Industrial equipment evidence obtaining data management method, system, equipment and medium

Abstract

The invention discloses an industrial equipment evidence obtaining data management method and system, equipment and a medium, and relates to the field of industrial data safety management. The method comprises the following steps: acquiring different types of evidence obtaining data of industrial equipment; carrying out cleaning and attribute labeling on the evidence obtaining data to obtain pre-processed evidence obtaining data; generating a unique hash value for the pre-processed evidence obtaining data, and writing the hash value and the labeled attribute into the block chain; storing the processed evidence obtaining data into a distributed file system and a database; performing multi-signature access control based on the smart contract of the block chain, and allowing a user to access requested data from a distributed file system and / or a database after the access request is approved; and recording each data access operation in the block chain through the smart contract. According to the method, high-reliability guarantee of the whole process of collecting, storing and accessing the evidence obtaining data of the industrial equipment is realized.

Description

Technical Field

[0001] The present application relates to the field of industrial data security management, and in particular to an industrial equipment forensic data management method, system, equipment and medium. Background Art

[0002] Industrial data security management plays a vital role in the modern industrial system. Industrial data not only carries the core information of products in production and circulation, but also involves the operational secrets and technical details of enterprises. Therefore, ensuring the security and integrity of industrial data is the key to protecting the competitiveness of enterprises and maintaining national economic security.

[0003] Industrial equipment forensic data has extremely important application value in the modern industrial system. It is not only the key basis for restoring evidence of data destruction, forming an effective chain of evidence, and quickly and effectively locating problems, but also an important material for industrial safety audits and compliance inspections. Therefore, it is particularly important to manage industrial equipment forensic data securely and reliably, because the integrity and authenticity of this data are directly related to the accuracy and credibility of data security forensic analysis. However, there are currently no methods and tools for secure and reliable management of industrial equipment forensic data. Given the importance of industrial data, data forensics of industrial equipment has become increasingly important, so there is an urgent need to develop forensic data tools for industrial equipment. Summary of the invention

[0004] The purpose of this application is to provide an industrial equipment forensic data management method, system, equipment and medium, which can achieve high-reliability protection for the entire process of industrial equipment forensic data from collection, storage to access.

[0005] To achieve the above objectives, this application provides the following solutions:

[0006] In a first aspect, the present application provides an industrial equipment forensic data management method, the industrial equipment forensic data management method comprising: collecting different types of forensic data of industrial equipment; cleaning and annotating the forensic data to obtain preprocessed forensic data; generating a unique hash value for the preprocessed forensic data, and writing the hash value and the annotated attributes into a blockchain; storing the processed forensic data in a distributed file system and a database; performing multi-signature access control based on a blockchain-based smart contract, and after approving the access request, allowing the user to access the requested data from the distributed file system and / or database; and recording each data access operation in the blockchain through a smart contract.

[0007] In the second aspect, the present application provides an industrial equipment forensic data management system, including: a data acquisition module, a data preprocessing module, a hash calculation module, a blockchain access module, a distributed storage module, an access control module and an audit module; the data acquisition module is connected to the data preprocessing module; the data acquisition module is used to collect different types of forensic data of industrial equipment; the data preprocessing module is respectively connected to the hash calculation module, the distributed storage module and the blockchain access module; the data preprocessing module is used to clean and attribute the forensic data to obtain the preprocessed forensic data, and transmit the preprocessed forensic data to the hash calculation module and the distributed storage module respectively, and the annotated attributes are transmitted to the blockchain. Blockchain access module; the distributed storage module is used to store the processed forensic data in the distributed file system and database; the hash calculation module is connected to the blockchain access module; the hash calculation module is used to generate a unique hash value for the pre-processed forensic data, and transmit the hash value to the blockchain access module; the blockchain access module is used to write the hash value and the annotated attributes into the blockchain; the access control module is used to perform multi-signature access control based on smart contracts, and after approving the access request, allow the user to access the requested forensic data from the distributed file system and / or database; the audit module is used to record each data access operation in the blockchain through a smart contract.

[0008] In a third aspect, the present application provides a computer device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement any of the above-described industrial equipment forensic data management methods.

[0009] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the industrial equipment forensic data management methods described above.

