Method and system for data acquisition based on encrypted secure communication link

Abstract

The invention discloses a data acquisition method and system based on an encryption security communication link, and relates to the technical field of Internet of Things communication, and the method comprises the steps: when target data is uploaded to a server, a data acquisition terminal generates a link establishment request, and sends the link establishment request to an Internet of Things security gateway; the Internet of Things security gateway performs identity authentication on the data acquisition terminal according to the link establishment request to obtain an identity authentication result; when the identity verification result shows that authentication succeeds, the data acquisition terminal initiates a key negotiation process to a security gateway of the Internet of Things so as to determine a session key used when the data acquisition terminal communicates with the server; and the data acquisition terminal establishes an encrypted secure communication link with the server based on the session key, and sends the target data to the server through the encrypted secure communication link. According to the invention, the security of data transmission can be ensured.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things communication technology, and in particular to a method and system for data collection based on an encrypted secure communication link. Background Art

[0002] With the advent of the era of the Internet of Everything, attacks on the perception layer, network layer, and application layer of the Internet of Things are emerging in an endless stream. At present, key infrastructure in important areas such as electricity, energy, and rail transit that are related to people's livelihood, a large number of IoT environments such as data collection, video monitoring, remote sensing, and telemetry built based on network communication technologies such as optical fiber, 3G / 4G, ZigBee, WIFI, and microwaves are used. Data collection systems such as operation and maintenance data collection systems upload data through the built IoT environment, such as Figure 1 As shown in the figure, currently, data communications between critical infrastructures generally lack security measures such as encryption, authentication, and access control management, making it easy for data transmitted in the Internet of Things to be stolen or illegally accessed, resulting in data leakage and the possibility of penetration and attack on the cloud. In particular, the data transmitted by critical infrastructure is highly sensitive, so the security threats encountered are more serious. Summary of the invention

[0003] The technical problem to be solved by the present invention is to address the deficiencies of the prior art and specifically provide a method and system for data collection based on an encrypted secure communication link, as follows:

[0004] 1) In the first aspect, the present invention provides a method for data collection based on an encrypted secure communication link, and the specific technical solution is as follows:

[0005] When uploading target data to the server, the data acquisition terminal generates a link establishment request and sends it to the IoT security gateway;

[0006] The IoT security gateway authenticates the data collection terminal based on the link establishment request and obtains the identity authentication result;

[0007] When the identity authentication result is successful, the data acquisition terminal initiates a key negotiation process to the IoT security gateway to determine the session key used when the data acquisition terminal communicates with the server;

[0008] The data acquisition terminal establishes an encrypted secure communication link with the server based on the session key, and sends the target data to the server through the encrypted secure communication link.

[0009] The beneficial effects of the method for data collection based on an encrypted secure communication link provided by the present invention are as follows:

[0010] When uploading data, it undergoes identity authentication, encryption and other processing to ensure that the data is secure and reliable during transmission, which can adapt to different scenarios and application requirements in the industrial Internet of Things environment. Moreover, under the protection of encrypted secure communication links, data can effectively resist threats such as hackers and malware during transmission. Even if the transmitted data is illegally obtained, attackers without the correct key cannot decrypt and use the encrypted data. This greatly reduces the risk of data leakage and ensures the security of transmitted data.

[0011] On the basis of the above scheme, the method for data collection based on an encrypted secure communication link of the present invention can also be improved as follows.

[0012] Furthermore, the IoT security gateway authenticates the data collection terminal according to the link establishment request and obtains the identity authentication result, including:

[0013] The IoT security gateway parses the link establishment request and obtains the identifier and identity authentication information of the data collection terminal;

[0014] The IoT security gateway searches the internal memory based on the identifier of the data collection terminal to determine the local authentication information associated with the identifier of the data collection terminal;

[0015] The IoT security gateway authenticates the identity authentication information based on the local authentication information and obtains the identity authentication result.

[0016] Furthermore, the IoT security gateway authenticates the identity authentication information based on the local authentication information and obtains the identity authentication result, including:

[0017] Acquire multiple authentication information items of the data collection terminal from the identity authentication information;

[0018] Each authentication information item of the data collection terminal is compared with the corresponding authentication information item in the local authentication information. When all comparison results are the same, the identity authentication result is authentication success. When any comparison result is different, the identity authentication result is authentication failure.

[0019] Furthermore, the data acquisition terminal is communicatively connected with multiple field devices. The data acquisition terminal creates a data item queue for each field device in the internal memory, uses the field device identifier to identify the data item queue, and sets an upload indicator for each data item queue. Each upload indicator is used to indicate whether the data of each data item in the response data item queue is uploaded to the server, and the target data is determined by the upload indicator.

[0020] 2) In the second aspect, the present invention also provides a system for data collection based on an encrypted secure communication link, and the specific technical solution is as follows:

[0021] Including data collection terminal and IoT security gateway;

[0022] The data acquisition terminal is used to: generate a link establishment request when uploading target data to the server and send it to the IoT security gateway;

[0023] The IoT security gateway is used to: authenticate the data collection terminal according to the link establishment request and obtain the identity authentication result;

[0024] The data collection terminal is used to: when the identity authentication result is successful, initiate a key negotiation process to the IoT security gateway to determine the session key used when the data collection terminal communicates with the server;

[0025] The data acquisition terminal is also used to: establish an encrypted secure communication link with the server based on the session key, and send the target data to the server through the encrypted secure communication link.

[0026] On the basis of the above scheme, the system for data collection based on encrypted secure communication link of the present invention can also be improved as follows.

