Data processing method and system

Abstract

The invention provides a data processing method and system, and relates to the field of data processing.The method comprises the steps that an industrial data acquisition end sends verification code generation request information used for requesting a verification code; the verification code generation server performs authority verification based on the equipment information of the industrial data acquisition end included in the verification code generation request information, and generates a dynamic verification code; the industrial data acquisition end performs identity verification based on the dynamic verification code; when the identity verification is passed, the industrial data acquisition end constructs a locally stored initial key sequence based on the dynamic verification code to obtain an encrypted key sequence, the initial key sequence and the encrypted key sequence both comprise a plurality of key moments, to-be-reported industrial data is segmented, a plurality of industrial data segments are encrypted, and the encrypted key moments are sent to the industrial data acquisition end; uploading a plurality of industrial data ciphertext fragments; and the storage management server obtains the information of the plurality of storage nodes and stores the plurality of industrial data ciphertext fragments, so that the method has the advantage of improving the security of the industrial data.

Description

Technical Field

[0001] The present invention relates to the field of data processing, and in particular to a data processing method and system. Background Art

[0002] The Industrial Internet of Things usually uses smart sensors and actuators to connect the network to form a system with data collection, analysis, conversion, transmission, storage, monitoring and feedback functions. The components of the Industrial Internet of Things include the Internet of Things gateway, sensors, actuators and edge devices. The Internet of Things gateway and sensors transmit the sensed information to the data communication equipment, which converts it into operational information that can be run by the machine. This information plays a key role in predictive maintenance, efficient on-site service, asset tracking and monitoring management, improving customer satisfaction, improving productivity and intelligent management.

[0003] At present, in order to prevent industrial data from being stolen, a large number of encryption software have been produced to encrypt the data that needs to be protected. In the encryption process, the plaintext is converted into ciphertext through the encryption algorithm and encryption key, and in the decryption algorithm, the ciphertext is restored to plaintext through the decryption algorithm and decryption key. However, when the key has been determined, the plaintext and the password are in a one-to-one correspondence, and brute force methods such as exhaustive methods can be used to crack it, resulting in the leakage of target data, and the security of the encrypted industrial data is low.

[0004] Therefore, it is necessary to provide a data processing method and system for dynamically encrypting industrial data to improve the security of industrial data. Summary of the invention

[0005] The present invention provides a data processing method, comprising: when performing industrial data reporting, the industrial data acquisition terminal sends verification code generation request information for requesting a verification code to a verification code generation server, wherein the verification code generation request information includes the device information of the industrial data acquisition terminal; the verification code generation server performs authority verification based on the device information of the industrial data acquisition terminal included in the verification code generation request information, and generates a dynamic verification code; when receiving the dynamic verification code sent from the dynamic verification code generation server, the industrial data acquisition terminal performs identity authentication based on the dynamic verification code; when the identity authentication is passed, the industrial data acquisition terminal converts the dynamic verification code into a digital matrix, determines a flag bit in the dynamic verification code, and determines a target operation mode based on the value of the flag bit, wherein the target operation mode is addition, subtraction, XOR and XOR. One or more combinations thereof, based on the target operation mode, operate the digital matrix and each key matrix included in the initial key sequence to obtain an encryption key sequence, wherein the number of the multiple key matrices included in the encryption key sequence is consistent with the number of the multiple key matrices included in the initial key sequence; the industrial data acquisition end divides the industrial data to be reported based on the multiple key matrices to obtain multiple industrial data fragments with the same number of key matrices; the industrial data acquisition end encrypts the multiple industrial data fragments based on the encryption key sequence to obtain multiple industrial data ciphertext fragments; the industrial data acquisition end uploads the multiple industrial data ciphertext fragments to the storage management server; the storage management server obtains information of multiple storage nodes, and stores the multiple industrial data ciphertext fragments based on the information of the multiple storage nodes.

[0006] Furthermore, the industrial data acquisition terminal determines the target operation mode based on the value of the flag bit, including: determining the target operation mode based on the value of the flag bit and a pre-constructed operation mode relationship table, wherein the operation mode relationship table contains the correspondence between the flag bit value and the operation mode.

[0007] Furthermore, the industrial data acquisition terminal segments the industrial data to be reported based on the multiple key matrices to obtain multiple industrial data segments with the same number as the key matrices, including: converting the industrial data to be reported into digital plaintext based on an ASCII comparison table; segmenting the digital plaintext according to a fixed length to obtain multiple initial plaintext segments; when the number of the initial plaintext segments is less than the number of key matrices, adding one or more empty segments after the multiple initial plaintext segments to obtain multiple industrial data segments, so that the number of the industrial data segments to be reported is equal to the number of key matrices; when the number of the initial plaintext segments is greater than or equal to the number of key matrices, using the multiple initial plaintext segments as multiple industrial data segments.

