A data processing method and system

Abstract

The present invention provides a data processing method and system, which relates to the field of data processing. The method includes: an industrial data acquisition end sends a verification code generation request message for requesting a verification code; a verification code generation server performs permission verification based on the device information of the industrial data acquisition end included in the verification code generation request message, and generates a dynamic verification code; the industrial data acquisition end performs identity verification based on the dynamic verification code; when the identity verification is passed, the industrial data acquisition end constructs an encryption key sequence based on the dynamic verification code for the initial key sequence stored locally. Both the initial key sequence and the encryption key sequence include multiple key matrices. The industrial data to be reported is segmented, multiple industrial data segments are encrypted, and multiple industrial data ciphertext segments are uploaded; a storage management server obtains information of multiple storage nodes and stores multiple industrial data ciphertext segments, which has the advantage of improving the security of industrial data.

Description

Technical Field

[0001] The present invention relates to the field of data processing, and particularly to a data processing method and system. Background Art

[0002] Industrial Internet of Things (IIoT) usually uses intelligent sensors and actuators to connect networks, forming a system with functions of data acquisition, analysis, conversion, transmission, storage, monitoring and feedback. The components of IIoT include IoT gateways, sensors, actuators and edge devices. The IoT gateway and sensors transmit the sensed information to data communication devices, and the data communication devices convert it into operation information that can be run by machines. These information play a key role in predictive maintenance, efficient field service, asset tracking and monitoring management, improving customer satisfaction, improving productivity and intelligent management.

[0003] Currently, in order to prevent industrial data from being stolen, a large number of encryption software have emerged to encrypt the data that needs to be protected. During the encryption process, plaintext is transformed into ciphertext through encryption algorithms and encryption keys, and in the decryption algorithm, decryption is to restore the ciphertext to plaintext through decryption algorithms and decryption keys. However, when the key has been determined, there is a one-to-one correspondence between the plaintext and the ciphertext, and brute-force methods such as exhaustive search can be used to crack it, resulting in the leakage of target data, and the security of the encrypted industrial data is relatively low.

[0004] Therefore, there is a need to provide a data processing method and system for dynamically encrypting industrial data to improve the security of industrial data. Summary of the Invention

[0005] The present invention provides a data processing method, including: when performing industrial data reporting, an industrial data acquisition terminal sends a verification code generation request message for requesting a verification code to a verification code generation server, where the verification code generation request message includes device information of the industrial data acquisition terminal; the verification code generation server performs permission verification based on the device information of the industrial data acquisition terminal included in the verification code generation request message and generates a dynamic verification code; when receiving the dynamic verification code sent by the dynamic verification code generation server, the industrial data acquisition terminal performs identity verification based on the dynamic verification code; when the identity verification is passed, the industrial data acquisition terminal converts the dynamic verification code into a digital matrix, determines a flag bit in the dynamic verification code, determines a target operation mode based on the value of the flag bit, where the target operation mode is one or a combination of addition, subtraction, exclusive NOR, and exclusive OR, performs an operation on the digital matrix and each key matrix included in the initial key sequence based on the target operation mode to obtain an encrypted key sequence, where the number of multiple key matrices included in the encrypted key sequence is the same as the number of multiple key matrices included in the initial key sequence; the industrial data acquisition terminal divides the industrial data to be reported based on the multiple key matrices to obtain multiple industrial data segments with the same number as the number of key matrices; the industrial data acquisition terminal encrypts the multiple industrial data segments based on the encrypted key sequence to obtain multiple industrial data ciphertext segments; the industrial data acquisition terminal uploads the multiple industrial data ciphertext segments to a storage management server; the storage management server obtains information of multiple storage nodes and stores the multiple industrial data ciphertext segments based on the information of the multiple storage nodes.

[0006] Further, the industrial data acquisition terminal determines the target operation mode based on the value of the flag bit, including: determining the target operation mode based on the value of the flag bit and a pre-constructed operation mode relationship table, where the operation mode relationship table contains the corresponding relationship between the value of the flag bit and the operation mode.