[0010] According to the specific embodiments provided in this application, this application discloses the following technical effects:

[0011] The present application provides an industrial equipment forensic data management method, system, device and medium, which clean and annotate forensic data, thereby improving the consistency and traceability of forensic data; utilizing the immutability and distributed ledger characteristics of blockchain to generate a unique fingerprint of forensic data and store it in the blockchain, thereby ensuring the authenticity and integrity of the forensic data; the preprocessed forensic data is stored in a distributed file system, which provides redundancy and backup functions, thereby ensuring the availability and security of forensic data by replicating data on multiple nodes; and utilizing smart contracts to implement multi-signature access control and detailed audit tracking, thereby ensuring the authority allocation and transparency of operations for forensic data access, thereby significantly improving the security and credibility of data management. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0013] Figure 1 This is a flow chart of an industrial equipment forensic data management method in one embodiment of the present application;

[0014] Figure 2 A schematic diagram of the overall architecture of industrial equipment forensic data collection and preprocessing provided in another embodiment of the present application;

[0015] Figure 3 A schematic diagram of a multi-signature access control and audit mechanism based on a blockchain smart contract provided in another embodiment of the present application;

[0016] Figure 4 A schematic diagram of a process for credible verification of data integrity of industrial equipment forensics provided by another embodiment of the present application;

[0017] Figure 5 A schematic diagram of the architecture of an industrial equipment forensic data management system provided in one embodiment of the present application;

[0018] Figure 6 A schematic diagram of the structure of a computer device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0020] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0021] Blockchain technology, with its decentralized, tamper-proof and traceable characteristics, provides an ideal solution for the trusted management of industrial equipment forensic data. Blockchain uses distributed ledgers and encryption algorithms to ensure that data cannot be tampered with once written, and every data access and modification can be tracked and verified. Therefore, blockchain technology can be applied to the management of industrial equipment forensic data to ensure its integrity, authenticity and immutability. In view of this, in an exemplary embodiment, Figure 1 As shown, a method for managing industrial equipment forensic data is provided, comprising the following steps 101 to 106. Among them:

[0022] Step 101: Collect different types of forensic data of industrial equipment.

[0023] Step 102: Clean and annotate the forensic data to obtain pre-processed forensic data.

[0024] Step 103: Generate a unique hash value for the preprocessed forensic data, and write the hash value and the annotated attributes into the blockchain.

[0025] Step 104: Store the processed forensic data in the distributed file system and database.

[0026] Step 105: Perform multi-signature access control based on the blockchain smart contract, and after approving the access request, allow the user to access the requested data from the distributed file system and / or database.

[0027] Step 106: Each data access operation is recorded in the blockchain through a smart contract.

[0028] The implementation of the above steps 101 to 106 combines a variety of data collection technologies and preprocessing methods to improve the consistency and traceability of the data. By utilizing the immutability and distributed ledger characteristics of the blockchain, a unique hash value of the forensic data is generated and stored in the blockchain to ensure the authenticity and integrity of the data. On this basis, smart contract management and storage attributes are deployed, and smart contracts are further used to implement multi-signature access control and detailed audit tracking to ensure the allocation of data access permissions and transparency of operations, significantly improving the security and reliability of data management. This solution stores large-scale forensic data through a distributed file system and database, and combines blockchain technology to achieve high-reliability protection of the entire process of industrial equipment forensic data from collection, storage to management, providing strong technical support for evidence in court. Therefore, an industrial equipment forensic data management method of the present application is a high-reliability management method for industrial equipment forensic data based on blockchain.

[0029] In another exemplary embodiment of the present application, industrial equipment forensic data exists in various forms, such as logs, video data, sensor data, and control system data. For different types of forensic data, different module methods for data collection need to be adopted. Equipment operation logs, system logs, etc. are collected in real time through the device's built-in log system or external log collection tools (such as Fluentd); monitoring videos and videos captured by device cameras are recorded in real time through monitoring cameras and transmitted to storage servers; sensor data such as temperature, pressure, and speed are collected through sensor interfaces (such as Modbus, Ethernet, S7, OPC UA), and transmitted to the data center through the industrial Internet of Things gateway; data from control systems such as PLC and SCADA are collected through PLC interfaces or SCADA systems, and transmitted to the data center through a dedicated network. The collection process includes deploying data acquisition equipment, setting up data transmission channels, ensuring that data can be transmitted to the data processing center in real time, and continuously collecting equipment operation data through a real-time monitoring system. Then the above step 101 can be replaced by the following steps 201 to 204:

[0030] Step 201: collect operation logs and system logs of industrial equipment in real time through a built-in log system of the industrial equipment or an external log collection tool.

[0031] Step 202: Collect the industrial equipment monitoring video recorded in real time by the monitoring camera and the video captured by the equipment camera.

