Data transmission secrecy system for information interaction

Abstract

A data transmission secrecy system for information interaction relates to the technical field of data transmission secrecy and comprises an industrial data sharing platform which is in communication connection with a data acquisition module, a data visual module, a data encryption module, a data verification module and an edge encryption module. The data acquisition module is used for uploading industrial data needing to be synchronously transmitted; the data visual module is used for constructing an industrial production whole-process model; the data encryption module performs dual encryption according to the exclusive identification sequence of the industrial data needing to be synchronously transmitted, the estimated time of data transmission and an asymmetric encryption algorithm; the data verification module performs dual security verification on the encrypted data transmitted to the blockchain node; and the edge encryption module is used for constructing a fog encryption area and adjusting and correcting the encryption process according to the encryption level of each flow sub-sequence in the fog encryption area so as to ensure that the data is protected in the transmission process from the edge equipment to the cloud end or the server.

Description

Technical Field

[0001] The present invention relates to the technical field of data transmission security, in particular to a data transmission security system for information interaction. Background Art

[0002] The information security protection capabilities of industrial control system terminal equipment are relatively weak. The vast majority of industrial control systems lack effective protection measures and contain system vulnerabilities, which can easily be remotely controlled, thereby affecting normal production order and causing loss of life and property.

[0003] Building a local trusted computing environment at the industrial control equipment layer is of great significance for significantly improving the information security protection capabilities of industrial control systems. How to start from the security issues of terminal control devices, complete the security protection of the equipment itself and its network, and build a highly secure and highly trusted industrial control network operating environment is a technical problem that we urgently need to solve. Now we provide a data transmission confidentiality system for information interaction. Summary of the invention

[0004] In order to solve the above technical problems, the object of the present invention is to provide a data transmission confidentiality system for information interaction, including an industrial data sharing platform, wherein the industrial data sharing platform is communicatively connected with a data acquisition module, a data visualization module, a data encryption module, a data verification module and an edge encryption module; The data acquisition module is used to upload the industrial data that needs to be transmitted synchronously during the industrial production process to the industrial data sharing platform; The data visualization module constructs an industrial production full process model according to the assembly order and assembly relationship between each process subsequence; The data encryption module performs double encryption according to the exclusive identification sequence of the industrial data to be transmitted synchronously, the estimated time of data transmission, and the asymmetric encryption algorithm; The data verification module performs double security verification on the encrypted data transmitted to the blockchain node; The edge encryption module is used to construct a fog-shaped encryption area, and adjust and modify the encryption process according to the encryption level of each process subsequence within the fog-shaped encryption area.

[0005] Furthermore, the process in which the data acquisition module uploads the industrial data that needs to be synchronously transmitted in the industrial production process to the industrial data sharing platform includes: An industrial data sharing platform is constructed using blockchain technology, wherein a plurality of blockchain nodes are arranged in the industrial data sharing platform, and each blockchain node is interconnected to form a blockchain environment; The data acquisition module is composed of several data entry terminals, which are linked to several blockchain nodes in the industrial data sharing platform, and are used to upload the industrial data that needs to be transmitted synchronously for each process subsequence in the industrial production process to the blockchain node, and generate an exclusive identification sequence for each process subsequence, and associate the generated identification sequence with the data entry terminal.

[0006] Furthermore, the data entry terminal generates a unique identification sequence for each process subsequence, and the process of associating the generated identification sequence with the data entry terminal includes: Obtain the process flow characteristics of the current industrial production equipment, extract process information based on the process flow characteristics, and divide the industrial production process into several process sub-sequences according to the process information; According to the functional characteristics in the process flow characteristics of each process subsequence, the key monitoring indicator data of each process subsequence is obtained by data retrieval, and the qualitative characteristics and quantitative characteristics of the key monitoring indicator data of each process subsequence are obtained. The key monitoring indicator data and the qualitative characteristics and the quantitative characteristics are encoded by information theory to obtain qualitative characteristic information entropy and quantitative characteristic information entropy, and an exclusive identification sequence of each process subsequence is generated according to the qualitative characteristic information entropy and the quantitative characteristic information entropy of each process subsequence.

