An encryption method, device, equipment and medium for industrial Internet data exchange

Abstract

The present invention discloses an encryption method, device, equipment and medium for industrial Internet data exchange, which relates to the field of industrial information security technology. The method comprises the following steps: using the elliptic curve ECDH protocol to generate a pair of public and private keys for industrial equipment or nodes initially participating in data exchange, and performing initial key exchange; generating a temporary additional key and calculating a temporary session key; encrypting the temporary session key using the public key of the recipient to obtain a session key, and processing the data separately according to different stages of the data exchange; and automatically discarding the old key and renegotiating a new session key when each session ends or reaches a preset time / data volume threshold. The present invention reduces resource consumption in the key exchange process, reduces security risks that may be caused by key reuse or long-term fixed keys, improves the anti-attack capability of the data exchange process, ensures the confidentiality and integrity of data exchange, and builds a continuous and secure environment for data exchange on the industrial Internet.

Description

Technical Field

[0001] The present invention relates to the field of industrial information security technology, and in particular to an encryption method, device, equipment and medium for industrial Internet data exchange. Background Art

[0002] In today's wave of digital transformation, the Industrial Internet, as the core support for intelligent manufacturing, is increasingly focusing on the security of its data exchange. With the increasing adoption of Industry 4.0 and the convergence of technologies such as the Internet of Things (IoT), big data, and cloud computing, the volume of data exchanged within the Industrial Internet is not only massive, but also encompasses multiple dimensions, including production, logistics, and management. This places higher demands on secure data transmission. Traditional encryption technologies, such as RSA asymmetric encryption, are increasingly limiting in the face of the massive, real-time data exchange scenarios of the Industrial Internet due to their high computational complexity and resource consumption.

[0003] Therefore, seeking efficient and secure data encryption methods has become a key issue in promoting the healthy development of the Industrial Internet. Against this backdrop, elliptic curve cryptography, with its unique mathematical foundation and algorithmic advantages, has gradually been recognized by the industry as an important means to improve encryption efficiency and security. As an important application of ECC, the elliptic curve protocol achieves secure key exchange by leveraging the intractability of the discrete logarithm problem on elliptic curves. Although ECDH provides strong security guarantees in theory, several challenges remain in practical applications, especially in the Industrial Internet environment, which have not been fully addressed. The primary issue is the complexity of key management. Especially in large-scale networks, frequent key updates and distribution become a significant burden for maintaining system security. In addition, how to ensure the effective implementation of dynamic and secure key policies at different stages of data exchange (such as initialization, data transmission, and session termination) is also a link that existing technologies have not fully covered. Summary of the Invention

[0004] The present invention is proposed in view of the problems existing in the existing encryption methods for industrial Internet data exchange. Therefore, the problem to be solved by the present invention is how to provide an encryption method, device, electronic device and storage medium for industrial Internet data exchange.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0006] In the first aspect, the present invention provides an encryption method for industrial Internet data exchange, which includes using the ECDH protocol to generate a pair of public keys and private keys for industrial equipment or nodes that initially participate in data exchange to initialize key exchange; generating a temporary additional key, and calculating a temporary session key through the temporary additional key and the private key; using the public key of the recipient to encrypt the temporary session key to obtain a session key, and sending it to the recipient, and processing the data according to different stages of the data exchange; completing the industrial Internet data exchange, and when each session ends or reaches a preset time or data volume threshold, automatically discarding the old key and renegotiating a new session key.

[0007] As a preferred solution of the encryption method for industrial Internet data exchange described in the present invention, the generation of a temporary additional key includes the following steps: clarifying the physical environment parameters to be collected, installing corresponding sensors on industrial equipment or nodes, and monitoring and recording the physical environment parameters in real time, including ambient temperature, humidity, vibration frequency, and electromagnetic interference intensity; performing quality checks on the collected data, eliminating outliers or invalid data, and converting the measured values of different parameters to a unified numerical range through normalization processing, mapping all parameters to between 0 and 1; combining the preprocessed parameters according to weights or rules to form a composite value, and converting the composite value into a fixed-length bit string through a secure hash algorithm as a random number seed; using the random number seed and the key derivation function in combination with the private key of the device or node to generate a temporary additional key; calculating a shared temporary session key through the ECDH protocol in combination with the temporary additional key and the private key; repeating the steps to periodically update the temporary session key according to changes in the physical environment parameters or a preset time period.

