A secure transmission system based on data encryption

Abstract

The application discloses a kind of based on data encryption's secure transmission system, including login data encryption decryption module, interactive data encryption decryption module, data security transmission module, and including the specific operation method steps of the system: step one: for the login scene of user in configuration environment, registration login data is encrypted and decrypted;Step two: using client and server mode carries out the interaction of encrypted data and decrypted data between user and industrial control terminal;Step three: the data encryption decryption interaction between configuration software and process operation station is realized by calling data interface dynamic link library, and the communication between configuration software and real-time database is established;Step four: configuration end downloads configuration engineering file, control logic file to operation server by FTP, and realizes data security transmission between operation server and configuration end by encryption, decryption;The application has the characteristics of improving physical security and guaranteeing real-time transmission security.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data encryption, in particular to a secure transmission system based on data encryption. BACKGROUND

[0002] In an industrial control system, in order to prevent other personnel from modifying the configuration engineering file, many configuration software supports encrypting the configuration engineering file, when opening a configuration engineering file with a password, the correct password must be inputted to view and edit the configuration engineering file, otherwise it cannot be opened, thereby realizing the security management of the configuration engineering file in the industrial control system, but most of the configuration software with vulnerabilities only compares the user inputted password with the real password, without using the inputted password to encrypt and decrypt the configuration engineering file, which leads to that no matter what password is inputted, the key jump statement can be found through reverse means, the instruction is modified to make the verification process always go to the correct branch, for this kind of security problem, the existing system can only solve the problem by spending a lot of time and effort to redesign the encryption mechanism, and needs to urge users to use the update patch, so that the risk of user data is increased and the service provider needs to invest more resources and operating costs to repair the vulnerability. Therefore, it is necessary to design a secure transmission system based on data encryption to improve physical security and ensure real-time transmission security. SUMMARY

[0003] The present application aims to provide a secure transmission system based on data encryption to solve the problems in the background art.

[0004] In order to solve the above technical problems, the present application provides the following technical scheme: a secure transmission system based on data encryption, comprising a login data encryption and decryption module, an interactive data encryption and decryption module, and a data security transmission module, characterized in that: the login data encryption and decryption module is used for encrypting and decrypting the registration login data for the user's login scene in the configuration environment; the interactive data encryption and decryption module is used for encrypting and decrypting the data interaction between the user and the industrial control terminal in the client and server mode; and the data security transmission module is used for encrypting and decrypting the data security transmission between the operation server and the configuration terminal.

[0005] According to the technical scheme, the login data encryption and decryption module comprises a configuration engineering file module, a user registration and login module, an encryption and decryption operation module, and a user identity verification module; the configuration engineering file module is configured to provide a configuration engineering file to a user by using a configuration function in an industrial control system; the user registration and login module is configured to enable a user to register and log in from a configuration environment configured by the engineering file; the encryption and decryption operation module is configured to add a configuration engineering password to encryption and decryption operation of data; and the user identity verification module is configured to verify the identity of the user by judging whether the generated original random number value is consistent with the received decrypted random number.

[0006] According to the technical scheme, the interactive data encryption and decryption module comprises a configuration interface connection module, a server access module, a process data interaction module, and an encryption mode selection module; the configuration interface connection module is configured to connect an original configuration program and an application program through a configuration interface; the server access module is configured to trigger a callback function of a server to access data according to a service request and an IP address searched by a server end; the process data interaction module is configured to realize data interaction between processes by using a shared memory between various software processes of the configuration end; and the encryption mode selection module is configured to select an encryption mode according to a configuration engineering file encryption algorithm during data interaction.

[0007] According to the technical scheme, the data security transmission module comprises a black and white list setting module, a message verification and judgment module, and a DES encryption transmission module; the black and white list setting module is configured to perform data transmission between a server and a client by setting a black and white list; the message verification and judgment module is configured to perform identity verification and judgment by sending a control message with a code ID of client identity information to the server by the client; and the DES encryption transmission module is configured to perform transmission by encrypting all data in the black and white list judgment mode by using DES.

