Encryption method, device and equipment for industrial internet data exchange and medium

Abstract

The invention discloses an encryption method and device for industrial internet data exchange, equipment and a medium, and relates to the technical field of industrial information security, and the encryption method comprises the following steps: generating a pair of public key and private key for industrial equipment or nodes preliminarily participating in data exchange by using an elliptic curve ECDH protocol, and carrying out initialized key exchange; generating a temporary additional key, and calculating a temporary session key; encrypting the temporary session key by using a public key of a receiver to obtain a session key, and processing data according to different stages of data exchange; and when each session ends or a preset time / data volume threshold is reached, automatically discarding the old key and renewedly negotiating a new session key. According to the method, resource consumption in the key exchange process is reduced, potential safety hazards possibly caused by key reuse or long-term key fixation are reduced, the attack resistance of the data exchange process is improved, the confidentiality and integrity of data exchange are guaranteed, and a continuous and safe environment is constructed for data exchange of the industrial internet.

Description

Technical Field

[0001] The present invention relates to the field of industrial information security technology, and in particular to an encryption method, device, equipment and medium for industrial Internet data exchange. Background Art

[0002] In today's wave of digital transformation, the security of data exchange of the Industrial Internet, as the core support of intelligent manufacturing, has increasingly become the focus of industry attention. With the integration and application of technologies such as the Internet of Things (IoT), big data, and cloud computing, the data exchange of the Industrial Internet is not only huge in scale, but also covers multiple dimensions such as production, logistics, and management, which puts higher requirements on the secure transmission of data. Traditional encryption technologies, such as RSA asymmetric encryption, have gradually shown their limitations in the face of massive, real-time data interaction scenarios of the Industrial Internet due to high computational complexity and high resource consumption.

[0003] Therefore, seeking efficient and secure data encryption methods has become an important issue to promote the healthy development of the Industrial Internet. In this context, elliptic curve cryptography, with its unique mathematical foundation and algorithmic advantages, has gradually been regarded by the industry as an important means to improve encryption efficiency and security. As an important application of ECC, the elliptic curve protocol achieves secure exchange of keys by utilizing the difficulty of the discrete logarithm problem on the elliptic curve. Although ECDH provides strong security guarantees in theory, there are still several challenges that have not been fully addressed in practical applications, especially in the industrial Internet environment. The primary problem is the complexity of key management, especially in large-scale networks, where frequent key updates and distribution have become a major burden for maintaining system security. In addition, how to ensure that dynamic and secure key strategies can be effectively implemented at different stages of data exchange (such as initialization, data transmission, and session termination) is also a link that existing technologies have not fully covered. Summary of the invention

[0004] In view of the problems existing in the existing encryption methods for industrial Internet data exchange, the present invention is proposed. Therefore, the problem to be solved by the present invention is how to provide an encryption method, device, electronic device and storage medium for industrial Internet data exchange.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0006] In a first aspect, the present invention provides an encryption method for industrial Internet data exchange, which includes using the elliptic curve ECDH protocol to generate a pair of public keys and private keys for industrial equipment or nodes that initially participate in data exchange, and performing initial key exchange; generating a temporary additional key, and calculating a temporary session key through the temporary additional key and the private key; encrypting the temporary session key with the public key of the recipient to obtain a session key, and sending it to the recipient, and processing the data according to different stages of the data exchange; completing the industrial Internet data exchange, and when each session ends or reaches a preset time / data volume threshold, automatically discarding the old key and renegotiating a new session key.

[0007] As a preferred scheme of the encryption method for industrial Internet data exchange described in the present invention, the generation of a temporary additional key includes the following steps: clarifying the physical environment parameters to be collected, installing corresponding sensors on industrial equipment or nodes, and real-time monitoring and recording physical environment parameters, including ambient temperature, humidity, vibration frequency, and electromagnetic interference intensity; performing quality checks on the collected data, eliminating abnormal values ​​or invalid data, and converting the measured values ​​of different parameters to a unified numerical range through normalization processing, mapping all parameters to between 0 and 1; combining the preprocessed parameters according to weights or rules to form a composite value, and converting the composite value into a fixed-length bit string as a random number seed through a secure hash algorithm; generating a temporary additional key using the random number seed and the key derivation function combined with the private key of the device; calculating a shared temporary session key through the existing key exchange protocol ECDH, combining the temporary additional key and the private key; and repeating the steps to periodically update the temporary session key according to changes in the physical environment parameters or a preset time period.