[0008] As a preferred solution of the encryption method for industrial Internet data exchange described in the present invention, the data is processed separately according to different stages of data exchange, including the following steps: dividing the data into multiple small blocks before actual data exchange encryption, applying a symmetric encryption algorithm to encrypt each data block, and encrypting it using a session key; using homomorphic encryption technology for data that needs to be processed in an encrypted state, combining multiple homomorphic encryption modes, designing a data processing flow, selecting a homomorphic encryption mode according to data processing requirements, and constructing a data processing pipeline to ensure that the data is correctly processed in an encrypted state; using a covert communication protocol to disguise the encrypted data as normal network traffic, and utilizing the redundancy of the network protocol The field embeds encrypted data or adjusts the sending time interval of the data packet to simulate normal network behavior to confuse the data flow; after the actual data exchange is encrypted, the encrypted data packets are reordered or the format is modified, and a security label containing the encrypted data information summary is generated for each data packet. The security label is signed with the sender's private key, and the receiver verifies the signature with the corresponding public key; a quantum key distribution system is deployed on industrial equipment or nodes that repeatedly exchange data, and a quantum key is generated and XORed with a temporary session key; a quantum key distribution protocol is used to distribute a security key between two trusted nodes, and the security key is XORed with the temporary session key generated by the ECDH protocol to directly generate a session key.

[0009] As a preferred solution of the encryption method for industrial Internet data exchange described in the present invention, the method comprises: selecting a homomorphic encryption mode according to data processing requirements includes: if it is necessary to perform arbitrarily complex calculations without decryption, and even a third party cannot obtain the plaintext data, then selecting a fully homomorphic encryption mode, allowing any program to be executed directly on the encrypted data, encrypting the original data, and directly executing the specified algorithm or operation on the encrypted data. After the calculation is completed, the encrypted result is decrypted back to plaintext using a private key to obtain the final calculation output; if it is necessary to perform addition or multiplication operations, then selecting a partial homomorphic encryption mode; if data processing only involves comparison operations, and it is necessary to process sorting or range queries of a large amount of data, then selecting a homomorphic encryption mode, allowing the relative size relationship of the data to be retained in the encrypted state, and performing range queries directly on the encrypted data, and performing data sorting and comparison operations.

[0010] As a preferred solution of the encryption method for industrial Internet data exchange described in the present invention, wherein: the said disguising encrypted data as normal network traffic includes the following steps: obtaining the commonly used protocols and standard formats of the target network, identifying the redundant fields or available spaces in the protocol, and selecting the protocol as the carrier of covert communication according to the network environment and data transmission requirements; dividing the encrypted data to be transmitted into multiple small blocks, and the size of each block should be adapted to the redundant fields or expandable areas of the selected carrier; designing the data encapsulation format to ensure that the encrypted data block can be embedded in the data part or the redundant fields of the header of the carrier protocol without destroying the format integrity of the protocol, and The data blocks are inserted into the corresponding positions of the protocol according to the designed format, and the sending time interval of the data packets is adjusted according to the statistical characteristics of normal network traffic. Data packets simulating normal communication are generated and interspersed between the covert data packets. The size, port number, and sequence number of the data packets are randomized. The covert communication system is tested in a simulated environment to check the integrity and concealment of data transmission, evaluate the anti-detection capability, and adjust the size, sending rate, and camouflage strategy of the data packet based on the test results. The covert communication system is gradually deployed in the real network. After deployment, the operating status of the covert communication is continuously monitored, feedback information on data packet transmission is collected, and the optimization strategy is adjusted in a timely manner.