[0008] Furthermore, the industrial data acquisition terminal encrypts multiple industrial data fragments based on the encryption key sequence to obtain multiple industrial data ciphertext fragments, including: converting the industrial data fragments to be reported into plaintext matrices; aligning the key matrix in the encryption key sequence with multiple plaintext matrices in order of arrangement, and when the number of key matrices is less than the number of plaintext matrices, adding A×n+m key matrices after the aligned encryption key sequence, so that each plaintext matrix corresponds to a key matrix, wherein n is the number of key matrices of a complete encryption key sequence, A is an integer greater than or equal to 0, m=MA×n, M is the number of plaintext matrices, and the added key matrices are arranged in the order in the encryption key sequence; performing AES encryption on the corresponding plaintext matrix based on each key matrix to obtain multiple industrial data ciphertext fragments.

[0009] Furthermore, the industrial data acquisition terminal uploads the multiple industrial data ciphertext fragments to the storage management server, including: determining the encryption time of the multiple industrial data ciphertext fragments; constructing a ciphertext based on the multiple industrial data ciphertext fragments and the encryption time, and uploading the ciphertext and the multiple industrial data ciphertext fragments to the storage management server, so that the storage management server obtains the corresponding dynamic verification code from the dynamic verification code generation server according to the encryption time to construct the initial key sequence in the storage management server.

[0010] Furthermore, the method also includes: when querying historical industrial data, the industrial data acquisition terminal simultaneously sends data query request information to the storage management server and the dynamic verification code generation server, wherein the data query request information includes the encryption time corresponding to the historical industrial data to be queried and the device information of the industrial data acquisition terminal; when the industrial data acquisition terminal receives the ciphertext returned from the storage management server and the verification code returned from the dynamic verification code generation server, the industrial data acquisition terminal constructs an initial key sequence stored locally based on the returned verification code to obtain a decryption key sequence, wherein the ciphertext returned by the storage management server and the verification code returned by the dynamic verification code generation server are generated based on the data query request information; the industrial data acquisition terminal decrypts the ciphertext returned by the storage management server based on the decryption key sequence to obtain the corresponding historical industrial data.

[0011] Furthermore, the industrial data acquisition terminal decrypts the ciphertext returned by the storage management server based on the decryption key sequence to obtain the corresponding historical industrial data, including: aligning each key matrix in the decryption key sequence with multiple industrial data ciphertext fragments in the ciphertext returned by the storage management server; when the number of key matrices is less than the number of industrial data ciphertext fragments in the ciphertext, adding A×n+l key matrices after the aligned decryption key sequence so that each industrial data ciphertext fragment corresponds to a key matrix, wherein n is the number of key matrices of a complete decryption key sequence, A is an integer greater than or equal to 0, l=LA×n, L is the number of industrial data ciphertext fragments, and the added key matrices are arranged in the order in the decryption key sequence; performing AES inverse operations on the corresponding industrial data ciphertext fragments based on each key matrix to obtain multiple industrial data fragments; and constructing historical industrial data based on the multiple industrial data fragments.

[0012] Furthermore, the storage management server stores the multiple industrial data ciphertext fragments based on the information of the multiple storage nodes, including: based on the remaining computing resource information and the remaining storage resource information of each of the storage nodes, screening the multiple storage nodes to determine at least one candidate storage node; based on the remaining computing resource information and the remaining storage resource information of each of the candidate storage nodes, generating multiple candidate storage schemes; for each of the candidate storage schemes, based on the storage evaluation system, determining the matching score corresponding to the candidate migration scheme, wherein the storage evaluation system includes multiple storage evaluation indicators and a weight corresponding to each of the storage evaluation indicators; based on the matching score corresponding to each of the candidate storage schemes, determining the target storage scheme from the multiple candidate storage schemes.

[0013] Furthermore, the storage management server generates multiple candidate storage solutions based on the remaining computing resource information and the remaining storage resource information of each candidate storage node, including: generating multiple candidate storage solutions based on a constraint set, the remaining computing resource information and the remaining storage resource information of the candidate storage nodes through a Monte Carlo model, wherein the candidate storage solutions include a target storage node corresponding to each industrial data fragment.

