A method and device for processing data in a confidential state

Abstract

The present application discloses a method and device for processing data in a confidential state, which belongs to the field of cryptographic processing technology. The method for processing data in a confidential state constructs a confidential support system that matches the industrial business system, so that the confidential support system becomes the shadow system of the industrial business system, and uses the shadow system to realize confidential support for various links related to industrial data covered by the industrial business system, thereby realizing confidential security protection from the perspective of the entire system. The industrial business system includes a first architecture and multiple field systems that communicate with the first architecture, and each field system includes multiple terminal data collectors; correspondingly, the confidential support system includes a second architecture and multiple virtual cloud machines that communicate with the second architecture, and each virtual cloud machine includes multiple cryptographic modules, and each cryptographic module is used to provide confidential support for the corresponding terminal data collector.

Description

Technical Field

[0001] The present application relates to the field of cryptographic processing technology, and in particular to a method and device for processing encrypted data. Background Art

[0002] The security protection of industrial data is a key content in the field of industrial data processing. Data leakage may occur in each link of industrial data collection, processing, storage, communication, etc., so that industrial data leakage threatens the security of related industrial systems.

[0003] In the related technology, confidential security protection can be performed for the aforementioned individual links, but the confidential security protection of a single link is very limited, and the link that has not been protected by confidential security protection is still likely to leak industrial data. Moreover, the confidential protection schemes for a single link are difficult to be compatible with each other. If confidential security protection is performed for each single link separately, the overall confidential security protection system may be too highly coupled, making sustainable iteration difficult. In short, the related technology lacks a solution for confidential security protection from the perspective of the entire industrial system. Summary of the invention

[0004] The embodiments of the present application provide a method and device for processing confidential data. By constructing a confidential support system that matches the industrial business system, the confidential support system becomes a shadow system of the industrial business system. The shadow system is used to implement confidential support for each industrial data-related link covered by the industrial business system, thereby achieving confidential security protection from the perspective of the entire system.

[0005] According to one aspect of an embodiment of the present application, a method for processing data in a confidential state is provided, which is applied to a data confidential state processing system, wherein the data confidential state processing system includes an industrial business system and a confidential state support system, wherein the confidential state support system is a shadow system of the industrial business system and performs secure communication with the industrial business system; the industrial business system includes a first architecture and a plurality of field systems communicating with the first architecture, each of the field systems includes a plurality of terminal data collectors; correspondingly, the confidential state support system includes a second architecture and a plurality of virtual cloud machines communicating with the second architecture, each of the virtual cloud machines includes a plurality of password modules, and each of the password modules is used to perform confidential state support for a corresponding terminal data collector; the method includes:

[0006] When the target terminal data collector collects industrial data, a first target parameter is requested from the field system to which it belongs, the first target parameter being a system parameter of the field system, the target terminal data collector being any of the terminal data collectors, and the first target parameter including a field system identifier;

[0007] Sending a data encryption request to the corresponding password module, the data encryption request carrying the first target parameter, the second target parameter and the third target parameter, the second target parameter being the device parameter of the target terminal data collector, and the third target parameter indicating the data type of the industrial data and the spatiotemporal information of the target terminal data collector;

[0008] In the case of receiving the encryption permission notification sent by the password module, sending the industrial data to the password module to trigger the password module to perform the following operations:

[0009] Generate encryption information based on the first target parameter, the second target parameter, and the third target parameter, and store the encryption information in a corresponding virtual cloud machine, wherein the encryption information is used to encrypt the industrial data;

[0010] The industrial data is encrypted based on the encryption information to obtain confidential data, and the confidential data is stored in the virtual cloud machine, so that the confidential data in the virtual cloud machine supports confidential data access services.

[0011] In one embodiment, the encryption information includes the first target parameter, the second target parameter, the third target parameter, an encryption algorithm set and an encryption parameter set, so that when the virtual cloud machine is authorized, the encryption algorithm set and the encryption parameter set are output based on the first target parameter, the second target parameter or the third target parameter, and the encryption algorithm set and the encryption parameter set are used to encrypt the industrial data.

