generally a low-performance MCU with extremely limited computing power, which is not suitable for encryption algorithms that require high computing power. While ensuring data security transmission, how to not affect the real-time data transmission and the stability of the acquisition system has also become a difficulty.

[0008] There are currently two main methods for data encryption requirements of the Modbus-RTU protocol.

[0009] Method 1: Encrypt the data segment in the Modbus-RTU protocol frame. For example, the hexadecimal plaintext message is 010404001400323A 55. The data segment (0400140032) uses the SM4 encryption algorithm (the encryption mode is ECB, the hexadecimal key is 7C FC 18EF 4579DF 82FE 851E 17B5 FE AD 94), and the hexadecimal ciphertext message is 010488D8F104 D8 BF F78C DA BAA359 C2 F978 AE 3A 55. The protocol frame format is shown in Table 2. The device that receives the ciphertext message decrypts the data segment to obtain the plaintext message, and then can parse the data according to the normal protocol logic.

[0010] Table 2 Data segment encryption in Modbus-RTU protocol frame

[0011]

[0012] Method 2: Add a security module between the Modbus master and slave devices. The system block diagram is as follows: Figure 2 As shown, the master device sends the plain text to the security module in the master device. The security module in the master device encrypts the data and transmits the ciphertext to the security module in the slave device through the RS485 bus. The security module in the slave device decrypts the ciphertext and sends it to the slave module, completing the encrypted data transmission from the master device to the slave device and the encrypted data transmission from the slave device to the master device.

[0013] Likewise, data encryption and decryption are performed through an added security module.

[0014] The above method 1 modifies the structure of the protocol message and needs to do business adaptation on the implementation logic of the standard Modbus-RTU protocol stack. The protocol and business cannot be decoupled. In addition, the commonly used algorithms such as SM4, AES or DES have a large amount of calculation, which affects the real-time performance of data transmission to a certain extent.

[0015] The above method 2 avoids the problems of method 1, but the newly added security module increases the complexity and cost of the system and reduces the stability of the acquisition system. Summary of the invention

[0016] The present invention aims at the technical problems existing in the prior art and provides a data encryption transmission method and system based on the Modbus-RTU protocol, which does not modify the structure of the protocol message and does not add additional structure, thereby improving the speed and security of data transmission.

[0017] According to a first aspect of the present invention, there is provided a data encryption transmission method based on the Modbus-RTU protocol, comprising:

[0018] Step 1, write the private key s of the Modbus slave device into the Modbus master device and the Modbus slave device respectively;

[0019] Step 2: The Modbus master device generates a random number k of corresponding length according to the number of input registers to be read, organizes messages based on the Modbus-RTU protocol, generates a first message, and sends it to the Modbus slave device;

[0020] Step 3, after the Modbus slave device receives the first message, it performs encryption operation on the collected data m according to the random number k in the first message and the private key s in the Modbus slave device to obtain encrypted collected data c;

[0021] Step 4, the Modbus slave device organizes the encrypted collected data c into a message based on the Modbus-RTU protocol, generates a second message, and sends it to the Modbus master device;

[0022] Step 5: After receiving the second message returned by the Modbus slave device, the Modbus master device decrypts the encrypted collected data c in the second message based on the random number k and the private key s in the Modbus slave device to obtain the collected data plaintext m.

[0023] Based on the above technical solution, the present invention can also make the following improvements.

[0024] Optionally, in step 2, the Modbus master device generates a random number k of corresponding length according to the number of input registers to be read, including:

[0025] The Modbus master device generates a random number k of corresponding length according to the number N of input registers that need to be read, where k=2N, and N is a positive integer.

[0026] Optionally, the Modbus-RTU protocol includes a 1-byte protocol address, a 1-byte function code, a data segment, and a 2-byte CRC check;

[0027] In the step 2, the message is organized based on the Modbus-RTU protocol, a first message is generated, and sent to the Modbus slave device, including:

[0028] The Modbus master device places the input register starting address, register quantity, data length and random number to be read in the data segment of the Modbus-RTU protocol frame, generates a first message and sends it to the Modbus slave device, wherein the input register starting address is 2 bytes, the register quantity is 2 bytes, the value is N, the data length is 1 byte, the value is 2*N, and the random number is 2N bytes.

