Data security privacy fusion method and system based on industrial internet

Abstract

The invention provides a data security privacy fusion method and system based on an industrial internet. Wherein a security framework is constructed based on the data stream subjected to differential privacy processing, and the security level of data in the security framework is defined; creating a decentralized identity authentication system for each participating entity through a block chain technology, and dynamically adjusting the access control authority of the identity authentication system according to the security level; establishing a data encryption and decryption rule according to the access control authority and the security level of the data stream, and applying the data encryption and decryption rule to the data stream; the encrypted data stream is transmitted to a cloud data center, and the security in the data transmission process is ensured by adopting a homomorphic encryption technology in the transmission process; generating a data fusion model in the cloud data center by using a result of the homomorphic encryption technology; and generating a final data security privacy fusion result according to the data fusion model. According to the technical scheme provided by the invention, the data security can be improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of data protection technology, and in particular, to a data security and privacy fusion method and system based on the industrial Internet. Background Art

[0002] With the rapid development of the industrial Internet, manufacturing companies are facing the need to manage and analyze massive amounts of equipment data. These data cover important information such as key parameters in the production process and equipment operating status, which are of great significance for improving production efficiency and optimizing resource allocation. However, with the increase in data volume and the expansion of distribution range, how to effectively utilize data while ensuring data security has become an urgent problem to be solved. Data sharing across organizations is becoming more and more frequent, which not only requires effective protection of data during transmission and storage, but also requires ensuring that privacy is not violated during data processing. Therefore, it is particularly important to develop a data processing method that can protect data security and maintain user privacy.

[0003] At present, some data protection measures commonly adopted in the industry mainly include data encryption technology, access control mechanism, and anonymization processing; however, these traditional methods have certain limitations when faced with the characteristics of large data volume, wide distribution, and strong real-time nature in the industrial Internet environment. Summary of the invention

[0004] The embodiments of the present application provide a data security and privacy fusion method and system based on the industrial Internet to solve the problem of poor data security in the prior art.

[0005] In a first aspect, an embodiment of the present application provides a data security and privacy fusion method based on the industrial Internet, including:

[0006] Collect data streams generated by industrial equipment and perform differential privacy processing;

[0007] Building a security framework based on the data flow processed by the differential privacy, and defining the security level of the data within the security framework;

[0008] In the security framework, a decentralized identity authentication system is created for each participating entity through blockchain technology, and the access control authority of the identity authentication system is dynamically adjusted according to the security level;

[0009] Establishing data encryption and decryption rules according to the access control authority and the security level of the data flow, and applying the data encryption and decryption rules to the data flow;

[0010] The encrypted data stream is transmitted to the cloud data center, and homomorphic encryption technology is used during the transmission process to ensure the security of the data transmission process;

[0011] Using the result of the homomorphic encryption technology, a data fusion model is generated in the cloud data center, wherein the data fusion model includes data contribution and sensitive information protection strategy of all participating entities;

[0012] The final data security and privacy fusion result is generated according to the data fusion model, and the result at least includes data contribution, sensitive information protection strategy and data usage rights of each participating entity.

[0013] Optionally, the decentralized identity authentication system is created for each participating entity through blockchain technology, specifically including:

[0014] Register the identity information of each participating entity in the blockchain network and record it in an unalterable block;

[0015] According to the pre-set smart contract, when the participating entity initiates a data request, the identity verification process is automatically executed;

[0016] If the authentication is successful, the participating entity is allowed to access the corresponding data resources, otherwise the access request is denied.

[0017] Optionally, establishing data encryption and decryption rules according to access control authority and security level of data flow specifically includes:

[0018] Different encryption algorithms are used to encrypt data streams at different security levels, and a multi-layer encryption mechanism is introduced to enhance security.

[0019] Set the encryption strength threshold. When the access control permission level is higher than the preset threshold, a higher level encryption algorithm is enabled.

[0020] Combined with a quantum random number generator, it provides unpredictable encryption keys for each encryption operation.

[0021] Optionally, the use of homomorphic encryption technology to ensure security during data transmission specifically includes:

[0022] Encrypt data using a fully homomorphic encryption scheme so that data can be calculated without being decrypted;

[0023] Decrypt the calculated data at the receiving end to restore the original data value;

[0024] Zero-knowledge proof technology is used to verify the correctness of encrypted data without revealing any information about the actual content of the data.

[0025] Optionally, the data fusion model includes data contribution and sensitive information protection strategies of all participating entities, specifically including:

[0026] Define the data contribution calculation method to ensure that the contribution of each participant can be quantified and evaluated;

[0027] Design sensitive information protection strategies and clarify the protection strategies for different types of information in different situations;

[0028] The above data contribution and sensitive information protection strategies are integrated into the data fusion model to form a complete data security and privacy framework.

[0029] Optionally, the quantum random number generator is combined to provide an unpredictable encryption key for each encryption operation, and the specific calculation formula is:

[0030]

[0031] Among them, K i represents the encryption key of the i-th device; H() is a secure hash function; K master is the master key; ∥ represents the concatenation operator; D i Indicates the identification information of the i-th device; T i Indicates timestamp; R i represents the random salt value; Π represents the product; p k represents the kth prime number; ek represents the prime number p k The exponent of ; m represents the number of prime numbers used.

[0032] Optionally, the encryption strength threshold is determined by a specific calculation formula:

[0033]

[0034] Among them, E s represents encryption strength; m represents data quality; v represents data flow speed; w represents data flow speed j represents the jth weight factor; T k Indicates the effective range of the key; T m represents the preset threshold; f(x) is a monotonically increasing function; l is the number of weight factors; g(θ, φ) represents a correction term related to the geographic angle θ and the azimuth angle φ.

