A method for secure storage and transmission of industrial Internet data

Abstract

The present invention discloses a method for secure storage and transmission of industrial Internet data, which relates to the technical field of data transmission. The method includes: configuring a distributed edge terminal and connecting it to the cloud; delegating an encryption module to the edge terminal, including a hash calculation unit and a public key, a private key, and a quantum key encryption block; generating pre-transmission data and performing classified encryption through the encryption module to generate secret data; determining a data network channel, transmitting secret data, and decrypting and verifying the data at the edge terminal of the destination, and receiving the original data. Thus, the technical effects of classified encryption and secure transmission of data, and improving deployment adaptability and transmission efficiency are achieved.

Description

Technical Field

[0001] The present invention relates to the field of data transmission technology, and in particular to a method for secure storage and transmission of industrial Internet data. Background Art

[0002] Industrial data often involves core corporate secrets and important production information, and its security is directly related to the company's production efficiency, economic benefits, and the stability of equipment operation. At present, the security of industrial Internet data mainly relies on traditional encryption technology and network security systems. For example, technologies based on symmetric encryption and asymmetric encryption, and blockchain technology are gradually being introduced into the industrial Internet to enhance data security through distributed ledgers and tamper-proof features. However, these technologies still have technical problems in practical applications, such as complex key management, high computing overhead, and difficulty in large-scale deployment. Summary of the invention

[0003] The present invention provides a method for secure storage and transmission of industrial Internet data to solve the technical problems in the prior art of complex key management, high computational overhead, and difficulty in large-scale deployment, thereby achieving the technical effects of classified encryption and secure transmission of data and improving deployment adaptability and transmission efficiency.

[0004] The present invention provides a method for secure storage and transmission of industrial Internet data, comprising:

[0005] A distributed edge terminal is configured for the industrial Internet, wherein the distributed edge terminal establishes a communication connection with the cloud.

[0006] An encryption module is obtained and decentralized to the distributed edge end, wherein the encryption module includes a hash calculation unit and an encryption unit, and the encryption unit includes a public key encryption block, a private key encryption block and a quantum key encryption block.

[0007] Generate pre-transmission data from the source to the destination, and based on the encryption module at the edge of the source, perform classified encryption processing on the pre-transmission data to generate confidential data, wherein the classified encryption includes public key encryption based on data summary, private key encryption based on pre-transmission data, or quantum key encryption.

[0008] Determine a data network channel from a source to a destination, transmit the secret data, perform classified decryption and data security verification based on the data summary according to an encryption module at an edge of the destination, and receive the pre-transmitted data.

[0009] In a feasible implementation, the step of obtaining the encryption module and delegating it to the distributed edge terminal includes:

[0010] Configure an encryption module architecture and delegate the encryption module architecture to the distributed edge end; the distributed edge end performs data processing training on the encryption module architecture by calling local data samples to determine N local encryption modules; transmit the N local encryption modules back to the cloud to perform module fusion and determine the encryption module; delegate the encryption module to the distributed edge end.

[0011] In a feasible implementation, the pre-transmission data is subjected to classified encryption processing, including:

[0012] For the pre-transmission data, based on the hash calculation unit, determine the data summary; transmit the data summary to the public key encryption block, perform public key distribution and encryption processing, and determine the first secret data part; for the pre-transmission data, perform encryption processing based on the encryption unit to determine the second secret data part; integrate the first secret data part and the second secret data part as the secret data.

[0013] In a feasible implementation, determining the data summary based on the hash calculation unit includes:

[0014] A hash function is established based on a one-way mapping relationship between an input data slice and an output hash value, wherein the hash function is built into the hash calculation unit; the pre-transmission data is received, data slicing is performed on the pre-transmission data based on a preset length, and a hash value is calculated based on the hash function, wherein the hash value corresponds one-to-one to the data slice; the hash values ​​are combined to determine a hash string as the data summary.

[0015] In a feasible implementation, performing encryption processing based on the encryption unit to determine the second secret data portion includes:

[0016] A data confidentiality level is set, wherein the data confidentiality level includes a first confidentiality level and a second confidentiality level; if the pre-transmitted data meets the first confidentiality level, private key distribution and encryption processing are performed based on the private key encryption block to determine the second secret data portion; if the pre-transmitted data meets the second confidentiality level, quantum key distribution and encryption processing are performed based on the quantum key encryption block to determine the second secret data portion.