[0007] Furthermore, the process of constructing the industrial production full process model according to the assembly order and assembly relationship between each process subsequence by the data visualization module includes: Obtain the physical entity of the industrial production equipment in the physical space of the current industrial production process, perform 3D modeling on the physical entity of the industrial production equipment and map it to the digital space, obtain the assembly sequence and assembly relationship between several process subsequences, and use the assembly sequence and assembly relationship between each process subsequence as the connection relationship between the 3D models; The different processing scenario information of each process sub-sequence is obtained, and the different processing scenario information is processed into a scenario sequence. The three-mode model of the industrial production equipment in the current industrial production process is combined with the current scenario sequence of each process sub-sequence to generate an industrial production full process model.

[0008] Furthermore, the process of the data encryption module performing double encryption according to the exclusive identification sequence of the industrial data to be transmitted synchronously, the estimated time of data transmission and the asymmetric encryption algorithm includes: Obtain the industrial data that needs to be transmitted synchronously and the corresponding exclusive identification sequence of the process subsequence, and obtain the estimated time for data transmission of the industrial data, obtain the data transmission encryption key of the process subsequence according to the exclusive identification sequence of the process subsequence and the estimated time point of data transmission, and obtain the message authentication code of the industrial data according to the data transmission encryption key and the hash function, encrypt the industrial data through an asymmetric encryption algorithm, and upload the encrypted industrial data to the blockchain node linked to it through the data entry terminal.

[0009] Furthermore, the process of the data verification module performing double security verification on the encrypted data transmitted to the blockchain node includes: When a blockchain node receives industrial data that needs to be synchronized by a process subsequence, it temporarily stores the received data, reads the public key it holds, and verifies the received data based on the public key it holds to determine whether the public key can decrypt the received industrial data. If the public key decryption is successful, it means that the blockchain node has the authority to receive the industrial data. Then read the message authentication code of the temporarily stored industrial data, perform integrity verification on the received industrial data through the message authentication code, and output the verification result; If the verification result is passed, it means that the industrial data received by the blockchain node is complete; If the verification result is a verification failure, it means that the data transmission process of the industrial data received by the blockchain node has been tampered with, and an industrial data integrity abnormality alarm signal is generated.

[0010] Furthermore, the edge encryption module constructs a fog-shaped encryption area, and the process of adjusting and correcting the encryption process according to the encryption level of each process subsequence in the fog-shaped encryption area includes: Preliminary positioning of the target process subsequence with data transmission abnormality is performed according to the industrial data integrity abnormality alarm signal, and the degree of abnormal impact on other process subsequences is calculated through the adjacency matrix of the target process subsequence in the industrial production full process model; An impact threshold is preset to obtain the abnormal impact degree of the target process subsequence on other process subsequences, a fog-shaped encryption area is constructed based on the target process subsequence and other process subsequences whose reliability impact degree is greater than the impact threshold, and the encryption level of each process subsequence in the fog-shaped encryption area is obtained, and the encryption process of each process subsequence in the fog-shaped encryption area is adjusted and corrected according to the encryption level.

[0011] Furthermore, the process of the edge encryption module obtaining the encryption level of each process subsequence in the fog encryption area includes: Obtain the scene sequence of each process subsequence in the fog-shaped encrypted area, obtain the own abnormality rate of each process subsequence according to the scene sequence of each process subsequence, and obtain the comprehensive abnormality rate of each process subsequence according to the degree of abnormal influence of each process subsequence and other process subsequences, and obtain the encryption level of the process subsequence according to the comprehensive abnormality rate.