[0011] As a preferred solution of the encryption method for industrial Internet data exchange described in the present invention, the generation of a security label containing a summary of encrypted data information includes the following steps: reordering the encrypted data packets, modifying the header information of the data packets, using a hash function to calculate the information summary for each encrypted and reassembled data packet, adding necessary metadata to the summary of each data packet to form a security label; using the sender's private key to digitally sign each security label, attaching the digital signature to the corresponding data packet and sending it together with the data packet in accordance with specific protocol requirements; sending the encrypted, reassembled and signed data packet to the receiver through the selected network channel; the receiver receives all data packets, separates the security label and signature from the data packet, and uses the sender's public key to verify the digital signature on each security label; based on the metadata in the label, the data packet is restored to the correct order, the reassembled data packet is decrypted using the corresponding key, and the original data is restored; the summary of the data packet is calculated again and compared with the summary in the security label to ensure data integrity.

[0012] As a preferred solution of the encryption method for industrial Internet data exchange of the present invention, wherein: the reordering of the encrypted data packets includes the following steps: assuming that the original data packet sequence is ,in represents the i-th data packet, and N is the total number of data packets. For each data packet, the offset based on the sequence number is calculated, and a pseudo-random number is generated as the offset indicator using the linear congruential method. The relevant expression is as follows:

[0013]

[0014] Where, is the offset of the sequence number, To calculate the hash function of the message digest, take the low-order 2 bits of the result as the actual offset value; create a new empty sequence R to store the reordered data packets. For each data packet, insert it into the new sequence according to the following steps: Calculate the target position. The relevant expression is as follows:

[0015]

[0016] in, is the position of the i-th data packet in the original sequence, i.e., sequence number i; Insert into the R[T] position. If the position is occupied, continue to look for the next available position. , until an empty position is found; record the sorting information, generate a mapping table M, and record the new and old position relationship of each data packet for the receiver to restore the original order. M[i]=T means that the original i-th packet is now at the T-th position in the new sequence.

[0017] In the second aspect, the present invention provides an encryption device for industrial Internet data exchange, which includes: an initialization module, which uses the ECDH protocol to generate a pair of public keys and private keys for industrial equipment or nodes that initially participate in data exchange, and performs initial key exchange; an additional module, which is used to generate a temporary additional key, and calculate a temporary session key through the temporary additional key and the private key; an encryption module, which is used to encrypt the temporary session key using the public key of the recipient to obtain a session key, and send it to the recipient, and process the data according to different stages of the data exchange; an update module, which is used to complete the industrial Internet data exchange, and when each session ends or reaches a preset time or data volume threshold, the old key is automatically discarded and a new session key is renegotiated.

[0018] In a third aspect, the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the processor executes the computer program, it implements the steps of an encryption method for industrial Internet data exchange.

[0019] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, the steps of the encryption method for industrial Internet data exchange are implemented.

[0020] The beneficial effects of the present invention are to achieve efficient and secure key initialization exchange in resource-constrained industrial environments, reduce resource consumption during the key exchange process, and ensure that a secure communication channel can be quickly established even in complex industrial Internet architectures. This has a significant beneficial effect on improving the security and response speed of initial data exchange. It also reduces the potential security risks caused by key reuse or long-term fixed keys, improves the anti-attack capability of the data exchange process, ensures the confidentiality and integrity of data exchange, and builds a continuously secure environment for data exchange on the Industrial Internet. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 Flowchart of the encryption method for industrial Internet data exchange.

[0023] Figure 2 Diagram of computer devices using encryption methods for data exchange on the Industrial Internet. DETAILED DESCRIPTION

[0024] To make the above-mentioned objects, features, and advantages of the present invention more easily understood, the following detailed description of the specific embodiments of the present invention is given in conjunction with the accompanying drawings. It is obvious that the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in this field without creative work should fall within the scope of protection of the present invention.

[0025] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0026] Secondly, the term "one embodiment" or "embodiment" herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in various places throughout this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive of other embodiments.

[0027] Example 1

[0028] Reference Figure 1 and Figure 2, which is the first embodiment of the present invention, provides an encryption method for industrial Internet data exchange, including:

[0029] S1: Generate a pair of public and private keys using the ECDH protocol for the industrial devices or nodes that initially participate in data exchange and perform initial key exchange.