[0008] According to the technical scheme, the specific operation method steps of the system comprise:

[0009] Step one: performing encryption and decryption of registration and login data for a user in a configuration environment;

[0010] Step two: performing interaction of encrypted data and decrypted data between a user and an industrial control terminal by using a client and server mode;

[0011] Step three: realizing interaction of data encryption and decryption between configuration software and a process operation station by calling a data interface dynamic link library, and establishing communication between the configuration software and a real-time database;

[0012] Step four: the configuration end downloads the configuration engineering file and control logic file to the operation server through FTP, and performs encryption and decryption between the operation server and the configuration end to realize safe data transmission.

[0013] According to the above technical solution, the step of performing encryption and decryption of registration and login data includes: the configuration function of the industrial control system provides the configuration engineering file for the user, the configuration function includes the function entity of the secondary development interface function and the header file of the related structure, the user registers and logs in from the configuration environment configured in the engineering file, directly calls the function entity and the related structure in the header file to complete the application of the user program end in the engineering, and based on the registered user, the user transmits the verification code to the back end for saving, and then the user logs in by inputting the password from the front end to the back end for verification, realizes the instruction operation of the user and transmits the instruction operation to the back end for verification, and after the server end receives the request submitted by the user, according to the username in the request data, takes out the identity of the corresponding user from the database to generate a random number, encrypts the generated random number by using the public key corresponding to the user identity, and returns the encryption result to the client end.

[0014] According to the above technical solution, in the process of performing encryption and decryption of registration and login data, the password transmission and storage process involved in the login scene is also included, the configuration engineering password is involved in the encryption and decryption operation of data, the salt value is appended to the password as the encryption and decryption key, the client end obtains the decryption result of the encrypted result by using the private key corresponding to the identity, and submits the decryption result to the configuration system, the configuration system judges whether the original random number value generated by the configuration system is consistent with the decrypted random number received, to judge whether the user has the private key corresponding to the identity, finally determines whether the user is the real holder of the corresponding identity, realizes the verification of the user identity, and for the case that the user forgets the password during login, the configuration system encrypts the correct encryption key into the configuration engineering file through the asymmetric algorithm, when it is proved that the configuration engineering file belongs to the user, the server end uses the private key to decrypt the ciphertext, and restores the forgotten login password of the user.

[0015] According to the above technical solution, the method for the user and the industrial control terminal to interact with the encrypted data and decrypted data includes:

[0016] After the user's service registration in the server is successful, the industrial control system separates the original program from the user's application program, generates executable image files respectively, connects the original configuration program and the application program through the configuration interface, constructs the configuration information of the industrial control system through the server mode, divides the executable file image file into specified partitions and locates it at a specified memory physical address after receiving the configuration engineering file query service request after the user's registration, searches and connects to the industrial control system according to the service request and IP address received by the server end, triggers the callback function of the server to access data, and the server updates the data in real time according to the data linked list of the real-time database real-time refresh storage tag variable, and the client sends a request to the server by using the HTTPS protocol instead of the HTTP protocol, and includes a secure connection request in the request, which informs the server that the request needs to be encrypted and decrypted using the SSL / TLS protocol, the server judges whether the HTTPS protocol is supported at the moment, returns a digital certificate containing the server public key and certificate authority information when the HTTPS protocol is supported, and uses a trusted third-party agency to issue a digital certificate for proving the identity of the server and the validity of the certificate, and the client verifies the validity of the digital certificate, which includes whether the certificate is expired and whether the certificate authority is trusted data information;

[0017] When the digital certificate is verified, the client uses the public key in it to establish a secure connection, and after the secure connection with the server is established, the client generates a session key for negotiating the encryption algorithm and the key length, the client encrypts the session key using the server public key, and sends the encrypted session key to the server, the server decrypts the session key using its own private key, and uses the session key to negotiate the encryption algorithm, the key length and other parameters, and transmits the encrypted return result content, after the secure connection is established and the negotiation process is completed, the client and the server will use the negotiated encryption algorithm and master key to communicate, ensuring the security of the data in the transmission process.

