Secure transmission system based on data encryption

Abstract

The invention discloses a secure transmission system based on data encryption, which comprises a login data encryption and decryption module, an interaction data encryption and decryption module and a data secure transmission module, and a specific operation method comprising the system comprises the following steps: step 1, aiming at a login scene of a user in a configuration environment, encrypting and decrypting registration login data; step 2, interaction of encrypted data and decrypted data between the user and the industrial control terminal is carried out by adopting a client and server mode; 3, realizing interaction of data encryption and decryption between the configuration software and the process operation station by calling the data interface dynamic link library, and establishing communication between the configuration software and the real-time database; step 4, the configuration end downloads the configuration engineering file and the control logic file into the operation server through FTP, and encryption and decryption between the operation server and the configuration end are carried out to realize data security transmission; the method has the characteristics of improving the physical security and guaranteeing the real-time transmission security.

Description

Technical Field

[0001] The present invention relates to the technical field of data encryption, and in particular to a secure transmission system based on data encryption. Background Art

[0002] In industrial control systems, in order to prevent other personnel from modifying configuration engineering files, many configuration software support encryption of configuration engineering files. When opening a configuration engineering file with a password, the correct password must be entered to view and edit the configuration engineering file, otherwise it cannot be opened, thereby realizing the security management of configuration engineering files in industrial control systems. However, most configuration software with vulnerabilities only compares the password entered by the user with the real password, and does not use the entered password to encrypt and decrypt the configuration engineering file. This results in that no matter what password is entered, the key jump statement can be found by reverse means, and the instruction is modified to make the verification process always go to the correct branch. For this type of security problem, the solution of the existing system can only be to spend a lot of time and energy to redesign the encryption mechanism, and it is necessary to urge users to use updated patches, which increases the risk of user data and requires service providers to invest more resources and operating costs in the repair of vulnerabilities. Therefore, it is necessary to design a secure transmission system based on data encryption to improve physical security and ensure real-time transmission security. Summary of the invention

[0003] The purpose of the present invention is to provide a secure transmission system based on data encryption to solve the problems raised in the above background technology.

[0004] In order to solve the above technical problems, the present invention provides the following technical solutions: a secure transmission system based on data encryption, comprising a login data encryption and decryption module, an interactive data encryption and decryption module, and a data secure transmission module, characterized in that: the login data encryption and decryption module is used to encrypt and decrypt registration login data for the user's login scenario in a configuration environment; the interactive data encryption and decryption module is used to use a client and server mode to perform interaction of encrypted data and decrypted data between the user and the industrial control terminal; the data secure transmission module is used to perform encryption and decryption between the computing server and the configuration end to achieve data secure transmission.

[0005] According to the above technical solution, the login data encryption and decryption module includes: a configuration project file module, a user registration and login module, an encryption and decryption operation module, and a user identity authentication module. The configuration project file module is used to provide configuration project files to users using the configuration function in the industrial control system; the user registration and login module is used for users to register and log in from the configuration environment configured in the project file; the encryption and decryption operation module is used to add the configuration project password to the encryption and decryption operation of the data; the user identity authentication module is used for the configuration system to verify the identity of the user by determining whether the generated original random number value is consistent with the received decrypted random number.

[0006] According to the above technical solution, the interactive data encryption and decryption module includes: a configuration interface connection module, a server access module, a process data interaction module, and an encryption method selection module, wherein the configuration interface connection module is used to connect the original configuration program and the application program through the configuration interface; the server access module is used for the client to trigger the server's callback function to access the data according to the service request and IP address search received by the server; the process data interaction module is used to realize data interaction between various software processes on the configuration end by using a shared memory method; the encryption method selection module is used to select the encryption method according to the configuration project file encryption algorithm during the data interaction process.

[0007] According to the above technical solution, the data security transmission module includes: a black and white list establishment module, a message verification and judgment module, and a DES encryption transmission module, wherein the black and white list establishment module is used to perform data transmission between the server and the client by establishing a black and white list; the message verification and judgment module is used for the client to send a control message with a code ID containing the client's identity information to the server for identity verification and judgment; the DES encryption transmission module is used to encrypt all data in the black and white list judgment mode through DES and then transmit it.