[0027] Furthermore, the IoT security gateway performs identity authentication on the data collection terminal based on the link establishment request, including:

[0028] The IoT security gateway parses the link establishment request and obtains the identifier and identity authentication information of the data collection terminal;

[0029] The IoT security gateway searches the internal memory based on the identifier of the data collection terminal to determine the local authentication information associated with the identifier of the data collection terminal;

[0030] The IoT security gateway authenticates the identity authentication information based on the local authentication information and obtains the identity authentication result.

[0031] Furthermore, the IoT security gateway authenticates the identity authentication information based on the local authentication information and obtains the identity authentication result, including:

[0032] Acquire multiple authentication information items of the data collection terminal from the identity authentication information;

[0033] Each authentication information item of the data collection terminal is compared with the corresponding authentication information item in the local authentication information. When all comparison results are the same, the identity authentication result is authentication success. When any comparison result is different, the identity authentication result is authentication failure.

[0034] Furthermore, the data acquisition terminal is communicatively connected with multiple field devices. The data acquisition terminal creates a data item queue for each field device in the internal memory, uses the field device identifier to identify the data item queue, and sets an upload indicator for each data item queue. Each upload indicator is used to indicate whether the data of each data item in the response data item queue is uploaded to the server, and the target data is determined by the upload indicator.

[0035] It should be noted that the beneficial effects achieved by the technical solution of the second aspect of the present invention and the corresponding possible implementation methods can be found in the above-mentioned technical effects of the first aspect and its corresponding possible implementation methods, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0037] Figure 1 This is a schematic diagram of the current data upload;

[0038] Figure 2 This is one of the flow charts of a method for data collection based on an encrypted secure communication link according to an embodiment of the present invention;

[0039] Figure 3 It is a schematic diagram of the structure of the OPC UA device information model;

[0040] Figure 4 A schematic diagram of uploading data using the present invention;

[0041] Figure 5 This is a second flow chart of a method for data collection based on an encrypted secure communication link according to an embodiment of the present invention;

[0042] Figure 6 This is a schematic diagram of the first phase of the negotiation process;

[0043] Figure 7 Schematic diagram of the second phase negotiation process. DETAILED DESCRIPTION

[0044] In order to make the objectives, technical solutions and advantages of the present invention more clear, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0045] like Figure 2 As shown, a method for data collection based on an encrypted secure communication link according to an embodiment of the present invention comprises the following steps:

[0046] S1. When uploading target data to the server, the data acquisition terminal generates a link establishment request and sends it to the IoT security gateway;

[0047] S2. The IoT security gateway authenticates the data collection terminal according to the link establishment request and obtains the identity authentication result;

[0048] S3. When the identity authentication result is successful, the data acquisition terminal initiates a key negotiation process to the IoT security gateway to determine the session key used when the data acquisition terminal communicates with the server;

[0049] S4. The data acquisition terminal establishes an encrypted secure communication link with the server based on the session key, and sends the target data to the server through the encrypted secure communication link.

[0050] Optionally, in the above technical solution, the IoT security gateway performs identity authentication on the data acquisition terminal according to the link establishment request, including:

[0051] S20, the IoT security gateway parses the link establishment request to obtain the identifier and identity authentication information of the data collection terminal;

[0052] S21, the IoT security gateway searches the internal memory based on the identifier of the data collection terminal to determine the local authentication information associated with the identifier of the data collection terminal;

[0053] S22. The IoT security gateway authenticates the identity authentication information based on the local authentication information to obtain an identity authentication result.

[0054] Optionally, in S22, the IoT security gateway authenticates the identity authentication information based on the local authentication information to obtain an identity authentication result, including:

[0055] S220, obtaining multiple authentication information items of the data collection terminal from the identity authentication information;

[0056] S221. Compare each authentication information item of the data collection terminal with the corresponding authentication information item in the local authentication information. When all comparison results are the same, the identity authentication result is successful authentication. When any comparison result is different, the identity authentication result is failed authentication.

[0057] Optionally, in the above technical solution, the data acquisition terminal is communicatively connected with multiple field devices, and the data acquisition terminal creates a data item queue for each field device in the internal memory, and uses the field device identifier to identify the data item queue, and sets an upload indicator for each data item queue. Each upload indicator is used to indicate whether the data of each data item in the response data item queue is uploaded to the server, and the target data is determined by the upload indicator.

[0058] like Figure 3 As shown, the technical solution of the present invention selects OPC UA to build an information model, and realizes information communication with the data acquisition device and the host computer (the host computer includes a server, and also includes an edge server, computer or computer used by a third party to collect data).

[0059] The full name of OPC is OLE (Object Linking and Embedding) for Process Control. In order to facilitate the exchange of data between devices and applications from different manufacturers in the automation industry, a unified interface function is defined, which is the OPC protocol specification. OPC is a technology based on WINDOWS COM / DOM, and can use a unified method to access product data from different equipment manufacturers. In short, OPC is used to exchange data between devices and software.

[0060] OPC UA uses objects as the basis for representing data and activities in process systems. Objects contain variables, events and methods, which are connected to each other through references.

[0061] UA stands for unified architecture. In order to cope with the trend of standardization and cross-platform, and to better promote OPC, the OPC Foundation has launched a new OPC standard in recent years based on the successful application of OPC: OPC UA. The OPC UA interface protocol includes the previous A&E, DA, OPC XML DA or HDA. It can access all previous objects using only one address space, and is not restricted by the Windosw platform because it is defined from the transport layer and above, resulting in improved flexibility and security than the previous OPC. OPC UA is essentially an abstract framework, a multi-layer architecture, in which each layer is completely abstracted from its adjacent layers. These layers define various communication protocols on the line, and whether messages containing data, data type definitions, etc. can be securely encoded / decoded. With this core service and data type framework, people can easily add more functions on its basis (inheritance).