[0012] In one embodiment, the first architecture includes a user interface layer and a secret data processing layer; correspondingly, the second architecture includes a secret interface interaction layer and a secret data access layer; the method further includes:

[0013] The user interface layer sends the secret data access request to the secret interface interaction layer;

[0014] The secret interface interaction layer performs account security verification on the account identifier and account password in the secret data access request, and if the verification passes, sends the secret data access request down to the secret data access layer;

[0015] The secret data access layer extracts the on-site system identifier to be accessed in the secret data access request, verifies whether it has access rights to the on-site system identifier to be accessed based on the account identifier and the account password, and obtains the target spatiotemporal information in the secret data access request if it has access rights; based on the target spatiotemporal information and the on-site system identifier to be accessed, securely accesses the virtual cloud machine corresponding to the on-site system identifier to be accessed to query the target secret data and target encryption information;

[0016] The secret data access layer feeds back the target secret data and the target encryption information to the secret data processing layer to trigger the secret data processing layer to generate visual industrial data based on the target secret data and the target encryption information, and feed it back to the user interface layer.

[0017] In one embodiment, the first target parameter further includes:

[0018] The main device chip serial number, main device motherboard serial number, main device MAC address, main device firmware serial number, main device operating system serial number, and main device communication protocol identification of the on-site system;

[0019] The second target parameter includes the device identification of the target terminal data collector, the main chip serial number of the target terminal data collector, the mainboard serial number of the target terminal data collector, the MAC address of the target terminal data collector, the international mobile equipment identity code of the target terminal data collector, and the software identification of the target terminal data collector.

[0020] In one embodiment, the third target parameter is obtained by the following method:

[0021] Slice the geographic space according to longitude and latitude;

[0022] Obtaining the zone identifier to which the target terminal data collector belongs when collecting industrial data;

[0023] Obtain the start time and end time when the target terminal data collector collects industrial data;

[0024] The area identifier, the start time and the end time are used as the third target parameter.

[0025] In one embodiment, generating encryption information based on the first target parameter, the second target parameter, and the third target parameter includes:

[0026] Obtaining a first characteristic value corresponding to the chip serial number of the main device and a second characteristic value corresponding to the device identification of the target terminal data collector;

[0027] Obtaining a third characteristic value corresponding to a data string formed by parameters of the first target parameter and the second target parameter excluding the master device chip serial number and the device identifier of the target terminal data collector;

[0028] Taking the modulo result of the length of the data string and a preset value as the fourth eigenvalue;

[0029] Taking the sum of the first eigenvalue, the second eigenvalue, the third eigenvalue and the fourth eigenvalue as the feature to be queried;

[0030] The encryption algorithm set and the encryption parameter set are obtained by querying the encryption information library uniquely corresponding to the field system in the virtual cloud machine based on the feature to be queried;

[0031] Among them, each on-site system is configured with a unique corresponding encryption information library, and the encryption information library is only open to the password module included in the corresponding virtual cloud machine.

[0032] In one embodiment, the step of obtaining the encryption algorithm set and the encryption parameter set by querying the encryption information library uniquely corresponding to the field system in the virtual cloud machine based on the feature to be queried includes:

[0033] Based on the feature to be queried, query the encryption information library uniquely corresponding to the field system in the virtual cloud machine to obtain the primary encryption method, the secondary encryption method, the primary encryption data string, the secondary encryption data string and the data conversion table corresponding to each type of industrial data;

[0034] Determining a target data conversion table based on the data type in the third target parameter;

[0035] Obtaining the encryption algorithm set based on the primary encryption method and the secondary encryption method;

[0036] The encryption parameter set is obtained based on the first-level encrypted data string, the second-level encrypted data string, and the target data conversion table.

[0037] According to one aspect of an embodiment of the present application, a data confidentiality processing system is provided, the data confidentiality processing system includes an industrial business system and a confidentiality support system, the confidentiality support system is a shadow system of the industrial business system, and communicates securely with the industrial business system; the industrial business system includes a first architecture and a plurality of field systems communicating with the first architecture, each of the field systems includes a plurality of terminal data collectors; correspondingly, the confidentiality support system includes a second architecture and a plurality of virtual cloud machines communicating with the second architecture, each of the virtual cloud machines includes a plurality of password modules, and each of the password modules is used to provide confidentiality support for a corresponding terminal data collector;

[0038] The data confidentiality processing system is used to implement the data confidentiality processing method.