[0008] As a preferred scheme of the encryption method for industrial Internet data exchange described in the present invention, wherein: the processing of data according to different stages of data exchange includes the following steps: dividing the data into multiple small blocks before actual data exchange encryption, applying a symmetric encryption algorithm to encrypt each data block, and encrypting it using a session key; using homomorphic encryption technology for data that needs to be processed in an encrypted state, combining multiple homomorphic encryption modes, designing a data processing flow, selecting a homomorphic encryption mode according to data processing requirements, and constructing a data processing pipeline to ensure that the data is correctly processed in an encrypted state; using a covert communication protocol to disguise the encrypted data as normal network traffic, and using the network protocol Redundant fields are embedded in encrypted data or the time interval for sending data packets is adjusted to simulate normal network behavior to confuse data streams. After the actual data exchange is encrypted, the encrypted data packets are reordered or the format is modified to generate a security label containing a summary of the encrypted data information for each data packet. The security label is signed with the sender's private key, and the receiver verifies the signature with the corresponding public key. A quantum key distribution system is deployed for industrial equipment or nodes that repeatedly exchange data to generate quantum keys and perform XOR operations on temporary shared keys. A quantum key distribution protocol is used to distribute security keys between two trusted nodes, and the security keys are XORed with the keys generated by the ECDH protocol to directly generate session keys.

[0009] As a preferred scheme of the encryption method for industrial Internet data exchange described in the present invention, wherein: the selection of the homomorphic encryption mode according to the data processing requirements includes: if it is necessary to perform arbitrarily complex calculations without decryption, and even a third party cannot obtain the plaintext data, then select the fully homomorphic encryption mode, allowing any program to be directly executed on the encrypted data, encrypt the original data, and directly execute the specified algorithm or operation on the encrypted data. After the calculation is completed, use the private key to decrypt the encrypted result back to plaintext to obtain the final calculation output; if it is necessary to perform addition or multiplication operations, select the partial homomorphic encryption mode; if the data processing only involves comparison operations, and it is necessary to process the sorting or range query of a large amount of data, then select the execution of the homomorphic encryption mode, allowing the relative size relationship of the data to be retained in the encrypted state, and directly execute the range query on the encrypted data, and perform data sorting and comparison operations.

[0010] As a preferred solution of the encryption method for industrial Internet data exchange described in the present invention, wherein: the method of disguising encrypted data as normal network traffic includes the following steps: obtaining the commonly used protocols and standard formats of the target network, identifying the redundant fields or available spaces in the protocol, and selecting the protocol as the carrier of covert communication according to the network environment and data transmission requirements; dividing the encrypted data to be transmitted into multiple small blocks, and the size of each block should be adapted to the redundant fields or expandable areas of the selected carrier; designing the data encapsulation format to ensure that the encrypted data block can be embedded in the data part or the redundant fields of the header of the carrier protocol without destroying the format integrity of the protocol, and The data blocks are inserted into the corresponding positions of the protocol according to the designed format, the sending time interval of the data packets is adjusted according to the statistical characteristics of normal network traffic, and data packets simulating normal communication are generated and interspersed between the covert data packets. The size, port number, and sequence number of the data packets are randomized; the covert communication system is tested in a simulated environment, the integrity and concealment of data transmission are checked, the anti-detection capability is evaluated, and the size, sending rate, and camouflage strategy of the data packet are adjusted according to the test results; the covert communication system is gradually deployed in the real network, and the operating status of the covert communication is continuously monitored after deployment, feedback information on data packet transmission is collected, and the optimization strategy is adjusted in a timely manner.