[0017] In a feasible implementation, classified decryption and data security verification based on the data summary are performed according to the encryption module of the sink edge, including:

[0018] Receive the secret data, perform public key decryption to determine the data summary, and perform private key decryption to determine the pre-transmission data; transmit the pre-transmission data to the hash calculation unit, and determine the summary information by performing hash calculation; proofread the data summary and the summary information to generate a data verification result; if the data verification result is consistent, output the pre-transmission data.

[0019] In a feasible implementation manner, after receiving the pre-transmission data, the method includes:

[0020] The pre-transmitted data is received and stored at the destination edge; alternating storage rules are set between the cloud and the distributed edge, wherein alternating storage constraints are imposed on data call frequency and data novelty; and alternating storage management of data between the distributed edge and the cloud is performed based on the alternating storage rules.

[0021] In a feasible implementation, the transmitting the secret data includes:

[0022] The data network channel is for transmission from a source edge end to a destination edge end; determining the communication status of concurrent communication data and the data network channel; based on the communication status, making transmission collision decisions and misalignment avoidance decisions for the concurrent communication data, and determining a concurrent communication strategy; and performing data transmission management based on the concurrent communication strategy.

[0023] The present invention discloses a method for secure storage and transmission of industrial Internet data, including: configuring a distributed edge terminal for the industrial Internet, wherein the distributed edge terminal establishes a communication connection with the cloud; obtaining an encryption module and delegating it to the distributed edge terminal, wherein the encryption module includes a hash calculation unit and an encryption unit, and the encryption unit includes a public key encryption block, a private key encryption block and a quantum key encryption block; generating pre-transmission data from a source to a destination, and performing classified encryption processing on the pre-transmission data based on the encryption module of the source edge terminal to generate secret data. The classified encryption includes public key encryption based on a data summary, private key encryption based on pre-transmission data or quantum key encryption; determining a data network channel from the source to the destination, transmitting secret data, and performing classified decryption and security verification of the data summary according to the encryption module of the destination edge terminal, and receiving the pre-transmission data. The method for secure storage and transmission of industrial Internet data disclosed in the present invention solves the technical problems of complex key management, large computational overhead, and difficulty in large-scale deployment, and realizes the technical effects of classified encryption and secure transmission of data, and improving deployment adaptability and transmission efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A schematic diagram of a process of secure storage and transmission of industrial Internet data according to the present invention;

[0025] Figure 2 The present invention is a flowchart of obtaining an encryption module and delegating it to a distributed edge terminal in a method for secure storage and transmission of industrial Internet data. DETAILED DESCRIPTION

[0026] The technical solution provided in the embodiments of the present invention is to solve the technical problems of complex key management, large computational overhead, and difficulty in large-scale deployment in the prior art. The overall idea adopted is as follows:

[0027] First, a distributed edge terminal is configured for the industrial Internet, wherein a communication connection is established between the distributed edge terminal and the cloud; then, an encryption module is obtained and decentralized to the distributed edge terminal, wherein the encryption module includes a hash calculation unit and an encryption unit, and the encryption unit includes a public key encryption block, a private key encryption block and a quantum key encryption block; then, pre-transmission data from the source to the destination is generated, and based on the encryption module at the source edge terminal, the pre-transmission data is classified and encrypted to generate confidential data, wherein the classified encryption includes public key encryption based on data summary, private key encryption based on pre-transmission data or quantum key encryption; then, the data network channel from the source to the destination is determined, the confidential data is transmitted, and classified decryption and data security verification based on the data summary are performed according to the encryption module at the destination edge terminal, and the pre-transmission data is received.

[0028] The above technical solution will be described in detail below in conjunction with the accompanying drawings and specific implementation methods of the specification to better understand the above technical solution. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments of the present invention. It should be understood that the present invention is not limited to the example embodiments used only to explain the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. In addition, it should be noted that, for the convenience of description, only the parts related to the present invention are shown in the drawings, rather than all of them.

[0029] Embodiment 1

[0030] Figure 1 The present invention is a flowchart of a method for secure storage and transmission of industrial Internet data, wherein the method comprises:

[0031] A distributed edge terminal is configured for the industrial Internet, wherein the distributed edge terminal establishes a communication connection with the cloud.

[0032] Specifically, distributed edge refers to computing nodes deployed at industrial sites or near data sources for real-time data collection, processing, and storage. Through distributed edge, data processing can be moved from the cloud to the local to reduce latency, improve response speed, and reduce bandwidth consumption.