[0032] Step 203: Collect data of industrial equipment measured by various sensors through a sensor interface; the data of industrial equipment measured by various sensors include temperature, pressure and speed.

[0033] Step 204: Collect control system data.

[0034] In another exemplary embodiment of the present application, after the forensic data of industrial equipment is collected, it is necessary to pre-process the data through a data pre-processing module to ensure the quality and uniformity of the forensic data. Figure 2 The overall architecture of industrial equipment forensic data collection and preprocessing shown in the figure, the above step 102 can be replaced by the following steps 301 to 303:

[0035] Step 301: Desensitize the forensic data, remove redundancy and noise, and obtain cleaned forensic data.

[0036] Step 302: Add a timestamp to each cleaned forensic data to synchronize the time of forensic data from different data sources.

[0037] Step 303: Add data source and data type labels to the forensic data after the synchronization time.

[0038] First, the main steps of the data desensitization process mentioned in step 301 above are as follows:

[0039] Step 1.1: Identify fields with sensitive information, such as device identifiers, personnel information, etc.

[0040] Step 1.2: Use the replacement method to replace these sensitive information with meaningless symbols or pseudo-randomly generated data to ensure data privacy without affecting the analysis results.

[0041] Step 1.3: Verify the desensitized data to ensure that sensitive information cannot be restored or identified.

[0042] After that, we remove redundancy and noise from the data: remove duplicate log entries, filter invalid sensor readings that are not within a reasonable range, and use the mean and median to remove outliers in the data.

[0043] Secondly, add accurate timestamps to each piece of forensic data and synchronize the data time from different sources to ensure that forensic analysis can be performed based on the timeline principle during subsequent calls, ensuring the timeliness of forensic data. Finally, add data sources, such as device ID, collection personnel information, and data type annotations, such as logs, videos, sensor data, etc., to all forensic data to facilitate data tracing and trustworthy verification during subsequent calls.

[0044] In another exemplary embodiment of the present application, in order to facilitate the subsequent verification of data integrity and ensure data traceability, the above step 103 can be replaced by the following steps 401 to 404:

[0045] Step 401: Use a hash algorithm to perform hash calculation on each pre-processed forensic data to generate a hash value.

[0046] Step 402: Ethereum is selected as the blockchain platform, and a smart contract is deployed to form a blockchain network; wherein the deployment of the smart contract includes defining access control rules and a multi-signature mechanism.

[0047] Step 403: Pack the hash value and annotated attributes of each pre-processed forensic data into a transaction and send it to the blockchain network.

[0048] Step 404: Verify the authenticity and integrity of the transaction through the nodes in the blockchain network, and after the verification is passed, write the transaction into a block of the blockchain and record the transaction ID.

[0049] Taking the SHA-256 algorithm as an example, the general idea of ​​writing forensic data into the blockchain is: for each piece of preprocessed forensic data, use the SHA-256 hash algorithm to calculate its hash value and generate a unique identifier for the industrial equipment forensic data. The hash identifier and the different attributes of the extracted forensic data (timestamp, data source, data type and description) are written into the blockchain through the smart contract. The following is a detailed description of the process of writing forensic data into the blockchain.

[0050] Hash calculation is used to uniquely identify industrial equipment forensic data. By calculating the hash value of the data, the integrity and tamper-proofness of the data during transmission and storage are ensured. Blockchain access technology has the characteristics of non-tamperability, distributed storage and high transparency, which can effectively guarantee the authenticity and reliability of forensic data. The relevant modules can be used for the integrity and trusted verification of industrial equipment forensic data and the trusted storage of its attribute information. The specific steps are as follows:

[0051] Step 2.1: A hash value is a unique digital fingerprint that can be used to detect any changes in data. The hash calculation module uses a secure hash algorithm (SHA-256) to perform hash calculations on pre-processed industrial equipment forensic data, such as log files, configuration files, sensor data, etc., to generate a unique hash value. This hash value will be used for subsequent data integrity verification.

[0052] The SHA-256 hash calculation algorithm is used to convert the input forensic data into a fixed-length 256-bit (32-byte) hash value, which can be used to verify the integrity of the data. The steps are as follows:

[0053] Step 2.1.1: Message padding: In order to make the message length a multiple of 512 bits, SHA-256 first pads the input data. The padding process is as follows:

[0054] 1) Add a '1' bit at the end of the message;

[0055] 2) Then add several '0' bits until the message length modulo 512 equals 448 bits;

[0056] 3) Finally, a 64-bit binary number is appended to indicate the length of the original message. After padding, the total length of the message will be an integer multiple of 512 bits.