[0039] In one embodiment, the components in the confidential support system are used to provide confidential support for the corresponding components in the industrial business system. The shadow system refers to a system that has the same architecture as the industrial business system and has a corresponding relationship between components at the same logical level in the architecture; secure communication is used between the components in the confidential support system.

[0040] According to one aspect of an embodiment of the present application, a computer device is provided, comprising a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the above-mentioned data confidentiality processing method.

[0041] According to one aspect of an embodiment of the present application, a computer-readable storage medium is provided, in which at least one instruction is stored. The at least one instruction is loaded and executed by a processor to implement the above-mentioned data confidentiality processing method.

[0042] According to one aspect of the embodiments of the present application, a computer program product is provided, the computer program product includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes to implement the above-mentioned data encryption processing method.

[0043] The technical solution provided in the embodiments of the present application can bring the following beneficial effects:

[0044] The embodiment of the present application proposes a method and device for processing data in a confidential state. The core of the method for processing data in a confidential state is to construct a shadow system corresponding to the industrial business system. The shadow system, as a confidential support system, provides confidential support for each link of the industrial business system. The industrial business system and the confidential support system collaborate to form a data confidential processing system, which implements confidential data processing for the entire system, thereby solving the problem of compatibility difficulties between confidential protection schemes for each single link in the related technology, and also solving the problem of high coupling and difficulty in sustainable iteration of the overall confidential security protection system caused by separate confidential security protection for each single link in the related technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0046] Figure 1 It is a schematic diagram of a data confidentiality processing system provided in an embodiment of the present application.

[0047] Figure 2 It is a schematic diagram of the specific architecture of the data confidentiality processing system provided in an embodiment of the present application.

[0048] Figure 3 This is a flowchart of a method for processing data in a confidential state provided by an embodiment of the present application;

[0049] Figure 4 It is a schematic diagram of a third target parameter acquisition method provided by an embodiment of the present application;

[0050] Figure 5 is a flow chart of a method for accessing secret data provided by an embodiment of the present application;

[0051] Figure 6 It is a flowchart of a method for generating encrypted information provided by an embodiment of the present application. DETAILED DESCRIPTION

[0052] Please refer to Figure 1 , which shows a schematic diagram of a data confidentiality processing system proposed in an embodiment of the present application. The data confidentiality processing system 100 includes an industrial business system 101 and a confidentiality support system 102, wherein the confidentiality support system 102 is a shadow system of the industrial business system 101 and communicates securely with the industrial business system 101.

[0053] The shadow system is a concept proposed in the embodiment of the present application, and the shadow system refers to a system that has the same architecture as the industrial business system 101 and has corresponding components at the same logical level in the architecture. Since the architecture is the same and the components at the same logical level have corresponding relationships. The shadow emphasizes the similarity between the shadow and the shape of the object, so the dense support system 102 is figuratively called the shadow system of the industrial business system 101.

[0054] The industrial business system 101 is a system for performing full-system processing of industrial data, which may include various links such as the collection, processing, storage, transmission, and communication of industrial data. The confidential support system 102 can provide confidential support for the full-system processing of industrial data, which may include confidential support for various links such as the collection, processing, storage, transmission, and communication of industrial data. Specifically, the components in the confidential support system 102 are used to provide confidential support for the corresponding components in the industrial business system 101, and secure communication is used between the various components in the confidential support system 102.

[0055] In the embodiment of the present application, any component of the dense support system 102 can only communicate with its corresponding component in the industrial business system 101, and its own upstream and downstream components at the logical level of the dense support system 102. Similarly, any component of the industrial business system 101 can only communicate with its corresponding component in the dense support system 102, and its own upstream and downstream components at the logical level of the industrial business system 101. Figure 1 Strict communication isolation between components without bidirectional arrows ensures the security of confidential support, thereby achieving confidential protection for the entire system and all links.

[0056] The present application embodiment does not limit the specific architecture of the industrial business system 101 and the dense support system 102. Figure 2 , which shows a schematic diagram of the specific architecture of the data confidentiality processing system.

[0057] The industrial business system 101 includes a first architecture 201 and multiple field systems 202 communicating with the first architecture 201, and each of the field systems 202 includes multiple terminal data collectors 203; correspondingly, the confidential support system 102 includes a second architecture 204 and multiple virtual cloud machines 205 communicating with the second architecture 204, and each of the virtual cloud machines 205 includes multiple password modules 206, and each of the password modules 206 is used to provide confidential support for the corresponding terminal data collector 203.