[0033] Specifically, according to the current industrial Internet scenario, select appropriate edge computing devices, such as industrial gateways, smart sensors, PLCs (programmable logic controllers), etc. Edge devices are used to collect data from industrial sites through local sensors and controllers, and perform preliminary pre-processing on the data, such as data filtering, compression, format conversion, etc., to reduce the amount of data transmitted to the cloud.

[0034] Specifically, the distributed edge establishes a connection with the cloud through a communication protocol to ensure secure data transmission and storage. Optional protocol standards include MQTT, CoAP, HTTPS, OPC UA, etc.

[0035] An encryption module is obtained and decentralized to the distributed edge end, wherein the encryption module includes a hash calculation unit and an encryption unit, and the encryption unit includes a public key encryption block, a private key encryption block and a quantum key encryption block.

[0036] Specifically, the encryption module includes a variety of encryption methods, corresponding to multiple encryption units, to ensure the privacy, integrity and security of the data. The encryption module includes a hash calculation unit and an encryption unit. The hash calculation unit is used to calculate the hash value of the data (such as SHA-256), thereby providing data integrity verification. The encryption module architecture design is deployed to each distributed edge terminal to ensure the security of data collection and transmission.

[0037] Specifically, the encryption unit includes multiple encryption blocks, among which the public key encryption block is used for data encryption to ensure that only users with the corresponding private key can decrypt the data; the private key encryption block is used for data decryption to ensure that the data is only available to authorized users; the quantum key encryption block is used to encrypt data using quantum key distribution (QKD) technology to enhance security against quantum computing.

[0038] In some embodiments, Figure 2 As shown, obtaining the encryption module and delegating it to the distributed edge end includes:

[0039] Configure an encryption module architecture and delegate the encryption module architecture to the distributed edge end; the distributed edge end performs data processing training on the encryption module architecture by calling local data samples to determine N local encryption modules; transmit the N local encryption modules back to the cloud to perform module fusion and determine the encryption module; delegate the encryption module to the distributed edge end.

[0040] Specifically, the encryption module architecture is configured according to the system requirements of the target industrial Internet scenario, including the selection of appropriate encryption algorithms (such as RSA, AES, etc.) and support for quantum encryption technology. Then, the configured initial encryption module (i.e., encryption module architecture) is deployed to each distributed edge terminal.

[0041] Specifically, each distributed edge device trains and optimizes the encryption module through local data samples according to its environment and data collection situation; first, the edge collects real-time data through local devices (such as sensors, PLCs, gateways, etc.), and these data will be used as data samples for training the encryption module; according to the collected data samples, the encryption module is processed and trained using the computing resources of the edge to optimize the performance and efficiency of the encryption module. The training content includes the adjustment of hash calculations and encryption algorithms, as well as the optimization of key management according to data samples; through training, the edge will obtain N local encryption modules, which can show the best encryption effect and performance in a specific data environment.

[0042] Furthermore, in order to improve the universality and reliability of the encryption module, N local encryption modules of each distributed edge terminal are integrated through the cloud to form a final standardized encryption module. The method of integrating the received N local encryption modules includes model integration, parameter adjustment, performance evaluation, etc. The encryption module obtained by integration can be deployed and used on multiple edge terminals to ensure a unified security strategy.

[0043] Specifically, the standardized encryption module that has been optimized through cloud integration will be deployed to each distributed edge terminal and undergo security testing to ensure that the module can stably and reliably perform data encryption tasks in the actual operating environment, thereby ensuring that each distributed edge terminal can independently perform data encryption and decryption operations.

[0044] Through the configuration and decentralization of the above-mentioned distributed encryption modules, it is ensured that the computing resources of each node in the Industrial Internet can optimize the encryption strategy according to the local environment, thereby improving the security of data transmission and storage, while avoiding excessive centralized computing pressure and ensuring the efficiency and scalability of the system.

[0045] Generate pre-transmission data from the source to the destination, and based on the encryption module at the edge of the source, perform classified encryption processing on the pre-transmission data to generate confidential data, wherein the classified encryption includes public key encryption based on data summary, private key encryption based on pre-transmission data, or quantum key encryption.

[0046] Specifically, the source edge first collects the data to be transmitted. This data may come from sensors, equipment, production lines or other systems to form original pre-transmission data. Then, at the source edge, an encryption module is used to classify and encrypt the data. Classification encryption refers to the use of different encryption methods based on the type, importance or confidentiality of the information, including public key encryption based on data summary, private key encryption based on pre-transmission data, and quantum key encryption.