[0062] OPC UA will be a transformation tool. Other protocols / standards (such as BACnet) can be converted to a subset within OPC UA very easily. The OPC UA multi-layer approach achieves the goals when the UA specification was originally designed: Functional parity: all COM OPC Classic specifications are mapped to UA; Platform independence: from embedded microcontrollers to cloud-based infrastructure; Security: information encryption, authentication and auditing; Extensibility: the ability to add new features without affecting existing applications; Comprehensive information modeling: for defining complex information.

[0063] like Figure 4 As shown, in view of the actual situation and the actual needs for the security of IoT data transmission, in the present invention, an IoT trusted password security collection and authentication gateway (hereinafter referred to as: IoT security gateway) is used to ensure the security of the data transmission link with the help of IPSec technology.

[0064] The IoT security gateway can use multiplexing technology to save most of the server TCP connections by bundling massive client connection requests, and use fewer connections to complete business requests in batches. Multiplexing technology changes the previous one-to-one way of allocating each user's HTTP / TCP to the server, reducing the server's workload without changing any network structure or increasing the organization's hardware investment costs, thereby improving the server's processing capacity.

[0065] The IoT security gateway establishes multiple TCP connections with the background server in advance and maintains them continuously, which significantly reduces the number of user-side connections that the background server needs to handle (the reduction can be up to 90%), speeds up the connection processing speed between the client and the background server, improves the processing capacity of the application system, and saves the organization's hardware investment costs.

[0066] In one embodiment, Figure 5 As shown, the present invention comprises the following steps:

[0067] S101, when the upload indicator of any data item queue among the multiple data item queues stored in the internal memory of the data collection terminal indicates that data upload is required, the data collection terminal generates a link establishment request, the link establishment request includes: an identifier and identity authentication information of the data collection terminal;

[0068] Optionally, in the above technical solution, the data acquisition terminal is connected to multiple field devices in a communication manner, and the communication connection is a wireless connection and / or a wired connection, and the field devices include: a pressure gauge, a pump, an analyzer, a valve, a handheld sensor, a temperature sensor, a humidity sensor, etc. The number of the pressure gauge, the pump, the analyzer, the valve, the handheld sensor, the temperature sensor, the humidity sensor, etc. can be one or more.

[0069] Optionally, in the above technical solution, the data acquisition terminal creates a data item queue for each field device in the internal memory, or creates a data item queue for each field device of each device type. The data item queue includes multiple data items, each data item includes, for example: field device identification, data type, device type, acquisition time and data content.

[0070] Optionally, in the above technical solution, when a data item queue is created for each field device in the internal memory, the data item queue is identified by using the field device identifier; when a data item queue is created for each type of field device in the internal memory, the data item queue is identified by using the device type. In the case where the data item queue is identified by using the device type, data items of multiple field devices of the same device type exist in the same queue and are distinguished by using the field device identifier.

[0071] Optionally, in the above technical solution, it also includes: setting an upload indicator for each data item queue in the multiple data item queues to indicate whether to upload the data items in the data item queue to the server. The upload indicator may include a timing component and a notification component. For example, the timing component starts counting down from a set time length, and when the remaining time of the timing component is zero, the notification component issues a notification to indicate that the data items in the data item queue are uploaded to the server. Alternatively, the timing component starts counting from zero, and when the time length of the timing component reaches the set time length, the notification component issues a notification to indicate that the data items in the data item queue are uploaded to the server.

[0072] S102, the data acquisition terminal sends a link establishment request to the IoT security gateway, so that the IoT security gateway performs identity authentication on the data acquisition terminal based on the identifier and identity authentication information of the data acquisition terminal in the link establishment request, and obtains an identity authentication result. The specific implementation process is as follows:

[0073] The IoT security gateway parses the link establishment request to obtain the identifier and identity authentication information of the data acquisition terminal; the IoT security gateway searches the internal memory based on the identifier of the data acquisition terminal to determine the local authentication information associated with the identifier of the data acquisition terminal; the IoT security gateway authenticates the identity authentication information based on the local authentication information to obtain the identity authentication result.

[0074] Among them, the process of the Internet of Things security gateway authenticating the identity authentication information based on the local authentication information is: obtaining multiple authentication information items of the data acquisition terminal from the identity authentication information; comparing each authentication information item of the data acquisition terminal with the corresponding authentication information item in the local authentication information. When all comparison results are the same, the identity authentication result is successful authentication. When any comparison result is different, the identity authentication result is failed authentication.

[0075] Optionally, it also includes: pre-storing local authentication information of each data acquisition terminal in the internal memory of the Internet of Things security gateway.

[0076] S103, when the identity authentication result is successful, the data acquisition terminal initiates a key negotiation process to the IoT security gateway to determine the session key used when the data acquisition terminal communicates with the server;

[0077] The module for cryptographic operations in the IoT data security trusted gateway (i.e. IoT security gateway) kernel uses CC903TP_CSH PCIe cryptographic card, which uses SM2 / SM3 / SM4 cryptographic algorithms and has anti-reading function. The security gateway correctly uses SM2-SM4 encryption algorithms. As a cryptographic product, key management is crucial to the security of the entire system. In order to provide comprehensive and multiple encryption protection for the application system, keys also need to be managed hierarchically. The cryptographic module supports a three-level key structure: device key (public key EK and private key DK), work key WK and session key SK.

[0078] Public key EK and private key DK: used to implement digital envelopes, user signatures, identity authentication, and the distribution, exchange protection, etc. of shared keys WK. Here, the private key DK must be stored securely. The security gateway generates its own public and private key pair through the encryption card, in which its own private key is protected by the master key in the encryption card and encrypted and stored on the solid-state hard disk of the security gateway. Once the encryption card is removed or destroyed, the corresponding private key will also become invalid. The public key can be stored unencrypted on the gateway device, or exported to other storage media for key exchange with other gateways.