[0011] As a preferred embodiment of the encryption method for industrial Internet data exchange described in the present invention, the generation of a security label containing a summary of encrypted data information includes the following steps: selecting an AES algorithm to encrypt the original data, using a session key to encrypt the data in blocks, and generating an encrypted data packet; reordering the encrypted data packets, modifying the header information of the data packets, and using a hash function to calculate the information summary for each encrypted and reassembled data packet, adding necessary metadata to the summary of each data packet to form a security label; using the sender's private key to digitally sign each security label, attaching the digital signature to the corresponding data packet and sending it together with the data packet in accordance with specific protocol requirements; sending the encrypted, reassembled data packet with a signature label to the receiver through a selected network channel; the receiver receives all data packets, separates the security label and signature from the data packet, and uses the sender's public key to verify the digital signature on each security label; according to the metadata in the label, the data packet is restored to the correct order, and the reassembled data packet is decrypted using the corresponding key to restore the original data; the summary of the decrypted data packet is calculated again, and compared with the summary in the security label to ensure data integrity.

[0012] As a preferred solution of the encryption method for industrial Internet data exchange described in the present invention, the reordering of the encrypted data packets includes the following steps: assuming that the original data packet sequence is P = [P1, P2, ..., PN], where Pi represents the i-th data packet and N is the total number of data packets; calculating the offset based on the sequence number for each data packet, using the linear congruential method to generate a pseudo-random number as an offset indication, the relevant expression is as follows:

[0013] Of i =(Hash(P i ,N)Mod(N-1))+1

[0014] In the formula, Of i is the offset of the sequence number, Hash is the hash function for calculating the information summary, and the low-order 2 bits of the result are taken as the actual offset value; create a new empty sequence R to store the reordered data packets, and for each data packet, insert it into the new sequence according to the following steps: Calculate the target position, and the relevant expression is as follows:

[0015] T=(Po i +Of i )modN

[0016] Among them, Po i is the position of the ith data packet in the original sequence, i.e., sequence number i; insert Pi into the position of R[T]. If the position is occupied, continue to look for the next available position. Until an empty position is found; record the sorting information, generate a mapping table M, record the new and old position relationship of each data packet, and use it for the receiver to restore the original order. M[i]=T means that the original i-th packet is now located at the T-th position in the new sequence.

[0017] In the second aspect, the present invention provides an encryption device for industrial Internet data exchange, which includes: an initialization module, which uses the elliptic curve ECDH protocol to generate a pair of public keys and private keys for industrial equipment or nodes that initially participate in data exchange, and performs initial key exchange; an additional module, which is used to generate a temporary additional key, and calculate a temporary session key through the temporary additional key and the private key; an encryption module, which is used to encrypt the temporary session key using the public key of the recipient to obtain a session key, and send it to the recipient, and process the data according to different stages of the data exchange; an update module, which is used to complete the industrial Internet data exchange, and when each session ends or reaches a preset time / data volume threshold, the old key is automatically discarded and a new session key is renegotiated.

[0018] In a third aspect, the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the processor executes the computer program, it implements the steps of an encryption method for industrial Internet data exchange.

[0019] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, the steps of an encryption method for industrial Internet data exchange are implemented.

[0020] The beneficial effects of the present invention are to achieve efficient and secure key initialization exchange in a resource-constrained industrial environment, reduce resource consumption in the key exchange process, ensure that a secure communication channel can be quickly established in a complex industrial Internet architecture, and have a significant beneficial effect on improving the security and response speed of initial data exchange. Reduce the potential security risks caused by key reuse or long-term fixed keys, improve the anti-attack capability of the data exchange process, ensure the confidentiality and integrity of data exchange, and build a continuous and secure environment for data exchange on the industrial Internet. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 Flowchart of the encryption method for industrial Internet data exchange.

[0023] Figure 2 Computer equipment diagram for encryption methods of data exchange for the Industrial Internet. DETAILED DESCRIPTION

[0024] In order to make the above-mentioned purposes, features and advantages of the present invention more understandable, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0025] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0026] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0027] Example 1

[0028] Reference Figure 1 and Figure 2 , which is the first embodiment of the present invention, and provides an encryption method for industrial Internet data exchange, including:

[0029] S1: Use the elliptic curve ECDH protocol to generate a pair of public and private keys for the industrial equipment or nodes that initially participate in data exchange, and perform initial key exchange;

[0030] Specifically, the elliptic curve ECDH protocol is used to generate a pair of public and private keys for the industrial equipment or nodes involved in data exchange, and the key exchange is initialized;

[0031] S2: Generate a temporary additional key, and calculate a temporary session key using the temporary additional key and the private key;