[0029] Optionally, in step 3, after the Modbus slave device receives the first message, performing encryption operation on the collected data m according to the random number k in the first message and the private key s in the Modbus slave device to obtain the encrypted collected data c includes:

[0030] After receiving the first message, the Modbus slave device parses the random number k in the first message;

[0031] The random number k is XORed with the private key s in the Modbus slave device to obtain the encryption key s', and the collected data m is XORed with the encryption key s' to generate the encrypted collected data c.

[0032] Optionally, in step 4, the Modbus slave device organizes the encrypted collected data c into a message based on the Modbus-RTU protocol, generates a second message, and sends it to the Modbus master device, including:

[0033] The Modbus slave device places the input register starting address, the number of registers, the data length and the encrypted input register value in the data segment of the Modbus-RTU protocol frame, generates a second message and returns it to the Modbus master device, wherein the input register starting address is 2 bytes, the number of registers is 2 bytes, the value is N, the data length is 1 byte, the value is 2*N, and the encrypted input register value is 2N bytes.

[0034] Optionally, after receiving the second message returned by the Modbus slave device, the Modbus master device decrypts the encrypted collected data c in the second message based on the random number k and the private key s in the Modbus slave device to obtain the collected data plaintext m, including:

[0035] After receiving the second message returned by the Modbus slave device, the Modbus master device performs an XOR operation on the random number k and the private key s of the Modbus slave device to obtain the encryption key s', and performs an XOR operation on the encrypted collected data c and the encryption key s' to obtain the collected data plaintext m.

[0036] According to a second aspect of the present invention, there is provided a data encryption transmission system based on the Modbus-RTU protocol, comprising a Modbus master device and a Modbus slave device;

[0037] The Modbus master device is used to generate a random number k of corresponding length according to the number of input registers that need to be read, organize messages based on the Modbus-RTU protocol, generate a first message, and send it to the Modbus slave device;

[0038] The Modbus slave device is used to, after receiving the first message, perform encryption operation on the collected data m according to the random number k in the first message and the private key s in the Modbus slave device to obtain encrypted collected data c; and organize the encrypted collected data c into messages based on the Modbus-RTU protocol, generate a second message, and send it to the Modbus master device;

[0039] The Modbus master device is further configured to, after receiving the second message returned by the Modbus slave device, decrypt the encrypted collected data c in the second message based on the random number k and the private key s in the Modbus slave device to obtain a plaintext m of the collected data;

[0040] Wherein, the Modbus master device and the Modbus slave device both store the private key s of the Modbus slave device.

[0041] Optionally, the Modbus-RTU protocol includes a 1-byte protocol address, a 1-byte function code, a data segment, and a 2-byte CRC check;

[0042] The Modbus master device is used to generate a random number k of corresponding length according to the number of input registers that need to be read, organize messages based on the Modbus-RTU protocol, generate a first message, and send it to the Modbus slave device, including:

[0043] The Modbus master device places the input register starting address, register quantity, data length and random number to be read in the data segment of the Modbus-RTU protocol frame, generates a first message and sends it to the Modbus slave device, wherein the input register starting address is 2 bytes, the register quantity is 2 bytes, the value is N, the data length is 1 byte, the value is 2*N, and the random number is 2N bytes;

[0044] The Modbus master device organizes the message based on the Modbus-RTU protocol, generates a second message, and sends it to the Modbus master device, including:

[0045] The Modbus slave device places the input register starting address, the number of registers, the data length and the encrypted input register value in the data segment of the Modbus-RTU protocol frame, generates a second message and returns it to the Modbus master device, wherein the input register starting address is 2 bytes, the number of registers is 2 bytes, the value is N, the data length is 1 byte, the value is 2*N, and the encrypted input register value is 2N bytes.

[0046] Optionally, the Modbus slave device is used to perform encryption operation on the collected data m according to the random number k in the first message and the private key s in the Modbus slave device after receiving the first message to obtain the encrypted collected data c, including:

[0047] After receiving the first message, the Modbus slave device parses the random number k in the first message;

[0048] The random number k is XORed with the private key s in the Modbus slave device to obtain the encryption key s', and the collected data m is XORed with the encryption key s' to generate the encrypted collected data c.

[0049] Optionally, the Modbus master device is further used to, after receiving the second message returned by the Modbus slave device, decrypt the encrypted collected data c in the second message based on the random number k and the private key s in the Modbus slave device to obtain the collected data plaintext m, including:

[0050] After receiving the second message returned by the Modbus slave device, the Modbus master device performs an XOR operation on the random number k and the private key s of the Modbus slave device to obtain the encryption key s', and performs an XOR operation on the encrypted collected data c and the encryption key s' to obtain the collected data plaintext m.