[0058] The first architecture 201 and the second architecture 204 are corresponding components. Each of the on-site systems 202 has a unique corresponding virtual cloud machine 205, and each terminal data collector 203 has a unique corresponding password module 206, thereby forming a shadow system.

[0059] In one embodiment, the first architecture 201 includes a user interface layer 2011 and a secret data processing layer 2012; correspondingly, the second architecture 204 includes a secret interface interaction layer 2041 and a secret data access layer 2042. The user interface layer 2011 and the secret interface interaction layer 2041 are corresponding components, and the secret data processing layer 2012 and the secret data access layer 2042 are corresponding components.

[0060] exist Figure 2 Based on the architecture of the data secret state processing system shown in FIG, the present application embodiment provides a data secret state processing method based on the data secret state processing system. Figure 3 , which shows a schematic flow chart of a method for processing data in a confidential state. The method comprises:

[0061] S301. When the target terminal data collector collects industrial data, it requests a first target parameter from the field system to which it belongs. The first target parameter is a system parameter of the field system. The target terminal data collector is any of the terminal data collectors. The first target parameter includes a field system identifier.

[0062] The embodiment of the present application takes any terminal data collector (target terminal data collector) as an example to illustrate the method. When the target terminal data collector collects industrial data, it requests the first target parameter from the master device (upstream) of the field system that it uniquely corresponds to, and the first target parameter is the system parameter of the field system. Specifically, the first target parameter includes the field system identifier, the chip serial number of the master device of the field system, the main board serial number of the master device, the MAC address of the master device, the firmware serial number of the master device, the operating system serial number of the master device, and the communication protocol identifier of the master device. The field system is composed of a mode of master device + multiple terminal data collectors, and the master device forms a one-to-many relationship with the multiple terminal data collectors. The first target parameter includes a lot of configuration information of the master device. The embodiment of the present application does not further limit the specific content of these configuration information, and does not constitute an implementation obstacle.

[0063] S302. Send a data encryption request to the corresponding cryptographic module, the data encryption request carries the first target parameter, the second target parameter and the third target parameter, the second target parameter is the device parameter of the target terminal data collector, the third target parameter indicates the data type of the industrial data and the time and space information of the target terminal data collector.

[0064] The target terminal data collector sends an encryption request to the only corresponding password module in the secret state support system. In the embodiment of the present application, operations related to secret state data processing such as encrypted generation of secret state data and storage of secret state data are completed on the secret state support system. The industrial business processing system itself does not need to pay attention to secret state data processing, but only needs to pay attention to the original business of industrial data and open an interface to the secret state support system for cooperation, so that the secret state support system and the industrial business system each perform their duties, and there is no need to make major changes to the original industrial business processing system. Therefore, the embodiment of the present application is a low-intrusion data secret state processing method, and the industrial business system and the secret state support system each have the significant advantage of decoupling.

[0065] The target terminal data collector itself can obtain the second target parameter and the third target parameter, and the second target parameter is the device parameter of the target terminal data collector. Specifically, the second target parameter includes the device identification of the target terminal data collector, the main chip serial number of the target terminal data collector, the mainboard serial number of the target terminal data collector, the MAC address of the target terminal data collector, the international mobile equipment identity code of the target terminal data collector, and the software identification of the target terminal data collector. The embodiment of the present application does not further limit the specific content of the second target parameter and does not constitute an implementation obstacle.

[0066] The third target parameter indicates the data type of the industrial data and the time and space information of the target terminal data collector. Figure 4 , which shows a schematic flow chart of a method for obtaining a third target parameter. The third target parameter is obtained by the following method:

[0067] S401. Slice the geographic space according to longitude and latitude; obtain the zone identifier to which the target terminal data collector belongs when collecting industrial data.

[0068] The target terminal data collector obtains the district identifier of the district to which the geographical location of the target terminal data collector belongs when collecting industrial data.

[0069] S402. Obtain the start time and end time when the target terminal data collector collects industrial data; and use the area identifier, the start time and the end time as the third target parameter.