[0008] According to the above technical solution, the specific operation method steps of the system include: Step 1: Encrypt and decrypt the registration and login data according to the user login scenario in the configuration environment; Step 2: Use client and server mode to exchange encrypted and decrypted data between the user and the industrial control terminal; Step 3: Implement the data encryption and decryption interaction between the configuration software and the process operation station by calling the data interface dynamic link library, and establish the communication between the configuration software and the real-time database; Step 4: The configuration end downloads the configuration project files and control logic files to the computing server via FTP, and performs encryption and decryption between the computing server and the configuration end to achieve secure data transmission.

[0009] According to the above technical scheme, the steps of encrypting and decrypting the registration and login data include: the configuration function in the industrial control system provides the user with a configuration project file, the configuration function includes the function entity of the server calling the secondary development interface function and the header file of the related structure, the user registers and logs in from the configuration environment configured in the project file, and directly calls the function entity and the related structure in the header file in the project to complete the application of the user program end, based on the registered user, the verification code is transmitted to the back-end for storage by inputting, and then the user login relies on the front-end input password to be transmitted to the back-end for verification, the user's instruction operation is implemented and transmitted to the back-end for verification, after the server receives the request submitted by the user, according to the user name in the request data, the corresponding user's identity is taken out from the database to generate a string of random numbers, the generated random number is encrypted using the public key corresponding to the user identity, and the encryption result is returned to the client.

[0010] According to the above technical solution, the process of encrypting and decrypting the registration login data also includes: for the password transmission and storage process involved in the login scenario, by allowing the configuration project password to participate in the data encryption and decryption operation, by appending the salt value to the password as the encryption and decryption key, the client obtains the decryption value of the encrypted result using the private key of the corresponding identifier, and submits the decryption result to the configuration system. The configuration system determines whether the user owns the private key corresponding to the identifier by judging whether the original random value it generates is consistent with the decrypted random number received, and finally determines whether the user is the true holder of the corresponding identifier to verify the user's identity. In the case where the user forgets the password when logging in, the configuration system encrypts the correct encryption key through an asymmetric algorithm and stores it in the configuration project file. When it is judged that the configuration project file is owned by the user, the server uses the private key it owns to decrypt the ciphertext and recover the user's forgotten login password.

[0011] According to the above technical solution, the method for interaction of encrypted data and decrypted data between the user and the industrial control terminal includes: After the industrial control system successfully registers the service of the user in the server, the original system program and the user application are separated, and executable image files are generated respectively. The original configuration program and the application are connected through the configuration interface, and the configuration information of the industrial control system is constructed through the server mode. After receiving the configuration project file query service request after the user registration, the executable file image file is divided into the specified partition and located at the specified physical address of the storage. When the client searches and connects to the industrial control system according to the service request and IP address received by the server, the callback function of the server is triggered to access the data. The server updates the access data in real time according to the data linked list of the tag class variables stored in the real-time database refreshed in real time. When the client sends a request to the server, the HTTPS protocol is used instead of the HTTP protocol, and a secure connection request is included in the request to inform the server that the request needs to be encrypted and decrypted using the SSL / TLS protocol. The server determines whether the HTTPS protocol is currently supported. If it is supported, a digital certificate containing the server public key and the certificate authority information is returned. A trusted third-party organization is used to issue a digital certificate for proving the identity of the server and the validity of the certificate. The client verifies the validity of the digital certificate, and the validity includes data information such as whether the certificate is expired and whether the certificate authority is credible. When the digital certificate is verified, the client will use the public key in it to establish a secure connection. After establishing a secure connection with the server, the client generates a session key for negotiating encryption algorithm and key length parameters. The client encrypts the session key with the server public key and sends the encrypted session key to the server. The server decrypts the session key with its own private key and uses the session key to negotiate encryption algorithm, key length and other parameters. The returned result content is encrypted and transmitted. After establishing a secure connection and completing the negotiation process, the client and server will communicate using the negotiated encryption algorithm and master key to ensure the security of data during transmission.