[0035] Optionally, the quantitative evaluation of the data contribution is specifically calculated as follows:

[0036]

[0037] Among them, C j represents the data contribution of the jth participating entity; w i represents the weight of the i-th contribution index; d ijrepresents the score of the jth participating entity on the ith contribution indicator; n is the number of contribution indicators; μ and σ represent the mean and standard deviation of the score, respectively; R represents the number of additional evaluation dimensions; h r (d ij ) represents the score d on the rth dimension ij is the nonlinear transformation function of ; Z is the normalization constant.

[0038] In a second aspect, an embodiment of the present application provides a data security and privacy fusion system based on the industrial Internet, including:

[0039] The collection module is used to collect the data streams generated by industrial equipment and perform differential privacy processing;

[0040] A construction module, used to build a security framework based on the data flow processed by the differential privacy, and define the security level of the data in the security framework;

[0041] An adjustment module, used to create a decentralized identity authentication system for each participating entity through blockchain technology in the security framework, and dynamically adjust the access control authority of the identity authentication system according to the security level;

[0042] An encryption module, used to establish data encryption and decryption rules according to the access control authority and the security level of the data stream, and apply the data encryption and decryption rules to the data stream;

[0043] The transmission module is used to transmit the encrypted data stream to the cloud data center, and homomorphic encryption technology is used during the transmission process to ensure the security of the data transmission process;

[0044] A generation module, used to generate a data fusion model in the cloud data center using the result of the homomorphic encryption technology, wherein the data fusion model includes data contribution and sensitive information protection strategy of all participating entities;

[0045] The output module is used to generate the final data security and privacy fusion result according to the data fusion model, and the result at least includes data contribution, sensitive information protection strategy and data usage rights of each participating entity.

[0046] In the third aspect, a computing device is provided in an embodiment of the present application, including a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a data security and privacy fusion method based on the industrial Internet as described in any one of the first aspects.

[0047] In an embodiment of the present application, the data stream generated by industrial equipment is collected and differential privacy processing is performed; a security framework is constructed based on the data stream processed by the differential privacy, and the security level of the data within the security framework is defined; in the security framework, a decentralized identity authentication system is created for each participating entity through blockchain technology, and the access control authority of the identity authentication system is dynamically adjusted according to the security level; data encryption and decryption rules are established according to the access control authority and the security level of the data stream, and the data encryption and decryption rules are applied to the data stream; the encrypted data stream is transmitted to the cloud data center, and homomorphic encryption technology is used during the transmission process to ensure the security of the data transmission process; using the results of the homomorphic encryption technology, a data fusion model is generated in the cloud data center, and the data fusion model includes the data contribution and sensitive information protection strategy of all participating entities; the final data security and privacy fusion result is generated according to the data fusion model, and the result at least includes data contribution, sensitive information protection strategy and data usage rights of each participating entity. The technical solution provided by the present application can improve data security.

[0048] These and other aspects of the present application will become more clearly understood in the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0050] Figure 1 A flowchart of a data security and privacy fusion method based on the industrial Internet provided in an embodiment of the present application;

[0051] Figure 2 A schematic diagram of the structure of a data security and privacy fusion system based on the industrial Internet provided in an embodiment of the present application;

[0052] Figure 3 A schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0053] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0054] In some of the processes described in the specification and claims of this application and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or executed in parallel. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish between different operations, and the serial numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to be different types.

[0055] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0056] Figure 1 A flowchart of a data security and privacy fusion method based on the industrial Internet is provided for the embodiment of the present application. Figure 1 As shown, the method includes:

[0057] 101. Collect data streams generated by industrial equipment and perform differential privacy processing;

[0058] In this step, industrial equipment refers to various types of machinery, instruments, automation control systems and other hardware facilities used in industrial production, such as sensors, robots, CNC machine tools, etc.

[0059] Data stream: A continuous sequence of data generated by industrial equipment during operation, which usually contains various types of data such as equipment status, operating parameters, and environmental monitoring.

[0060] Differential privacy processing: It is a data privacy protection technology that adds random noise to the original data, making it difficult for a single individual's data to be accurately identified, thereby protecting data privacy. The core of differential privacy is that regardless of whether the data set contains the data of a certain individual, the probability distribution of the query results is almost the same, thereby protecting individual privacy.

[0061] In the embodiment of the present application, it is assumed that the equipment (such as sensors, machine vision systems, etc.) on a factory production line generates a large amount of real-time data, which needs to be collected and used for analysis to optimize the production process. First, the data streams from each device are collected through the data acquisition module deployed on the device.

[0062] Next, in order to protect data privacy, differential privacy processing is performed on the collected data stream. Specifically, the Laplace mechanism can be used to blur the true value of individual data by adding random noise to the data. For example, suppose that the product qualification rate on a production line needs to be counted, and the original qualification rate is 95%. In order to introduce differential privacy, a random noise that follows the Laplace distribution can be added to the data:

[0063] Noise~Laplace(0,b)

[0064] Where b is a parameter of the privacy budget, which determines the amount of noise added. Assuming b = 10, the possible noise values ​​will be distributed between -10 and +10. Add the noise to the original pass rate:

[0065] NoisyRate=95+Noise

[0066] Assuming the added noise is 3, the final reported pass rate is 98%. In this way, even if the data is accessed by a third party, it is difficult to infer the exact original data value from it due to the addition of noise to the data, thus protecting data privacy.