[0070] S303-0. Upon receiving the encryption permission notification issued by the password module, the industrial data is sent to the password module to trigger the password module to perform the following operations:

[0071] S303-1. Generate encryption information based on the first target parameter, the second target parameter and the third target parameter, and store the encryption information in the corresponding virtual cloud machine, where the encryption information is used to encrypt the industrial data.

[0072] In the embodiment of the present application, the encryption information generated by the specific cryptographic module is stored in the only virtual cloud machine to which it belongs, and the encryption information is used to encrypt the industrial data.

[0073] The encryption information includes the first target parameter, the second target parameter, the third target parameter, an encryption algorithm set and an encryption parameter set, so that when the virtual cloud machine is authorized, the encryption algorithm set and the encryption parameter set are output based on the first target parameter, the second target parameter or the third target parameter, and the encryption algorithm set and the encryption parameter set are used to encrypt the industrial data.

[0074] S303-2. Encrypt the industrial data based on the encryption information to obtain confidential data, and store the confidential data in the virtual cloud machine so that the confidential data in the virtual cloud machine supports confidential data access services.

[0075] In the embodiment of the present application, the specific cryptographic module completes the encryption operation to obtain confidential data. The confidential data is also stored in the virtual cloud machine to which it belongs exclusively, and will not be stored in any component of the industrial business system. The confidential support system has a higher internal security protection standard and can be maintained by a very professional data security team without the need for personnel intervention on the industrial business system side, thereby achieving high decoupling and high security management.

[0076] Please refer to Figure 5 , which shows a method for accessing secret data. The method comprises:

[0077] S501. The user interface layer sends a confidential data access request to the confidential interface interaction layer.

[0078] The user interface layer and the dense interface interaction layer are components with a corresponding relationship.

[0079] S502. The confidential interface interaction layer performs account security verification on the account identifier and account password in the confidential data access request, and if the verification passes, sends the confidential data access request down to the confidential data access layer.

[0080] There are no restrictions on account security verification methods and this does not constitute an obstacle to implementation.

[0081] S503. The confidential data access layer extracts the on-site system identifier to be accessed in the confidential data access request, verifies whether it has access rights to the on-site system identifier to be accessed based on the account identifier and the account password, and obtains the target space-time information in the confidential data access request if it has access rights; based on the target space-time information and the on-site system identifier to be accessed, securely accesses the virtual cloud machine corresponding to the on-site system identifier to be accessed to query the target confidential data and target encryption information.

[0082] S504. The secret data access layer feeds back the target secret data and the target encryption information to the secret data processing layer to trigger the secret data processing layer to generate visual industrial data based on the target secret data and the target encryption information, and feed it back to the user interface layer.

[0083] The present application embodiment does not limit the method for generating encrypted information and does not constitute an implementation obstacle. In an exemplary implementation, please refer to Figure 6 , which shows a schematic diagram of a method for generating encrypted information. The method of generating encrypted information based on the first target parameter, the second target parameter and the third target parameter includes:

[0084] S601. Obtain a first characteristic value corresponding to the chip serial number of the main device and a second characteristic value corresponding to the device identification of the target terminal data collector.

[0085] Each password module has a feature value generator, which can output a feature value for any input data string. The feature value generator can adopt existing technology and only realize a data mapping function, which does not constitute an implementation obstacle. The feature value generator can be used to generate various related feature values ​​in the embodiments of this application.

[0086] S602. Obtain a third characteristic value corresponding to a data string formed by parameters of the first target parameter and the second target parameter excluding the master device chip serial number and the device identifier of the target terminal data collector.

[0087] S603. Taking the modulo result of the length of the data string and a preset value as the fourth eigenvalue.

[0088] The embodiment of the present application does not limit the preset value, for example, it can be set to 1024.

[0089] S604. Take the sum of the first eigenvalue, the second eigenvalue, the third eigenvalue and the fourth eigenvalue as the feature to be queried.

[0090] S605. The encryption algorithm set and the encryption parameter set are obtained by querying the encryption information library uniquely corresponding to the field system in the virtual cloud machine based on the characteristics to be queried; wherein each field system is configured with a unique encryption information library, which is only open to the cryptographic module included in the corresponding virtual cloud machine.