[0030] Specifically, the ECDH protocol is used to generate a pair of public and private keys for industrial devices or nodes involved in data exchange, and initialize key exchange;

[0031] S2: Generate a temporary additional key and calculate a temporary session key using the temporary additional key and the private key;

[0032] Specifically, the physical environment parameters to be collected should be clearly identified, and corresponding sensors should be installed on industrial equipment or nodes to monitor and record the physical environment parameters in real time, including ambient temperature, humidity, vibration frequency, and electromagnetic interference intensity;

[0033] Perform quality checks on the collected data, remove outliers or invalid data, and convert the measured values of different parameters to a unified numerical range through normalization, mapping all parameters to between 0 and 1;

[0034] The preprocessed parameters are combined according to weights or rules to form a composite value, which is converted into a fixed-length bit string using a secure hash algorithm as a random number seed;

[0035] Generate a temporary additional key using a random number seed and a key derivation function combined with the private key of the device or node;

[0036] The shared temporary session key is calculated by combining the temporary additional key and the private key through the ECDH protocol;

[0037] The temporary session key is updated periodically by repeating the steps according to changes in physical environment parameters or a preset time period.

[0038] S3: Use the recipient's public key to encrypt the temporary session key to obtain the session key, send it to the recipient, and process the data according to different stages of data exchange;

[0039] Specifically, before the actual data exchange and encryption, the data is divided into multiple small blocks, and each data block is encrypted using a symmetric encryption algorithm and a session key;

[0040] Homomorphic encryption technology is used for data that needs to be processed in an encrypted state. Multiple homomorphic encryption modes are combined to design data processing processes. Homomorphic encryption modes are selected according to data processing requirements, and data processing pipelines are constructed to ensure that data is correctly processed in an encrypted state.

[0041] If you need to perform arbitrarily complex calculations without decrypting the data, and even third parties such as cloud service providers cannot access the plaintext data, choose fully homomorphic encryption mode. This allows any program to be executed directly on the encrypted data. Encrypt the original data and execute the specified algorithm or operation directly on the encrypted data. After the calculation is complete, use the private key to decrypt the encrypted result back to the plaintext to obtain the final calculation output.

[0042] If you mainly need to perform addition or multiplication operations, choose the partially homomorphic encryption mode;

[0043] If data processing only involves comparison operations and requires sorting or range queries on large amounts of data, choose the ordered homomorphic encryption mode, which allows the relative size relationships of the data to be retained in the encrypted state, allowing range queries to be performed directly on the encrypted data for data sorting and comparison operations.

[0044] Using covert communication protocols to disguise encrypted data as normal network traffic, using redundant fields in network protocols to embed encrypted data or adjusting the intervals between data packet transmissions to simulate normal network behavior and obfuscate data flows;

[0045] Obtain the target network's commonly used protocols and standard formats, identify redundant fields or available space within the protocols, and select protocols as a covert communication carrier based on the network environment and data transmission requirements. For example, if DNS queries are frequent on the network, DNS protocol can be selected as a covert channel.

[0046] Divide the encrypted data to be transmitted into multiple small blocks, and the size of each block should be adapted to the redundant field or expandable area of the selected carrier;

[0047] The data encapsulation format is designed to ensure that the encrypted data block can be embedded in the data part or redundant field of the header of the carrier protocol without destroying the format integrity of the protocol. The data block is inserted into the corresponding position of the protocol according to the designed format.

[0048] According to the statistical characteristics of normal network traffic, the time interval between sending data packets is adjusted to generate data packets that simulate normal communication and insert them between covert data packets. The size, port number and sequence number of the data packets are randomized.

[0049] Test covert communication systems in a simulated environment, check the integrity and concealment of data transmission, evaluate anti-detection capabilities, and adjust packet size, transmission rate, and camouflage strategies based on test results;

[0050] Gradually deploy the covert communication system in the real network. After deployment, continuously monitor the operation status of the covert communication, collect feedback information on data packet transmission, and adjust the optimization strategy in a timely manner.

[0051] After the actual data exchange is encrypted, the encrypted data packets are reordered or modified in format, and a security tag containing a summary of the encrypted data information is generated for each data packet. The security tag is signed using the sender's private key, and the receiver verifies the signature using the corresponding public key.