[0012] According to the above technical solution, the method for establishing communication between the configuration software and the real-time database includes: The computing server broadcasts the encrypted and decrypted real-time data to the configuration terminal for data display. The server sends commands to the computing server through the TCP protocol. The various software processes on the configuration terminal use shared memory to achieve data interaction between processes. In the data interaction process, the encryption method is selected according to the configuration project file encryption algorithm, and the configuration project file is exported in ciphertext form, that is, encrypted into a ciphertext file, forming a string in the form of garbled code; All encryption program information is placed in the configuration information, including the basic information of the encryption program and the information of the encryption method. The program content includes plain text and encrypted ciphertext, which are stored in the main part of the program. Then the corresponding key is determined through the ECC algorithm, and then the corresponding session key is determined through the key negotiation mechanism, and the public and private key pair is determined, and a specific mapping processing identification ID is performed to determine the interactive public and private keys between the server and the client; According to the communication protocol between the configuration software of the industrial control system and the real-time database, data encryption is performed at the edge of the industrial control system, and the communication between the client and the server is encrypted and transmitted.

[0013] According to the above technical solution, the steps of encrypting and decrypting data between the computing server and the configuration terminal to achieve secure data transmission include: The client and server randomly generate their own private keys and notify each other. The two private keys are combined into a master key through an algorithm, and then data is securely transmitted through encryption and decryption. By setting up a blacklist and whitelist, only clients on the whitelist can establish a connection with the server and transmit data. Unknown clients are added to the blacklist. After the server receives the data and decrypts it, it compares the data with the standard format. If the data passes the verification, it can be saved and used. Then a secret key algorithm is generated and written to the server and client, and all data is transmitted using DES encryption.

[0014] Compared with the prior art, the beneficial effects achieved by the present invention are as follows: the present invention, by targeting the user login scenario in the configuration environment, performs encryption and decryption of registration and login data, adopts the client and server modes to perform the interaction of encrypted and decrypted data between the user and the industrial control terminal; realizes the interaction of data encryption and decryption between the configuration software and the process operation station by calling the data interface dynamic link library, establishes the communication between the configuration software and the real-time database, and the configuration end downloads the configuration project file and the control logic file to the operation server through FTP, performs encryption and decryption between the operation server and the configuration end to realize data security transmission; improves the user identity verification in the configuration software and the transmission security of the interactive data. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings: Figure 1 A flowchart of a secure transmission method based on data encryption provided in Embodiment 1 of the present invention; Figure 2 A schematic diagram of the module composition of a secure transmission system based on data encryption provided in Embodiment 2 of the present invention. DETAILED DESCRIPTION

[0016] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0017] Embodiment 1: Figure 1 This is a flowchart of a secure transmission method based on data encryption provided in Embodiment 1 of the present invention. This embodiment can be applied to scenarios where data encryption is used. This method can be executed by a secure transmission system based on data encryption provided in this embodiment. Figure 1 As shown, the method specifically comprises the following steps: Step 1: Encrypt and decrypt the registration and login data according to the user login scenario in the configuration environment; In an embodiment of the present invention, the configuration function in the industrial control system provides the user with a configuration project file. The configuration function includes a header file of a function entity and a related structure of a server calling a secondary development interface function. The user registers and logs in from the configuration environment configured in the project file. In the project, the function entity and the related structure in the header file are directly called to complete the application of the user program end. The registered user inputs a verification code and transmits it to the back-end for storage. Then the user logs in by inputting a password at the front end and transmitting it to the back-end for verification. The user's instruction operation is implemented and transmitted to the back-end for verification. After receiving the request submitted by the user, the server side takes out the identity of the corresponding user from the database according to the user name in the request data to generate a string of random numbers, encrypts the generated random number using the public key corresponding to the user identity, and returns the encryption result to the client; Exemplarily, for the password transmission and storage process involved in the login scenario, the configuration project password is involved in the data encryption and decryption operations, and the salt value is appended to the password as the encryption and decryption key. After the client obtains the decryption value of the encrypted result using the private key of the corresponding identifier, the decryption result is submitted to the configuration system. The configuration system determines whether the user owns the private key corresponding to the identifier by judging whether the original random value it generates is consistent with the decrypted random number received, and finally determines whether the user is the true holder of the corresponding identifier to verify the user's identity. In the case where the user forgets the password when logging in, the configuration system encrypts the correct encryption key through an asymmetric algorithm and stores it in the configuration project file. When it is judged that the configuration project file is owned by the user, the server uses the private key it owns to decrypt the ciphertext and recover the user's forgotten login password.