[0047] Specifically, the data encrypted through classification is confidential data, that is, the encrypted data, including public key encrypted data based on data summary, which ensures data integrity and prevents tampering; private key encrypted data based on pre-transmitted data, which ensures the confidentiality of data during transmission; quantum key encrypted data, which ensures quantum encrypted data that is resistant to quantum computing attacks.

[0048] In some embodiments, the pre-transmission data is subjected to classified encryption processing, including:

[0049] For the pre-transmission data, based on the hash calculation unit, determine the data summary; transmit the data summary to the public key encryption block, perform public key distribution and encryption processing, and determine the first secret data part; for the pre-transmission data, perform encryption processing based on the encryption unit to determine the second secret data part; integrate the first secret data part and the second secret data part as the secret data.

[0050] Specifically, first, the pre-transmitted data is processed by a hash calculation unit (such as a hash calculation based on SHA-256 or other hash algorithms) to generate a data digest, which is a unique identifier of the original data and has a fixed size. The calculated data digest is used to verify the integrity of the data and ensure that the data has not been tampered with during transmission.

[0051] Specifically, the data summary is transmitted to a public key encryption block, which is a block that encrypts data using a public key encryption algorithm (such as RSA or elliptic curve encryption algorithm) to ensure that only the receiving end holding the corresponding private key can decrypt the data summary, thereby verifying the integrity of the data. The data obtained after public key distribution and encryption processing is the first secret data part.

[0052] Specifically, in addition to the public key encryption of the data summary, the pre-transmitted data itself also needs to be encrypted using an encryption unit (based on private key encryption or quantum key encryption) to generate a second secret data part; illustratively, if private key encryption is selected (for example, encryption using a private key in asymmetric encryption), it can be ensured that only the receiving end has the corresponding public key to decrypt the data; if quantum key encryption technology is used, the data will be encrypted using a quantum key, increasing the ability to resist quantum computing attacks.

[0053] Furthermore, the source edge integrates the data summary encrypted with the public key and the encrypted part of the pre-transmitted data, and the final secret data generated is composed of the first secret data generated by the public key encryption of the data summary and the second secret data generated by the private key encryption or quantum key encryption of the pre-transmitted data.

[0054] Through the above steps, the source edge classifies and encrypts the pre-transmitted data to generate confidential data, which includes public key encryption based on data summary and private key or quantum key encryption based on the data itself. The encrypted data finally generated can remain encrypted during the communication process to ensure the confidentiality, integrity and anti-attack capability of the data during transmission. After receiving the confidential data, the destination can decrypt and verify it according to the encryption method to ensure the security of the data.

[0055] In some implementations, determining the data digest based on the hash calculation unit includes:

[0056] A hash function is established based on a one-way mapping relationship between an input data slice and an output hash value, wherein the hash function is built into the hash calculation unit; the pre-transmission data is received, data slicing is performed on the pre-transmission data based on a preset length, and a hash value is calculated based on the hash function, wherein the hash value corresponds one-to-one to the data slice; the hash values ​​are combined to determine a hash string as the data summary.

[0057] Specifically, the hash function is built into the hash calculation unit, which can process the input data and generate the corresponding output hash value. The basic principle of the hash function is to map input data of any length (input data slice) to a hash value of fixed length (output hash value). This mapping relationship is one-way, that is, given a hash value, the original input data cannot be reversed.

[0058] Specifically, first receive the original data to be transmitted (i.e., pre-transmission data). The original data can be of any size and can contain multiple fields, texts, numbers, or other forms of data; then, slice the data according to the preset length. Each piece of data is called a data slice, and a hash function is used to process each data slice to calculate the hash value. Each data slice has a corresponding hash value; then, connect all the hash values ​​in sequence to obtain a continuous hash string. The hash string represents the unique identifier of the entire pre-transmission data, which serves as the final data summary to ensure the integrity of the data.

[0059] In some implementations, determining the second secret data portion based on the encryption processing performed by the encryption unit includes:

[0060] A data confidentiality level is set, wherein the data confidentiality level includes a first confidentiality level and a second confidentiality level; if the pre-transmitted data meets the first confidentiality level, private key distribution and encryption processing are performed based on the private key encryption block to determine the second secret data portion; if the pre-transmitted data meets the second confidentiality level, quantum key distribution and encryption processing are performed based on the quantum key encryption block to determine the second secret data portion.