[0079] Shared key WK: The length of WK is not less than 128 bits. WK can be used as a data encryption and decryption key or a key encryption and decryption key; WK must be changed frequently. The shared key is the result of the first phase negotiation process of the security gateway and is used to encrypt the negotiation session key process of the second phase negotiation process. The negotiation of the first phase negotiation process uses a public key and a private key pair to complete identity authentication and is protected by the key of the second phase negotiation process. The shared key is stored in the PCI-E encryption card of the security gateway and is changed periodically with a period of 28800 seconds.

[0080] Session key SK: A key used to encrypt and decrypt data. The session key must be generated by a physical noise source. The session key is protected by a shared key, generated by the second phase of IKE negotiation, stored in the PCI-E encryption card of the security gateway, and replaced periodically with a period of 3600 seconds.

[0081] For security reasons, the security gateway renegotiates the key every 60 minutes (or as set by the user) without affecting performance. Regardless of whether the new key negotiation is successful or not, the old key will be destroyed from the system, ensuring the security of data encryption.

[0082] According to one embodiment, the key negotiation process includes: a first-phase negotiation process and a second-phase negotiation process. For example, IKE key negotiation includes two phases of information exchange and negotiation.

[0083] The first phase of the negotiation process completes algorithm negotiation, identity authentication and shared key exchange, and the second phase of the negotiation process completes policy negotiation, protection mode, algorithm negotiation and session key exchange.

[0084] The first phase of the negotiation process includes a series of information exchanges such as identity authentication, algorithm components, lifetime and working key exchange. The main mode is adopted. The main mode is an identity protection exchange, and its exchange process consists of 6 messages. The authentication of the identities of both parties uses the public and private key pairs. The communicating parties should configure the public key list of each other in advance. The algorithm components include encryption algorithm and verification algorithm. The lifetime negotiation of the first phase of the negotiation process refers to the validity period of the first phase of the negotiation process. A new round of exchange must be carried out before the expiration to ensure security.

[0085] The first phase of the negotiation process Figure 6 As shown in FIG. 1 , the process of key exchange and identity authentication is completed through three steps and a total of six messages to finally establish the IKE SA of the first phase negotiation process.

[0086] Message 1: The initiator (e.g., a data acquisition terminal) sends a security alliance payload encapsulated with a suggestion payload to the responder (IoT security gateway), and the suggestion payload encapsulated with a transformation payload. It should be understood that both the initiator and the responder can be data acquisition terminals, IoT security gateways or servers, and the negotiation process that can encrypt a secure communication link can be carried out between two reasonable entities.

[0087] Message 2: The responder sends a security association payload that indicates the SA proposal it accepts from the initiator.

[0088] Message 3 and Message 4: The initiator and responder exchange data, including payloads such as Nonce, identity (ID), and optional certificates. Nonce is a parameter required to generate encryption keys and authentication keys; ID is the identifier of the initiator or responder. These data are encrypted and protected using a temporary key Sk, which is protected by a digital envelope. Finally, both parties digitally sign the encrypted data XCH.

[0089] The data exchanged by the initiator is as follows:

[0090] XCHi=Asymmetric_Encrypt(Ski,pub_r)|Symmetric_Encrypt(Ni,Ski)|Symmetric_Encrypt(IDi,Ski)[|Symmetric_Encrypt(CERT,Ski)];

[0091] SIGi_b=Asymmetric_Sign(Hash(Ski_b|Ni_b|IDi_b[|CERT_b]),priv_i);

[0092] The data exchanged by the responder is as follows:

[0093] XCHr=Asymmetric_Encrypt(Skr,pub_i)|Symmetric_Encrypt(Nr,Skr)|Symmetric_Encrypt(IDr,Skr);

[0094] SIGr_b=Asymmetric_Sign(Hash(Skr_b|Nr_b|IDr_b),priv_r);

[0095] The asymmetric encryption algorithm, symmetric encryption algorithm and cryptographic hash algorithm used in the above process are all determined by message 1 and message 2. The temporary key Sk is randomly generated by the initiator and the responder respectively, and its length should meet the key length requirements of the symmetric encryption algorithm.

[0096] Symmetric encryption uses CBC mode, and the IV value of the first payload is 0; subsequent IVs use the last ciphertext of the previous payload.

[0097] The exchanged data before encryption should be padded so that its length is equal to an integral multiple of the symmetric encryption algorithm block length. The values ​​of all padding bytes are 0 except the last byte, and the value of the last padding byte is the number of padding bytes excluding itself.

[0098] After the exchange of messages 3 and 4 is completed, the two parties involved in the communication generate the basic key parameter SKEYID to generate the subsequent keys SKEYID_d, SKEYID_a, and SKEYID_e. The calculation methods are as follows:

[0099] SKEYID=PRF(Hash(Ni_b|Nr_b),CKY-I|CKY-R)

[0100] SKEYID_d=PRF(SKEYID,CKY-I|CKY-R|0)

[0101] SKEYID_a=PRF(SKEYID,SKEYID_d|CKY-I|CKY-R|1)

[0102] SKEYID_e=PRF(SKEYID,SKEYID_a|CKY-I|CKY-R|2)

[0103] The values ​​0, 1, and 2 in the above calculation formula are the numerical values ​​of a single byte.

[0104] SKEYID_e is the working key used by the ISAKMP SA to protect the confidentiality of its messages. SKEYID_a is the working key used by the ISAKMP SA to verify the integrity of its messages and the identity of the data source. SKEYID_d is used to generate session keys.