[0018] Step 2: Use client and server mode to exchange encrypted and decrypted data between the user and the industrial control terminal; In an embodiment of the present invention, after the industrial control system summarizes the successful service registration of the user in the server, the original system program and the user application program are separated, and executable image files are generated respectively, and the original configuration program and the application program are connected through the configuration interface, and the configuration information of the industrial control system is constructed through the server mode. After receiving the configuration engineering file query service request after the user registration, the executable file image file is divided into specified partitions and located at the specified physical address of the memory. When the client searches and connects to the industrial control system according to the service request and IP address received by the server, the callback function of the server is triggered to access the data. The server updates the access data in real time according to the data linked list storing the tag class variables refreshed in real time by the real-time database. When the client sends a request to the server, the HTTPS protocol is used instead of the HTTP protocol, and a secure connection request is included in the request to inform the server that the request needs to be encrypted and decrypted using the SSL / TLS protocol. The server determines whether the HTTPS protocol is currently supported. If it is supported, a digital certificate containing the server public key and the certificate issuing authority information is returned, and a digital certificate for proving the identity of the server and the validity of the certificate is issued by a trusted third-party organization. The client verifies the validity of the digital certificate, and the validity includes data information such as whether the certificate is expired and whether the certificate issuing authority is credible. Exemplarily, when the digital certificate is verified, the client will use the public key therein to establish a secure connection. After establishing a secure connection with the server, the client generates a session key for negotiating parameters such as the encryption algorithm and key length. The client encrypts the session key using the server public key and sends the encrypted session key to the server. The server decrypts the session key using its own private key and uses the session key to negotiate the encryption algorithm, key length and other parameters. The returned result content is encrypted and transmitted. After establishing a secure connection and completing the negotiation process, the client and server will communicate using the negotiated encryption algorithm and master key to ensure the security of data during transmission.

[0019] Step 3: Implement the data encryption and decryption interaction between the configuration software and the process operation station by calling the data interface dynamic link library, and establish the communication between the configuration software and the real-time database; In the embodiment of the present invention, the operation server broadcasts the encrypted and decrypted real-time data to the configuration terminal for data display. The server sends the command to the operation server through the TCP protocol. The various software processes of the configuration end use a shared memory method to realize data interaction between the processes. Specifically, the ontology model is constructed for the information data contained in the standard of each process, and the similarity value of the concepts between different ontologies is calculated by the matching algorithm of the ontology model to obtain similar concepts between different ontology models. A mapping relationship between the configuration end and the data standard between the processes is established. According to the mapping relationship, the format of the configuration end is converted into the standard format, and the interaction between the configuration program and the data is completed. Exemplarily, during the data interaction process, an encryption method is selected according to the configuration project file encryption algorithm. The configuration project file is exported in ciphertext form, that is, encrypted into a ciphertext file to form a character string in garbled form. All encryption program information is placed in the configuration information, including basic information of the encryption program and information on the encryption method. The content of the program includes plain text and encrypted ciphertext, which are stored in the main body of the program. Then, the corresponding key is determined through the ECC algorithm, and then the corresponding session key is determined through the key negotiation mechanism, and the public-private key pair is determined. A specific mapping processing identification ID is performed to determine the interactive public-private key between the server and the client. For the communication protocol between the industrial control system configuration software and the real-time database, data encryption is performed at the edge of the industrial control system, and the communication between the client and the server is encrypted and transmitted, thereby ensuring the communication security of the industrial control equipment data transmitted to the server.