[0032] Specifically, the physical environment parameters to be collected should be clearly identified, and corresponding sensors should be installed on industrial equipment or nodes to monitor and record the physical environment parameters in real time, including ambient temperature, humidity, vibration frequency, and electromagnetic interference intensity;

[0033] Perform quality checks on the collected data, remove outliers or invalid data, and convert the measured values ​​of different parameters to a unified numerical range through normalization, mapping all parameters to between 0 and 1;

[0034] The preprocessed parameters are combined according to weights or rules to form a composite value, and the composite value is converted into a fixed-length bit string as a random number seed through a secure hash algorithm;

[0035] Generate a temporary additional key using a random number seed and a key derivation function combined with the device's private key;

[0036] The shared temporary session key is calculated by combining the temporary additional key and the private key through the existing key exchange protocol ECDH.

[0037] The temporary session key is updated periodically by repeating the steps according to the changes of the physical environment parameters or the preset time period.

[0038] S3: Use the public key of the recipient to encrypt the temporary session key to obtain the session key, send it to the recipient, and process the data according to different stages of data exchange;

[0039] Specifically, the data is divided into multiple small blocks before the actual data exchange encryption, and a symmetric encryption algorithm is applied to each data block for encryption using a session key;

[0040] Homomorphic encryption technology is used for data that needs to be processed in an encrypted state. Multiple homomorphic encryption modes are combined to design data processing procedures. Homomorphic encryption modes are selected according to data processing requirements, and data processing pipelines are constructed to ensure that data is correctly processed in an encrypted state.

[0041] If you need to perform any complex calculations without decryption, and even third parties such as cloud service providers cannot obtain plaintext data, then choose the fully homomorphic encryption mode, which allows any program to be executed directly on the encrypted data. Encrypt the original data and execute the specified algorithm or operation directly on the encrypted data. After the calculation is completed, use the private key to decrypt the encrypted result back to plaintext to obtain the final calculation output;

[0042] If you mainly need to perform addition or multiplication operations, select the partially homomorphic encryption mode;

[0043] If data processing only involves comparison operations and requires sorting or range queries of large amounts of data, select the ordered homomorphic encryption mode, which allows the relative size relationship of the data to be retained in the encrypted state, and allows range queries to be performed directly on the encrypted data to perform data sorting and comparison operations.

[0044] Use covert communication protocols to disguise encrypted data as normal network traffic, use redundant fields of network protocols to embed encrypted data or adjust the time interval for sending data packets, and simulate normal network behavior to confuse data flows;

[0045] Obtain the commonly used protocols and standard formats of the target network, identify the redundant fields or available space in the protocol, and select the protocol as the carrier of covert communication according to the network environment and data transmission requirements. For example, if DNS queries are frequent in the network, the DNS protocol can be selected as a covert channel.

[0046] Divide the encrypted data to be transmitted into multiple small blocks, and the size of each block should be adapted to the redundant field or expandable area of ​​the selected carrier;

[0047] The data encapsulation format is designed to ensure that the encrypted data block can be embedded in the data part or the redundant field of the header of the carrier protocol without destroying the format integrity of the protocol. The data block is inserted into the corresponding position of the protocol according to the designed format.

[0048] According to the statistical characteristics of normal network traffic, the time interval for sending data packets is adjusted to generate data packets simulating normal communication, which are interspersed between covert data packets, and the size, port number and sequence number of the data packets are randomized;

[0049] Test the covert communication system in a simulated environment, check the integrity and concealment of data transmission, evaluate the anti-detection capability, and adjust the size, sending rate, and camouflage strategy of the data packet based on the test results;

[0050] Gradually deploy the covert communication system in the real network, continuously monitor the operating status of the covert communication after deployment, collect feedback information on data packet transmission, and adjust the optimization strategy in time.