[0014] The present invention provides a data processing system including an industrial data acquisition terminal, a verification code generation server and a storage management server; the industrial data acquisition terminal is used to send verification code generation request information for requesting a verification code to the verification code generation server when performing industrial data reporting; the verification code generation server is used to generate a dynamic verification code based on the verification code generation request information; the industrial data acquisition terminal is also used to perform identity authentication based on the dynamic verification code when receiving the dynamic verification code sent by the dynamic verification code generation server; the industrial data acquisition terminal is also used to convert the dynamic verification code into a digital matrix when the identity authentication is passed, and determine the flag bit in the dynamic verification code, and determine the target operation mode based on the value of the flag bit, wherein the target operation mode is one or more combinations of addition, subtraction, XOR and XOR, based on the target The operation method operates the digital matrix and each key matrix included in the initial key sequence to obtain an encryption key sequence, wherein the number of multiple key matrices included in the encryption key sequence is consistent with the number of multiple key matrices included in the initial key sequence; the industrial data acquisition end is also used to segment the industrial data to be reported based on the multiple key matrices to obtain multiple industrial data fragments with the same number of key matrices; the industrial data acquisition end is also used to encrypt the multiple industrial data fragments based on the encryption key sequence to obtain multiple industrial data ciphertext fragments; the industrial data acquisition end is also used to upload the multiple industrial data ciphertext fragments to the storage management server; the storage management server is used to obtain information of multiple storage nodes, and store the multiple industrial data ciphertext fragments based on the information of the multiple storage nodes.

[0015] Compared with the prior art, the data processing method and system provided by the present invention have at least the following beneficial effects:

[0016] Each time industrial data is reported, the identity of the industrial data collection end will be verified by requesting a verification code. After the identity is verified, the industrial data reporting will be executed. In this process, the industrial data collection end automatically combines the dynamic verification code to construct an encryption key sequence different from the initial key sequence, and encrypts the industrial data based on the encryption key sequence. The encrypted ciphertext is subsequently sent to multiple storage nodes for storage. Since the dynamic verification code is randomly generated by the verification code generation server, the key sequence corresponding to each industrial data to be reported is different. When decrypting, it is necessary to combine the dynamic verification code sent by the verification code generation server at the time and the local initial key sequence to construct the corresponding decryption key sequence. Therefore, even if multiple storage nodes are hacked, the industrial data will not be leaked, which improves the security of industrial data. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] This specification will be further described in the form of exemplary embodiments, which will be described in detail by the accompanying drawings. These embodiments are not restrictive, and in these embodiments, the same number represents the same structure, wherein:

[0018] Figure 1 is a module schematic diagram of a data processing system according to some embodiments of this specification;

[0019] Figure 2 It is a flowchart of a data processing method shown in some embodiments of this specification. DETAILED DESCRIPTION

[0020] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the following is a brief introduction to the drawings required for the description of the embodiments. Obviously, the drawings described below are only some examples or embodiments of this specification. For ordinary technicians in this field, this specification can also be applied to other similar scenarios based on these drawings without creative work. Unless it is obvious from the language environment or otherwise explained, the same reference numerals in the figures represent the same structure or operation.

[0021] Figure 1 is a module diagram of a data processing system according to some embodiments of this specification, such as Figure 1 As shown, a data processing system may include an industrial data acquisition terminal, a verification code generation server and a storage management server.

[0022] The industrial data collection terminal is used to send verification code generation request information for requesting a verification code to the verification code generation server when performing industrial data reporting.

[0023] The verification code generation server is used to generate a dynamic verification code based on the verification code generation request information.

[0024] The industrial data acquisition terminal is also used to perform identity authentication based on the dynamic verification code when receiving the dynamic verification code sent from the dynamic verification code generation server.

[0025] The industrial data acquisition terminal is also used to convert the dynamic verification code into a digital matrix when the identity authentication is passed, and determine the flag bit in the dynamic verification code, and determine the target operation mode based on the value of the flag bit, wherein the target operation mode is one or more combinations of addition, subtraction, XOR and XOR, and the digital matrix and each key matrix included in the initial key sequence are operated based on the target operation mode to obtain an encryption key sequence, wherein the number of multiple key matrices included in the encryption key sequence is consistent with the number of multiple key matrices included in the initial key sequence.

[0026] The industrial data collection end is also used to segment the industrial data to be reported based on multiple key matrices to obtain multiple industrial data segments with the same number as the key matrices.

[0027] The industrial data acquisition terminal is also used to encrypt multiple industrial data fragments based on an encryption key sequence to obtain multiple industrial data ciphertext fragments.

[0028] The industrial data collection terminal is also used to upload multiple industrial data ciphertext fragments to the storage management server.

[0029] The storage management server is used to obtain information of multiple storage nodes and store multiple industrial data ciphertext fragments based on the information of the multiple storage nodes.