[0057] Step 2.1.2: Initialize hash value: SHA-256 defines eight 32-bit initial hash values, which are generated by calculating the decimal part of the square root of a natural constant for subsequent hash calculations.

[0058] Step 2.1.3: Process message blocks: Split the padded message into 512-bit (64-byte) blocks. Each block will be processed independently. For each block, perform the following operations:

[0059] 1) Divide the 512-bit message block into 16 32-bit words, each word representing a part of the message;

[0060] 2) Expand these 16 words to 64 words for subsequent hash calculations. The expansion process uses a message dispatch function.

[0061] Step 2.1.4: Initialize working variables: Assign eight initial hash values ​​to eight working variables (a, b, c, d, e, f, g, h). These variables will be continuously updated in the subsequent calculation process.

[0062] Step 2.1.5: Main loop: 64 rounds of calculation for each message block, iterative operation through the compression function of the hash function. Each round of calculation uses the word generated by the message scheduling function, combined with a set of constants, and mixed through non-linear functions and bit operations (bit rotation, XOR, etc.) to update the working variables.

[0063] Step 2.1.6: Update hash value: After each round of calculation, add the current working variable value to the initial hash value to get a new hash value. This process ensures that the impact of the input message is gradually propagated to the final hash value.

[0064] Step 2.1.7: Output hash value: After all message blocks are processed, the eight 32-bit hash values ​​are concatenated to form the final 256-bit hash value. This 256-bit hash value is the unique SHA-256 hash value of the input message.

[0065] Step 2.2: Using the blockchain access module to store hash values ​​and their related metadata can ensure the immutability and traceability of the data. Ethereum is selected as the blockchain platform, and a smart contract is deployed to store and manage the hash values ​​of industrial equipment forensic data and its data source, timestamp, and data description. A smart contract is a contract that is automatically executed on the blockchain. By writing pre-defined rules, conditions, and logic, it can ensure that the hash values ​​of industrial equipment forensic data and their related metadata (such as data source, timestamp, and data description) can be safely and reliably stored and managed without human intervention. The specific process includes: First, the device identifier, timestamp, data description, and hash value are packaged into a transaction and sent to the blockchain network. The nodes in the blockchain network will verify the authenticity and integrity of the transaction. After the verification is passed, the transaction will be written into a block of the blockchain, and then the corresponding transaction ID will be recorded. The data source information ensures the traceability of the data, the timestamp records the specific time of data collection, the data description briefly describes the content and format of the data, and the hash value is used to verify the integrity of the data. Once the block is confirmed, the data is permanently stored in the blockchain and cannot be tampered with. The distributed nature and immutability of blockchain ensure the security and credibility of the hash values ​​and data attribute information stored in it. In addition, due to its transparency and immutability, the data stored in blockchain has a high degree of legal credibility and can be used as strong evidence in court. Through the transparency of blockchain, it is easy to query the relevant attribute information of forensic data and ensure the traceability of data.

[0066] In another exemplary embodiment of the present application, the above step 104 divides the big data of forensic data into small pieces, distributes them to different storage nodes, and then writes these fragmented data into a distributed file system and database, so that the forensic data is easy to manage. At the same time, the distributed file system provides redundancy and backup functions, and ensures the availability and security of the forensic data by replicating the data on multiple nodes.

[0067] Forensic data is stored in different locations according to different types of data. Generally speaking, structured data is stored in the database, while large-scale unstructured data (such as surveillance videos) is stored in the distributed file system. That is, the structured data in the processed forensic data is stored in the database, and the unstructured data in the processed forensic data is stored in the distributed file system.

[0068] Usually, industrial equipment forensic data includes a large amount of raw data, which is stored in a distributed file system, such as HDFS (Hadoop Distributed File System) or IPFS (InterPlanetary File System). These systems are capable of processing large-scale data and provide high availability and reliability through a distributed architecture. Through this classified storage, the advantages of different storage systems can be fully utilized to optimize data management and retrieval efficiency. Distributed file systems provide redundancy and backup functions to ensure data availability and security by replicating data on multiple nodes. When retrieving data, the system is able to process data blocks on multiple nodes in parallel, thereby increasing retrieval speed.