[0018] According to the above technical scheme, the method for establishing communication between the configuration software and the real-time database comprises:

[0019] The operation server broadcasts the encrypted real-time data to the configuration terminal for data display, the server sends commands to the operation server through the TCP protocol, and the software processes of the configuration terminal realize data interaction between processes in the form of shared memory;

[0020] In the data interaction process, the encryption method is selected according to the configuration engineering file encryption algorithm, the configuration engineering file is exported in the form of ciphertext, that is, encrypted into a ciphertext file, and a string in the form of random code is formed;

[0021] All the encryption program information is placed in the configuration information, including the basic information of the encryption program and the information of the encryption mode, the content of the program including the plaintext and the ciphertext formed by the encryption, and the ciphertext is stored in the main part of the program;

[0022] Then the corresponding key is determined through the ECC algorithm, then the corresponding session key is determined through the key negotiation mechanism, and the public and private key pairs are determined, the specific mapping processing identification ID is performed, so that the interactive public and private keys of the server and the client are determined;

[0023] For the communication protocol between the configuration software of the industrial control system and the real-time database, data encryption is performed at the edge of the industrial control system, and the communication between the client and the server is encrypted and transmitted.

[0024] According to the above technical scheme, the step of realizing data security transmission through encryption and decryption between the operation server and the configuration end includes:

[0025] The client and the server randomly generate their own private keys and notify each other, combine the two private keys into a master key through an algorithm, and realize data security transmission through encryption and decryption;

[0026] By setting up a white list, only the client on the white list can establish a connection with the server and transmit data, unknown clients are pulled into the black list, the server compares the data with the standard format after decrypting the data, and the data is verified to be saved for use, then a secret key algorithm is generated and written into the server and the client, and all data is transmitted through DES encryption.

[0027] Compared with the prior art, the beneficial effects achieved by the present application are: the present application, by aiming at the login scene of the user in the configuration environment, performs encryption and decryption of the registration login data, adopts the client and server mode to interact between the encrypted data and the decrypted data between the user and the industrial control terminal; the data encryption and decryption interaction between the configuration software and the process operation station is realized by calling the data interface dynamic link library, the communication between the configuration software and the real-time database is established, the configuration engineering file and the control logic file are downloaded to the operation server through FTP by the configuration end, the data security transmission between the operation server and the configuration end is realized through encryption and decryption, and the transmission security of the user identity verification and the interactive data in the configuration software is improved. BRIEF DESCRIPTION OF DRAWINGS

[0028] The accompanying drawings are used to provide a further understanding of the present application, and constitute a part of the specification, together with the embodiments of the present application, to explain the present application, and do not constitute a limitation on the present application. In the drawings:

[0029] Figure 1 A flowchart of a secure transmission method based on data encryption is provided for the first embodiment of the present application;

[0030] Figure 2 A module composition schematic diagram of a secure transmission system based on data encryption provided for the second embodiment of the present application. DETAILED DESCRIPTION

[0031] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the present application.

[0032] Embodiment one: Figure 1 A flowchart of a secure transmission method based on data encryption provided for the first embodiment of the present application. The present embodiment can be applied to the scene of data encryption. The method can be executed by a secure transmission system based on data encryption provided by the present embodiment. As shown in the figure, the method specifically includes the following steps: Figure 1

[0033] Step one: For the login scene of the user in the configuration environment, the registration and login data are encrypted and decrypted.