[0051] After the actual data exchange is encrypted, the encrypted data packets are reordered or the format is modified, and a security label containing a summary of the encrypted data information is generated for each data packet. The security label is signed using the sender's private key, and the receiver verifies the signature using the corresponding public key;

[0052] Assume that the original data packet sequence is P = [P1, P2, ..., PN], where Pi represents the i-th data packet and N is the total number of data packets;

[0053] Calculate the offset based on the sequence number for each data packet, and use the linear congruential method to generate a pseudo-random number as an offset indicator. The relevant expression is as follows:

[0054] Of i =(Hash(P i ,N)Mod(N-1))+1

[0055] In the formula, Of i is the offset of the serial number, Hash is the hash function for calculating the information digest, the low-order 2 bits of the result are taken as the actual offset value, and Mod(N-1) is used to limit the range of the offset;

[0056] Create a new empty sequence R to store the reordered packets. For each packet, insert it into the new sequence according to the following steps:

[0057] Calculate the target position, the relevant expression is as follows:

[0058] T=(Po i +Of i )modN

[0059] Among them, Po i is the position of the ith data packet in the original sequence, i.e., sequence number i. Mod N is used to ensure that the calculated target position T is within the legal range, i.e., it cycles between 0 and N-1;

[0060] Insert Pi into the position of R[T]. If the position is occupied, continue to look for the next available position. Until you find a vacant spot;

[0061] Record the sorting information, generate a mapping table M, record the new and old position relationship of each data packet, and use it for the receiver to restore the original order. M[i]=T means that the original i-th packet is now located at the T-th position in the new sequence.

[0062] Select the AES algorithm to encrypt the original data, use the session key to encrypt the data in blocks, and generate an encrypted data packet;

[0063] Reorder the encrypted data packets, modify the header information of the data packets, use the hash function to calculate the information summary of each encrypted and reassembled data packet, add necessary metadata to the summary of each data packet to form a security label;

[0064] Use the sender's private key to digitally sign each security tag, attach the digital signature to the corresponding data packet, and send it together with the data packet according to the specific protocol requirements;

[0065] Send the encrypted, reassembled and signed data packets to the receiver through the selected network channel;

[0066] The receiver receives all data packets, separates the security tags and signatures from the data packets, and verifies the digital signature on each security tag using the sender's public key;

[0067] According to the metadata in the tag, the data packet is restored to the correct order, and the reassembled data packet is decrypted using the corresponding key to restore the original data;

[0068] The digest of the decrypted data packet is calculated again and compared with the digest in the security label to ensure data integrity.

[0069] Deploy a quantum key distribution system on industrial equipment or nodes that repeatedly exchange data to generate quantum keys and perform XOR operations with temporary shared keys;

[0070] The quantum key distribution protocol is used to distribute security keys between two trusted nodes, and the security key is XORed with the key generated by the ECDH protocol to directly generate the session key. QKD provides theoretically unbreakable security because any attempt to eavesdrop will be immediately discovered due to the change in the quantum state.

[0071] S4: Complete the industrial Internet data exchange. When each session ends or reaches the preset time / data volume threshold, the old key is automatically discarded and a new session key is renegotiated.

[0072] Furthermore, this embodiment also provides an encryption device for industrial Internet data exchange, including: an initialization module, which uses the elliptic curve ECDH protocol to generate a pair of public keys and private keys for industrial equipment or nodes that initially participate in data exchange, and performs initial key exchange; an additional module, which is used to generate a temporary additional key, and calculate a temporary session key through the temporary additional key and the private key; an encryption module, which is used to encrypt the temporary session key using the public key of the recipient to obtain a session key, and send it to the recipient, and process the data according to different stages of the data exchange; an update module, which is used to complete the industrial Internet data exchange, and when each session ends or reaches a preset time / data volume threshold, the old key is automatically discarded and a new session key is renegotiated.

[0073] This embodiment also provides a computer device, which is suitable for the encryption method of industrial Internet data exchange, including: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute computer-executable instructions to implement all or part of the steps of the method described in the embodiment of the present invention as proposed in the above embodiment.

[0074] This embodiment also provides a storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the method in any optional implementation of the above embodiment is executed. Wherein, the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read-Only Memory, referred to as EPROM), programmable read-only memory (Programmable Red-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic memory, flash memory, disk or optical disk.

[0075] The storage medium proposed in this embodiment and the data storage method proposed in the above embodiment belong to the same inventive concept. The technical details not fully described in this embodiment can be found in the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0076] As can be seen from the above, this method first realizes efficient and secure key initialization exchange in a resource-constrained industrial environment, provides higher security and computational efficiency than traditional RSA encryption, reduces resource consumption in the key exchange process, and ensures that even in a complex industrial Internet architecture, a secure communication channel can be quickly established, which has a significant beneficial effect on improving the security and response speed of initial data exchange. Enhance the dynamics and security of data exchange. Allow each session to be based on a different key. Even if a key is unfortunately leaked, it will not affect the security of other sessions, greatly reducing the potential security risks caused by key reuse or long-term fixed keys. Improve the anti-attack capability of the entire data exchange process and ensure the confidentiality and integrity of data exchange. Implement strict management of the key life cycle to prevent security vulnerabilities that may be caused by long-term use of keys, and build a continuous and secure environment for data exchange on the industrial Internet.