[0067] The main purpose of this step is to protect the privacy information in the data stream collected from industrial equipment through differential privacy processing technology. The design principle is to cover up the real data value by introducing random noise, so that even accurate data cannot be directly inferred from the processed data, thereby achieving the effect of protecting privacy.

[0068] Compared with the traditional solution of directly transmitting unprocessed raw data, this step enhances data security through differential privacy processing, making it difficult to expose sensitive information during data sharing and analysis. This processing method is particularly suitable for situations where cross-organizational data sharing is required in the industrial Internet environment, which can maximize the value of data while protecting privacy.

[0069] Assume that we need to count the qualified rate of products on a production line. The original qualified rate is 95%. We choose the privacy budget parameter b=10, then the added noise obeys the Laplace distribution Noise~Laplace(0,10).

[0070] Assume the generated noise Noise = 3, then:

[0071] NoisyRate = 95 + 3 = 98

[0072] Therefore, the final reported pass rate is 98% instead of the actual 95%, which makes it difficult for the data to leak real information during transmission and use.

[0073] 102. Building a security framework based on the data flow processed by the differential privacy, and defining the security level of the data in the security framework;

[0074] In this step, Differential Privacy Processing is a privacy protection technique that prevents sensitive information from being identified by adding random noise to the data.

[0075] Security Framework: A security protection system established around the data processing process.

[0076] Security Level: Data is divided into different security levels based on factors such as the importance and sensitivity of the data.

[0077] Access Control: Define who can access what data and under what conditions.

[0078] Encryption Policy: Specifies the encryption measures that should be taken when storing and transmitting data.

[0079] Audit Mechanism: Record data access and usage for tracking and auditing.

[0080] In the embodiment of the present application, it is assumed that a factory collects a large amount of production data through various sensors on its production line and has processed these data with differential privacy. The next step is to build a security framework based on these processed data streams and define the security level of the data.

[0081] Building a security framework:

[0082] First, the basic components of the security framework need to be defined, including but not limited to:

[0083] Data classification: Classify data into different categories based on data type and purpose.

[0084] Access control: Define who can access what data, and under what conditions.

[0085] Encryption policy: Specifies the encryption measures that should be taken when storing and transmitting data.

[0086] Audit mechanism: Record data access and usage for tracking and auditing purposes.

[0087] Define the security level:

[0088] Next, you need to define the security level based on the importance and sensitivity of the data. For example, data can be divided into three levels: public, internal, and confidential:

[0089] Public level: Data that is open to the public and can be accessed by anyone.

[0090] Internal level: data that is accessible only to employees within the company.

[0091] Confidentiality: Extremely sensitive data that can only be accessed by specific authorized personnel.

[0092] Assume that the production data of a factory includes the following categories:

[0093] Temperature data: used to monitor the operating temperature of production equipment and is internal-level data.

[0094] Production data: records the output quantity of the production line every day, which is internal data.

[0095] Fault alarm data: records the fault information of production equipment and is confidential data.

[0096] The process of building a security framework is as follows:

[0097] Data classification: temperature data and output data are classified as internal-level data, and fault alarm data are classified as confidential-level data.

[0098] Access control: It is stipulated that all internal-level data can only be accessed by internal factory personnel, and confidential-level data can only be accessed by designated maintenance engineers or managers.

[0099] Encryption strategy: All internal-level data is stored and transmitted using the AES-256 encryption algorithm, and confidential-level data is stored and transmitted using the higher-level RSA-4096 encryption algorithm.

[0100] Audit mechanism: Record every data access behavior, especially access records of confidential data, and conduct regular reviews to ensure that no unauthorized access occurs.

[0101] The main purpose of this step is to further strengthen data security management by building a security framework and defining security levels based on data collection and processing. The design principle is to classify and grade data and take differentiated protection measures to ensure that important data is better protected.

[0102] 103. In the security framework, a decentralized identity authentication system is created for each participating entity through blockchain technology, and the access control authority of the identity authentication system is dynamically adjusted according to the security level;

[0103] Optionally, the step 103 creates a decentralized identity authentication system for each participating entity through blockchain technology, specifically including: registering the identity information of each participating entity in the blockchain network and recording it in a tamper-proof block; according to a pre-set smart contract, when the participating entity initiates a data request, the identity authentication process is automatically executed; if the identity authentication is successful, the participating entity is allowed to access the corresponding data resources, otherwise the access request is rejected.

[0104] In this step, blockchain technology (Blockchain Technology): a decentralized database technology that records transaction information through distributed ledgers and has the characteristics of being tamper-proof. Blockchain technology ensures data consistency through a consensus mechanism and ensures data security through encryption technology.

[0105] Decentralized Identity Verification System: An identity management system created using blockchain technology that does not rely on a central agency, but instead maintains and verifies identity information through multiple nodes in the blockchain network.

[0106] Smart Contract: A program running on the blockchain that automatically executes, controls or records transactions of digital assets. Smart contracts can automatically execute contract terms based on preset conditions without human intervention.

[0107] Identity Information: Information used to identify participating entities, such as user name, public key, biometric data, etc.

[0108] Block: A data structure unit that stores transaction information in the blockchain. Each block contains several transaction records and links the hash value of the previous block to form a chain structure.

[0109] Authentication: The process of confirming a user's identity, ensuring that the user is who they claim to be.

[0110] Access Control: The process of determining whether a user can access specific resources based on their permissions.

[0111] In the embodiment of this application, in an industrial Internet application scenario, it is assumed that multiple factories need to share production data to optimize supply chain management. In order to ensure the secure sharing of data, this application proposes to create a decentralized identity authentication system for each participating entity through blockchain technology, and dynamically adjust the access control authority of the identity authentication system according to the security level.