[0034] In the embodiments of the present application, the configuration function in the industrial control system provides the configuration engineering file for the user. The configuration function includes the function entity of the secondary development interface function and the header file of the related structure. The user registers and logs in the configuration environment configured from the engineering file. The function entity and the related structure in the header file are directly called in the engineering to complete the application of the user program end. Based on the registered user, the verification code is input and transmitted to the back end for saving. Then the user logs in by inputting the password from the front end to the back end for verification. The instruction operation of the user is realized and transmitted to the back end for verification. After the server end receives the request submitted by the user, a string of random numbers is generated according to the username in the request data, the corresponding public key of the user identification is used to encrypt the generated random numbers, and the encryption result is returned to the client end.

[0035] ​For example, for the password transmission and storage process involved in the login scenario, by letting the configuration engineering password participate in the encryption and decryption operation of data, by appending the salt value to the password as the encryption and decryption key, the client obtains the private key corresponding to the identifier, decrypts the encrypted result, and submits the decryption result to the configuration system, the configuration system judges whether the original random number value generated by it is consistent with the decrypted random number received to judge whether the user has the private key corresponding to the identifier, and finally determines whether the user is the real holder of the corresponding identifier, realizes the verification of the user identity, and for the case that the user forgets the password, the configuration system stores the correct encryption key in the configuration engineering file by asymmetric algorithm, when it is proved that the configuration engineering file belongs to the user, the server uses the private key to decrypt the ciphertext, and restores the forgotten login password of the user.

[0036] Step two: adopt the client and server mode to interact the encrypted data and decrypted data between the user and the industrial control terminal;

[0037] In the embodiment of the present application, after the user's service registration in the server is successful, the system original program and the user application program are separated, executable image files are generated respectively, and the original configuration program and the application program are connected through the configuration interface, the configuration information of the industrial control system is constructed through the server mode, after receiving the configuration engineering file query service request after the user registration, the executable file image file is divided into specified partitions and located at the specified memory physical address, when the client searches and connects to the industrial control system according to the service request and IP address received by the server end, the callback function of the server is triggered to access the data, the server accesses the real-time update of the data according to the real-time database real-time refreshing data link table of the storage label variable, when the client sends a request to the server, HTTPS protocol is used instead of HTTP protocol, and a secure connection request is included in the request, which tells the server that the request needs to be encrypted and decrypted using SSL / TLS protocol, the server judges whether HTTPS protocol is supported at present, returns a digital certificate containing server public key and certificate authority information when it is supported, and uses the digital certificate issued by a trusted third-party institution to prove the identity of the server and the validity of the certificate, the client verifies the validity of the digital certificate, and the validity includes whether the certificate is expired and whether the certificate authority is trusted data information.

[0038] Exemplarily, when the digital certificate is verified, the client uses the public key therein to establish a secure connection, after the secure connection is established with the server, the client generates a session key for negotiating parameters of an encryption algorithm and a key length, the client encrypts the session key using the server public key, and sends the encrypted session key to the server, the server decrypts the session key using its own private key, and uses the session key to negotiate the encryption algorithm, the key length and other parameters, and transmits the encrypted return result content, after the secure connection is established and the negotiation process is completed, the client and the server use the negotiated encryption algorithm and the master key to communicate, so as to ensure the security of data in the transmission process.

[0039] Step three: the data encryption and decryption interaction between the configuration software and the process operation station is realized by calling the data interface dynamic link library, and the communication between the configuration software and the real-time database is established;

[0040] In the embodiment of the application, the operation server broadcasts the encrypted and decrypted real-time data to the configuration terminal for data display, the server sends commands to the operation server through the TCP protocol, the software processes of the configuration terminal realize data interaction between the processes in a shared memory mode, specifically, the information data contained in the standards of the processes are respectively subjected to ontology model construction, the similarity values of concepts between different ontologies are calculated through the matching algorithm of the ontology model, the similar concepts between different ontology models are obtained, the mapping relationship between the data standards of the configuration terminal and the processes is established, the format of the configuration terminal is converted into a standard format according to the mapping relationship, and the interaction of the configuration program and the data is completed;