[0077] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. An encryption method for industrial Internet data exchange, characterized in that: include, For industrial equipment or nodes that initially participate in data exchange, use the elliptic curve ECDH protocol to generate a pair of public and private keys to perform initial key exchange; Generate a temporary additional key, and calculate a temporary session key using the temporary additional key and the private key; The temporary session key is encrypted with the public key of the recipient to obtain the session key, which is sent to the recipient, and the data is processed according to different stages of data exchange; Complete industrial Internet data exchange. When each session ends or reaches the preset time / data volume threshold, the old key is automatically discarded and a new session key is renegotiated.

2. The encryption method for industrial Internet data exchange according to claim 1, characterized in that: The generating of the temporary additional key comprises the following steps: Identify the physical environment parameters to be collected, install corresponding sensors on industrial equipment or nodes, and monitor and record the physical environment parameters in real time, including ambient temperature, humidity, vibration frequency, and electromagnetic interference intensity; Perform quality checks on the collected data, remove outliers or invalid data, and convert the measured values ​​of different parameters to a unified numerical range through normalization, mapping all parameters to between 0 and 1; The preprocessed parameters are combined according to weights or rules to form a composite value, and the composite value is converted into a fixed-length bit string as a random number seed through a secure hash algorithm; Generate a temporary additional key using a random number seed and a key derivation function combined with the device's private key; The shared temporary session key is calculated by combining the temporary additional key and the private key through the existing key exchange protocol ECDH. The temporary session key is updated periodically by repeating the steps according to the changes of the physical environment parameters or the preset time period.

3. The encryption method for industrial Internet data exchange according to claim 2, characterized in that: The processing of data according to different stages of data exchange comprises the following steps: Before the actual data exchange encryption, the data is divided into multiple small blocks, and each data block is encrypted by applying a symmetric encryption algorithm and using a session key for encryption; Homomorphic encryption technology is used for data that needs to be processed in an encrypted state. Multiple homomorphic encryption modes are combined to design data processing procedures. Homomorphic encryption modes are selected according to data processing requirements, and data processing pipelines are constructed to ensure that data is correctly processed in an encrypted state. Use covert communication protocols to disguise encrypted data as normal network traffic, use redundant fields of network protocols to embed encrypted data or adjust the time interval for sending data packets, and simulate normal network behavior to confuse data flows; After the actual data exchange is encrypted, the encrypted data packets are reordered or the format is modified, and a security label containing a summary of the encrypted data information is generated for each data packet. The security label is signed using the sender's private key, and the receiver verifies the signature using the corresponding public key; Deploy a quantum key distribution system on industrial equipment or nodes that repeatedly exchange data to generate quantum keys and perform XOR operations with temporary shared keys; The quantum key distribution protocol is used to distribute security keys between two trusted nodes, and the security key is XORed with the key generated by the ECDH protocol to directly generate the session key.

4. The encryption method for industrial Internet data exchange according to claim 3, characterized in that: The selection of a homomorphic encryption mode according to data processing requirements includes: If you need to perform any complex calculation without decryption, and even third parties cannot obtain the plaintext data, then select the fully homomorphic encryption mode, which allows any program to be executed directly on the encrypted data. Encrypt the original data, and execute the specified algorithm or operation directly on the encrypted data. After the calculation is completed, use the private key to decrypt the encrypted result back to plaintext to obtain the final calculation output; If addition or multiplication operations need to be performed, select the partial homomorphic encryption mode; If data processing only involves comparison operations and requires sorting or range queries of large amounts of data, select the ordered homomorphic encryption mode, which allows the relative size relationship of the data to be retained in the encrypted state, and allows range queries to be performed directly on the encrypted data to perform data sorting and comparison operations.