[0030] Under the above mechanism, if the storage management server and multiple storage nodes are hacked, only the ciphertext and the initial key sequence that cannot decrypt the ciphertext are obtained. If the hacker needs to manipulate the storage management server to retrieve the verification code in the verification code generation server, then the identity authentication system in the verification code generation server needs to be broken. Therefore, in the above system, the security of the historical industrial data reported by the industrial data collection terminal can be guaranteed to the greatest extent.

[0031] Figure 2 is a flow chart of a data processing method according to some embodiments of this specification, such as Figure 2 As shown: A data processing method of this embodiment may include steps S210 to S280:

[0032] S210, when performing industrial data reporting, the industrial data collection terminal sends verification code generation request information for requesting a verification code to the verification code generation server;

[0033] The verification code generation request information includes the device information of the industrial data collection terminal, such as the device unique identification code and device location information.

[0034] S220, the verification code generation server performs authority verification based on the device information of the industrial data acquisition terminal included in the verification code generation request information, and generates a dynamic verification code;

[0035] The verification code generation server performs authority verification based on the pre-stored device information of each industrial data acquisition terminal and the device information of the industrial data acquisition terminal included in the verification code generation request information.

[0036] S230, when receiving the dynamic verification code sent from the dynamic verification code generation server, the industrial data acquisition terminal performs identity authentication based on the dynamic verification code;

[0037] Among them, the industrial data collection end returns the dynamic verification code to the verification code generation server. When the verification code generation server determines that the previous and subsequent verification codes are consistent, it assigns permissions to the corresponding account, and then the industrial data reporting operation can be performed. The above identity authentication mechanism has been used in a large number of industrial data processing scenarios, and will not be repeated here.

[0038] S240, when the identity authentication is passed, the industrial data acquisition terminal converts the dynamic verification code into a digital matrix, determines a flag bit in the dynamic verification code, determines a target operation mode based on the value of the flag bit, and operates the digital matrix and each key matrix included in the initial key sequence based on the target operation mode to obtain an encryption key sequence;

[0039] The target operation mode is one or a combination of addition, subtraction, XOR and XOR, and the number of the multiple key matrices included in the encryption key sequence is consistent with the number of the multiple key matrices included in the initial key sequence.

[0040] The locally stored initial key sequence is encrypted and transmitted in advance through the storage management server. This application adopts symmetric encryption, and the same initial key sequence is stored in both the industrial data acquisition terminal and the storage management server. In order to ensure the security of the locally stored encryption key sequence, SSL / TLS encrypted email transmission, segmented transmission, multiple signatures and other mechanisms can be used for transmission.

[0041] In order to avoid the high risk of using the same key to encrypt all industrial data, this application directly uses the dynamic verification code sent by the verification code generation server to construct the initial key sequence, thereby obtaining a unique encryption key sequence. In order to improve the security of industrial data.

[0042] S250, the industrial data collection end segments the industrial data to be reported based on the multiple key matrices to obtain multiple industrial data segments with the same number as the key matrices;

[0043] This application uses the AES algorithm for encryption. In the AES encryption algorithm, the length of the plaintext is fixed at 128 bits (i.e. 16 bytes), but the industrial data reported each time is generally larger than 128 bits. Therefore, the industrial data needs to be segmented before encryption to meet the encryption conditions of the AES encryption algorithm.

[0044] S260, the industrial data collection end encrypts the multiple industrial data fragments based on the encryption key sequence to obtain multiple industrial data ciphertext fragments;

[0045] The industrial data ciphertext fragments are encrypted based on the constructed encryption key sequence, so the encryption key sequences corresponding to multiple industrial data ciphertext fragments corresponding to different industrial data are different, thereby improving the security of the industrial data.

[0046] S270, the industrial data collection terminal uploads multiple industrial data ciphertext segments to the storage management server;

[0047] S280, the storage management server obtains information of multiple storage nodes, and stores multiple industrial data ciphertext segments based on the information of the multiple storage nodes.

[0048] Specifically include:

[0049] Based on the remaining computing resource information and the remaining storage resource information of each storage node, multiple storage nodes are screened to determine at least one candidate storage node;

[0050] Generate multiple candidate storage solutions based on the remaining computing resource information and remaining storage resource information of each candidate storage node;

[0051] For each candidate storage solution, a matching score corresponding to the candidate migration solution is determined based on a storage evaluation system, wherein the storage evaluation system includes multiple storage evaluation indicators and a weight corresponding to each storage evaluation indicator, and the multiple storage evaluation indicators may include a storage load balance indicator of the candidate storage node and an industrial data fragment distribution balance indicator, etc.;

[0052] Based on the matching score corresponding to each candidate storage solution, a target storage party is determined from multiple candidate storage solutions.