[0041] Exemplarily, in the data interaction process, the encryption mode is selected according to the configuration engineering file encryption algorithm, the configuration engineering file is exported in the form of ciphertext, that is, the configuration engineering file is encrypted into a ciphertext file to form a string in the form of random code, all the encrypted program information is placed in the configuration information, including the basic information of the encrypted program and the information of the encryption mode, the content of the program includes plaintext and ciphertext formed by encryption, and the plaintext and the ciphertext are stored in the main part of the program, then the corresponding key is determined through the ECC algorithm, then the corresponding session key is determined through the key negotiation mechanism, and the public and private key pairs are determined, specific mapping processing identification ID is performed, so that the interaction public and private keys of the server and the client are determined, the communication protocol between the industrial control system configuration software and the real-time database is encrypted at the edge of the industrial control system, the communication between the client and the server is encrypted and transmitted, so that the communication security of the industrial control equipment data transmitted to the server end is ensured.

[0042] Step four: the configuration terminal downloads the configuration engineering file and the control logic file to the operation server through FTP, and realizes data security transmission through encryption and decryption between the operation server and the configuration terminal;

[0043] In the embodiment of the present application, the client and the server randomly generate respective private keys and notify each other, combine the two private keys into a master key through an algorithm, and realize data secure transmission through encryption and decryption; specifically, by setting up a white list and a black list, only the clients on the white list can establish a connection with the server and perform data transmission, unknown clients are pulled into the black list, the server compares the data after decryption with the standard format, and if the verification is passed, the data can be saved for use, then a secret key algorithm is generated and written into the server and the client, and all data is transmitted through DES encryption;

[0044] For example, the client sends a control message with the code ID of the client identity information to the server, the server receives the message and judges whether the code ID is on the white list, when judging that the code ID is not on the white list, the code ID is listed in the black list, when judging that the code ID is on the white list, the server establishes a connection with the client, randomly generates a private key of the server side and sends it to the client, the client saves the received private key and randomly generates a private key of the client side, the client that successfully establishes a connection with the server sends a message, the message contains the private key generated by the client, the server generates a master key through an algorithm, then the server sends a message to the client for the first time, notifying the client that the master key has been generated, the client generates a master key through an algorithm using the saved private key of the server side and the randomly generated private key of the client side, the encryption channel of the client and the server is generated, and data transmission is performed; the client further sends a message for the second time, the message content is fixed format data encrypted by the master key generated by the client, the server receives the message and performs DES decryption through the master key generated by the server, and then verifies the format of the decrypted data, when the format is correct, the data is saved or used, when the format is incorrect, the data is discarded, and the ID of the client is pulled into the black list.

[0045] Embodiment two: the embodiment two of the present application provides a secure transmission system based on data encryption, Figure 2 For the module composition schematic diagram of the secure transmission system based on data encryption provided by the embodiment two of the present application, as Figure 2 shown, the system comprises:

[0046] The login data encryption and decryption module is used for encrypting and decrypting the registration login data in the login scene of the user in the configuration environment;

[0047] The interactive data encryption and decryption module is used for the encryption data and decryption data interaction between the user and the industrial control terminal in the client and server mode;

[0048] The data security transmission module is used for encryption and decryption between the operation server and the configuration end to realize data secure transmission.

[0049] In some embodiments of the present application, the login data encryption and decryption module comprises:

[0050] The configuration engineering file module is configured to provide a configuration engineering file to a user by using a configuration function in the industrial control system.

[0051] The user registration and login module is configured to register and log in a user from a configuration environment configured by the engineering file.

[0052] The encryption and decryption operation module is configured to add the configuration engineering password into the encryption and decryption operation of the data.

[0053] The user identity verification module is configured to verify the identity of the user by judging whether the generated original random number value is consistent with the received decrypted random number.

[0054] In some embodiments of the present application, the interactive data encryption and decryption module comprises:

[0055] The configuration interface connection module is configured to connect the original configuration program and the application program through the configuration interface.