[0020] Step 4: The configuration end downloads the configuration project file and control logic file to the computing server through FTP, and performs encryption and decryption between the computing server and the configuration end to achieve secure data transmission; In the embodiment of the present invention, the client and the server randomly generate their own private keys and notify each other, and then combine the two private keys into a master key through an algorithm, and then realize data security transmission through encryption and decryption; specifically, by setting up a blacklist and a whitelist, only the clients on the whitelist can establish a connection with the server and transmit data, and unknown clients are added to the blacklist. After the server receives the data and decrypts it, it compares the data with the standard format, and can save and use the data if it passes the verification, and then generates a secret key algorithm to write it to the server and the client, and all data is transmitted through DES encryption; Exemplarily, the client sends a control message of a code ID with the client's identity information to the server. The server receives the message and verifies whether the code ID is in the whitelist. When it is determined that the code ID is not in the whitelist, the code ID is added to the blacklist. When it is determined that the code ID is in the whitelist, the server establishes a connection with the client, randomly generates a private key on the server side and sends it to the client through the server. The client saves the received private key and randomly generates a private key on the client side. The client that successfully establishes a connection with the server sends a message containing the private key generated by the client. The server generates a master key through an algorithm, and then the server sends The client sends a message for the first time, notifying the client that the master key has been generated. The client uses the saved server private key and its own randomly generated client private key, and also generates a master key through an algorithm. An encrypted channel between the client and the server is generated for data transmission. The client further sends a second message. The message content is fixed-format data encrypted by DES using the master key generated by itself. The server receives the message and decrypts it with DES using the master key generated by itself, and then verifies the format of the decrypted data. When the format is verified to be correct, the data is saved or responded to. When the format verification is incorrect, the data is discarded and the ID of this client is added to the blacklist.

[0021] Embodiment 2: Embodiment 2 of the present invention provides a secure transmission system based on data encryption. Figure 2 A schematic diagram of the module composition of a secure transmission system based on data encryption provided in the second embodiment of the present invention is shown in FIG. Figure 2 As shown, the system includes: The login data encryption and decryption module is used to encrypt and decrypt the registration login data according to the user login scenario in the configuration environment; The interactive data encryption and decryption module is used to encrypt and decrypt data between the user and the industrial control terminal in client and server mode; The data security transmission module is used to encrypt and decrypt data between the computing server and the configuration end to achieve secure data transmission.

[0022] In some embodiments of the present invention, the login data encryption and decryption module includes: Configuration engineering file module, used to provide configuration engineering files to users by using configuration functions in industrial control systems; User registration and login module, used for users to register and log in from the configuration environment configured in the project file; The encryption and decryption operation module is used to add the configuration engineering password to the encryption and decryption operation of the data; The user identity authentication module is used to configure the system to verify the user's identity by determining whether the generated original random number is consistent with the received decrypted random number.

[0023] In some embodiments of the present invention, the interactive data encryption and decryption module includes: A configuration interface connection module is used to connect the original configuration program and the application program through the configuration interface; The server access module is used by the client to trigger the server's callback function to access data based on the service request and IP address search received by the server; The process data interaction module is used to implement data interaction between various software processes on the configuration end by using shared memory; The encryption mode selection module is used to select the encryption mode according to the configuration project file encryption algorithm during data interaction.

[0024] In some embodiments of the present invention, the data security transmission module includes: A black and white list establishment module is used to perform data transmission between the server and the client by establishing a black and white list; The message verification module is used for the client to send a control message with a code ID containing the client's identity information to the server for identity verification; The DES encryption transmission module is used to encrypt all data in the black and white list judgment mode through DES and then transmit it.