[0112] Registration information:

[0113] First, each participating entity (such as factory A, B, C) needs to register its identity information in the blockchain network. This information can include the factory's name, address, contact person, public key, etc., and is recorded in the blockchain block. For example:

[0114] Block #1: Factory A: Name = Factory A, Address = Address A, Contact = Contact A, Public Key = PublicKey A

[0115] Block #2: Factory B: Name = Factory B, Address = Address B, Contact = Contact B, Public Key = PublicKey B

[0116] Block #3: Factory C: Name = Factory C, Address = Address C, Contact = Contact C, Public Key = PublicKey C

[0117] Writing smart contracts:

[0118] Next, write a smart contract to automate the identity verification process. The smart contract defines the verification logic when a participating entity initiates a data request. The specific logic is described as follows:

[0119] Check if the requester’s address exists in the whitelist: The smart contract checks if the requester’s address is in the whitelist.

[0120] Check request type: Perform different levels of permission checks based on the request type (public, internal, confidential).

[0121] If the request type is Public, access is allowed to everyone.

[0122] If the request type is "internal", it further checks whether the requester's address is in the internal access list.

[0123] If the request type is "confidential", check whether the requester's address is in the confidential access list.

[0124] Authentication process:

[0125] When Factory A wants to access Factory B’s internal data, it initiates a request. The smart contract automatically executes the authentication logic:

[0126] The smart contract checks if the address of Factory A is in the whitelist.

[0127] If the address of factory A is in the white list, it is further checked whether its address is in the internal access list.

[0128] If the address of factory A is also in the internal access list, it is allowed to access the internal data of factory B; otherwise, the access request is denied.

[0129] The main purpose of this step is to create a decentralized identity authentication system for participating entities through blockchain technology and dynamically adjust access control permissions according to security levels. The design principle is to use the immutability of blockchain and the automatic execution capability of smart contracts to ensure the secure storage and automatic verification of identity information, thereby improving the security and reliability of data access control.

[0130] 104. Establish data encryption and decryption rules according to the access control authority and the security level of the data flow, and apply the data encryption and decryption rules to the data flow;

[0131] Optionally, the data encryption and decryption rules are established according to the access control authority and the security level of the data flow in step 104, specifically including: using different encryption algorithms for encryption processing for data flows with different security levels, and introducing a multi-layer encryption mechanism to enhance security; setting an encryption strength threshold, when the access control authority level is higher than the preset threshold, enabling a higher level encryption algorithm; combining a quantum random number generator to provide an unpredictable encryption key for each encryption operation.

[0132] Optionally, the combination of the quantum random number generator in step 104 provides an unpredictable encryption key for each encryption operation, and the specific calculation formula is:

[0133]

[0134] Among them, K i represents the encryption key of the i-th device; H() is a secure hash function; K master is the master key; ∥ represents the concatenation operator; D i Indicates the identification information of the i-th device; T i Indicates timestamp; R i represents the random salt value; Π represents the product; p k represents the kth prime number; ek represents the prime number p k The exponent of ; m represents the number of prime numbers used.

[0135] Optionally, the encryption strength threshold in step 104 is determined by a specific calculation formula:

[0136]

[0137] Among them, E s represents encryption strength; m represents data quality; v represents data flow speed; w represents data flow speed jrepresents the jth weight factor; T k Indicates the effective range of the key; T m represents the preset threshold; f(x) is a monotonically increasing function; l is the number of weight factors; g(θ, φ) represents a correction term related to the geographic angle θ and the azimuth angle φ.

[0138] In this step:

[0139] Data Stream: A continuous sequence of data generated by industrial equipment during operation, usually including various types of data such as equipment status, operating parameters, and environmental monitoring.

[0140] Encryption Algorithm: An algorithm used to convert plaintext data into ciphertext data to protect data security.

[0141] Multi-layer Encryption Mechanism: Use multiple encryption algorithms or multiple encryptions to increase data security.

[0142] Encryption Strength Threshold: An encryption strength standard determined based on parameters such as data quality and data flow speed, used to determine when to use a higher strength encryption algorithm.

[0143] Quantum Random Number Generator (QRNG): A device that uses the principles of quantum mechanics to generate truly random numbers, used to improve the unpredictability of encryption keys.

[0144] Secure Hash Function: A function used to generate a fixed-length digest, often used to verify data integrity.

[0145] Master Key: The base key used to generate other keys.

[0146] ID Information: Information used to uniquely identify a device, such as a device ID.

[0147] In the embodiment of the present application, it is assumed that a factory needs to encrypt the equipment data on its production line to protect the security of the data. The following is a specific embodiment:

[0148] Determine the security level of the data flow:

[0149] Assume that the factory divides data flows into three security levels: public, internal, and confidential.

[0150] Use different encryption algorithms for encryption

[0151] Public-level data stream: encrypted using the symmetric encryption algorithm AES-128.

[0152] Internal data flow: Encrypted using the symmetric encryption algorithm AES-256.

[0153] Confidential data stream: encrypted using the asymmetric encryption algorithm RSA-2048 and double encrypted using the symmetric encryption algorithm AES-256.

[0154] Introducing a multi-layer encryption mechanism:

[0155] For confidential data streams, in addition to using RSA-2048 for asymmetric encryption, AES-256 is also used for symmetric encryption to increase data security.