[0056] The server access module is configured to search the server according to the service request and the IP address received by the server end, trigger the callback function of the server to access the data.

[0057] The process data interaction module is configured to realize the data interaction between the processes by using the shared memory between the software processes of the configuration end.

[0058] The encryption mode selection module is configured to select the encryption mode according to the configuration engineering file encryption algorithm in the data interaction process.

[0059] In some embodiments of the present application, the data security transmission module comprises:

[0060] The black and white list setting module is configured to transmit the data between the server and the client by setting the black and white list.

[0061] The message verification and judgment module is configured to send the control message with the code ID of the client identity information to the server to verify and judge the identity of the client.

[0062] The DES encryption transmission module is configured to transmit all the data in the black and white list judgment mode by DES encryption.

[0063] It is to be noted that, in the present text, relational terms such as first and second and the like can be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0064] Finally, it should be noted that the above-mentioned only constitutes the preferred embodiments of the present application and is not intended to limit the present application. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art will appreciate that modifications can be made to the technical solutions described in the foregoing embodiments, or equivalent replacements can be made to some of the technical features. Any modifications, equivalent replacements, improvements, and the like made within the spirit and principle of the present application shall fall within the scope of the protection of the present application.

Claims

1. A secure transmission system based on data encryption, comprising a login data encryption and decryption module, an interactive data encryption and decryption module, and a data secure transmission module, characterized in that: The login data encryption and decryption module is configured to encrypt and decrypt registration login data for a login scenario of a user in a configuration environment; and the interactive data encryption and decryption module is configured to use a client and server mode to interact with encrypted data and decrypted data between the user and the industrial control terminal. The data security transmission module is configured to encrypt and decrypt to achieve data security transmission between the operation server and the configuration terminal. The specific operation method of the secure transmission system includes the following steps: Step one: encrypt and decrypt registration login data for a login scenario of a user in a configuration environment; including: the configuration function of the industrial control system provides a configuration engineering file to the user, the configuration function includes a function entity of a secondary development interface function and a header file of a related structure, the user registers and logs in from a configuration environment configured in the engineering file, directly calls the function entity and the related structure in the header file to complete the application of the user program terminal in the engineering, inputs a verification code to the backend based on the registered user to save, then logs in by inputting a password from the front end to the backend for verification, realizes the instruction operation of the user and transmits it to the backend for verification, and the server receives the request submitted by the user, generates a random number according to the username in the request data, encrypts the random number using the public key corresponding to the user identifier, and returns the encryption result to the client; For the password transmission and storage process involved in the login scenario, the configuration engineering password is involved in the encryption and decryption operation of the data, the salt value is appended to the password as the encryption and decryption key, the decrypted result is submitted to the configuration system after the client obtains the private key corresponding to the identifier and decrypts the encrypted result, the configuration system judges whether the original random number value generated by it is consistent with the decrypted random number received to determine whether the user has the private key corresponding to the identifier, and finally determines whether the user is the real holder of the identifier, realizes the verification of the user identity, and for the case that the user forgets the password, the configuration system encrypts the correct encryption key into the configuration engineering file through the asymmetric algorithm, and when it is proved that the configuration engineering file belongs to the user, the server uses the private key to decrypt the ciphertext to restore the forgotten login password of the user; Step two: use a client and server mode to interact with encrypted data and decrypted data between the user and the industrial control terminal; Step three: call the data interface dynamic link library to realize the interaction of data encryption and decryption between the configuration software and the process operation station, and establish communication between the configuration software and the real-time database; Step four: the configuration terminal downloads the configuration engineering file and the control logic file to the operation server through FTP to encrypt and decrypt to achieve data security transmission between the operation server and the configuration terminal.

2. The secure transmission system based on data encryption according to claim 1, characterized in that: The login data encryption and decryption module comprises a configuration engineering file module, a user registration and login module, an encryption and decryption operation module, and a user identity verification module.