[0051] The present invention provides a data encryption transmission method and system based on the Modbus-RTU protocol, which encrypts and decrypts collected data according to a random number and a key of a slave device, and then fills the encrypted data into a data segment of the Modbus-RTU protocol without modifying the structure of the Modbus-RTU protocol frame; and the random number is dynamically generated, which ensures the security of data encryption, thereby ensuring the security of data transmission between a master device and a slave device. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 It is a schematic diagram of the data message format based on the standard Modbus-RTU protocol frame;

[0053] Figure 2 To increase the structural block diagram of the data encryption system of the security module;

[0054] Figure 3 A flow chart of a data encryption transmission method based on Modbus-RTU protocol provided by the present invention;

[0055] Figure 4 The following is a schematic diagram of the data message format from the Modbus master device to the Mosbus slave device;

[0056] Figure 5This is a schematic diagram of the data message format from the Modbus slave device to the Mosbus master device;

[0057] Figure 6 The present invention provides a structural block diagram of a data encryption transmission system based on the Modbus-RTU protocol. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. In addition, the technical features in the various embodiments or single embodiments provided by the present invention can be arbitrarily combined with each other to form a feasible technical solution. This combination is not subject to the constraints of the sequence of steps and / or the structural composition mode, but must be based on the ability of ordinary technicians in this field to achieve. When the combination of technical solutions is contradictory or cannot be achieved, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0059] Figure 3 The present invention provides a flow chart of a data encryption transmission method based on the Modbus-RTU protocol, such as Figure 3 As shown, the method includes:

[0060] Step 1: Write the private key s of the Modbus slave device into the Modbus master device and the Modbus slave device respectively.

[0061] It is understandable that the data transmission between the Modbus master device and the Modbus slave device needs to be encrypted. For example, the data collected by the sensor (slave device) needs to be encrypted and transmitted to the data acquisition terminal (master device), so the private key of the slave device needs to be set. Before data transmission, the private key s of the Modbus slave device is stored in the Modbus master device and the Modbus slave device respectively, and access control is implemented to ensure its security.

[0062] Step 2: The Modbus master device generates a random number k of corresponding length according to the number of input registers to be read, organizes messages based on the Modbus-RTU protocol, generates a first message, and sends it to the Modbus slave device.

[0063] It is understandable that when the Modbus slave device needs to transmit data to the Modbus master device, the Modbus master device generates a random number of corresponding length according to the number of input registers that need to be read, that is, N registers need to generate a random number k of 2*N bytes in length, and generates a first message according to the message format based on the Modbus-RTU protocol, sends it to the Modbus slave device, and records the random number k.

[0064] The data acquisition terminal and the sensor usually use registers in the Modbus-RTU protocol for data exchange, where the holding register is usually used for parameter configuration and the input register is used for data acquisition. Modbus-RTU supports user-defined function codes, with a custom range of 0x41 to 0x48 (i.e. 65 to 72) and 0x64 to 0x6E (100 to 110), so the collected data of the input register can be encrypted and transmitted through the custom function code. As shown in Table 1 above, the general Modbus-RTU protocol frame format mainly includes protocol address, function code, data segment and CRC check.

[0065] When the present invention generates the first message on the Modbus master device, the Modbus master device puts the information such as the input register starting address (2 bytes), the number of registers (2 bytes, the value is N), the data length (1 byte, the value is 2*N) and the random number (2*N bytes) to be read in the data segment of the Modbus-RTU protocol frame, generates the first message, and sends it to the Modbus slave device. The message format from the Modbus master device to the Modbus slave device can be seen in Figure 4 .

[0066] Step 3: After the Modbus slave device receives the first message, it performs encryption operation on the collected data m according to the random number k in the first message and the private key s in the Modbus slave device to obtain encrypted collected data c.

[0067] It can be understood that after the Modbus slave device receives the first message corresponding to the data encryption, it parses the first message, performs an XOR operation on the random number k in the first message and the private key s of the Modbus slave device to obtain the encryption key s', and then performs an XOR operation on the collected data m and the encryption key s' to generate the encrypted collected data c, and the operation is as follows: s'=k^s, c=m^s'.

[0068] Step 4: The Modbus slave device organizes the encrypted collected data c into a message based on the Modbus-RTU protocol, generates a second message, and sends it to the Modbus master device.