[0053] A Monte Carlo model can be used to generate multiple candidate storage solutions based on a set of constraints, remaining computing resource information and remaining storage resource information of candidate storage nodes, wherein the candidate storage solutions include a target storage node corresponding to each industrial data fragment, and the set of constraints can include a minimum constraint on remaining computing resources and a minimum constraint on remaining storage resources of the candidate storage nodes.

[0054] The locally stored initial key sequence is constructed based on the verification code to obtain an encryption key sequence, including:

[0055] S310, converting the dynamic verification code into a digital matrix, and determining a flag bit in the dynamic verification code, wherein the flag bit is one of the bits of the verification code;

[0056] The dynamic verification code of the present application is an 8-bit hexadecimal number, and the converted digital matrix is ​​a 4*4 matrix. Therefore, 0 can be assigned in front of or after each verification code digit to obtain a 16-bit number, and then the corresponding 4*4 digital matrix can be obtained.

[0057] The flag bit in the dynamic verification code can be determined according to the order, such as the first bit; or it can be determined according to the value, such as the maximum bit, the minimum bit; this application does not make any restrictions here. The value of the flag bit is used to determine the subsequent calculation method for constructing the encryption key sequence.

[0058] In this embodiment, the target operation mode is determined based on the value of the flag bit and a pre-constructed operation mode relationship table, wherein the operation mode relationship table includes the corresponding relationship between the value of the flag bit and the operation mode.

[0059] S320, determining a target operation mode based on the value of the flag bit, wherein the target operation mode is one or a combination of addition, subtraction, XOR and XOR;

[0060] S330, performing operations on the digital matrix and each key matrix based on the target operation mode to obtain an encryption key sequence.

[0061] The digital matrix is ​​a 4*4 matrix, and the key matrix is ​​also a 4*4 matrix. Therefore, when performing operations, the numbers in the same position can be operated correspondingly. The target operation mode is one of addition, subtraction, XOR and XOR, or a combination of addition first and then XOR, subtraction first and then XOR, so as to transform each key matrix.

[0062] The industrial data is segmented to obtain multiple industrial data segments with the same number as the key matrix, including:

[0063] S410, converting the industrial data into digital plain text based on the ASCII comparison table; wherein the digital plain text is in hexadecimal.

[0064] S420, divide the digital plaintext into fixed lengths to obtain multiple initial plaintext fragments; this application uses the AES encryption algorithm for encryption, so it is also necessary to divide the digital plaintext into initial plaintext fragments of size 128 bits, and the last initial plaintext fragment is less than or equal to 128 bits.

[0065] S430, when the number of initial plaintext fragments is less than the number of key matrices, one or more empty fragments are added after the multiple initial plaintext fragments to obtain multiple industrial data fragments, so that the number of industrial data fragments is equal to the number of key matrices; when the number of initial plaintext fragments is greater than or equal to the number of key matrices, the multiple initial plaintext fragments are used as multiple industrial data fragments.

[0066] In this embodiment, since the number of key matrices in the encryption key sequence is fixed, when the number of initial plaintext segments is less than the number of key matrices, empty segments are added at the end to make up for the number. When the empty segments are subsequently encrypted, the ciphertext obtained is directly empty. When decrypting, if there is an empty ciphertext, it can be directly restored to an empty segment.

[0067] Multiple industrial data fragments are encrypted based on the encryption key sequence to obtain multiple industrial data ciphertext fragments, including:

[0068] S510, converting the industrial data fragments into a plaintext matrix; each industrial data fragment is 128 bits, that is, 16 bytes, and thus can be directly converted into a 4*4 plaintext matrix required by the AES algorithm.

[0069] S520, aligning the key matrix in the encryption key sequence with the plurality of plaintext matrices in an arrangement order, and when the number of the key matrices is less than the number of the plaintext matrices, adding A×n+m key matrices after the aligned encryption key sequence, so that each plaintext matrix corresponds to a key matrix, wherein n is the number of key matrices of a complete encryption key sequence, A is an integer greater than or equal to 0, m=MA×n, M is the number of plaintext matrices, and the added key matrices are arranged in the order in the encryption key sequence;

[0070] If the number of plaintext matrices is greater than the number of key matrices in the encryption key sequence, the encryption key sequence is copied and placed cyclically after the aligned encryption key sequence until all plaintext matrices are aligned with a key matrix. At this time, the redundant key matrices are removed to complete the preparations before encryption. At this time, the number of key matrices added is A×n+m.

[0071] S530, performing AES encryption on the corresponding plaintext matrix based on each key matrix to obtain multiple industrial data ciphertext fragments.