5. The encryption method for industrial Internet data exchange according to claim 4, characterized in that: Disguising encrypted data as normal network traffic comprises the following steps: Obtain the commonly used protocols and standard formats of the target network, identify the redundant fields or available spaces in the protocol, and select the protocol as the carrier of covert communication according to the network environment and data transmission requirements; Divide the encrypted data to be transmitted into multiple small blocks, and the size of each block should be adapted to the redundant field or expandable area of ​​the selected carrier; Design the data encapsulation format to ensure that the encrypted data block can be embedded in the data part of the carrier protocol or the redundant field of the header, while not destroying the format integrity of the protocol, and insert the data block into the corresponding position of the protocol according to the designed format. According to the statistical characteristics of normal network traffic, the sending time interval of data packets is adjusted to generate data packets simulating normal communication, which are interspersed between covert data packets, and the size, port number and sequence number of the data packets are randomized; Test the covert communication system in a simulated environment, check the integrity and concealment of data transmission, evaluate the anti-detection capability, and adjust the size, sending rate, and camouflage strategy of the data packet based on the test results; Gradually deploy the covert communication system in the real network, continuously monitor the operating status of the covert communication after deployment, collect feedback information on data packet transmission, and adjust the optimization strategy in time.

6. The encryption method for industrial Internet data exchange according to claim 5, characterized in that: The generation of a security label containing a summary of encrypted data information comprises the following steps: Select the AES algorithm to encrypt the original data, use the session key to encrypt the data in blocks, and generate an encrypted data packet; Reorder the encrypted data packets, modify the header information of the data packets, use the hash function to calculate the information summary of each encrypted and reassembled data packet, add necessary metadata to the summary of each data packet to form a security label; Use the sender's private key to digitally sign each security tag, attach the digital signature to the corresponding data packet, and send it together with the data packet according to the specific protocol requirements; Send the encrypted, reassembled and signed data packets to the receiver through the selected network channel; The receiver receives all data packets, separates the security tags and signatures from the data packets, and verifies the digital signature on each security tag using the sender's public key; According to the metadata in the tag, the data packet is restored to the correct order, and the reassembled data packet is decrypted using the corresponding key to restore the original data; The digest of the decrypted data packet is calculated again and compared with the digest in the security label to ensure data integrity.

7. The encryption method for industrial Internet data exchange according to claim 6, characterized in that: The reordering of the encrypted data packets comprises the following steps: Assume that the original data packet sequence is P = [P1, P2, ..., PN], where Pi represents the i-th data packet and N is the total number of data packets; Calculate the offset based on the sequence number for each data packet, and use the linear congruential method to generate a pseudo-random number as an offset indicator. The relevant expression is as follows: Of i =(Hash(P i ,N)Mod(N-1))+1 In the formula, Of i is the offset of the serial number, Hash is the hash function for calculating the information digest, and the low-order 2 bits of the result are taken as the actual offset value; Create a new empty sequence R to store the reordered packets. For each packet, insert it into the new sequence according to the following steps: Calculate the target position, the relevant expression is as follows: T=(Po i +Of i )modN Among them, Po i is the position of the i-th data packet in the original sequence, i.e., sequence number i; Insert Pi into the position of R[T]. If the position is occupied, continue to look for the next available position. Until you find a vacant spot; Record the sorting information, generate a mapping table M, record the new and old position relationship of each data packet, and use it for the receiver to restore the original order. M[i]=T means that the original i-th packet is now located at the T-th position in the new sequence.

8. An encryption device for industrial Internet data exchange, based on the encryption method for industrial Internet data exchange according to any one of claims 1 to 7, characterized in that: include, The initialization module uses the elliptic curve ECDH protocol to generate a pair of public and private keys for the industrial equipment or nodes that initially participate in data exchange, and performs initial key exchange; The additional module is used to generate a temporary additional key and calculate a temporary session key by using the temporary additional key and a private key; The encryption module is used to encrypt the temporary session key with the public key of the recipient to obtain the session key, send it to the recipient, and process the data according to different stages of data exchange; The update module is used to complete the industrial Internet data exchange. When each session ends or reaches the preset time / data volume threshold, the old key is automatically discarded and a new session key is renegotiated.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the encryption method for industrial Internet data exchange described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the encryption method for industrial Internet data exchange described in any one of claims 1 to 7 are implemented.

Images