[0061] Specifically, the data confidentiality level is used to classify the pre-transmitted data, that is, to divide it into different confidentiality levels according to the sensitivity of the data and the level of protection required. Exemplarily, the data confidentiality level includes the first confidentiality level and the second confidentiality level. The first confidentiality level represents a level with lower data protection requirements and is suitable for public or low-sensitivity data; the second confidentiality level represents a level with higher data protection requirements and is suitable for highly sensitive data, which requires the use of more complex and secure encryption methods.

[0062] Specifically, for data that meets the first confidentiality level, that is, the data has a low sensitivity, encryption processing is performed using a private key encryption block, including allocating an appropriate private key and using the private key to encrypt pre-transmitted data, and the encrypted second secret data portion can only be decrypted by the corresponding public key.

[0063] Specifically, for data that meets the second confidentiality level, that is, data with high sensitivity, quantum key encryption blocks are used for encryption processing, thereby providing stronger security than private key encryption. For example, keys are first distributed through quantum key exchange technology; then the pre-transmitted data is encrypted using the quantum key to generate a second secret data part. Quantum key encryption can provide extremely high anti-eavesdropping capabilities and ensure security during data transmission; in other words, the encrypted second secret data part can only be restored to the original data by decrypting it with the corresponding quantum key.

[0064] Through the above steps, different encryption methods are used according to the sensitivity of the pre-transmitted data to ensure the confidentiality of the data. For the first confidentiality level data with lower sensitivity, traditional private key encryption is used; for the second confidentiality level data with higher sensitivity, quantum key encryption is used to provide stronger security protection, thereby taking into account the processing efficiency and data security of the distributed edge.

[0065] Determine a data network channel from a source to a destination, transmit the secret data, perform classified decryption and data security verification based on the data summary according to an encryption module at an edge of the destination, and receive the pre-transmitted data.

[0066] Specifically, first, according to the communication requirements between the source (sender) and the destination (receiver), a suitable network channel is selected to transmit confidential data. Channel selection factors include network bandwidth, transmission distance and delay, channel encryption and security, transmission stability, etc.

[0067] Specifically, after the destination receives the secret data transmitted from the source through the network channel, it performs corresponding decryption and data security verification. The destination edge is equipped with an encryption module that matches the source to perform decryption operations according to the encryption method of the secret data (such as public key encryption, private key encryption or quantum key encryption).

[0068] Specifically, the destination compares the original data digest contained in the received confidential data with the newly calculated digest. If the two are consistent, it means that the data has not been tampered with, that is, the data security check has passed, the data integrity has been verified, and then the pre-transmitted data is accepted; the pre-transmitted data has been securely encrypted and decrypted, and the data integrity and security have been verified.

[0069] In some embodiments, classified decryption and data security verification based on the data summary are performed according to the encryption module of the sink edge, including:

[0070] Receive the secret data, perform public key decryption to determine the data summary, and perform private key decryption to determine the pre-transmission data; transmit the pre-transmission data to the hash calculation unit, and determine the summary information by performing hash calculation; proofread the data summary and the summary information to generate a data verification result; if the data verification result is consistent, output the pre-transmission data.

[0071] Specifically, the sink edge first receives the confidential data transmitted from the source through the data network channel, and uses the public key to decrypt the data summary (hash value) in the confidential data, that is, to decrypt the public key encrypted part of the confidential data; then, the sink edge continues to use the private key to decrypt the rest of the confidential data, and restores the original pre-transmitted data (such as device monitoring data, sensor data, etc.), that is, to decrypt the private key encrypted part of the confidential data.

[0072] Furthermore, the recovered pre-transmission data will be transmitted to the hash calculation unit, which performs a hash operation based on the received pre-transmission data and calculates new summary information (i.e., a new hash value) of the pre-transmission data through the same hash algorithm as the data digest (such as SHA256, etc.); then, the data digest obtained when the public key is decrypted is compared with the summary information generated by the hash calculation unit. If the summary values ​​are exactly the same, it means that the data has not been tampered with during the transmission process; correspondingly, if they are inconsistent, it means that the data may have been tampered with or a transmission error has occurred.

[0073] Specifically, when the data verification result is consistent, the sink edge will output the restored original data (i.e., the pre-transmitted data), that is, the sink edge can further process or store the data; through the above process, the integrity and security of the data during transmission are ensured.