[0069] It is understandable that the Modbus slave device returns the encrypted collected data c to the Modbus master device in a message format organized according to the Modbus-RTU protocol.

[0070] When the second message is generated on the Modbus slave device, the Modbus slave device puts the input register starting address (2 bytes), the number of registers (2 bytes, the value is N), the data length (1 byte, the value is 2*N) and the encrypted input register value (2*N bytes) in the data segment of the Modbus-RTU protocol frame and returns it to the Modbus master device. The random number is the same length as the input register value. The message format from the Modbus slave device to the Modbus master device can be found in Figure 5 .

[0071] Step 5: After receiving the second message returned by the Modbus slave device, the Modbus master device decrypts the encrypted collected data c in the second message based on the random number k and the private key s in the Modbus slave device to obtain the collected data plaintext m.

[0072] It is understandable that when the Modbus master device receives the message returned by the Modbus slave device, it first performs an XOR operation on the random number k and the private key s of the corresponding Modbus slave device to obtain the encryption key s', and then performs an XOR operation on the encrypted collected data c and the encryption key s'. The specific operation is as follows: s'=k^s, m'=c^s'.

[0073] According to the characteristics of the XOR operation, if a value is XORed twice in succession, the value itself will be returned, that is, m' is the same as m, and the Modbus master device obtains the plain text of the collected data.

[0074] The encryption algorithm uses XOR encryption. The random number is the same length as the input register value, and the random number is one-time and randomly generated each time. Because the random number is randomly generated each time, the generated ciphertext has all possible values ​​and is evenly distributed, and no features of the original text can be seen from the ciphertext. XOR encryption has the largest "information entropy", so it is extremely secure.

[0075] See also Figure 5 , the present invention also provides a data encryption transmission system based on the Modbus-RTU protocol, including a Modbus master device 51 and a Modbus slave device 52;

[0076] The Modbus master device 51 is used to generate a random number k of corresponding length according to the number of input registers that need to be read, organize messages based on the Modbus-RTU protocol, generate a first message, and send it to the Modbus slave device 52;

[0077] The Modbus slave device 52 is used to, after receiving the first message, perform encryption operation on the collected data m according to the random number k in the first message and the private key s of the Modbus slave device 52 to obtain the encrypted collected data c; and organize the encrypted collected data c into a message based on the Modbus-RTU protocol, generate a second message, and send it to the Modbus master device 51;

[0078] The Modbus master device 51 is further configured to, after receiving the second message returned by the Modbus slave device 52, decrypt the encrypted collected data c in the second message based on the random number k and the private key s of the Modbus slave device 52 to obtain the collected data plaintext m;

[0079] The Modbus master device 51 and the Modbus slave device 52 both store the private key s of the Modbus slave device.

[0080] The Modbus-RTU protocol includes a 1-byte protocol address, a 1-byte function code, a data segment, and a 2-byte CRC check; the Modbus master device 51 is used to generate a random number k of corresponding length according to the number of input registers to be read, and organize messages based on the Modbus-RTU protocol to generate a first message and send it to the Modbus slave device 53, including:

[0081] The Modbus master device 51 places the input register starting address, register number, data length and random number to be read in the data segment of the Modbus-RTU protocol frame, generates a first message and sends it to the Modbus slave device 52, wherein the input register starting address is 2 bytes, the register number is 2 bytes, the value is N, the data length is 1 byte, the value is 2*N, and the random number is 2N bytes;

[0082] The Modbus slave device 52 organizes the message based on the Modbus-RTU protocol, generates a second message, and sends it to the Modbus master device 51, including:

[0083] The Modbus slave device 52 places the input register starting address, the number of registers, the data length and the encrypted input register value in the data segment of the Modbus-RTU protocol frame, generates a second message and returns it to the Modbus master device 51, wherein the input register starting address is 2 bytes, the number of registers is 2 bytes, the value is N, the data length is 1 byte, the value is 2*N, and the encrypted input register value is 2N bytes.

[0084] The Modbus slave device 52 is used to perform encryption operation on the collected data m according to the random number k in the first message and the private key s in the Modbus slave device after receiving the first message to obtain the encrypted collected data c, including:

[0085] After receiving the first message, the Modbus slave device 52 parses the random number k in the first message;

[0086] The random number k is subjected to an XOR operation with the private key s of the Modbus slave device 52 to obtain an encryption key s', and the collected data m is subjected to an XOR operation with the encryption key s' to generate encrypted collected data c.