[0105] The length of all SKEYIDs is determined by the output length of the PRF function. If the output length of the PRF function is too short to be used as a key, then SKEYID_e should be extended. For example, a PRF of HMAC Hash can produce 128 bits of output, but the cryptographic algorithm requires a 320-bit key. Then, SKEYID_e needs to be extended using the feedback and concatenation method until the key length requirement is met. The feedback and concatenation method is as follows:

[0106] K=K1|K2|K3……

[0107] K1=PRF(SKEYID_e,0)

[0108] K2=PRF(SKEYID_e,K1)

[0109] K3=PRF(SKEYID_e,K2)

[0110] …

[0111] Finally, starting from the starting position of K, the number of bits required for the key of the cryptographic algorithm is taken.

[0112] In messages 5 and 6, the initiator and responder authenticate the previous exchange process. The information transmitted in these two messages is encrypted using a symmetric encryption algorithm. The symmetric encryption algorithm is determined by messages 1 and 2, and the key is SKEYID_e. The symmetric encryption operation uses CBC mode, and the initialization vector IV is obtained by concatenating the Ski in message 3 and the Skr in message 4 through a hash operation, that is:

[0113] IV=Hash(Ski|Skr)

[0114] The hash algorithm is determined by message 1 and message 2.

[0115] The message before encryption should be padded to make its length equal to an integer multiple of the symmetric encryption algorithm block length. All padding bytes have a value of 0. The message length in the header should include the length of the padding bytes, as this reflects the length of the ciphertext.

[0116] To authenticate the exchange, the initiator generates HASH_I and the responder generates HASH_R, calculated as follows:

[0117] HASH_I=PRF(SKEYID,CKY-I|CKY-R|SAi_b|IDi_b)

[0118] HASH_R=PRF(SKEYID,CKY-R|CKY-I|SAi_b|IDr_b)

[0119] The second phase of negotiation process Figure 7 As shown, the session key exchange belongs to the second phase of the key negotiation protocol, which adopts the quick mode. The quick mode exchange depends on the main mode exchange in the first phase of the negotiation process. As part of the IPSec SA negotiation process, it negotiates the security policy of the IPSec SA and derives the session key. The information exchanged in quick mode is protected by the ISAKMP SA, that is, all payloads except the ISAKMP header must be encrypted. In quick mode, a hash payload should follow the ISAKMP header. This hash is used for message integrity verification and data source identity authentication. In the second phase of the negotiation process, the payload is encrypted using the CBC working mode of the symmetric encryption algorithm. The IV of the first message is the hash operation of the last set of ciphertext in the first phase of the negotiation process and the MsgID in the second phase of the negotiation process, that is:

[0120] IV = Hash (the last set of ciphertext in the first phase of negotiation|MsgID)

[0121] The subsequent IV is the last ciphertext of the previous message. The message padding is the same as the padding in the first phase of the negotiation process.

[0122] The MsgID in the ISAKMP header uniquely identifies an ongoing quick mode, and the ISAKMP SA itself is identified by the cookies in the ISAKMP header. Because each instance of quick mode uses a unique IV, it is possible for multiple quick modes based on a single ISAKMP SA to be in progress at any one time.

[0123] In quick mode negotiation, the identity ID is defined by default as the IP addresses of both ISAKMP parties, and there is no mandatory requirement for the allowed protocols or port numbers. If the negotiating parties need to specify IDs, the identities of both parties should be passed as IDi and IDr in sequence. The local security policy of the responder will determine whether to accept the other party's identity ID. If the initiator's identity ID is not accepted by the responder due to security policy or other reasons, the responder should send a notification message with a notification payload of INVALID_ID_INFORMATION(18).

[0124] When multiple tunnels exist simultaneously between the communicating parties, the identity ID is the corresponding IPSec SA identifier and specifies that the communication data flow enters the corresponding tunnel.

[0125] The exchange process of quick mode is as follows:

[0126] Message 1: The initiator sends a hash payload, a security association payload (which encapsulates one or more suggestion payloads, each of which encapsulates one or more transformation payloads), a nonce payload, and an identification payload to the responder.

[0127] The message digest in the hash payload is calculated as follows:

[0128] HASH(1)=PRF(SKEYID_a,MsgID|SA|Ni[|IDi|IDr])

[0129] Message 2: The responder sends a hash payload, a security association payload, a nonce payload, and an identification payload to the initiator.

[0130] The message digest in the hash payload is calculated as follows:

[0131] HASH(2)=PRF(SKEYID_a,MsgID|Ni|SA|Nr[|IDi|IDr])

[0132] Message 3: The initiator sends a hash payload to the responder to authenticate the previous exchange.

[0133] The message digest in the hash payload is calculated as follows:

[0134] HASH(3)=PRF(SKEYID_a,0|MsgID|Ni|Nr)

[0135] Finally, the session key material is defined as:

[0136] KEYMAT=PRF(SKEYID_d,protocol|SPI|Ni_b|Nr_b)

[0137] The protocol and SPI are selected from the negotiated ISAKMP recommended payload.

[0138] Among them, KEYMAT is not equal to the final session key. The final session key is extracted from KEYMAT (session key material) according to the algorithm length.

[0139] The session key used for encryption and the session key used for integrity verification are selected from KEYMAT in sequence according to the length required by the algorithm. The session key used for encryption is selected first, and then the session key used for integrity verification is selected.