[0012] Compared with the prior art, the beneficial effects of the present invention are: the advantage of double encryption according to the exclusive identification sequence of industrial data that needs to be transmitted synchronously and the asymmetric encryption algorithm is that it is difficult to crack, and the advantage of encryption using the estimated time of data transmission is that its encrypted data changes in real time. The two are combined to ensure the security of data during transmission in the industrial control network operating environment, while also ensuring the consistency of the original data received by the block node. A fog encryption area is constructed through the edge encryption module, and the encryption process is adjusted and corrected according to the encryption level of each process subsequence within the fog encryption area. The encryption level of data in these specific ranges of the fog encryption area is adjusted to ensure that the data is protected during transmission from the edge device to the cloud or server. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 A schematic diagram of a data transmission security system for information interaction according to an embodiment of the present application. DETAILED DESCRIPTION

[0014] The following is a clear and complete description of the technical solutions in the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0015] like Figure 1 As shown, a data transmission confidentiality system for information interaction includes an industrial data sharing platform, wherein the industrial data sharing platform is communicatively connected with a data acquisition module, a data visualization module, a data encryption module, a data verification module and an edge encryption module; The data acquisition module is used to upload the industrial data that needs to be transmitted synchronously during the industrial production process to the industrial data sharing platform; The data visualization module constructs an industrial production full process model according to the assembly order and assembly relationship between each process subsequence; The data encryption module performs double encryption according to the exclusive identification sequence of the industrial data to be transmitted synchronously, the estimated time of data transmission, and the asymmetric encryption algorithm; The data verification module performs double security verification on the encrypted data transmitted to the blockchain node; The edge encryption module is used to construct a fog-shaped encryption area, and adjust and modify the encryption process according to the encryption level of each process subsequence within the fog-shaped encryption area.

[0016] It should be further explained that, in the specific implementation process, the process in which the data acquisition module uploads the industrial data that needs to be synchronously transmitted in the industrial production process to the industrial data sharing platform includes: The data acquisition module is composed of several data entry terminals, and an industrial data sharing platform is constructed using blockchain technology. Several blockchain nodes are set in the industrial data sharing platform, and each blockchain node is linked to each other to form a blockchain environment, and each blockchain node is linked to a corresponding data entry terminal. The data entry terminal is used to upload the industrial data that needs to be transmitted synchronously for each process subsequence in the industrial production process to the blockchain node, and generate an exclusive identification sequence for each process subsequence, and associate the generated identification sequence with the data entry terminal.

[0017] It should be further explained that, in a specific implementation process, the data entry end generates a unique identification sequence for each process subsequence, and the process of associating the generated identification sequence with the data entry end includes: Obtain the process flow characteristics of the current industrial production equipment, extract process information based on the process flow characteristics, and divide the industrial production process into several process sub-sequences according to the process information; According to the functional characteristics in the process flow characteristics of each process subsequence, the key monitoring indicator data of each process subsequence is obtained by data retrieval, and the qualitative characteristics and quantitative characteristics of the key monitoring indicator data of each process subsequence are obtained. The key monitoring indicator data and the qualitative characteristics and the quantitative characteristics are encoded by information theory to obtain qualitative characteristic information entropy and quantitative characteristic information entropy, and an exclusive identification sequence of each process subsequence is generated according to the qualitative characteristic information entropy and the quantitative characteristic information entropy of each process subsequence.

[0018] It should be further explained that, in the specific implementation process, the process of obtaining the qualitative feature information entropy and the quantitative feature information entropy through the information entropy calculation formula in information theory coding includes:

[0019] Where x represents a random variable, represents the information entropy of x; represents the output probability function; n represents the number of possible values ​​of the random variable x; the greater the uncertainty of the variable, the greater the entropy.

[0020] It should be further explained that, in the specific implementation process, the key monitoring indicator data of each process subsequence include but are not limited to: production output per unit time, product qualification rate, defective rate, customer complaint rate, equipment utilization efficiency, equipment downtime or idle time, raw material cost in the production process, labor cost, energy consumption cost, raw material inventory, work-in-progress inventory and finished product inventory in the production process, etc.

[0021] It should be further explained that, in the specific implementation process, the process of the data visualization module constructing the industrial production full process model according to the assembly order and assembly relationship between each process subsequence includes: Obtain the physical entity of the industrial production equipment in the physical space of the current industrial production process, perform 3D modeling on the physical entity of the industrial production equipment and map it to the digital space, obtain the assembly sequence and assembly relationship between several process subsequences, and use the assembly sequence and assembly relationship between each process subsequence as the connection relationship between the 3D models; Obtain different processing scenario information of each process sub-sequence, process the different processing scenario information into a scenario sequence, and combine the three-mode model of industrial production equipment in the current industrial production process with the current scenario sequence of each process sub-sequence to produce an industrial production full process model.