[0052] Assume the original data packet sequence is ,in represents the i-th data packet, N is the total number of data packets;

[0053] Calculate the offset based on the sequence number for each data packet and use the linear congruential method to generate a pseudo-random number as the offset indicator. The relevant expression is as follows:

[0054]

[0055] Where, is the offset of the sequence number, To calculate the hash function of the message digest, the low-order 2 bits of the result are taken as the actual offset value, and Mod(N-1) is used to limit the range of the offset;

[0056] Create a new empty sequence R to store the reordered packets. For each packet, insert it into the new sequence according to the following steps:

[0057] Calculate the target position, the relevant expression is as follows:

[0058]

[0059] in, is the position of the i-th data packet in the original sequence, i.e., sequence number i. Mod N is used to ensure that the calculated target position T is within the legal range, i.e., it cycles between 0 and N-1;

[0060] Will Insert into the R[T] position. If the position is occupied, continue to look for the next available position. , until a vacant position is found;

[0061] Record the sorting information and generate a mapping table M to record the new and old position relationship of each data packet for the receiver to restore the original order. M[i]=T means that the original i-th packet is now at the T-th position in the new sequence.

[0062] Reorder the encrypted data packets, modify the header information of the data packets, use the hash function to calculate the information summary of each encrypted and reassembled data packet, and add the necessary metadata to the summary of each data packet to form a security label;

[0063] Use the sender's private key to digitally sign each security tag, attach the digital signature to the corresponding data packet, and send it together with the data packet according to specific protocol requirements;

[0064] Send the encrypted, reassembled and signed data packets to the receiver through the selected network channel;

[0065] The receiver receives all data packets, separates the security tags and signatures from the data packets, and verifies the digital signature on each security tag using the sender's public key;

[0066] Based on the metadata in the tag, the data packets are restored to the correct order, and the corresponding key is used to decrypt the reassembled data packets to restore the original data;

[0067] The digest of the data packet is recalculated and compared with the digest in the security label to ensure data integrity.

[0068] Deploy a quantum key distribution system on industrial equipment or nodes that repeatedly exchange data to generate quantum keys and perform XOR operations with temporary session keys;

[0069] A security key is distributed between two trusted nodes using the quantum key distribution protocol. This key is then XORed with the temporary session key generated by the ECDH protocol to directly generate the session key. QKD provides theoretically unbreakable security because any attempt to eavesdrop is immediately detected due to the change in the quantum state.

[0070] S4: Complete the industrial Internet data exchange. When each session ends or reaches the preset time or data volume threshold, the old key is automatically discarded and a new session key is renegotiated.

[0071] Furthermore, this embodiment also provides an encryption device for industrial Internet data exchange, including: an initialization module, which uses the ECDH protocol to generate a pair of public keys and private keys for industrial equipment or nodes that initially participate in data exchange to perform initial key exchange; an additional module, which is used to generate a temporary additional key, and calculate a temporary session key through the temporary additional key and the private key; an encryption module, which is used to use the public key of the recipient to encrypt the temporary session key to obtain a session key, send it to the recipient, and process the data according to different stages of data exchange; an update module, which is used to complete industrial Internet data exchange, and when each session ends or reaches a preset time or data volume threshold, the old key is automatically discarded and a new session key is renegotiated.

[0072] This embodiment also provides a computer device suitable for the encryption method of industrial Internet data exchange, including: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute computer-executable instructions to implement all or part of the steps of the method described in the embodiment of the present invention as proposed in the above embodiment.

[0073] This embodiment also provides a storage medium having a computer program stored thereon, which, when executed by a processor, executes the method of any optional implementation of the above embodiment. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk, or optical disk.