[0140] When the output length of the PRF function is less than the key material length required by KEYMAT, it is necessary to use feedback and connection methods to expand it until the key length requirement is met. That is:

[0141] KEYMAT=K1|K2|K3|……

[0142] K1=PRF(SKEYID_d,protocol|SPI|Ni_b|Nr_b)

[0143] K2=PRF(SKEYID_d,K1|protocol|SPI|Ni_b|Nr_b)

[0144] K3=PRF(SKEYID_d,K2|protocol|SPI|Ni_b|Nr_b)

[0145] …

[0146] A single SA negotiation results in two security associations: one inbound and one outbound. Different SPIs for each SA (one chosen by the initiator and the other chosen by the responder) ensure that there is a different KEYMAT for each direction. The SPI chosen by the destination of the SA is used to derive the KEYMAT for that SA.

[0147] The DOI identifier defines the format of the payload, the type of exchange, and the naming convention for security-related information, such as the naming of security policies or encryption algorithms and modes. The DOI identifier is used to indicate which DOI identifier the payload is interpreted by. There are two commonly used DOI identifiers, 0 and 1. 0 represents ISAKMP DOI, and 1 represents IPSec DOI.

[0148] Finally, the entire IKE negotiation process completes the addition, deletion, and update of SAs to the JNSEC kernel through a unified software bus interface.

[0149] S104. The data collection terminal establishes an encrypted secure communication link with the server based on the session key, and sends all data items in the specific data item queue to the server via the encrypted secure communication link.

[0150] In one embodiment, after the server receives all data items in a specific data item queue, the server further includes:

[0151] Parse each data item to obtain the field device identification, data type, device type, acquisition time, and data content;

[0152] Determine data processing rules based on data types, and process all data contents based on the data processing rules to determine data processing results;

[0153] Based on the data processing results, determine whether to perform corresponding operations on specific field equipment. If it is determined to perform corresponding operations, generate a response message according to the field equipment identification and send the response message to the data acquisition terminal via the Internet of Things security gateway. The response message includes: the field equipment identification and the operation content;

[0154] The data acquisition terminal determines the target field device according to the field device identifier in the response message, and operates the field device based on the operation content, such as adjusting the data acquisition accuracy, adjusting the data acquisition time interval, etc.

[0155] In one embodiment, the method further includes: determining whether to perform alarm processing based on the data processing result.

[0156] In one embodiment, it also includes: roles and their management strategies. The security gateway system is designed with a dedicated and independent protocol layer user authentication module, which breaks through the service type restrictions of authentication and provides user authentication functions for access control such as VPN, packet filtering, bidirectional NAT, and proxy. The security gateway system supports user and group management, user policies (source IP binding, accessible destination IP and services), and traffic control and time control of user accounts.

[0157] In one embodiment, the security gateway system is designed with a packet filtering firewall technology based on state detection, which can perform state detection analysis on TCP protocol consistency. The security gateway system is designed with in-depth analysis of network dynamic protocols, and fully supports the parsing of dynamic protocols such as H.323, FTP, and SQL.NET. The design supports state packet filtering of complex dynamic protocols, and dynamically opens the required ports through real-time analysis of the deep content of the protocol. Once the transmission is completed, the ports are immediately closed in real time to ensure the security of the intranet. The security gateway system is designed with content filtering functions for HTTP, FTP, SMTP, and POP3 protocols to protect terminal users from legally and effectively using various network objects. It supports filtering of small programs such as java, JavaScript, and ActiveX in web pages.

[0158] In the completely independently developed security protocol stack, the design implements the detection and blocking of common attacks, and can implement the submission frequency check and threshold analysis of ICMP, UDP, and TCP flood attacks, such as completing the filter type and code, frequency, and packet length check for ICMP Flood, completing the frequency and packet length check for UDP Flood, and completing the frequency check for Syn flood. For the most common Syn flood attacks, a SYN proxy is set to protect the internal network and the security gateway itself from such denial of service attacks, providing high security and high availability. The design supports the detection of the following attacks: TCP port scan, UDP port scan, Syn flood attack, ICMP flood attack, UDP flood attack, Ping of death attack, Ping sweep attack, IP spoofing, Land attack, Teardrop attack, CC attack, WinNuke attack, Synfragments attack, Syn and Fin bit set attack, No flags in TCP attack, FIN with no ACK attack, IP record route, IP security options, IP stream, etc.

[0159] In one implementation, the security gateway supports manual key destruction and anti-pry key destruction physical protection solutions. Once the physical protection layer of the hardware board that stores the key information is illegally pried, the cryptographic module will immediately and automatically destroy all the key information inside to prevent key leakage accidents caused by device loss / theft / damage, etc., and ensure the security of the information system.

[0160] In one implementation, the security gateway is mainly divided into management services and application service services. The two services are respectively bound to different physical network ports on the panel to provide external business services. The management service is to manage the cryptographic machine through the WEB management interface. The management interface can be opened on any browser, and users can manage the users, keys and logs of the cryptographic machine through the management interface. The use of the management interface only supports local management. Users are required to insert the identity Ukey on the server cryptographic machine for identity authentication. After confirming the identity authority of the administrator, the user can further implement the management function of the device on the management interface. The application service business provides users with IPSec encryption and decryption services through the business network port.

[0161] In one implementation, the security gateway mainly encrypts and decrypts data to ensure data security. Therefore, the parameters of the server cryptographic machine itself must be kept secure during operation. The following measures are taken during operation:

[0162] (a) In management and business services, the data content of cryptographic resources such as cryptographic algorithms, parameters, and keys (in clear or confidential form) shall not be output or displayed; the process data of processing cryptographic resources shall not be output or displayed; the attribute information (version, status, time setting, etc.) and test results of cryptographic resources may be output and displayed.

[0163] (b) In addition to supporting log export and configuration file information, the security gateway does not provide an interface for extracting other data.