[0069] The high availability and fault tolerance of distributed file systems and databases ensure the continuous availability of data. Even if some nodes fail, the data can still be accessed through other nodes. The scalability of these systems allows dynamic adjustment of storage capacity and performance as needed to cope with the growth of data volume and changes in business needs.

[0070] In another exemplary embodiment of the present application, smart contract deployment includes defining access control rules and a multi-signature mechanism; when a user requests access to data through a smart contract, the smart contract verifies user permissions and records access operations, while encrypting the requested data for transmission to ensure data security, and performing multi-signature verification on important operations to ensure the security of operations. Important operations include reading, writing, storing, transmitting, processing and other operations. The multi-signature mechanism requires multiple users to sign together to complete an access operation, ensuring the allocation of data access permissions and multi-party review. Then the above step 105 can be replaced by the following steps 501 to 507:

[0071] Step 501: When a user initiates an access request for industrial equipment forensic data, a smart contract is used to automatically check whether the access request meets predefined conditions; the predefined conditions include verifying access rights and confirming the number of required signatures.

[0072] Step 502: After confirming that the access request meets the predefined conditions, the users who need to participate in the signature are predefined. At the same time, the smart contract generates a multi-signature request and sends it to all users who are predefined as needing to participate in the signature, notifying the users to sign the access request.

[0073] Step 503: The user who receives the multi-signature request reviews the access request based on the authority, and uses the private key to digitally sign after the review is passed, and sends the signature result back to the smart contract.

[0074] Step 504: After receiving all the signatures, the smart contract verifies the number of signatures and the validity of the signatures.

[0075] Step 505: If the number of signatures meets the predefined multi-signature number requirement and all signatures are valid, the smart contract approves the access request and records the operation and all related signatures on the blockchain.

[0076] Step 506: The smart contract allows the user to access the requested data from the distributed file system and / or database.

[0077] Based on the above-mentioned database that stores structured data, the distributed file system stores unstructured data. When users access forensic data, structured data is accessed through the query interface provided by the database. When users need to access large-scale unstructured data, they access it through the interface or tools provided by the distributed file system.

[0078] Step 507: If the number of signatures does not meet the predefined multi-signature number requirement, or any signature is invalid, the access request is rejected.

[0079] In another exemplary embodiment of the present application, during the data access process, all operations are recorded in the blockchain, which is the audit mechanism of the smart contract. These records include detailed information such as access time, visitor identity, and specific data accessed. Due to the immutability and transparency of the blockchain, all access operations can be permanently traced and verified, ensuring the integrity and authenticity of the audit records. Figure 3 shown.

[0080] In another exemplary embodiment of the present application, in order to verify the integrity of the forensic data, the method may further include the following steps 601 to 606. Among them:

[0081] Step 601: When integrity verification of industrial equipment forensic data is required, the forensic data to be verified is re-extracted from the database.

[0082] Step 602: Perform hash calculation on the extracted forensic data using a hash algorithm to generate a new hash value.

[0083] Step 603: Retrieve the stored hash value from the blockchain based on the transaction ID recorded when the extracted forensic data is written to the blockchain.

[0084] Step 604: Compare the new hash value with the hash value stored in the blockchain.

[0085] Step 605: If the two hash values ​​are consistent, it is determined that the forensic data has not been tampered with during the entire process and the integrity is verified.

[0086] Step 606: If the two hash values ​​are inconsistent, it is determined that the forensic data may have been modified.

[0087] The process of trusted verification of industrial equipment forensic data integrity is as follows: Figure 4 As shown. When the integrity verification of the forensic data of industrial equipment is required, the data to be verified is re-extracted from the database, and the hash calculation is performed on it through the SHA-256 hash algorithm of the hash calculation module to generate a new hash value. Then, using the previously recorded transaction ID, the stored hash value is retrieved from the blockchain through the blockchain storage module, and the newly calculated hash value is compared with the hash value stored in the blockchain. If the two hash values ​​are consistent, it means that the data has not been tampered with throughout the process and the integrity is verified; if they are inconsistent, it means that the data may have been modified. That is: once the forensic data is tampered with, the regenerated hash value will not match the hash value stored in the blockchain, thereby achieving trusted verification of the forensic data.

[0088] The SHA-256 hash algorithm is used to generate data hash values, and these hash values ​​are written into the blockchain through smart contracts, which can effectively solve the problems of data tampering and unreliability. In addition, through the multi-signature access control and audit mechanism based on blockchain smart contracts, the security and transparency of data access are further improved, ensuring that every data access and operation can be accurately recorded and verified, effectively preventing unauthorized access and operation, forming a reliable chain of evidence, and helping to quickly locate and solve security problems.