[0156] To set the encryption strength threshold:

[0157] Assume that the factory sets the encryption strength threshold based on data quality and data flow speed. The specific calculation formula is:

[0158]

[0159] Among them, E s represents encryption strength; m represents data quality; v represents data flow speed; w represents data flow speed j represents the jth weight factor; T k Indicates the effective range of the key; T m represents the preset threshold; f(x) is a monotonically increasing function; l is the number of weight factors; g(θ, φ) represents a correction term related to the geographic angle θ and the azimuth angle φ.

[0160] Calculation example:

[0161]

[0162] E s =25000+5.5+5=25010.

[0163] When E s When it is greater than the preset threshold, a higher level encryption algorithm is enabled.

[0164] Combined with quantum random number generator to generate encryption keys:

[0165] A quantum random number generator is used to provide an unpredictable encryption key for each encryption operation. The specific calculation formula is:

[0166]

[0167] Among them, E s represents encryption strength; m represents data quality; v represents data flow speed; w represents data flow speed j represents the jth weight factor; T k Indicates the effective range of the key; T m represents the preset threshold; f(x) is a monotonically increasing function; l is the number of weight factors; g(θ, φ) represents a correction term related to the geographic angle θ and the azimuth angle φ.

[0168] Calculation example:

[0169] K i

[0170] =H("MasterKey123"||"DeviceID001"||"202409160042"||"SaltValue456")+2 1 ·3 2 5 3

[0171] Assume that the output of the hash function H(·) is "abcdefg...".

[0172] K i ="abcdefg..."+2·9·125="abcdefg..."+2250

[0173] The main purpose of this step is to establish data encryption and decryption rules based on the security level and access control permissions of the data flow, and to generate unpredictable encryption keys in combination with a quantum random number generator to enhance data security. The design principle is to ensure the security of data at different security levels through a multi-layer encryption mechanism and dynamic adjustment of encryption strength.

[0174] 105. Transmit the encrypted data stream to the cloud data center, and use homomorphic encryption technology to ensure the security of data transmission during the transmission process;

[0175] Optionally, the use of homomorphic encryption technology in step 105 to ensure security during data transmission includes: encrypting the data using a fully homomorphic encryption scheme so that the data can be calculated without decrypting it; decrypting the calculated data at the receiving end to restore the original data value; and using zero-knowledge proof technology to verify the correctness of the encrypted data without leaking any information about the actual content of the data.

[0176] In this step, Homomorphic Encryption: A cryptographic technique that allows calculations to be performed directly on encrypted data without first decrypting the data. After the calculation is completed, the correct calculation result can be obtained by decryption. Fully Homomorphic Encryption (FHE) allows any number of addition and multiplication operations to be performed on encrypted data.

[0177] Fully Homomorphic Encryption Scheme: A homomorphic encryption scheme that supports any number of addition and multiplication operations on encrypted data, allowing complex calculations to be performed on the data without decrypting it.

[0178] Zero-Knowledge Proof: A cryptographic protocol that allows one party (the prover) to prove the truth of a statement to another party (the verifier) ​​without revealing any information about the actual content of the statement. This means that the verifier can be sure that the prover's statement is correct, but does not know the specific content of the statement.

[0179] Data Stream: A continuous sequence of data generated by industrial equipment during operation, usually including various types of data such as equipment status, operating parameters, and environmental monitoring.

[0180] Cloud Data Center: A data center located on a cloud platform that is responsible for storing, processing, and managing large amounts of data.

[0181] In the embodiment of the present application, it is assumed that a factory needs to encrypt the equipment data on its production line and transmit it to the cloud data center for further processing. In order to ensure the security of the data transmission process, a fully homomorphic encryption scheme is used to encrypt the data, and zero-knowledge proof technology is used to verify the correctness of the encrypted data.

[0182] Data Encryption:

[0183] Encrypt data using a fully homomorphic encryption scheme. Assume that the factory selects a mature fully homomorphic encryption algorithm (such as Gentry's FHE scheme) to encrypt the equipment data on the production line.

[0184] For example, suppose a factory needs to transmit a set of temperature data. The encrypted data can be expressed as:

[0185] EncryptedData=Encrypt PK (TemperatureData)

[0186] Among them, Encrypt PK It shows the encryption operation using the public key PK, and TemperatureData is the original temperature data.

[0187] Data transmission:

[0188] Transmit the encrypted data stream to the cloud data center. Assume that there is a secure transmission channel between the factory and the cloud data center, and the encrypted data can be transmitted to the data center through this channel.

[0189] Data calculation:

[0190] In the cloud data center, the encrypted data can be used for calculations. Suppose the data center needs to calculate the average temperature, which can be calculated without decryption:

[0191] EncryptedAverage=ComputeOnEncryptedData(EncryptedData)

[0192] Among them, ComputeOnEncryptedData represents an operation of performing calculations on encrypted data.

[0193] Data Decryption:

[0194] At the receiving end (e.g. the data processing department of a factory), the calculated data is decrypted using the private key to restore the original data value:

[0195] Average=Decrypt Sk (EncryptedAverage)

[0196] Among them, Decrypt SK Represents a decryption operation using the private key SK.

[0197] Zero-knowledge proof:

[0198] In order to verify the correctness of the encrypted data, zero-knowledge proof technology is used. Assuming that the factory needs to verify whether the average temperature calculated by the data center is correct, it can request the data center to provide a zero-knowledge proof:

[0199] ZKP=GenerateZKP(EncryptedAverage)

[0200] Among them, GenerateZKP represents the operation of generating zero-knowledge proof.

[0201] After receiving the zero-knowledge proof, the factory can verify the correctness of the calculation results without obtaining any information about the actual content of the data.