[0087] The Modbus master device 51 is further used to decrypt the encrypted collected data c in the second message after receiving the second message returned by the Modbus slave device 52 based on the random number k and the private key s of the Modbus slave device 52 to obtain the collected data plaintext m, including:

[0088] After receiving the second message returned by the Modbus slave device 52, the Modbus master device 51 performs an XOR operation on the random number k and the private key s of the Modbus slave device to obtain the encryption key s', and performs an XOR operation on the encrypted collected data c and the encryption key s' to obtain the collected data plaintext m.

[0089] It can be understood that the data encryption transmission system based on the Modbus-RTU protocol provided by the present invention corresponds to the data encryption transmission method based on the Modbus-RTU protocol provided in the aforementioned embodiments. The relevant technical features of the data encryption transmission system based on the Modbus-RTU protocol can refer to the relevant technical features of the data encryption transmission method based on the Modbus-RTU protocol, which will not be repeated here.

[0090] The embodiment of the present invention provides a data encryption transmission method and system based on the Modbus-RTU protocol, wherein the Modbus master device generates a random number k, organizes a message based on the Modbus-RTU protocol and sends it to the Modbus slave device; after the slave device receives the message, it performs encryption operation on the collected data m according to the random number k and the slave device private key s, organizes the encrypted collected data c based on the Modbus-RTU protocol and sends it to the master device; after the master device receives the returned message, it decrypts the encrypted collected data c based on the random number k and the slave device private key s to obtain the collected data plaintext m. The implementation method of the present invention is fully compatible with the standard of the Modbus-RTU protocol, and encryption and decryption are implemented at the business layer. It is a non-intrusive design for the protocol stack, and there is no compatibility problem of the protocol; the XOR encryption algorithm is extremely simple, particularly suitable for sensors with limited computing resources, and ensures the security and real-time performance of data transmission; and because the random number used for encryption is randomly generated each time, it can effectively prevent man-in-the-middle attacks / replay attacks and key exhaustive attacks.

[0091] It should be noted that in the above embodiments, the description of each embodiment has its own emphasis, and for parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0092] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0093] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded computer, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0094] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0095] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0096] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0097] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A data encryption transmission method based on Modbus-RTU protocol, characterized in that: include: Step 1, write the private key s of the Modbus slave device into the Modbus master device and the Modbus slave device respectively; Step 2: The Modbus master device generates a random number k of corresponding length according to the number of input registers to be read, organizes messages based on the Modbus-RTU protocol, generates a first message, and sends it to the Modbus slave device; Step 3, after the Modbus slave device receives the first message, it performs encryption operation on the collected data m according to the random number k in the first message and the private key s in the Modbus slave device to obtain encrypted collected data c; Step 4, the Modbus slave device organizes the encrypted collected data c into a message based on the Modbus-RTU protocol, generates a second message, and sends it to the Modbus master device; Step 5: After receiving the second message returned by the Modbus slave device, the Modbus master device decrypts the encrypted collected data c in the second message based on the random number k and the private key s in the Modbus slave device to obtain the collected data plaintext m.

2. The data encryption transmission method according to claim 1, characterized in that: In step 2, the Modbus master device generates a random number k of corresponding length according to the number of input registers to be read, including: The Modbus master device generates a random number k of corresponding length according to the number N of input registers that need to be read, where k=2N, and N is a positive integer.

3. The data encryption transmission method according to claim 2, characterized in that: The Modbus-RTU protocol includes a 1-byte protocol address, a 1-byte function code, a data segment, and a 2-byte CRC checksum; In the step 2, the message is organized based on the Modbus-RTU protocol, a first message is generated, and sent to the Modbus slave device, including: The Modbus master device places the input register starting address, register quantity, data length and random number to be read in the data segment of the Modbus-RTU protocol frame, generates a first message and sends it to the Modbus slave device, wherein the input register starting address is 2 bytes, the register quantity is 2 bytes, the value is N, the data length is 1 byte, the value is 2*N, and the random number is 2N bytes.

4. The data encryption transmission method according to claim 3, characterized in that: The step 3, after the Modbus slave device receives the first message, performs encryption operation on the collected data m according to the random number k in the first message and the private key s in the Modbus slave device to obtain the encrypted collected data c, includes: After receiving the first message, the Modbus slave device parses the random number k in the first message; The random number k is XORed with the private key s in the Modbus slave device to obtain the encryption key s', and the collected data m is XORed with the encryption key s' to generate the encrypted collected data c.