[0072] This application adopts AES encryption. For each plaintext matrix and the corresponding key matrix, the plaintext matrix and the key matrix are first XORed to obtain the first matrix; then the key is expanded based on the key matrix to obtain 10 rounds of sub-keys, and then 9 rounds of first encryption (including sequential byte substitution, row shift, column confusion, and round key addition) are performed on the first matrix based on the corresponding sub-key, and the second encryption (including sequential byte substitution, row shift, and round key addition) is performed in the 10th round, and finally the industrial data ciphertext fragment is obtained. Perform the above operations on all plaintext matrices and the corresponding key matrices to obtain multiple industrial data ciphertext fragments.

[0073] In one embodiment of the present application, after obtaining a plurality of industrial data ciphertext segments, the method further includes:

[0074] Determine the encryption time of multiple ciphertext segments of industrial data;

[0075] A ciphertext is constructed based on multiple industrial data ciphertext fragments and encryption time, and the ciphertext is sent to a storage management server, so that the storage management server obtains a corresponding verification code from a verification code generation server according to the encryption time to construct an initial key sequence in the storage management server.

[0076] Since this application adopts dynamic encryption, the industrial data collection terminal automatically encrypts after passing the verification. Therefore, the encryption time of the industrial data ciphertext fragment is basically consistent with the verification time, but there may still be a slight difference. Therefore, the verification code corresponding to the verification time consistent with the encryption time ±(5-10)S is the verification code corresponding to the encryption time.

[0077] In this embodiment, if the background needs to retrieve industrial data from the industrial data collection terminal, it also needs to first verify the authority through the management host. After verification, the storage management server can obtain the corresponding verification code in the verification code generation server and construct the decryption key sequence in the same way as above to decrypt. This prevents the storage management server from being hijacked and directly retrieving the verification code from the verification code generation server for decryption.

[0078] In one embodiment of the present application, it also includes:

[0079] When requesting historical industrial data from the storage management server, simultaneously sending data query request information to the storage management server and the verification code generation server, wherein the data query request information includes the encryption time;

[0080] Upon receiving the ciphertext returned from the storage management server and the verification code returned from the verification code generation server, constructing the initial key sequence stored locally based on the returned verification code to obtain a decryption key sequence, wherein the ciphertext returned by the storage management server and the verification code returned by the verification code generation server are generated based on the data query request information;

[0081] The ciphertext returned by the storage management server is decrypted based on the decryption key sequence to obtain the corresponding historical industrial data.

[0082] If a user needs to access the historical industrial data of a certain industrial data collection terminal, he only needs to specify the generation time of the historical industrial data to be accessed (basically consistent with the verification time). If the user obtains the permission in advance, he can retrieve the corresponding ciphertext from the storage management server and the corresponding verification code from the verification code generation server, and automatically construct and decrypt the key in the background of the industrial data collection terminal, and finally display the obtained historical industrial data to the industrial data collection terminal. The above process is automatically completed in the background of the industrial data collection terminal, thereby realizing the dynamic encryption / decryption of historical industrial data.

[0083] In one embodiment of the present application, the ciphertext returned by the storage management server is decrypted based on the decryption key sequence to obtain the corresponding historical industrial data, including:

[0084] aligning each key matrix in the decryption key sequence with a plurality of industrial data ciphertext fragments in the ciphertext returned by the storage management server;

[0085] When the number of key matrices is less than the number of industrial data ciphertext segments in the ciphertext, A×n+l key matrices are added after the aligned decryption key sequence so that each industrial data ciphertext segment corresponds to a key matrix, where n is the number of key matrices of a complete decryption key sequence, A is an integer greater than or equal to 0, l=LA×n, L is the number of industrial data ciphertext segments, and the added key matrices are arranged in the order in the decryption key sequence;

[0086] Based on each key matrix, an AES inverse operation is performed on the corresponding industrial data ciphertext fragment to obtain multiple industrial data fragments;

[0087] Build historical industrial data based on multiple industrial data fragments.

[0088] In this application, the encryption process is basically the same as the decryption process. It is necessary to align the industrial data ciphertext fragment with the constructed decryption key sequence, and then perform the AES inverse operation respectively. The process of AES inverse operation is prior art and will not be repeated here.