[0074] The storage medium proposed in this embodiment and the data storage method proposed in the above embodiment belong to the same inventive concept. Technical details not fully described in this embodiment can be found in the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0075] As can be seen from the above, this method first realizes efficient and secure key initialization exchange in a resource-constrained industrial environment, provides higher security and computational efficiency than traditional RSA encryption, reduces resource consumption in the key exchange process, and ensures that even in a complex industrial Internet architecture, a secure communication channel can be quickly established, which has a significant beneficial effect on improving the security and response speed of the initial data exchange. Enhance the dynamics and security of data exchange. Allow each session to be based on a different key. Even if a key is unfortunately leaked, it will not affect the security of other sessions, greatly reducing the security risks that may be caused by key reuse or long-term fixed keys. Improve the anti-attack capability of the entire data exchange process and ensure the confidentiality and integrity of data exchange. Implement strict management of the key life cycle to prevent security vulnerabilities that may be caused by long-term use of keys, and build a continuous and secure environment for data exchange on the industrial Internet.

[0076] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. An encryption method for industrial Internet data exchange, characterized by: include, For industrial devices or nodes that initially participate in data exchange, use the ECDH protocol to generate a pair of public and private keys to perform initial key exchange; Generate a temporary additional key and calculate a temporary session key using the temporary additional key and the private key; The temporary session key is encrypted using the recipient's public key to obtain the session key, which is then sent to the recipient. The data is processed according to different stages of data exchange. Complete industrial Internet data exchange. When each session ends or reaches a preset time or data volume threshold, the old key is automatically discarded and a new session key is renegotiated. The generating of the temporary additional key and calculating the temporary session key by using the temporary additional key and the private key comprises the following steps: Identify the physical environment parameters to be collected, install corresponding sensors on industrial equipment or nodes, and monitor and record physical environment parameters in real time, including ambient temperature, humidity, vibration frequency, and electromagnetic interference intensity; Perform quality checks on the collected data, remove outliers or invalid data, and convert the measured values of different parameters to a unified numerical range through normalization, mapping all parameters to between 0 and 1; The preprocessed parameters are combined according to weights or rules to form a composite value, which is converted into a fixed-length bit string using a secure hash algorithm as a random number seed; Generate a temporary additional key using a random number seed and a key derivation function combined with the private key of the device or node; The shared temporary session key is calculated by combining the temporary additional key and the private key through the ECDH protocol; The temporary session key is updated periodically by repeating the steps according to changes in physical environment parameters or a preset time period.

2. The encryption method for industrial Internet data exchange according to claim 1, characterized in that: Said processing of data according to different stages of data exchange comprises the following steps: Before the actual data exchange is encrypted, the data is divided into multiple small blocks, and each data block is encrypted using a symmetric encryption algorithm and a session key; Homomorphic encryption technology is used for data that needs to be processed in an encrypted state. Multiple homomorphic encryption modes are combined to design data processing processes. Homomorphic encryption modes are selected according to data processing requirements, and data processing pipelines are constructed to ensure that data is correctly processed in an encrypted state. Using covert communication protocols to disguise encrypted data as normal network traffic, using redundant fields in network protocols to embed encrypted data or adjusting the intervals between data packet transmissions to simulate normal network behavior and obfuscate data flows; After the actual data exchange is encrypted, the encrypted data packets are reordered or modified in format, and a security tag containing a summary of the encrypted data information is generated for each data packet. The security tag is signed using the sender's private key, and the receiver verifies the signature using the corresponding public key. Deploy a quantum key distribution system on industrial equipment or nodes that repeatedly exchange data to generate quantum keys and perform XOR operations with temporary session keys; The quantum key distribution protocol is used to distribute the security key between two trusted nodes, and the security key is XORed with the temporary session key generated by the ECDH protocol to directly generate the session key.

3. The encryption method for industrial Internet data exchange according to claim 2, characterized in that: The selection of homomorphic encryption mode according to data processing requirements includes: If you need to perform arbitrarily complex calculations without decrypting the data, and even third parties cannot access the plaintext data, choose fully homomorphic encryption mode. This allows any program to be executed directly on the encrypted data. Encrypt the original data and execute the specified algorithm or operation directly on the encrypted data. After the calculation is complete, use the private key to decrypt the encrypted result back to the plaintext to obtain the final calculation output. If addition or multiplication operations need to be performed, select the partially homomorphic encryption mode; If data processing only involves comparison operations and requires sorting or range queries on large amounts of data, choose the ordered homomorphic encryption mode, which allows the relative size relationships of the data to be retained in the encrypted state, allowing range queries to be performed directly on the encrypted data for data sorting and comparison operations.