5. The data encryption transmission method according to claim 3 or 4, characterized in that: In step 4, the Modbus slave device organizes the encrypted collected data c into a message based on the Modbus-RTU protocol, generates a second message, and sends it to the Modbus master device, including: The Modbus slave device places the input register starting address, the number of registers, the data length and the encrypted input register value in the data segment of the Modbus-RTU protocol frame, generates a second message and returns it to the Modbus master device, wherein the input register starting address is 2 bytes, the number of registers is 2 bytes, the value is N, the data length is 1 byte, the value is 2*N, and the encrypted input register value is 2N bytes.

6. The data encryption transmission method according to claim 3, characterized in that: After receiving the second message returned by the Modbus slave device, the Modbus master device decrypts the encrypted collected data c in the second message based on the random number k and the private key s in the Modbus slave device to obtain the collected data plaintext m, including: After receiving the second message returned by the Modbus slave device, the Modbus master device performs an XOR operation on the random number k and the private key s of the Modbus slave device to obtain the encryption key s', and performs an XOR operation on the encrypted collected data c and the encryption key s' to obtain the collected data plaintext m.

7. A data encryption transmission system based on Modbus-RTU protocol, characterized in that: Including Modbus master device and Modbus slave device; The Modbus master device is used to generate a random number k of corresponding length according to the number of input registers that need to be read, organize messages based on the Modbus-RTU protocol, generate a first message, and send it to the Modbus slave device; The Modbus slave device is used to, after receiving the first message, perform encryption operation on the collected data m according to the random number k in the first message and the private key s in the Modbus slave device to obtain encrypted collected data c; and organize the encrypted collected data c into messages based on the Modbus-RTU protocol, generate a second message, and send it to the Modbus master device; The Modbus master device is further configured to, after receiving the second message returned by the Modbus slave device, decrypt the encrypted collected data c in the second message based on the random number k and the private key s in the Modbus slave device to obtain a plaintext m of the collected data; Wherein, the Modbus master device and the Modbus slave device both store the private key s of the Modbus slave device.

8. The data encryption transmission system according to claim 7, characterized in that: The Modbus-RTU protocol includes a 1-byte protocol address, a 1-byte function code, a data segment, and a 2-byte CRC checksum; The Modbus master device is used to generate a random number k of corresponding length according to the number of input registers that need to be read, organize messages based on the Modbus-RTU protocol, generate a first message, and send it to the Modbus slave device, including: The Modbus master device places the input register starting address, register quantity, data length and random number to be read in the data segment of the Modbus-RTU protocol frame, generates a first message and sends it to the Modbus slave device, wherein the input register starting address is 2 bytes, the register quantity is 2 bytes, the value is N, the data length is 1 byte, the value is 2*N, and the random number is 2N bytes; The Modbus master device organizes the message based on the Modbus-RTU protocol, generates a second message, and sends it to the Modbus master device, including: The Modbus slave device places the input register starting address, the number of registers, the data length and the encrypted input register value in the data segment of the Modbus-RTU protocol frame, generates a second message and returns it to the Modbus master device, wherein the input register starting address is 2 bytes, the number of registers is 2 bytes, the value is N, the data length is 1 byte, the value is 2*N, and the encrypted input register value is 2N bytes.

9. The data encryption transmission system according to claim 7, characterized in that: The Modbus slave device is used to perform encryption operation on the collected data m according to the random number k in the first message and the private key s in the Modbus slave device after receiving the first message to obtain the encrypted collected data c, including: After receiving the first message, the Modbus slave device parses the random number k in the first message; The random number k is XORed with the private key s in the Modbus slave device to obtain the encryption key s', and the collected data m is XORed with the encryption key s' to generate the encrypted collected data c.

10. The data encryption transmission method according to claim 7, characterized in that: The Modbus master device is further used to, after receiving the second message returned by the Modbus slave device, decrypt the encrypted collected data c in the second message based on the random number k and the private key s in the Modbus slave device to obtain the collected data plaintext m, including: After receiving the second message returned by the Modbus slave device, the Modbus master device performs an XOR operation on the random number k and the private key s of the Modbus slave device to obtain the encryption key s', and performs an XOR operation on the encrypted collected data c and the encryption key s' to obtain the collected data plaintext m.

Images