[0202] The main purpose of this step is to encrypt the data using a fully homomorphic encryption scheme and verify the correctness of the encrypted data using zero-knowledge proof technology to ensure the security of the data during transmission and processing. The design principle is to calculate the data without decrypting it and ensure the validity of the evidence through zero-knowledge proof technology without leaking any information about the actual content of the data.

[0203] 106. Using the result of the homomorphic encryption technology, a data fusion model is generated in the cloud data center, wherein the data fusion model includes data contribution and sensitive information protection strategies of all participating entities;

[0204] Optionally, the data fusion model in step 106 includes the data contribution and sensitive information protection strategy of all participating entities, specifically including: defining the data contribution calculation method to ensure that the contribution of each participant can be quantified and evaluated; designing the sensitive information protection strategy to clarify the protection strategies for different types of information in different situations; integrating the above data contribution and sensitive information protection strategy in the data fusion model to form a complete data security and privacy framework.

[0205] Optionally, the quantitative evaluation of the data contribution in step 106 is specifically calculated as follows:

[0206]

[0207] Among them, C j represents the data contribution of the jth participating entity; w i represents the weight of the i-th contribution index; d ij represents the score of the jth participating entity on the ith contribution indicator; n is the number of contribution indicators; μ and σ represent the mean and standard deviation of the score, respectively; R represents the number of additional evaluation dimensions; h r (d ij ) represents the score d on the rth dimension ij is the nonlinear transformation function of ; Z is the normalization constant.

[0208] In this step, Data Contribution Degree is a quantitative indicator to measure the contribution of each participating entity in the data fusion process. By calculating the quality and quantity of data provided by each participant, its influence on the overall data fusion result can be evaluated.

[0209] Sensitive Information Protection Policy: defines the methods and rules for protecting different types of information during the data fusion process. These policies clarify how to handle and protect sensitive information in different situations to ensure data security and privacy.

[0210] Data Fusion Model: Integrate data from different sources into a comprehensive model to better analyze and utilize the data. The model includes the data contribution of all participating entities and sensitive information protection strategies.

[0211] Contribution Metrics: used to evaluate various dimensions of contribution of participating entities, such as data quality, data volume, data timeliness, etc.

[0212] Non-linear Transformation Function: used to transform the contribution score into a form more suitable for calculation to reflect the influence of the contribution score in different dimensions.

[0213] Normalization Constant: It is used to ensure that the calculation results are within a certain range, making it easier to compare the contributions of different participating entities.

[0214] In the embodiment of this application, it is assumed that a manufacturing company has multiple partners in its supply chain, and these partners need to share production data to optimize production processes and supply chain management. In order to ensure the security and privacy of data, this application proposes to use the results of homomorphic encryption technology to generate a data fusion model in a cloud data center, and include the data contribution of all participating entities and sensitive information protection strategies.

[0215] Define the data contribution calculation method:

[0216] First, we need to define the calculation method of data contribution. The specific calculation formula is:

[0217]

[0218] Among them, C j represents the data contribution of the jth participating entity; w i represents the weight of the i-th contribution index; d ij represents the score of the jth participating entity on the ith contribution indicator; n is the number of contribution indicators; μ and σ represent the mean and standard deviation of the score, respectively; R represents the number of additional evaluation dimensions; h r (d ij) represents the score d on the rth dimension ij is the nonlinear transformation function of ; Z is the normalization constant.

[0219] Assume that we have three participating entities (factories A, B, and C), and each entity has four contribution indicators (data quality, data volume, data timeliness, and data accuracy). Assume that the weights of each contribution indicator are 0.3, 0.3, 0.2, and 0.2, respectively, and the mean μ of the score is 50 and the standard deviation σ is 10.

[0220]

[0221] Design a sensitive information protection strategy:

[0222] Next, we need to design a sensitive information protection strategy. Assume that factories A, B, and C need to protect the following types of information during data sharing: production cost data (high sensitivity); production process data (medium sensitivity); and equipment status data (low sensitivity).

[0223] The sensitive information protection strategy is as follows: production cost data is only visible to factory internal personnel; production process data can be viewed by specific authorized personnel; equipment status data can be viewed publicly; integrated data contribution and sensitive information protection strategy.

[0224] Finally, the above data contribution and sensitive information protection strategy are integrated into the data fusion model. The specific steps are as follows:

[0225] The data contribution of each participating entity is calculated according to the above formula.

[0226] Integrate sensitive information protection strategies into the data fusion model to ensure that protection strategies are followed during the data fusion process.

[0227] Form a complete data security and privacy framework to ensure that data is fully utilized and privacy is protected during the sharing and processing process.

[0228] The main purpose of this step is to ensure that the contribution of each participating entity can be quantified and evaluated during the data fusion process, and that sensitive information is effectively protected by defining a data contribution calculation method and designing a sensitive information protection strategy. The design principle is to ensure the security and fairness of data during sharing and processing by quantifying and evaluating data contribution and clarifying protection strategies.

[0229] 107. Generate a final data security and privacy fusion result based on the data fusion model, which at least includes data contribution, sensitive information protection strategy and data usage rights of each participating entity.

[0230] In this step, data fusion model: refers to the process of integrating data from different sources in order to analyze data from multiple perspectives and improve the quality of decision-making. Data fusion can occur at multiple levels, from simple data merging to complex multi-source information integration.

[0231] Data contribution: measures the importance and impact of the data provided by each participant in the entire data set. This helps to assess the contribution of each party to the final result and make reasonable benefit distribution or rewards accordingly.