[0022] It should be further explained that, in the specific implementation process, the data encryption module performs double encryption according to the exclusive identification sequence of the industrial data to be transmitted synchronously, the estimated time of data transmission and the asymmetric encryption algorithm, including: Obtain the industrial data that needs to be transmitted synchronously and the corresponding exclusive identification sequence of the process subsequence, and obtain the estimated time for data transmission of the industrial data, obtain the data transmission encryption key of the process subsequence according to the exclusive identification sequence of the process subsequence and the estimated time point of data transmission, obtain the message authentication code of the industrial data according to the data transmission encryption key and the hash function, and encrypt the industrial data through an asymmetric encryption algorithm.

[0023] For example, the exclusive identification sequence of the process subsequence is 095087, and the estimated time point of data transmission is 13:14:52, then the various digits in the estimated time point are added to obtain a time value of 16, and the estimated time point and the exclusive identification sequence are combined to obtain a target value of 131452095087; then the time value 16 is set as the dividend, and the combined value 131452095087 is modulo 16 to obtain the encryption key 821575594315, The encryption key 821575594315 and the industrial data are used as input, and the SHA256 hash function is used to calculate to obtain the hash value H; H is processed again to obtain the final message authentication code; Subsequently, two prime numbers are selected and marked as a and b respectively, and a and b are large enough. Obtain the parameter n = a * b; calculate Euler's formula φ(n) = (a - 1) * (b - 1), and select a public exponent e that satisfies 1 < e < φ(n) and e is relatively prime to φ(n). Calculate the private key exponent d, and the calculation formula for the private key exponent d is e * d ≡ 1 (mod φ(n)). Obtain the public key (n, e) and the private key (n, d) respectively. The process subsequence encrypts the industrial data through the private key (n, d) and the corresponding asymmetric encryption algorithm.

[0024] It should be further noted that in the specific implementation process, the process of the data verification module performing double security verification on the encrypted data transmitted to the blockchain node includes: When the blockchain node receives the industrial data that needs to be synchronized by the process subsequence, it temporarily stores the received data, reads the public key it holds, and verifies the received data according to the public key it holds, and judges whether the public key can decrypt the received industrial data. If the public key decryption is successful, it means that the blockchain node has the permission to receive industrial data. Then read the message authentication code of the industrial data stored temporarily, perform integrity verification on the received industrial data through the message authentication code, and output the verification result. If the verification result is passed, it means that the industrial data received by the blockchain node is complete. If the verification result is a verification failure, it means that the data transmission process of the industrial data received by the blockchain node has been tampered with, and an industrial data integrity exception alarm signal is generated.

[0025] It should be further noted that in the specific implementation process, the process of the edge encryption module constructing a fog-shaped encryption area and adjusting and correcting the encryption process according to the encryption levels of each process subsequence in the fog-shaped encryption area includes: Perform a preliminary positioning of the target process subsequence with abnormal data transmission according to the industrial data integrity exception alarm signal, and calculate the abnormal influence degree on other process subsequences through the adjacency matrix of the target process subsequence in the industrial production full process model. Preset an influence threshold, obtain the abnormal influence degree of the target process subsequence on other process subsequences, construct a fog-shaped encryption area according to the target process subsequence and other process subsequences with a reliability influence degree greater than the influence threshold, obtain the encryption levels of each process subsequence in the fog-shaped encryption area, and adjust and correct the encryption process of each process subsequence in the fog-shaped encryption area according to the encryption levels.

[0026] It should be further explained that, in the specific implementation process, the calculation formula for calculating the abnormal impact degree on other process subsequences through the adjacency matrix of the target process subsequence in the industrial production full process model is:

[0027] in, , Respectively represent the abnormal impact of a process subsequence on other process subsequences after the i+1th and ith iterations; P= , whose specific value is obtained through the node adjacency matrix; represents the damping factor; represents the state transition matrix; E represents an N×1 matrix whose elements are all 1; N represents the number of process subsequences; It should be further explained that, in a specific implementation process, the process of the edge encryption module obtaining the encryption level of each process subsequence in the fog encryption area includes: Obtain the scene sequence of each process subsequence in the fog-shaped encrypted area, obtain the own abnormality rate of each process subsequence according to the scene sequence of each process subsequence, and obtain the comprehensive abnormality rate of each process subsequence according to the degree of abnormal influence of each process subsequence and other process subsequences, and obtain the encryption level of the process subsequence according to the comprehensive abnormality rate.