[0074] In some embodiments, after receiving the pre-transmission data, the method further comprises:

[0075] The pre-transmitted data is received and stored at the destination edge; alternating storage rules are set between the cloud and the distributed edge, wherein alternating storage constraints are imposed on data call frequency and data novelty; and alternating storage management of data between the distributed edge and the cloud is performed based on the alternating storage rules.

[0076] Specifically, the received pre-transmission data is stored in a local storage system at the edge of the sink, ready for subsequent processing.

[0077] Specifically, the storage management between the distributed edge (such as the sink edge) and the cloud adopts an alternating storage rule, which makes storage decisions based on the data call frequency and data novelty. Among them, the data call frequency refers to the frequency with which the data is accessed and used. High-frequency data is more likely to be stored at the edge first to reduce latency and bandwidth pressure. Data novelty refers to the time update or freshness of the data. New data (such as real-time sensor data) needs to be stored at the edge to support instant analysis and response. Data with low data call frequency or outdated data will be transferred to the cloud to free up edge storage space, while ensuring that the cloud can centrally analyze and back up the data.

[0078] Specifically, the sink edge will periodically check the novelty and access frequency of the data according to the alternating storage rules, and automatically or according to the policy will migrate part of the data from the local to the cloud, or migrate the cloud data to the edge. For example, for the newly transmitted real-time data, a temporary storage time limit is set to measure the novelty. If the storage time limit at the sink edge exceeds the limit, the corresponding data can be stored in the cloud and the local storage space can be released. The above storage method can improve the flexibility of the system, ensure the real-time processing of key data, reduce the storage pressure at the edge, and help the cloud to centrally manage and analyze historical data.

[0079] In some embodiments, transmitting the secret data includes:

[0080] The data network channel is for transmission from a source edge end to a destination edge end; determining the communication status of concurrent communication data and the data network channel; based on the communication status, making transmission collision decisions and misalignment avoidance decisions for the concurrent communication data, and determining a concurrent communication strategy; and performing data transmission management based on the concurrent communication strategy.

[0081] Specifically, the current status of the data network channel is analyzed, including analysis of dimensions such as bandwidth utilization, transmission delay, signal strength, and network load; concurrent communication data refers to multiple data streams or data packets sent through the network channel at the same time. When multiple data streams try to pass through the same channel at the same time, collisions may occur, resulting in data loss or errors.

[0082] Specifically, collision decision involves monitoring the channel status to ensure that the channel is idle before transmission; when a collision occurs, a retransmission strategy is set to ensure reliable data transmission; priorities are assigned to different types of data to ensure that critical data is transmitted first and delays are reduced; dislocation avoidance decisions include reasonably allocating network bandwidth according to the priority of concurrent communication data, the size of data streams and transmission timeliness to avoid excessive bandwidth congestion; when the network load is high, the data transmission rate is dynamically adjusted or the transmission of certain data streams is suspended to avoid data loss or timeouts.

[0083] Through the above-mentioned communication status analysis, collision and misalignment decisions, the data transmission process can be optimized, the transmission efficiency can be improved, and the problems that may occur during the transmission process, such as collision, misalignment or overload, can be reduced.

[0084] In summary, the method for secure storage and transmission of industrial Internet data provided by the present invention has the following technical effects:

[0085] By configuring a distributed edge terminal for the industrial Internet, wherein the distributed edge terminal establishes a communication connection with the cloud; obtaining an encryption module and delegating it to the distributed edge terminal, wherein the encryption module includes a hash calculation unit and an encryption unit, and the encryption unit includes a public key encryption block, a private key encryption block, and a quantum key encryption block; generating pre-transmission data from the source to the destination, and performing classified encryption processing on the pre-transmission data based on the encryption module of the source edge terminal to generate secret data. The classified encryption includes public key encryption based on data summary, private key encryption based on pre-transmission data, or quantum key encryption; determining the data network channel from the source to the destination, transmitting secret data, and performing classified decryption and security verification of the data summary according to the encryption module of the destination edge terminal, receiving the pre-transmission data, thereby achieving the technical effect of classified encryption and secure transmission of data, improving deployment adaptability and transmission efficiency.

[0086] It should be understood that the embodiments disclosed in the present invention and the above description can enable those skilled in the art to use the present invention to implement the present invention. At the same time, the present invention is not limited to the above-mentioned embodiments. It should be understood that those skilled in the art can still modify the technical solutions recorded in the above-mentioned embodiments, or replace some of the technical features therein by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention.