[0025] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0026] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A secure transmission system based on data encryption, comprising a login data encryption and decryption module, an interactive data encryption and decryption module, and a data secure transmission module, characterized in that: The login data encryption and decryption module is used to encrypt and decrypt the registration login data according to the user login scenario in the configuration environment; the interactive data encryption and decryption module is used to use the client and server mode to perform the interaction of encrypted data and decrypted data between the user and the industrial control terminal; The data security transmission module is used to perform encryption and decryption between the computing server and the configuration terminal to achieve data security transmission.

2. A secure transmission system based on data encryption according to claim 1, characterized in that: The login data encryption and decryption module includes: a configuration project file module, a user registration and login module, an encryption and decryption operation module, and a user identity authentication module. The configuration project file module is used to provide configuration project files to users using the configuration function in the industrial control system; the user registration and login module is used for users to register and log in from the configuration environment configured in the project file; the encryption and decryption operation module is used to add the configuration project password to the encryption and decryption operation of the data; the user identity authentication module is used for the configuration system to verify the identity of the user by judging whether the generated original random number value is consistent with the received decrypted random number.

3. A secure transmission system based on data encryption according to claim 2, characterized in that: The interactive data encryption and decryption module includes: a configuration interface connection module, a server access module, a process data interaction module, and an encryption method selection module, wherein the configuration interface connection module is used to connect the original configuration program and the application program through the configuration interface; the server access module is used for the client to trigger the server's callback function to access data according to the service request and IP address search received by the server; the process data interaction module is used to realize data interaction between various software processes on the configuration end by using a shared memory method; the encryption method selection module is used to select an encryption method according to the configuration project file encryption algorithm during the data interaction process.

4. A secure transmission system based on data encryption according to claim 3, characterized in that: The data security transmission module includes: a black and white list establishment module, a message verification and judgment module, and a DES encryption transmission module, wherein the black and white list establishment module is used to transmit data between the server and the client by establishing a black and white list; the message verification and judgment module is used for the client to send a control message with a code ID containing the client's identity information to the server for identity verification and judgment; the DES encryption transmission module is used to encrypt all data in the black and white list judgment mode through DES and then transmit it.

5. A secure transmission system based on data encryption according to claim 4, characterized in that: The specific operation method steps of the system include: Step 1: Encrypt and decrypt the registration and login data according to the user login scenario in the configuration environment; Step 2: Use client and server mode to exchange encrypted and decrypted data between the user and the industrial control terminal; Step 3: Implement the data encryption and decryption interaction between the configuration software and the process operation station by calling the data interface dynamic link library, and establish the communication between the configuration software and the real-time database; Step 4: The configuration end downloads the configuration project files and control logic files to the computing server via FTP, and performs encryption and decryption between the computing server and the configuration end to achieve secure data transmission.

6. A secure transmission system based on data encryption according to claim 5, characterized in that: The steps of encrypting and decrypting the registration and login data include: the configuration function in the industrial control system provides the user with a configuration project file, the configuration function includes the function entity of the server calling the secondary development interface function and the header file of the related structure, the user registers and logs in from the configuration environment configured in the project file, and directly calls the function entity and the related structure in the header file in the project to complete the application of the user program end, based on the registered user, the verification code is transmitted to the back end for storage by inputting, and then the user login relies on the front end to input the password and transmit it to the back end for verification, the user's instruction operation is implemented and transmitted to the back end for verification, after the server receives the request submitted by the user, according to the user name in the request data, the corresponding user's identity is taken out from the database to generate a string of random numbers, the generated random number is encrypted using the public key corresponding to the user identity, and the encryption result is returned to the client.

7. A secure transmission system based on data encryption according to claim 6, characterized in that: The process of encrypting and decrypting the registration login data also includes: for the password transmission and storage process involved in the login scenario, by allowing the configuration project password to participate in the data encryption and decryption operations, by appending the salt value to the password as the encryption and decryption key, the client obtains the decryption value of the encrypted result using the private key of the corresponding identifier, and submits the decryption result to the configuration system. The configuration system determines whether the user owns the private key corresponding to the identifier by judging whether the original random value it generates is consistent with the decrypted random number received, and finally determines whether the user is the true holder of the corresponding identifier to verify the user's identity. In the case where the user forgets the password when logging in, the configuration system encrypts the correct encryption key through an asymmetric algorithm and stores it in the configuration project file. When it is judged that the configuration project file is owned by the user, the server uses the private key it owns to decrypt the ciphertext and recover the user's forgotten login password.