[0028] It should be further explained that, in the specific implementation process, the process of obtaining the abnormality rate of each process subsequence according to the scenario sequence of each process subsequence, and obtaining the comprehensive abnormality rate of each process subsequence according to the abnormality influence of each process subsequence and other process subsequences includes: According to the historical occurrence probability of industrial data integrity abnormal alarm signals under different processing scenario sequence conditions of each process subsequence, the indicator weight matrix of the evaluation indicator is set according to the process flow characteristics of each process subsequence, the abnormal probability level is preset, and the membership matrix representing the fuzzy relationship between the industrial data integrity abnormal alarm signal and the processing scenario sequence is constructed; The weight matrix is ​​merged with the membership matrix to obtain a fuzzy comprehensive evaluation result vector between the industrial data integrity abnormal alarm signal of each process subsequence and the processing scenario sequence, and the abnormal probability level representing the industrial data integrity abnormal alarm signal generated by each process subsequence under different processing scenario sequences is obtained according to the fuzzy comprehensive evaluation result vector; the self-abnormal rate of each process subsequence is obtained according to the processing scenario sequence in which each process subsequence is located and the abnormal probability level of the industrial data integrity abnormal alarm signal generated by each process subsequence under different processing scenario sequences; The specific calculation formula for obtaining the comprehensive abnormality rate of each process subsequence based on its own abnormality rate and abnormal impact degree is as follows:

[0029] in, represents the comprehensive abnormality rate of process subsequence j; represents the abnormality rate of process subsequence j; Indicates the degree of abnormal impact of process subsequence j on other process subsequences; The abnormality rate of several other process subsequences; The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A data transmission security system for information interaction, including an industrial data sharing platform, characterized in that: The industrial data sharing platform is communicatively connected with a data acquisition module, a data visualization module, a data encryption module, a data verification module and an edge encryption module; The data acquisition module is used to upload the industrial data that needs to be transmitted synchronously during the industrial production process to the industrial data sharing platform; The data visualization module constructs an industrial production full process model according to the assembly order and assembly relationship between each process subsequence; The data encryption module performs double encryption according to the exclusive identification sequence of the industrial data to be transmitted synchronously, the estimated time of data transmission, and the asymmetric encryption algorithm; The data verification module performs double security verification on the encrypted data transmitted to the blockchain node; The edge encryption module is used to construct a fog-shaped encryption area, and adjust and modify the encryption process according to the encryption level of each process subsequence within the fog-shaped encryption area.

2. A data transmission security system for information interaction according to claim 1, characterized in that: The process of uploading the industrial data that needs to be synchronously transmitted in the industrial production process to the industrial data sharing platform by the data acquisition module includes: An industrial data sharing platform is constructed using blockchain technology, wherein a plurality of blockchain nodes are arranged in the industrial data sharing platform, and each blockchain node is interconnected to form a blockchain environment; The data acquisition module is composed of several data entry terminals, which are linked to several blockchain nodes in the industrial data sharing platform, and are used to upload the industrial data that needs to be transmitted synchronously for each process subsequence in the industrial production process to the blockchain node, and generate an exclusive identification sequence for each process subsequence, and associate the generated identification sequence with the data entry terminal.

3. A data transmission security system for information interaction according to claim 2, characterized in that: The data entry end generates a unique identification sequence for each process subsequence, and the process of associating the generated identification sequence with the data entry end includes: Obtain the process flow characteristics of the current industrial production equipment, extract process information based on the process flow characteristics, and divide the industrial production process into several process sub-sequences according to the process information; According to the functional characteristics in the process flow characteristics of each process subsequence, the key monitoring indicator data of each process subsequence is obtained by data retrieval, and the qualitative characteristics and quantitative characteristics of the key monitoring indicator data of each process subsequence are obtained. The key monitoring indicator data and the qualitative characteristics and the quantitative characteristics are encoded by information theory to obtain qualitative characteristic information entropy and quantitative characteristic information entropy, and an exclusive identification sequence of each process subsequence is generated according to the qualitative characteristic information entropy and the quantitative characteristic information entropy of each process subsequence.