[0091] Each on-site system has a unique encryption information library that can be configured by relevant security personnel. The encryption information library is stored in the virtual cloud machine that uniquely corresponds to the on-site system, and is only open to the corresponding cryptographic modules downstream of the virtual cloud machine, thereby ensuring that the encryption information library is only used to encrypt data collected by the terminal data collector in the on-site system.

[0092] The structure of the encrypted information library is simple, that is, a number of characteristic values, each of which corresponds to two encryption methods, two encrypted data strings, and a data conversion table corresponding to each type of industrial data corresponding to the characteristic value. After receiving the feature to be queried, the feature to be queried is mapped to a certain characteristic value among the several characteristic values, thereby extracting the corresponding two encryption methods, two encrypted data strings, and a data conversion table corresponding to each type of industrial data corresponding to the characteristic value. Among them, the specific algorithm for mapping the feature to be queried to a certain characteristic value among the several characteristic values ​​uses existing technology and does not constitute an implementation obstacle. Among them, the two encryption methods, two encrypted data strings, and the data conversion table corresponding to each type of industrial data corresponding to the characteristic value are all configured by security personnel, without limitation, and do not constitute an implementation obstacle.

[0093] Obviously, the acquisition of the encryption algorithm set and the encryption parameter set in the embodiment of the present application requires the use of information from four dimensions: the field system, the acquisition terminal, the spatiotemporal information, and the data type, which makes it more difficult to obtain the encryption algorithm set and the encryption parameter set, and the diversification of dimensions is conducive to improving the security of obtaining the encryption algorithm set and the encryption parameter set. The acquisition process of the encryption algorithm set and the encryption parameter set is designed according to the architecture of the shadow system of the present application and the specific encryption process, is highly compatible with the shadow system, and meets industrial-grade security requirements.

[0094] Specifically, the encryption algorithm set and the encryption parameter set are obtained by querying the encryption information library uniquely corresponding to the field system in the virtual cloud machine based on the feature to be queried, including: querying the encryption information library uniquely corresponding to the field system in the virtual cloud machine based on the feature to be queried, obtaining the aforementioned two encryption methods, which are the first-level encryption method and the second-level encryption method, and obtaining the aforementioned two encrypted data strings, which are the first-level encrypted data string, the second-level encrypted data string and the data conversion table corresponding to each type of industrial data; determining the target data conversion table based on the data type in the third target parameter, that is, selecting the target data conversion table corresponding to the data type in the third target parameter from the data conversion tables corresponding to each type of industrial data; obtaining the encryption algorithm set based on the first-level encryption method and the second-level encryption method; obtaining the encryption parameter set based on the first-level encrypted data string, the second-level encrypted data string and the target data conversion table.

[0095] Furthermore, based on the first-level encryption method, the second-level encryption method, the first-level encrypted data string, the second-level encrypted data string, and the target data conversion table, industrial data encryption can be performed, and the encryption process is not limited and does not constitute an implementation obstacle. This application only provides an exemplary description of the encryption process:

[0096] The target data conversion table records the mapping relationship between original characters and ciphertext characters. Each character in the industrial data is taken as the original character, and the corresponding ciphertext character is obtained based on the target data conversion table, thereby converting the industrial data into first-level ciphertext data.

[0097] The first-level ciphertext data and the first-level encrypted data string are mixed to obtain the second-level ciphertext data. The embodiment of the present application does not limit the method of mixing the first-level data, and it can be agreed upon.

[0098] The second level ciphertext data is encrypted according to the first level encryption method to obtain the third level ciphertext data. Of course, if the first level encryption method involves a key, the key is part of the first level encryption method.

[0099] The third-level ciphertext data is mixed with the second-level encrypted data string to obtain the fourth-level ciphertext data. The embodiment of the present application does not limit the method of mixing the second-level data, and it can be agreed upon.

[0100] The level 4 ciphertext data is encrypted according to the level 2 encryption method to obtain level 5 ciphertext data. Of course, if the level 2 encryption method involves a key, the key is part of the level 2 encryption method.

[0101] The third target parameter is used as a key to perform an encryption operation on the level 5 ciphertext data to obtain the encrypted data. The specific encryption operation is not limited and can be agreed upon.