[0089] This application innovatively combines a variety of data collection technologies and preprocessing methods to ensure comprehensive coverage and high-quality processing of equipment operation logs, monitoring videos, sensor data, and control system data, and improves data consistency and traceability through steps such as data desensitization, noise filtering, timestamp synchronization, and data labeling. Taking advantage of the immutability and distributed ledger characteristics of blockchain, the unique fingerprint of forensic data is generated through the SHA-256 hash algorithm and stored in the blockchain to ensure the authenticity and integrity of the data. On this basis, smart contracts are deployed to manage and store metadata, and smart contracts are further used to implement multi-signature access control and detailed audit tracking to ensure the allocation of data access permissions and transparency of operations, significantly improving the security and credibility of data management. This solution stores large-scale forensic data through a distributed file system and database, and combines blockchain technology to achieve high credibility protection for the entire process of industrial equipment forensic data from collection, storage to management, providing strong technical support for evidence in court.

[0090] The advantages of the industrial equipment forensic data management method of this application are as follows:

[0091] 1. After desensitizing the collected forensic data of different types of industrial equipment, redundancy and noise are removed, and accurate timestamps, data source labels and data type labels are added to them. The advantages are: desensitizing protects sensitive information, enhances data privacy, and ensures that privacy is not leaked during the use of forensic data; removing redundancy and noise improves the quality of forensic data, making the data more accurate and reliable, and facilitating subsequent forensic analysis; adding accurate timestamps and data labels to forensic data ensures the authenticity and traceability of the data, and improves the transparency of data management and auditing.

[0092] 2. Perform hash calculation on the preprocessed forensic data to generate a unique hash value and write it into the blockchain to verify the integrity of the data. The advantages are: 1) Hash value and blockchain technology ensure that once the data is recorded, it cannot be changed, preventing data tampering and forgery; 2) By comparing hash values, the integrity of the forensic data can be quickly verified to ensure that the data has not been modified during transmission and storage.

[0093] 3. Establish a multi-signature access control and audit mechanism based on blockchain smart contracts. Its advantages are: 1) The multi-signature mechanism ensures that only authorized users can access data with their joint consent, preventing single point failures and unauthorized access; 2) All access operations are recorded on the blockchain to form a complete audit log, ensuring that each access is traceable and enhancing the transparency of data management; 3) The immutability of the blockchain ensures the authenticity and reliability of audit records and access control information, and enhances the trust of the overall method.

[0094] Based on the same inventive concept, the embodiment of the present application also provides an industrial equipment forensic data management system for implementing the industrial equipment forensic data management method involved above. The system is intended to ensure the integrity, authenticity and security of industrial equipment forensic data. The implementation solution provided by the system to solve the problem is similar to the implementation solution recorded in the above method, so the specific limitations in one or more industrial equipment forensic data management system embodiments provided below can refer to the limitations of the industrial equipment forensic data management method above, and will not be repeated here.

[0095] In an exemplary embodiment, Figure 5 As shown, an industrial equipment forensic data management system is provided, including: a data acquisition module, a data preprocessing module, a hash calculation module, a blockchain access module, a distributed storage module, an access control module and an audit module. The data acquisition module is connected to the data preprocessing module; the data preprocessing module is respectively connected to the hash calculation module, the distributed storage module and the blockchain access module; the hash calculation module is connected to the blockchain access module.

[0096] The data acquisition module is used to collect different types of forensic data of industrial equipment. The data preprocessing module is used to clean and annotate the forensic data, obtain the preprocessed forensic data, and transmit the preprocessed forensic data to the hash calculation module and the distributed storage module respectively, and the annotated attributes are transmitted to the blockchain access module. The distributed storage module is used to store the processed forensic data in the distributed file system and database. The hash calculation module is used to generate a unique hash value for the preprocessed forensic data, and transmit the hash value to the blockchain access module. The blockchain access module is used to write the hash value and the annotated attributes into the blockchain together. The access control module is used to perform multi-signature access control based on smart contracts, and after approving the access request, allow the user to access the requested forensic data from the distributed file system and database. The audit module is used to record each data access operation in the blockchain through a smart contract.