[0232] Sensitive information protection strategy: refers to the methods and measures used to protect sensitive information of individuals or organizations to prevent data leakage, abuse or unauthorized access. Common strategies include but are not limited to data encryption, anonymization, access control, etc.

[0233] Data usage rights of each participating entity: defines which participants can access which data and the operations they can perform on the data (such as reading, modifying, deleting, etc.). Rights management is a key component to ensure data security.

[0234] In the embodiment of this application, assume that a research project needs to collect patient data from different hospitals to study disease patterns, but directly sharing the original data may infringe on the privacy of patients. The following is an implementation step:

[0235] Data fusion model design: The researchers developed a data fusion model that can receive anonymized data segments from different hospitals and combine them to study disease patterns without exposing individual information.

[0236] Calculate data contribution: The amount and quality of data provided by each hospital determines its contribution. For example, if Hospital A provides a large amount of high-quality data, while Hospital B only provides a small amount of data, then Hospital A's contribution is higher.

[0237] Develop a sensitive information protection policy: All participating hospitals agree to de-identify the data and remove information that can directly or indirectly identify the patient. In addition, all data transmissions must be encrypted and only authorized researchers can access the data.

[0238] Assigning data usage rights: Based on the contribution of each hospital, the research team has formulated different data access permissions. For example, researchers from Hospital A can fully access the research data, while researchers from Hospital B can only view part of the data.

[0239] The main purpose of this step is to ensure the security and privacy of data while protecting the interests of all parties. By quantifying the contribution of data, the contribution of each participant can be fairly and reasonably evaluated, and the benefits or rewards can be distributed accordingly. At the same time, formulating sensitive information protection strategies and clear data usage permissions can minimize the risk of data leakage, protect personal privacy, and maintain trust between all parties.

[0240] Compared with the traditional solution, the improvement is that the traditional data sharing method usually lacks an effective privacy protection mechanism, which may lead to the leakage of sensitive information. In this embodiment, the data is processed through the data fusion model, which not only improves the security of the data, but also realizes a fair and reasonable cooperation model through the contribution calculation and authority allocation mechanism.

[0241] Figure 2 A structural diagram of a data security and privacy fusion system based on the industrial Internet is provided for the embodiment of the present application, such as Figure 2 As shown, the device comprises:

[0242] A collection module 21, used to collect data streams generated by industrial equipment and perform differential privacy processing;

[0243] A construction module 22, configured to construct a security framework based on the data stream processed by the differential privacy, and define a security level of the data within the security framework;

[0244] An adjustment module 23, used to create a decentralized identity authentication system for each participating entity in the security framework through blockchain technology, and dynamically adjust the access control authority of the identity authentication system according to the security level;

[0245] The encryption module 24 is used to establish data encryption and decryption rules according to the access control authority and the security level of the data flow, and apply the data encryption and decryption rules to the data flow;

[0246] The transmission module 25 is used to transmit the encrypted data stream to the cloud data center, and homomorphic encryption technology is used during the transmission process to ensure the security of the data transmission process;

[0247] A generating module 26, configured to generate a data fusion model in the cloud data center using the result of the homomorphic encryption technology, wherein the data fusion model includes data contribution and sensitive information protection strategies of all participating entities;

[0248] The output module 27 is used to generate the final data security and privacy fusion result according to the data fusion model, and the result at least includes data contribution, sensitive information protection strategy and data usage rights of each participating entity.

[0249] Figure 2The data security and privacy fusion system based on the industrial Internet can perform Figure 1 The implementation principle and technical effect of the data security and privacy fusion method based on the industrial Internet described in the illustrated embodiment will not be repeated. The specific way in which each module and unit performs operations in the data security and privacy fusion system based on the industrial Internet in the above embodiment has been described in detail in the embodiment of the method, and will not be elaborated here.

[0250] In one possible design, Figure 2 The data security and privacy fusion system based on the industrial Internet in the illustrated embodiment can be implemented as a computing device, such as Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32;

[0251] The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 32 .

[0252] The processing component 32 is used to: collect data streams generated by industrial equipment and perform differential privacy processing; build a security framework based on the data streams processed by the differential privacy, and define the security level of the data within the security framework; in the security framework, create a decentralized identity authentication system for each participating entity through blockchain technology, and dynamically adjust the access control authority of the identity authentication system according to the security level; establish data encryption and decryption rules based on the access control authority and the security level of the data stream, and apply the data encryption and decryption rules to the data stream; transmit the encrypted data stream to the cloud data center, and use homomorphic encryption technology during the transmission process to ensure the security of the data transmission process; use the results of the homomorphic encryption technology to generate a data fusion model in the cloud data center, the data fusion model includes the data contribution and sensitive information protection strategy of all participating entities; generate the final data security and privacy fusion result based on the data fusion model, which at least includes the data contribution, sensitive information protection strategy and data usage rights of each participating entity.

[0253] The processing component 32 may include one or more processors to execute computer instructions to complete all or part of the steps in the above method. Of course, the processing component may also be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to perform the above method.

[0254] The storage component 31 is configured to store various types of data to support operations at the terminal. The storage component can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0255] Of course, the computing device may also include other components, such as input / output interfaces, display components, communication components, etc.

[0256] The input / output interface provides an interface between the processing component and the peripheral interface module, which may be an output device, an input device, etc.

[0257] The communication component is configured to facilitate, among other things, wired or wireless communications between the computing device and other devices.

[0258] Among them, the computing device can be a physical device or an elastic computing host provided by a cloud computing platform, etc. In this case, the computing device can refer to a cloud server, and the above-mentioned processing components, storage components, etc. can be basic server resources rented or purchased from the cloud computing platform.