4. A data transmission security system for information interaction according to claim 3, characterized in that: The process of constructing the industrial production full process model according to the assembly order and assembly relationship between each process subsequence by the data visualization module includes: Obtain the physical entity of the industrial production equipment in the physical space of the current industrial production process, perform 3D modeling on the physical entity of the industrial production equipment and map it to the digital space, obtain the assembly sequence and assembly relationship between several process subsequences, and use the assembly sequence and assembly relationship between each process subsequence as the connection relationship between the 3D models; The different processing scenario information of each process sub-sequence is obtained, and the different processing scenario information is processed into a scenario sequence. The three-mode model of the industrial production equipment in the current industrial production process is combined with the current scenario sequence of each process sub-sequence to generate an industrial production full process model.

5. A data transmission security system for information interaction according to claim 4, characterized in that: The process of the data encryption module performing double encryption according to the exclusive identification sequence of the industrial data to be transmitted synchronously, the estimated time of data transmission and the asymmetric encryption algorithm includes: Obtain the industrial data that needs to be transmitted synchronously and the corresponding exclusive identification sequence of the process subsequence, and obtain the estimated time for data transmission of the industrial data, obtain the data transmission encryption key of the process subsequence according to the exclusive identification sequence of the process subsequence and the estimated time point of data transmission, and obtain the message authentication code of the industrial data according to the data transmission encryption key and the hash function, encrypt the industrial data through an asymmetric encryption algorithm, and upload the encrypted industrial data to the blockchain node linked to it through the data entry terminal.

6. A data transmission security system for information interaction according to claim 5, characterized in that: The process of the data verification module performing double security verification on the encrypted data transmitted to the blockchain node includes: When a blockchain node receives industrial data that needs to be synchronized by a process subsequence, it temporarily stores the received data, reads the public key it holds, and verifies the received data based on the public key it holds to determine whether the public key can decrypt the received industrial data. If the public key decryption is successful, it means that the blockchain node has the authority to receive the industrial data. Then read the message authentication code of the temporarily stored industrial data, perform integrity verification on the received industrial data through the message authentication code, and output the verification result; If the verification result is passed, it means that the industrial data received by the blockchain node is complete; If the verification result is a verification failure, it means that the data transmission process of the industrial data received by the blockchain node has been tampered with, and an industrial data integrity abnormality alarm signal is generated.

7. A data transmission security system for information interaction according to claim 6, characterized in that: The edge encryption module constructs a fog-shaped encryption area, and the process of adjusting and correcting the encryption process according to the encryption level of each process subsequence in the fog-shaped encryption area includes: Preliminary positioning of the target process subsequence with data transmission abnormality is performed according to the industrial data integrity abnormality alarm signal, and the degree of abnormal impact on other process subsequences is calculated through the adjacency matrix of the target process subsequence in the industrial production full process model; An impact threshold is preset to obtain the abnormal impact degree of the target process subsequence on other process subsequences, a fog-shaped encryption area is constructed based on the target process subsequence and other process subsequences whose reliability impact degree is greater than the impact threshold, and the encryption level of each process subsequence in the fog-shaped encryption area is obtained, and the encryption process of each process subsequence in the fog-shaped encryption area is adjusted and corrected according to the encryption level.

8. A data transmission security system for information interaction according to claim 7, characterized in that: The process of the edge encryption module obtaining the encryption level of each process subsequence in the fog encryption area includes: Obtain the scene sequence of each process subsequence in the fog-shaped encrypted area, obtain the own abnormality rate of each process subsequence according to the scene sequence of each process subsequence, and obtain the comprehensive abnormality rate of each process subsequence according to the degree of abnormal influence of each process subsequence and other process subsequences, and obtain the encryption level of the process subsequence according to the comprehensive abnormality rate.

Images