4. The encryption method for industrial Internet data exchange according to claim 3, characterized in that: Disguising encrypted data as normal network traffic includes the following steps: Obtain the target network's commonly used protocols and standard formats, identify redundant fields or available space in the protocol, and select the protocol as the carrier for covert communication based on the network environment and data transmission requirements; Divide the encrypted data to be transmitted into multiple small blocks, and the size of each block should be adapted to the redundant field or expandable area of the selected carrier; The data encapsulation format is designed to ensure that the encrypted data block can be embedded in the data part or redundant field of the header of the carrier protocol without destroying the format integrity of the protocol. The data block is inserted into the corresponding position of the protocol according to the designed format. According to the statistical characteristics of normal network traffic, the time interval between sending data packets is adjusted to generate data packets that simulate normal communication and insert them between covert data packets. The size, port number and sequence number of the data packets are randomized. Test covert communication systems in a simulated environment, check the integrity and concealment of data transmission, evaluate anti-detection capabilities, and adjust packet size, transmission rate, and camouflage strategies based on test results; Gradually deploy the covert communication system in the real network. After deployment, continuously monitor the operation status of the covert communication, collect feedback information on data packet transmission, and adjust the optimization strategy in a timely manner.

5. The encryption method for industrial Internet data exchange according to claim 4, characterized in that: The generation of a security label containing a summary of the encrypted data information comprises the following steps: Reorder the encrypted data packets, modify the header information of the data packets, use the hash function to calculate the information summary of each encrypted and reassembled data packet, and add the necessary metadata to the summary of each data packet to form a security label; Use the sender's private key to digitally sign each security tag, attach the digital signature to the corresponding data packet, and send it together with the data packet according to specific protocol requirements; Send the encrypted, reassembled and signed data packets to the receiver through the selected network channel; The receiver receives all data packets, separates the security tags and signatures from the data packets, and verifies the digital signature on each security tag using the sender's public key; Based on the metadata in the tag, the data packets are restored to the correct order, and the corresponding key is used to decrypt the reassembled data packets to restore the original data; The digest of the data packet is recalculated and compared with the digest in the security label to ensure data integrity.

6. The encryption method for industrial Internet data exchange according to claim 5, characterized in that: The reordering of the encrypted data packets comprises the following steps: Assume the original data packet sequence is ,in represents the i-th data packet, N is the total number of data packets; Calculate the offset based on the sequence number for each data packet and use the linear congruential method to generate a pseudo-random number as the offset indicator. The relevant expression is as follows: Where, is the offset of the sequence number, To calculate the hash function of the message digest, take the low-order 2 bits of the result as the actual offset value; Create a new empty sequence R to store the reordered packets. For each packet, insert it into the new sequence according to the following steps: Calculate the target position, the relevant expression is as follows: in, is the position of the i-th data packet in the original sequence, i.e., sequence number i; Will Insert into the R[T] position. If the position is occupied, continue to look for the next available position. , until a vacant position is found; Record the sorting information and generate a mapping table M to record the new and old position relationship of each data packet for the receiver to restore the original order. M[i]=T means that the original i-th packet is now at the T-th position in the new sequence.

7. An encryption device for industrial Internet data exchange, based on the encryption method for industrial Internet data exchange according to any one of claims 1 to 6, characterized in that: include, The initialization module uses the ECDH protocol to generate a pair of public and private keys for the industrial equipment or nodes that initially participate in data exchange and perform initial key exchange; An additional module, used for generating a temporary additional key and calculating a temporary session key by using the temporary additional key and a private key; The encryption module is used to encrypt the temporary session key using the public key of the recipient to obtain the session key, send it to the recipient, and process the data according to different stages of data exchange; The update module is used to complete industrial Internet data exchange. When each session ends or reaches the preset time or data volume threshold, the old key is automatically discarded and a new session key is renegotiated.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the encryption method for industrial Internet data exchange described in any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the encryption method for industrial Internet data exchange described in any one of claims 1 to 6 are implemented.

Images