[0259] The present application also provides a computer storage medium storing a computer program, wherein the computer program can achieve the above-mentioned Figure 1 The illustrated embodiment is a data security and privacy fusion method based on the industrial Internet.

[0260] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0261] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0262] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0263] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A data security and privacy fusion method based on industrial Internet, characterized in that: include: Collect data streams generated by industrial equipment and perform differential privacy processing; Building a security framework based on the data flow processed by the differential privacy, and defining the security level of the data within the security framework; In the security framework, a decentralized identity authentication system is created for each participating entity through blockchain technology, and the access control authority of the identity authentication system is dynamically adjusted according to the security level; Establishing data encryption and decryption rules according to the access control authority and the security level of the data flow, and applying the data encryption and decryption rules to the data flow; The encrypted data stream is transmitted to the cloud data center, and homomorphic encryption technology is used during the transmission process to ensure the security of the data transmission process; Using the result of the homomorphic encryption technology, a data fusion model is generated in the cloud data center, wherein the data fusion model includes data contribution and sensitive information protection strategy of all participating entities; The final data security and privacy fusion result is generated according to the data fusion model, and the result at least includes data contribution, sensitive information protection strategy and data usage rights of each participating entity.

2. The method according to claim 1, characterized in that The decentralized identity authentication system is created for each participating entity through blockchain technology, specifically including: Register the identity information of each participating entity in the blockchain network and record it in an unalterable block; According to the pre-set smart contract, when the participating entity initiates a data request, the identity verification process is automatically executed; If the authentication is successful, the participating entity is allowed to access the corresponding data resources, otherwise the access request is denied.

3. The method according to claim 1, characterized in that The data encryption and decryption rules are established according to the access control authority and the security level of the data flow, specifically including: Different encryption algorithms are used to encrypt data streams at different security levels, and a multi-layer encryption mechanism is introduced to enhance security. Set the encryption strength threshold. When the access control permission level is higher than the preset threshold, a higher level encryption algorithm is enabled. Combined with a quantum random number generator, it provides unpredictable encryption keys for each encryption operation.

4. The method according to claim 1, characterized in that: The homomorphic encryption technology is used to ensure the security of data transmission, specifically including: Encrypt data using a fully homomorphic encryption scheme so that data can be calculated without being decrypted; Decrypt the calculated data at the receiving end to restore the original data value; Zero-knowledge proof technology is used to verify the correctness of encrypted data without revealing any information about the actual content of the data.

5. The method according to claim 1, characterized in that The data fusion model includes the data contribution of all participating entities and the sensitive information protection strategy, including: Define the data contribution calculation method to ensure that the contribution of each participant can be quantified and evaluated; Design sensitive information protection strategies and clarify the protection strategies for different types of information in different situations; The above data contribution and sensitive information protection strategies are integrated into the data fusion model to form a complete data security and privacy framework.

6. The method according to claim 3, characterized in that The combined quantum random number generator provides an unpredictable encryption key for each encryption operation. The specific calculation formula is: Among them, K i represents the encryption key of the i-th device; H() is a secure hash function; K master is the master key; || represents the concatenation operator; D i Indicates the identification information of the i-th device; T i Indicates timestamp; R i represents the random salt value; Π represents the product; p k represents the kth prime number; ek represents the prime number p k The exponent of ; m represents the number of prime numbers used.

7. The method according to claim 3, characterized in that The specific calculation formula for determining the encryption strength threshold is: Among them, E s represents encryption strength; m represents data quality; v represents data flow speed; w represents data flow speed j represents the jth weight factor; T k Indicates the effective range of the key; T m represents the preset threshold; f(x) is a monotonically increasing function; l is the number of weight factors; g(θ, φ) represents a correction term related to the geographic angle θ and the azimuth angle φ.

8. The method according to claim 5, characterized in that The quantitative evaluation of the data contribution is calculated as follows: Among them, C j represents the data contribution of the jth participating entity; w i represents the weight of the i-th contribution index; d ij represents the score of the jth participating entity on the i-th contribution index; n is the number of contribution indicators; μ and σ represent the mean and standard deviation of the scores respectively; R represents the number of additional evaluation dimensions; h r (d ij ) represents the score d on the rth dimension ij is the nonlinear transformation function of ; Z is the normalization constant.

9. A data security and privacy fusion system based on industrial Internet, characterized in that: include: The collection module is used to collect the data streams generated by industrial equipment and perform differential privacy processing; A construction module, used to build a security framework based on the data flow processed by the differential privacy, and define the security level of the data in the security framework; An adjustment module, used to create a decentralized identity authentication system for each participating entity through blockchain technology in the security framework, and dynamically adjust the access control authority of the identity authentication system according to the security level; An encryption module, used to establish data encryption and decryption rules according to the access control authority and the security level of the data stream, and apply the data encryption and decryption rules to the data stream; The transmission module is used to transmit the encrypted data stream to the cloud data center, and homomorphic encryption technology is used during the transmission process to ensure the security of the data transmission process; A generation module, used to generate a data fusion model in the cloud data center using the result of the homomorphic encryption technology, wherein the data fusion model includes data contribution and sensitive information protection strategy of all participating entities; The output module is used to generate the final data security and privacy fusion result according to the data fusion model, and the result at least includes data contribution, sensitive information protection strategy and data usage rights of each participating entity.

10. A computing device, characterized in that It includes a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a data security and privacy fusion method based on the industrial Internet as described in any one of claims 1 to 8.

Images