[0102] According to one aspect of an embodiment of the present application, a data confidentiality processing system is provided, the data confidentiality processing system includes an industrial business system and a confidentiality support system, the confidentiality support system is a shadow system of the industrial business system, and communicates securely with the industrial business system; the industrial business system includes a first architecture and a plurality of field systems communicating with the first architecture, each of the field systems includes a plurality of terminal data collectors; correspondingly, the confidentiality support system includes a second architecture and a plurality of virtual cloud machines communicating with the second architecture, each of the virtual cloud machines includes a plurality of password modules, and each of the password modules is used to provide confidentiality support for a corresponding terminal data collector;

[0103] The data confidentiality processing system is used to implement the data confidentiality processing method.

[0104] In one embodiment, the components in the confidential support system are used to provide confidential support for the corresponding components in the industrial business system. The shadow system refers to a system that has the same architecture as the industrial business system and has a corresponding relationship between components at the same logical level in the architecture; secure communication is used between the components in the confidential support system.

[0105] According to one aspect of an embodiment of the present application, a computer device is provided, comprising a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the above-mentioned data confidentiality processing method.

[0106] According to one aspect of an embodiment of the present application, a computer-readable storage medium is provided, in which at least one instruction is stored. The at least one instruction is loaded and executed by a processor to implement the above-mentioned data confidentiality processing method.

[0107] According to one aspect of the embodiments of the present application, a computer program product is provided, the computer program product includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes to implement the above-mentioned data encryption processing method.

[0108] It should be understood that the "multiple" mentioned in this article refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. In addition, the step numbers described in this article only illustrate a possible execution sequence between the steps. In some other embodiments, the above steps may not be executed in the order of the numbers, such as two steps with different numbers are executed at the same time, or two steps with different numbers are executed in the opposite order to the diagram. The embodiments of the present application are not limited to this.

[0109] In addition, in the specific implementation of this application, related data such as user information is involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0110] The above are merely exemplary embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for processing data in a confidential state, characterized in that: Applied to a data confidentiality processing system, the data confidentiality processing system includes an industrial business system and a confidentiality support system, the confidentiality support system is a shadow system of the industrial business system, and communicates securely with the industrial business system; the industrial business system includes a first architecture and multiple field systems communicating with the first architecture, each of the field systems includes multiple terminal data collectors; correspondingly, the confidentiality support system includes a second architecture and multiple virtual cloud machines communicating with the second architecture, each of the virtual cloud machines includes multiple password modules, and each of the password modules is used to provide confidentiality support for the corresponding terminal data collector; the method includes: When the target terminal data collector collects industrial data, a first target parameter is requested from the field system to which it belongs, the first target parameter being a system parameter of the field system, the target terminal data collector being any of the terminal data collectors, and the first target parameter including a field system identifier; Sending a data encryption request to the corresponding password module, the data encryption request carrying the first target parameter, the second target parameter and the third target parameter, the second target parameter being the device parameter of the target terminal data collector, and the third target parameter indicating the data type of the industrial data and the spatiotemporal information of the target terminal data collector; In the case of receiving the encryption permission notification sent by the password module, sending the industrial data to the password module to trigger the password module to perform the following operations: Generate encryption information based on the first target parameter, the second target parameter, and the third target parameter, and store the encryption information in a corresponding virtual cloud machine, wherein the encryption information is used to encrypt the industrial data; The industrial data is encrypted based on the encryption information to obtain confidential data, and the confidential data is stored in the virtual cloud machine, so that the confidential data in the virtual cloud machine supports confidential data access services.

2. The method according to claim 1, characterized in that The encryption information includes the first target parameter, the second target parameter, the third target parameter, an encryption algorithm set and an encryption parameter set, so that when the virtual cloud machine is authorized, the encryption algorithm set and the encryption parameter set are output based on the first target parameter, the second target parameter or the third target parameter, and the encryption algorithm set and the encryption parameter set are used to encrypt the industrial data.