Claims

1. A method for secure storage and transmission of industrial Internet data, characterized in that: The method comprises: Configuring a distributed edge terminal for the industrial Internet, wherein the distributed edge terminal establishes a communication connection with the cloud; Obtain an encryption module and delegate it to the distributed edge end, wherein the encryption module includes a hash calculation unit and an encryption unit, and the encryption unit includes a public key encryption block, a private key encryption block, and a quantum key encryption block; Generate pre-transmission data from the information source to the information destination, and perform classified encryption processing on the pre-transmission data based on the encryption module at the edge of the information source to generate secret data, wherein classified encryption refers to adopting different encryption methods according to the type, importance or confidentiality of the information, including public key encryption based on data summary, private key encryption based on pre-transmission data, or quantum key encryption; Determine a data network channel from a source to a destination, transmit the secret data, and perform classified decryption and data security verification based on a data summary according to an encryption module of the destination edge end. When the data security verification passes, the destination edge end receives the pre-transmitted data; The obtaining of the encryption module and delegating it to the distributed edge terminal includes: Configuring an encryption module architecture, and delegating the encryption module architecture to the distributed edge end; The distributed edge terminal performs data processing training on the encryption module architecture by calling local data samples to determine N local encryption modules; The N local encryption modules are transmitted back to the cloud for module fusion to determine the encryption module; The encryption module is decentralized to the distributed edge end.

2. The method for secure storage and transmission of industrial Internet data according to claim 1, characterized in that: The pre-transmission data is subjected to classified encryption processing, including: For the pre-transmission data, based on the hash calculation unit, determining the data digest; Transmitting the data summary to the public key encryption block, performing public key distribution and encryption processing, and determining the first secret data part; Performing encryption processing on the pre-transmitted data based on the encryption unit to determine a second encrypted data portion; The first secret data portion and the second secret data portion are integrated as the secret data.

3. A method for secure storage and transmission of industrial Internet data as claimed in claim 2, characterized in that: Determining the data summary based on the hash calculation unit includes: Establishing a hash function based on a one-way mapping relationship between an input data slice and an output hash value, wherein the hash function is built into the hash calculation unit; receiving the pre-transmission data, slicing the pre-transmission data based on a preset length, and calculating a hash value based on the hash function, wherein the hash value corresponds to the data slice one by one; The hash values ​​are combined to determine a hash string as the data digest.

4. The method for secure storage and transmission of industrial Internet data according to claim 2, characterized in that: The method of performing encryption processing based on the encryption unit to determine the second encrypted data portion includes: Setting a data confidentiality level, wherein the data confidentiality level includes a first confidentiality level and a second confidentiality level; If the pre-transmitted data meets the first confidentiality level, performing private key distribution and encryption processing based on the private key encryption block to determine the second secret data portion; If the pre-transmitted data meets the second confidentiality level, quantum key distribution and encryption processing are performed based on the quantum key encryption block to determine the second secret data part.

5. The method for secure storage and transmission of industrial Internet data according to claim 4, characterized in that: According to the encryption module of the sink edge, classified decryption and data security verification based on data summary are performed, including: Receiving the secret data, performing public key decryption to determine the data summary, performing corresponding private key decryption or quantum key decryption based on the classified encryption process, and determining the pre-transmitted data; Transmitting the pre-transmission data to the hash calculation unit, and determining summary information by performing hash calculation; Verifying the data summary and the summary information to generate a data verification result; If the data verification result is consistent, the pre-transmission data is output.

6. The method for secure storage and transmission of industrial Internet data according to claim 1, characterized in that: After receiving the pre-transmission data, the method further comprises: Receiving the pre-transmission data and storing it at the sink edge; Setting alternating storage rules between the cloud and the sink edge, wherein alternating storage constraints are imposed based on data call frequency and data novelty; Based on the alternating storage rule, data is alternately stored and managed between the sink edge and the cloud.

7. The method for secure storage and transmission of industrial Internet data according to claim 1, characterized in that: The transmitting of the secret data comprises: The data network channel is the transmission from the information source edge end to the information sink edge end; determining a communication status of concurrent communication data and the data network channel; Based on the communication status, performing transmission collision decision and dislocation avoidance decision on the concurrent communication data, and determining a concurrent communication strategy; Based on the concurrent communication strategy, data transmission management is performed.

Images