[0164] (c) Failure to design and approve operation and maintenance interfaces;

[0165] (d) do not support other unauthorized access;

[0166] (e) It has the technical means and authority to effectively control operation and maintenance, and records the operation and maintenance of the equipment in a log. The log content includes the user's management information of the equipment and the user's login and logout behavior and is managed by an independent auditor. It supports the export and backup of the log.

[0167] In one embodiment, the production process of the security gateway: the production process of the security gateway mainly includes three processes: assembly, installation and aging test. The security gateway does not carry any keys during the generation process and will not leave any security risks to the system security. The cryptographic algorithm software of the security gateway is written into the internal secure memory during the production process. The cryptographic algorithm software does not include any keys. Therefore, the generation process of the security gateway is only the production of the hardware itself, and no keys are involved in this process.

[0168] In one implementation, the storage of the security gateway: After the user gets the device, the security gateway must be initialized by the user to generate and manage personnel and enter a password. Distribution of the security gateway After production, the security gateway can be delivered to the user for use. The product does not store any keys during transportation. The security gateway is initialized and generates keys at all levels by the user, generates random number seeds, and updates various passwords. Therefore, the security gateway will not leak keys during the distribution process.

[0169] The present invention is committed to building a highly secure and reliable technical solution for secure encrypted transmission of the Industrial Internet of Things, using the SM3 and SM4 national secret algorithms, and combining the IpSec technology to provide solid protection for the security and credibility of data during transmission. The SM3 algorithm is an advanced cryptographic hash function, and the SM4 algorithm is a block cipher algorithm suitable for encrypting and decrypting data. The combination of the two can provide strong security for data transmission. IpSec (IP Security Protocol) is a network layer encryption technology that can encrypt and authenticate data packets to ensure the confidentiality, integrity and authentication of data during transmission. By introducing IpSec technology in the transmission channel, data is not easily illegally intercepted, tampered with or eavesdropped during transmission.

[0170] By integrating the SM3 and SM4 national encryption algorithms with IpSec technology, a secure encrypted transmission channel, namely a secure encrypted transmission link, is constructed. In this channel, data is encrypted and authenticated from the source to ensure its security and reliability during transmission. At the same time, the transmission channel is also highly scalable and can adapt to different scenarios and application requirements in the industrial Internet of Things environment. Under the protection of the secure encrypted transmission channel, data can effectively resist threats such as hackers and malware during transmission. Even if the data is illegally obtained, attackers without the correct key cannot decrypt and use the encrypted data. This greatly reduces the risk of data leakage and ensures the security of transmitted data.

[0171] Preferably, the method further includes: determining whether to perform alarm processing based on the data processing result.

[0172] In the above embodiments, although the steps are numbered S1, S2, etc., these are only specific embodiments given by the present invention. Those skilled in the art may adjust the execution order of S1, S2, etc. according to actual conditions, which is also within the protection scope of the present invention. It can be understood that in some embodiments, some or all of the above embodiments may be included.

[0173] A system for data collection based on an encrypted secure communication link according to an embodiment of the present invention includes a data collection terminal and an Internet of Things security gateway;

[0174] The data acquisition terminal is used to: generate a link establishment request when uploading target data to the server and send it to the IoT security gateway;

[0175] The IoT security gateway is used to: authenticate the data collection terminal according to the link establishment request and obtain the identity authentication result;

[0176] The data collection terminal is used to: when the identity authentication result is successful, initiate a key negotiation process to the IoT security gateway to determine the session key used when the data collection terminal communicates with the server;

[0177] The data acquisition terminal is also used to: establish an encrypted secure communication link with the server based on the session key, and send the target data to the server through the encrypted secure communication link.

[0178] Optionally, in the above technical solution, the IoT security gateway performs identity authentication on the data acquisition terminal according to the link establishment request, including:

[0179] The IoT security gateway parses the link establishment request and obtains the identifier and identity authentication information of the data collection terminal;

[0180] The IoT security gateway searches the internal memory based on the identifier of the data collection terminal to determine the local authentication information associated with the identifier of the data collection terminal;

[0181] The IoT security gateway authenticates the identity authentication information based on the local authentication information and obtains the identity authentication result.

[0182] Optionally, in the above technical solution, the IoT security gateway authenticates the identity authentication information based on the local authentication information to obtain an identity authentication result, including:

[0183] Acquire multiple authentication information items of the data collection terminal from the identity authentication information;

[0184] Each authentication information item of the data collection terminal is compared with the corresponding authentication information item in the local authentication information. When all comparison results are the same, the identity authentication result is authentication success. When any comparison result is different, the identity authentication result is authentication failure.

[0185] Optionally, in the above technical solution, the data acquisition terminal is communicatively connected with multiple field devices, and the data acquisition terminal creates a data item queue for each field device in the internal memory, and uses the field device identifier to identify the data item queue, and sets an upload indicator for each data item queue. Each upload indicator is used to indicate whether the data of each data item in the response data item queue is uploaded to the server, and the target data is determined by the upload indicator.

[0186] In another embodiment, a data collection terminal and an Internet of Things security gateway are included;

[0187] The data acquisition terminal is used to: when determining that the upload indicator of a specific data item queue among the multiple data item queues stored in the internal memory indicates that data upload is required, generate a link establishment request, the link establishment request including: an identifier and identity authentication information of the data acquisition terminal; send the link establishment request to the Internet of Things security gateway; establish an encrypted secure communication link with the server based on the session key, and send all data items in the specific data item queue to the server via the encrypted secure communication link;

[0188] The IoT security gateway is used to: authenticate the data acquisition terminal based on the identifier and authentication information of the data acquisition terminal in the link establishment request to obtain an authentication result; when it is determined that the authentication result of the data acquisition terminal is successful, prompt the data acquisition terminal to initiate a key negotiation process to the IoT security gateway to determine the session key used to communicate with the server.