[0089] A data processing method of the present invention, each time industrial data is reported, the identity of the industrial data acquisition terminal will be verified by requesting a verification code, and the industrial data reporting will be executed after the identity is verified. In this process, the industrial data acquisition terminal automatically combines the dynamic verification code to construct an encryption key sequence different from the initial key sequence, and encrypts the industrial data based on the encryption key sequence. The encrypted ciphertext is subsequently sent to multiple storage nodes for storage. Since the dynamic verification code is randomly generated by the verification code generation server, the key sequence corresponding to each industrial data to be reported is different. When decrypting, it is necessary to combine the dynamic verification code sent by the verification code generation server at the time and the local initial key sequence to construct the corresponding decryption key sequence. Therefore, even if multiple storage nodes are hacked, the industrial data will not be leaked, which improves the security of the industrial data.

[0090] Finally, it should be understood that the embodiments described in this specification are only used to illustrate the principles of the embodiments of this specification. Other variations may also fall within the scope of this specification. Therefore, as an example and not a limitation, alternative configurations of the embodiments of this specification may be considered consistent with the teachings of this specification. Accordingly, the embodiments of this specification are not limited to the embodiments explicitly introduced and described in this specification.

Claims

1. A data processing method, characterized in that: include: When performing industrial data reporting, the industrial data collection terminal sends verification code generation request information for requesting a verification code to the verification code generation server, wherein the verification code generation request information includes device information of the industrial data collection terminal; The verification code generation server performs authority verification based on the device information of the industrial data acquisition terminal included in the verification code generation request information, and generates a dynamic verification code; When receiving the dynamic verification code sent from the dynamic verification code generation server, the industrial data acquisition terminal performs identity authentication based on the dynamic verification code; When the identity authentication is passed, the industrial data acquisition terminal converts the dynamic verification code into a digital matrix, determines the flag bit in the dynamic verification code, and determines the target operation mode based on the value of the flag bit, wherein the target operation mode is one or a combination of addition, subtraction, XOR and XOR, and operates the digital matrix and each key matrix included in the initial key sequence based on the target operation mode to obtain an encryption key sequence, wherein the number of the multiple key matrices included in the encryption key sequence is consistent with the number of the multiple key matrices included in the initial key sequence; The industrial data collection end segments the industrial data to be reported based on the multiple key matrices to obtain multiple industrial data segments with the same number as the key matrices; The industrial data collection end encrypts the multiple industrial data fragments based on the encryption key sequence to obtain multiple industrial data ciphertext fragments; The industrial data collection terminal uploads the multiple industrial data ciphertext segments to the storage management server; The storage management server obtains information of multiple storage nodes, and stores the multiple industrial data ciphertext segments based on the information of the multiple storage nodes.

2. A data processing method according to claim 1, characterized in that: The industrial data acquisition terminal determines the target operation mode based on the value of the flag bit, including: The target operation mode is determined based on the value of the flag bit and a pre-constructed operation mode relationship table, wherein the operation mode relationship table includes a correspondence between the value of the flag bit and the operation mode.

3. A data processing method according to claim 1, characterized in that: The industrial data collection end divides the industrial data to be reported based on the multiple key matrices to obtain multiple industrial data segments with the same number as the key matrices, including: Converting the industrial data to be reported into digital plain text based on the ASCII comparison table; Segmenting the digital plaintext according to fixed lengths to obtain a plurality of initial plaintext segments; When the number of the initial plaintext segments is less than the number of the key matrices, one or more empty segments are added after the multiple initial plaintext segments to obtain multiple industrial data segments, so that the number of the industrial data segments to be reported is equal to the number of the key matrices; When the number of the initial plaintext segments is greater than or equal to the number of the key matrices, the multiple initial plaintext segments are used as the multiple industrial data segments.

4. A data processing method according to claim 3, characterized in that: The industrial data acquisition end encrypts multiple industrial data fragments based on the encryption key sequence to obtain multiple industrial data ciphertext fragments, including: Converting the industrial data fragment to be reported into a plaintext matrix; Aligning the key matrix in the encryption key sequence with the plurality of plaintext matrices in an arrangement order, and when the number of key matrices is less than the number of plaintext matrices, adding A×n+m key matrices after the aligned encryption key sequence, so that each plaintext matrix corresponds to a key matrix, wherein n is the number of key matrices of a complete encryption key sequence, A is an integer greater than or equal to 0, m=MA×n, M is the number of plaintext matrices, and the added key matrices are arranged in the order in the encryption key sequence; Based on each key matrix, the corresponding plaintext matrix is ​​encrypted by AES to obtain multiple industrial data ciphertext fragments.

5. A data processing method according to claim 1, characterized in that: The industrial data collection terminal uploads the multiple industrial data ciphertext segments to the storage management server, including: Determine the encryption time of multiple ciphertext segments of industrial data; A ciphertext is constructed based on multiple industrial data ciphertext fragments and the encryption time, and the ciphertext and the multiple industrial data ciphertext fragments are sent to a storage management server, so that the storage management server obtains the corresponding dynamic verification code from the dynamic verification code generation server according to the encryption time to construct an initial key sequence in the storage management server.