8. A secure transmission system based on data encryption according to claim 7, characterized in that: The method for interaction of encrypted data and decrypted data between a user and an industrial control terminal includes: After the industrial control system successfully registers the service of the user in the server, the original system program and the user application are separated, and executable image files are generated respectively. The original configuration program and the application are connected through the configuration interface, and the configuration information of the industrial control system is constructed through the server mode. After receiving the configuration project file query service request after the user registration, the executable file image file is divided into the specified partition and located at the specified physical address of the storage. When the client searches and connects to the industrial control system according to the service request and IP address received by the server, the callback function of the server is triggered to access the data. The server updates the access data in real time according to the data linked list of the tag class variables stored in the real-time database refreshed in real time. When the client sends a request to the server, the HTTPS protocol is used instead of the HTTP protocol, and a secure connection request is included in the request to inform the server that the request needs to be encrypted and decrypted using the SSL / TLS protocol. The server determines whether the HTTPS protocol is currently supported. If it is supported, a digital certificate containing the server public key and the certificate authority information is returned. A trusted third-party organization is used to issue a digital certificate for proving the identity of the server and the validity of the certificate. The client verifies the validity of the digital certificate, and the validity includes data information such as whether the certificate is expired and whether the certificate authority is credible. When the digital certificate is verified, the client will use the public key in it to establish a secure connection. After establishing a secure connection with the server, the client generates a session key for negotiating encryption algorithm and key length parameters. The client encrypts the session key with the server public key and sends the encrypted session key to the server. The server decrypts the session key with its own private key and uses the session key to negotiate encryption algorithm, key length and other parameters. The returned result content is encrypted and transmitted. After establishing a secure connection and completing the negotiation process, the client and server will communicate using the negotiated encryption algorithm and master key to ensure the security of data during transmission.

9. A secure transmission system based on data encryption according to claim 8, characterized in that: The method for establishing communication between the configuration software and the real-time database comprises: The computing server broadcasts the encrypted and decrypted real-time data to the configuration terminal for data display. The server sends commands to the computing server through the TCP protocol. The various software processes on the configuration terminal use shared memory to achieve data interaction between processes. In the data interaction process, the encryption method is selected according to the configuration project file encryption algorithm, and the configuration project file is exported in ciphertext form, that is, encrypted into a ciphertext file, forming a string in the form of garbled code; All encryption program information is placed in the configuration information, including the basic information of the encryption program and the information of the encryption method. The program content includes plain text and encrypted ciphertext, which are stored in the main part of the program. Then the corresponding key is determined through the ECC algorithm, and then the corresponding session key is determined through the key negotiation mechanism, and the public and private key pair is determined, and a specific mapping processing identification ID is performed to determine the interactive public and private keys between the server and the client; According to the communication protocol between the configuration software of the industrial control system and the real-time database, data encryption is performed at the edge of the industrial control system, and the communication between the client and the server is encrypted and transmitted.

10. A secure transmission system based on data encryption according to claim 9, characterized in that: The steps of encrypting and decrypting data between the computing server and the configuration terminal to achieve secure data transmission include: The client and server randomly generate their own private keys and notify each other. The two private keys are combined into a master key through an algorithm, and then data is securely transmitted through encryption and decryption. By setting up a blacklist and whitelist, only clients on the whitelist can establish a connection with the server and transmit data. Unknown clients are added to the blacklist. After the server receives the data and decrypts it, it compares the data with the standard format. If the data passes the verification, it can be saved and used. Then a secret key algorithm is generated and written to the server and client, and all data is transmitted using DES encryption.

Images