[0097] At present, the existing evidence collection equipment is mainly aimed at traditional information systems or information equipment (such as servers, hosts, etc.), which can solve the data evidence collection of some general equipment in industrial scenarios, but for special industrial equipment (such as controllers, industrial touch screens, industrial intelligent sensor equipment, etc.), because the data protocols, data formats, data interfaces, etc. are different, the applicability of existing evidence collection tools is not strong, or even not applicable. In this application, the equipment operation log, system log, etc. are collected in real time through the built-in log system of the equipment or external log collection tools (such as Fluentd); the monitoring video and the video captured by the equipment camera are recorded in real time and transmitted to the storage server through the monitoring camera; the sensor data such as temperature, pressure, speed, etc. are collected through the sensor interface (such as Modbus, Ethernet, S7, OPC UA), and transmitted to the data center through the industrial Internet of Things gateway; the data of control systems such as PLC and SCADA are collected through the PLC interface or SCADA system, and transmitted to the data center through a dedicated network. The setting of the data acquisition module of this application includes deploying data acquisition equipment, setting up data transmission channels, ensuring that data can be transmitted to the data processing center in real time, and continuously collecting equipment operation data through the real-time monitoring system.

[0098] The architecture of industrial equipment forensic data management system Figure 5As shown. Data acquisition module: responsible for collecting forensic data from industrial equipment in real time, covering important information such as the equipment's operating status, log information, sensor data, and surveillance video, to ensure the comprehensiveness and accuracy of the data. Data preprocessing module: performs preliminary processing on the collected data, including data cleaning, removing noise and redundant information, and data desensitization operations, and adding accurate timestamps, source labels, and type labels to the data for subsequent processing. Hash calculation module: uses a secure hash algorithm (SHA-256) to calculate the hash value of the preprocessed data to generate a unique hash value, which is used to identify the uniqueness of the data and ensure its integrity during transmission and storage. Blockchain access module: packages the hash value and related metadata information into transactions and records them in the blockchain, using the blockchain's immutability and distributed storage characteristics to ensure the authenticity and security of the data. Distributed storage module: divides large-scale forensic data into small blocks, distributes them to different storage nodes for distributed storage, and records the location information and metadata information of the data blocks through the metadata management system to achieve efficient data storage and retrieval. Access control module: Implement multi-signature access control mechanism through blockchain smart contracts to ensure that only authorized users can access forensic data and prevent unauthorized access and operation. Audit module: Record and manage all access and operations to data, generate detailed audit logs, and ensure transparency and traceability of data access.

[0099] The data acquisition module is the starting point of the entire system. The collected raw data is provided to the data preprocessing module for cleaning, desensitization and labeling. The preprocessed data will be passed to the hash calculation module to generate a unique hash value. Then, the hash calculation module passes the generated hash value together with the metadata to the blockchain access module and stores it in the blockchain. At the same time, the actual forensic data after preprocessing will be received by the distributed storage module and stored on different nodes. The access control module is used in conjunction with the audit module. The former ensures the security of data access, while the latter records every data access and operation. The entire system ensures the security and reliability of the entire process from data collection to storage and access control through the collaborative work of various modules.

[0100] In an exemplary embodiment, a computer device is provided. The computer device may be a server or a terminal. The internal structure diagram thereof may be as follows: Figure 6As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store processed forensic data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for managing industrial equipment forensic data is implemented.

[0101] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components. In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0102] In an exemplary embodiment, a computer-readable storage medium is provided, storing a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0103] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0104] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM may be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0105] The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. The non-relational database may include a distributed database based on blockchain, etc., but is not limited thereto. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but is not limited thereto.

[0106] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0107] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. At the same time, for those skilled in the art, according to the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. A method for managing industrial equipment forensic data, characterized in that: The industrial equipment forensic data management method comprises: Collect different types of forensic data from industrial equipment; Cleaning and attribute labeling the forensic data to obtain preprocessed forensic data; Generate a unique hash value for the preprocessed forensic data, and write the hash value and the annotated attributes into the blockchain; Store processed forensic data into distributed file systems and databases; Blockchain-based smart contracts perform multi-signature access control and allow users to access requested data from distributed file systems and / or databases after approving the access request; Each data access operation is recorded in the blockchain through a smart contract.

2. The industrial equipment forensic data management method according to claim 1, characterized in that: Collect different types of forensic data from industrial equipment, including: Collect the operation logs and system logs of industrial equipment in real time through the built-in log system of industrial equipment or external log collection tools; Collect industrial equipment monitoring videos recorded in real time by surveillance cameras and videos captured by equipment cameras; Collecting data of industrial equipment measured by various sensors through a sensor interface; the data of industrial equipment measured by various sensors include temperature, pressure and speed; Collect data from the control system.