[0189] Based on cryptographic technology and trusted computing technology, the present invention constructs an operation and maintenance data security collection and transmission data security assurance system of "end-to-end, pipe-to-cloud, and control" from four security dimensions of environment, authentication, communication, and management and control throughout the entire life cycle of operation and maintenance data security collection and transmission, ensuring the integrity, confidentiality, and non-repudiation of production data and instructions, and fundamentally solving the data security risks exposed by operation and maintenance data due to the complexity of the network, business, and environment.

[0190] It should be noted that the beneficial effects of the system for data collection based on an encrypted secure communication link provided by the above embodiment are the same as the beneficial effects of the method for data collection based on an encrypted secure communication link, which will not be described in detail here. In addition, when the system provided by the above embodiment realizes its functions, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the system can be divided into different functional modules according to actual conditions to complete all or part of the functions described above. In addition, the system and method embodiments provided by the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be described in detail here.

[0191] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. A method for data collection based on an encrypted secure communication link, characterized in that: include: When uploading target data to the server, the data acquisition terminal generates a link establishment request and sends it to the IoT security gateway; The IoT security gateway performs identity authentication on the data acquisition terminal according to the link establishment request to obtain an identity authentication result; When the identity authentication result is successful authentication, the data acquisition terminal initiates a key negotiation process to the IoT security gateway to determine a session key used when the data acquisition terminal communicates with the server; The data acquisition terminal establishes an encrypted secure communication link with the server based on the session key, and sends the target data to the server through the encrypted secure communication link.

2. A method for data collection based on an encrypted secure communication link according to claim 1, characterized in that: The IoT security gateway performs identity authentication on the data acquisition terminal according to the link establishment request to obtain an identity authentication result, including: The IoT security gateway parses the link establishment request to obtain the identifier and identity authentication information of the data acquisition terminal; The IoT security gateway searches in an internal memory based on the identifier of the data acquisition terminal to determine the local authentication information associated with the identifier of the data acquisition terminal; The Internet of Things security gateway authenticates the identity authentication information based on the local authentication information to obtain the identity authentication result.

3. A method for data collection based on an encrypted secure communication link according to claim 2, characterized in that: The IoT security gateway authenticates the identity authentication information based on the local authentication information to obtain the identity authentication result, including: Acquire multiple authentication information items of the data acquisition terminal from the identity authentication information; Each authentication information item of the data acquisition terminal is compared with the corresponding authentication information item in the local authentication information. When all comparison results are the same, the identity authentication result is authentication success. When any comparison result is different, the identity authentication result is authentication failure.

4. The method for data collection based on an encrypted secure communication link according to claim 3, characterized in that: The data acquisition terminal is communicatively connected with a plurality of field devices, and creates a data item queue for each field device in the internal memory, identifies the data item queue using the field device identifier, and sets an upload indicator for each data item queue. Each upload indicator is used to indicate whether the data of each data item in the response data item queue is uploaded to the server, and the target data is determined by the upload indicator.

5. The method for data collection based on an encrypted secure communication link according to claim 4, characterized in that: The field device includes at least one of a pressure gauge, a pump, an analyzer, a valve, a handheld sensor, a temperature sensor, and a humidity sensor.

6. A system for data collection based on an encrypted secure communication link, characterized in that: Including data collection terminal and IoT security gateway; The data acquisition terminal is used to: when uploading target data to the server, generate a link establishment request and send it to the Internet of Things security gateway; The IoT security gateway is used to: perform identity authentication on the data acquisition terminal according to the link establishment request to obtain an identity authentication result; The data acquisition terminal is used to: when the identity authentication result is successful authentication, initiate a key negotiation process to the Internet of Things security gateway to determine the session key used when the data acquisition terminal communicates with the server; The data acquisition terminal is also used to establish an encrypted secure communication link with the server based on the session key, and send the target data to the server through the encrypted secure communication link.

7. A system for data collection based on an encrypted secure communication link according to claim 6, characterized in that: The IoT security gateway performs identity authentication on the data acquisition terminal according to the link establishment request, including: The IoT security gateway parses the link establishment request to obtain the identifier and identity authentication information of the data acquisition terminal; The IoT security gateway searches in an internal memory based on the identifier of the data acquisition terminal to determine the local authentication information associated with the identifier of the data acquisition terminal; The Internet of Things security gateway authenticates the identity authentication information based on the local authentication information to obtain the identity authentication result.

8. A system for data collection based on an encrypted secure communication link according to claim 7, characterized in that: The IoT security gateway authenticates the identity authentication information based on the local authentication information to obtain the identity authentication result, including: Acquire multiple authentication information items of the data acquisition terminal from the identity authentication information; Each authentication information item of the data acquisition terminal is compared with the corresponding authentication information item in the local authentication information. When all comparison results are the same, the identity authentication result is authentication success. When any comparison result is different, the identity authentication result is authentication failure.

9. A system for data collection based on an encrypted secure communication link according to claim 8, characterized in that: The data acquisition terminal is communicatively connected with a plurality of field devices, and creates a data item queue for each field device in the internal memory, identifies the data item queue using the field device identifier, and sets an upload indicator for each data item queue. Each upload indicator is used to indicate whether the data of each data item in the response data item queue is uploaded to the server, and the target data is determined by the upload indicator.

10. A system for data collection based on an encrypted secure communication link according to claim 9, characterized in that: The field device includes at least one of a pressure gauge, a pump, an analyzer, a valve, a handheld sensor, a temperature sensor, and a humidity sensor.

Images