6. A data processing method according to claim 5, characterized in that: Also includes: When querying historical industrial data, the industrial data acquisition terminal simultaneously sends data query request information to the storage management server and the dynamic verification code generation server, wherein the data query request information includes the encryption time corresponding to the historical industrial data to be queried and the device information of the industrial data acquisition terminal; When the industrial data acquisition terminal receives the ciphertext returned from the storage management server and the verification code returned from the dynamic verification code generation server, the industrial data acquisition terminal constructs the initial key sequence stored locally based on the returned verification code to obtain a decryption key sequence, wherein the ciphertext returned by the storage management server and the verification code returned by the dynamic verification code generation server are generated based on the data query request information; The industrial data acquisition terminal decrypts the ciphertext returned by the storage management server based on the decryption key sequence to obtain the corresponding historical industrial data.

7. A data processing method according to claim 6, characterized in that: The industrial data acquisition terminal decrypts the ciphertext returned by the storage management server based on the decryption key sequence to obtain corresponding historical industrial data, including: aligning each key matrix in the decryption key sequence with a plurality of industrial data ciphertext fragments in the ciphertext returned by the storage management server; When the number of the key matrices is less than the number of industrial data ciphertext segments in the ciphertext, A×n+l key matrices are added after the aligned decryption key sequence, so that each industrial data ciphertext segment corresponds to a key matrix, wherein n is the number of key matrices of a complete decryption key sequence, A is an integer greater than or equal to 0, l=LA×n, L is the number of industrial data ciphertext segments, and the added key matrices are arranged in the order of the decryption key sequence; Based on each key matrix, an AES inverse operation is performed on the corresponding industrial data ciphertext fragment to obtain multiple industrial data fragments; Historical industrial data is constructed based on the multiple industrial data fragments.

8. A data processing method according to any one of claims 1 to 7, characterized in that: The storage management server stores the plurality of industrial data ciphertext segments based on the information of the plurality of storage nodes, including: Based on the remaining computing resource information and the remaining storage resource information of each storage node, the plurality of storage nodes are screened to determine at least one candidate storage node; Generate multiple candidate storage solutions based on the remaining computing resource information and the remaining storage resource information of each of the candidate storage nodes; For each of the candidate storage solutions, determining a matching score corresponding to the candidate migration solution based on a storage evaluation system, wherein the storage evaluation system includes a plurality of storage evaluation indicators and a weight corresponding to each of the storage evaluation indicators; Based on the matching score corresponding to each of the candidate storage solutions, a target storage solution is determined from the multiple candidate storage solutions.

9. A data processing method according to claim 8, characterized in that: The storage management server generates multiple candidate storage solutions based on the remaining computing resource information and the remaining storage resource information of each candidate storage node, including: A plurality of candidate storage schemes are generated based on a constraint set, remaining computing resource information and remaining storage resource information of candidate storage nodes through a Monte Carlo model, wherein the candidate storage schemes include a target storage node corresponding to each industrial data segment.

10. A data processing system, characterized in that: Including industrial data collection terminal, verification code generation server and storage management server; The industrial data acquisition terminal is used to send verification code generation request information for requesting a verification code to the verification code generation server when performing industrial data reporting; The verification code generation server is used to generate a dynamic verification code based on the verification code generation request information; The industrial data acquisition terminal is also used to perform identity authentication based on the dynamic verification code when receiving the dynamic verification code sent from the dynamic verification code generation server; The industrial data acquisition terminal is also used to convert the dynamic verification code into a digital matrix when the identity authentication is passed, and determine the flag bit in the dynamic verification code, and determine the target operation mode based on the value of the flag bit, wherein the target operation mode is one or a combination of addition, subtraction, XOR and XOR, and the digital matrix and each key matrix included in the initial key sequence are operated based on the target operation mode to obtain an encryption key sequence, wherein the number of the multiple key matrices included in the encryption key sequence is consistent with the number of the multiple key matrices included in the initial key sequence; The industrial data collection end is further used to segment the industrial data to be reported based on the multiple key matrices to obtain multiple industrial data segments with the same number as the key matrices; The industrial data acquisition terminal is also used to encrypt multiple industrial data fragments based on the encryption key sequence to obtain multiple industrial data ciphertext fragments; The industrial data collection terminal is also used to upload the multiple industrial data ciphertext segments to the storage management server; The storage management server is used to obtain information of multiple storage nodes, and store the multiple industrial data ciphertext fragments based on the information of the multiple storage nodes.

Images