3. The method according to claim 2, characterized in that The first architecture includes a user interface layer and a secret data processing layer; correspondingly, the second architecture includes a secret interface interaction layer and a secret data access layer; the method further includes: The user interface layer sends the secret data access request to the secret interface interaction layer; The secret interface interaction layer performs account security verification on the account identifier and account password in the secret data access request, and if the verification passes, sends the secret data access request down to the secret data access layer; The secret data access layer extracts the on-site system identifier to be accessed in the secret data access request, verifies whether it has access rights to the on-site system identifier to be accessed based on the account identifier and the account password, and obtains the target spatiotemporal information in the secret data access request if it has access rights; based on the target spatiotemporal information and the on-site system identifier to be accessed, securely accesses the virtual cloud machine corresponding to the on-site system identifier to be accessed to query the target secret data and target encryption information; The secret data access layer feeds back the target secret data and the target encryption information to the secret data processing layer to trigger the secret data processing layer to generate visual industrial data based on the target secret data and the target encryption information, and feed it back to the user interface layer.

4. The method according to claim 2, characterized in that: The first target parameter also includes: The main device chip serial number, main device motherboard serial number, main device MAC address, main device firmware serial number, main device operating system serial number, and main device communication protocol identification of the on-site system; The second target parameter includes the device identification of the target terminal data collector, the main chip serial number of the target terminal data collector, the mainboard serial number of the target terminal data collector, the MAC address of the target terminal data collector, the international mobile equipment identity code of the target terminal data collector, and the software identification of the target terminal data collector.

5. The method according to claim 4, characterized in that The third target parameter is obtained by the following method: Slice the geographic space according to longitude and latitude; Obtaining the zone identifier to which the target terminal data collector belongs when collecting industrial data; Obtain the start time and end time when the target terminal data collector collects industrial data; The area identifier, the start time and the end time are used as the third target parameter.

6. The method according to claim 5, characterized in that The generating encryption information based on the first target parameter, the second target parameter and the third target parameter comprises: Obtaining a first characteristic value corresponding to the chip serial number of the main device and a second characteristic value corresponding to the device identification of the target terminal data collector; Obtaining a third characteristic value corresponding to a data string formed by parameters of the first target parameter and the second target parameter excluding the master device chip serial number and the device identifier of the target terminal data collector; Taking the modulo result of the length of the data string and a preset value as the fourth eigenvalue; Taking the sum of the first eigenvalue, the second eigenvalue, the third eigenvalue and the fourth eigenvalue as the feature to be queried; The encryption algorithm set and the encryption parameter set are obtained by querying the encryption information library uniquely corresponding to the field system in the virtual cloud machine based on the feature to be queried; Among them, each on-site system is configured with a unique corresponding encryption information library, and the encryption information library is only open to the password module included in the corresponding virtual cloud machine.

7. The method according to claim 6, characterized in that The step of obtaining the encryption algorithm set and the encryption parameter set by querying the encryption information library uniquely corresponding to the on-site system in the virtual cloud machine based on the feature to be queried includes: Based on the feature to be queried, query the encryption information library uniquely corresponding to the field system in the virtual cloud machine to obtain the primary encryption method, the secondary encryption method, the primary encryption data string, the secondary encryption data string and the data conversion table corresponding to each type of industrial data; Determining a target data conversion table based on the data type in the third target parameter; Obtaining the encryption algorithm set based on the primary encryption method and the secondary encryption method; The encryption parameter set is obtained based on the first-level encrypted data string, the second-level encrypted data string, and the target data conversion table.

8. A data confidentiality processing system, characterized in that: The data confidentiality processing system includes an industrial business system and a confidentiality support system, wherein the confidentiality support system is a shadow system of the industrial business system and performs secure communication with the industrial business system; the industrial business system includes a first architecture and a plurality of field systems communicating with the first architecture, each of the field systems includes a plurality of terminal data collectors; correspondingly, the confidentiality support system includes a second architecture and a plurality of virtual cloud machines communicating with the second architecture, each of the virtual cloud machines includes a plurality of password modules, and each of the password modules is used to perform confidentiality support for the corresponding terminal data collector; The data confidentiality processing system is used to implement a data confidentiality processing method as described in any one of claims 1 to 7.

9. The system according to claim 8, characterized in that The components in the confidential support system are used to provide confidential support for the corresponding components in the industrial business system. The shadow system refers to a system that has the same architecture as the industrial business system and has a corresponding relationship with the components at the same logical level in the architecture; secure communication is used between the various components in the confidential support system.

10. A computer-readable storage medium, characterized in that: The storage medium stores at least one instruction, and the at least one instruction is loaded and executed by the processor to implement a data confidentiality processing method as described in any one of claims 1 to 7.

Images