3. The industrial equipment forensic data management method according to claim 1, characterized in that: Cleaning and attribute labeling of the forensic data, specifically including: Performing data desensitization processing on the forensic data, removing redundancy and noise, and obtaining cleaned forensic data; Add a timestamp to each cleaned forensic data to synchronize the forensic data time from different data sources; Add data source and data type annotations to forensic data after synchronization time.

4. The industrial equipment forensic data management method according to claim 1, characterized in that: Generate a unique hash value for the preprocessed forensic data, and write the hash value and the annotated attributes into the blockchain, including: A hash algorithm is used to perform hash calculation on each preprocessed forensic data to generate a hash value; Choose Ethereum as the blockchain platform and deploy a smart contract to form a blockchain network. The deployment of the smart contract includes defining access control rules and multi-signature mechanisms. Package the hash value and annotated attributes of each preprocessed forensic data into a transaction and send it to the blockchain network; The authenticity and integrity of the transaction are verified by the nodes in the blockchain network, and after the verification is passed, the transaction is written into a block of the blockchain and the transaction ID is recorded.

5. The industrial equipment forensic data management method according to claim 1, characterized in that: Storing processed forensic data in distributed file systems and databases, including: The structured data in the processed forensic data is stored in a database, and the unstructured data in the processed forensic data is stored in a distributed file system.

6. The industrial equipment forensic data management method according to claim 1, characterized in that: Blockchain-based smart contracts perform multi-signature access control and allow users to access the requested data from the distributed file system and / or database after approving the access request, including: When a user initiates an access request for industrial equipment forensic data, the smart contract automatically checks whether the access request meets predefined conditions; the predefined conditions include verifying access rights and confirming the number of required signatures; After confirming that the access request meets the predefined conditions, the users who need to participate in the signature are predefined, and the smart contract generates a multi-signature request and sends it to all the users who are predefined to participate in the signature, notifying the users to sign the access request; The user who receives the multi-signature request reviews the access request based on the permissions, and after passing the review, uses the private key to digitally sign and sends the signature result back to the smart contract; After receiving all the signatures, the smart contract verifies the number of signatures and the validity of the signatures; If the number of signatures meets the predefined multi-signature number requirement and all signatures are valid, the smart contract approves the access request and records the operation and all related signatures on the blockchain; Smart contracts allow users to access requested data from distributed file systems and / or databases; If the number of signatures does not meet the predefined multi-signature number requirement, or any signature is invalid, the access request will be rejected.

7. The industrial equipment forensic data management method according to claim 1, characterized in that: The industrial equipment forensics data management method further includes: When the integrity verification of industrial equipment forensic data is required, the forensic data that needs to be verified is re-extracted from the database; Perform hash calculation on the extracted forensic data through a hash algorithm to generate a new hash value; Retrieve the stored hash value from the blockchain based on the transaction ID recorded when the extracted forensic data was written to the blockchain; Compare the new hash with the hash stored in the blockchain; If the two hash values ​​are consistent, it is determined that the forensic data has not been tampered with during the entire process and the integrity is verified; If the two hash values ​​are inconsistent, it is determined that the forensic data may have been modified.

8. An industrial equipment forensic data management system, characterized in that: include: Data collection module, data preprocessing module, hash calculation module, blockchain access module, distributed storage module, access control module and audit module; The data acquisition module is connected to the data preprocessing module; the data acquisition module is used to collect different types of forensic data of industrial equipment; The data preprocessing module is connected to the hash calculation module, the distributed storage module and the blockchain access module respectively; the data preprocessing module is used to clean and annotate the forensic data, obtain the preprocessed forensic data, and transmit the preprocessed forensic data to the hash calculation module and the distributed storage module respectively, and transmit the annotated attributes to the blockchain access module; The distributed storage module is used to store the processed forensic data into a distributed file system and a database; The hash calculation module is connected to the blockchain access module; the hash calculation module is used to generate a unique hash value for the preprocessed forensic data and transmit the hash value to the blockchain access module; The blockchain access module is used to write the hash value and the marked attributes into the blockchain; The access control module is used to perform multi-signature access control based on smart contracts and, after approving the access request, allow the user to access the requested forensic data from the distributed file system and / or database; The audit module is used to record each data access operation in the blockchain through a smart contract.

9. A computer device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the industrial equipment forensic data management method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the industrial equipment forensic data management method described in any one of claims 1 to 7 is implemented.

Images