3. The secure transmission system based on data encryption according to claim 2, characterized in that: The interactive data encryption and decryption module comprises a configuration interface connection module, a server access module, a process data interaction module, and an encryption mode selection module.

4. The secure transmission system based on data encryption according to claim 3, characterized in that: The data security transmission module comprises a black and white list setting module, a message verification and judgment module, and a DES encryption transmission module.

5. The secure transmission system based on data encryption according to claim 1, characterized in that: The method for the interactive encryption data and decryption data between the line user and the industrial control terminal comprises: After the user's service registration in the server is successful, the industrial control system separates the original program from the user's application program, generates executable image files respectively, connects the original configuration program and the application program through the configuration interface, constructs the configuration information of the industrial control system through the server mode, divides the executable file image file into the specified partition and locates it at the specified memory physical address after receiving the configuration engineering file query service request of the user after registration, searches and connects to the industrial control system according to the service request and IP address received by the server end, triggers the callback function of the server to access data, and updates the data in real time according to the data linked list of the stored label type variable refreshed by the real-time database, and sends a request to the server by using the HTTPS protocol instead of the HTTP protocol, and includes a secure connection request in the request, which informs the server that the request needs to be encrypted and decrypted using the SSL / TLS protocol, the server judges whether the HTTPS protocol is supported at the moment, returns a digital certificate containing the server public key and certificate authority information if the HTTPS protocol is supported, and uses a trusted third-party agency to issue a digital certificate for proving the identity of the server and the validity of the certificate, and the client verifies the validity of the digital certificate, including whether the certificate is expired and whether the certificate authority is trusted data information; When the digital certificate is verified, the client uses the public key in it to establish a secure connection, generates a session key for negotiating encryption algorithm and key length after establishing a secure connection with the server, encrypts the session key using the server public key, and sends the encrypted session key to the server, decrypts the session key using its own private key, and uses the session key to negotiate encryption algorithm, key length and other parameters, encrypts the return result content and transmits it, after establishing a secure connection and completing the negotiation process, the client and the server will use the negotiated encryption algorithm and master key for communication to ensure the security of data in the transmission process.

6. The secure transmission system based on data encryption according to claim 5, characterized in that: The method for establishing communication between the configuration software and the real-time database comprises the following steps: The operation server broadcasts the encrypted real-time data to the configuration terminal for data display, the server sends commands to the operation server through the TCP protocol, and the software processes of the configuration terminal realize data interaction between processes by using shared memory; In the data interaction process, the encryption method is selected according to the configuration engineering file encryption algorithm, the configuration engineering file is exported in the form of ciphertext, that is, encrypted into a ciphertext file, and a string in the form of random code is formed; All encryption program information is placed in the configuration information, including the basic information of the encryption program and the information of the encryption method, the content of the program includes plaintext and ciphertext formed by encryption, and is stored in the main part of the program; Then the corresponding key is determined through the ECC algorithm, then the corresponding session key is determined through the key negotiation mechanism, and the public and private key pair is determined, the specific mapping processing identifier ID is determined, and the interaction public and private keys of the server and the client are determined; The communication protocol between the industrial control system configuration software and the real-time database is encrypted at the edge of the industrial control system, and the communication between the client and the server is encrypted and transmitted.

7. The secure transmission system based on data encryption according to claim 6, characterized in that: The step of realizing the secure transmission of data through encryption and decryption between the operation server and the configuration end comprises: The client and the server randomly generate their respective private keys and notify each other, combine the two private keys into a master key through an algorithm, and realize the secure transmission of data through encryption and decryption; Only the client on the white list can establish a connection with the server and transmit data, unknown clients are pulled into the black list, the server compares the data with the standard format after decrypting the data, and verifies that the data can be saved for use, then generates a secret key algorithm and writes it into the server and the client, and all data is transmitted through DES encryption.

Images