[0007] Further, the industrial data acquisition terminal divides the industrial data to be reported based on the multiple key matrices to obtain multiple industrial data segments with the same number as the number of key matrices, including: converting the industrial data to be reported into a digital plaintext based on the ASCII comparison table; dividing the digital plaintext according to a fixed length to obtain multiple initial plaintext segments; when the number of the initial plaintext segments is less than the number of key matrices, adding one or more empty segments after the multiple initial plaintext segments to obtain multiple industrial data segments, so that the number of the industrial data segments to be reported is equal to the number of key matrices; when the number of the initial plaintext segments is greater than or equal to the number of key matrices, using the multiple initial plaintext segments as the multiple industrial data segments.

[0008] Further, the industrial data acquisition end encrypts multiple industrial data segments based on the encrypted key sequence to obtain multiple industrial data ciphertext segments, including: converting the industrial data segments to be reported into plaintext matrices; aligning the key matrices in the encrypted key sequence with the multiple plaintext matrices in the arrangement order. When the number of key matrices is less than the number of plaintext matrices, add A×n + m key matrices after the already aligned encrypted key sequence so that each plaintext matrix corresponds to a key matrix, where n is the number of key matrices in a complete encrypted key sequence, A is an integer greater than or equal to 0, m = M - A×n, M is the number of plaintext matrices, and the added key matrices are arranged in the order in the encrypted key sequence; performing AES encryption on the corresponding plaintext matrix based on each key matrix to obtain multiple industrial data ciphertext segments.

[0009] Further, the industrial data acquisition end uploads the multiple industrial data ciphertext segments to the storage management server, including: determining the encryption time of the multiple industrial data ciphertext segments; constructing a ciphertext based on the multiple industrial data ciphertext segments and the encryption time, and sending the ciphertext and the multiple industrial data ciphertext segments to the storage management server, so that the storage management server obtains the corresponding dynamic verification code from the dynamic verification code generation server according to the encryption time to construct the initial key sequence in the storage management server.

[0010] Further, the method further includes: when querying historical industrial data, the industrial data acquisition end simultaneously sends a data query request message to the storage management server and the dynamic verification code generation server, where the data query request message includes the encryption time corresponding to the historical industrial data to be queried and the device information of the industrial data acquisition end; when the industrial data acquisition end receives the ciphertext returned from the storage management server and the verification code returned from the dynamic verification code generation server, constructing a decryption key sequence based on the returned verification code for the initial key sequence stored locally, where the ciphertext returned from the storage management server and the verification code returned from the dynamic verification code generation server are generated based on the data query request message; the industrial data acquisition end decrypts the ciphertext returned from the storage management server based on the decryption key sequence to obtain the corresponding historical industrial data.

[0011] Further, the industrial data acquisition end decrypts the ciphertext returned by the storage management server based on the decryption key sequence to obtain the corresponding historical industrial data, including: aligning each key matrix in the decryption key sequence with multiple industrial data ciphertext segments in the ciphertext returned by the storage management server; when the number of key matrices is less than the number of industrial data ciphertext segments in the ciphertext, adding A×n + l key matrices after the aligned decryption key sequence so that each industrial data ciphertext segment corresponds to a key matrix, where n is the number of key matrices in a complete decryption key sequence, A is an integer greater than or equal to 0, l = L - A×n, L is the number of industrial data ciphertext segments, and the added key matrices are arranged in the order in the decryption key sequence; performing AES inverse operation on the corresponding industrial data ciphertext segment based on each key matrix to obtain multiple industrial data segments; constructing historical industrial data based on the multiple industrial data segments.

[0012] Further, the storage management server stores the multiple industrial data ciphertext segments based on the information of the multiple storage nodes, including: screening the multiple storage nodes based on the remaining computing resource information and remaining storage resource information of each storage node to determine at least one candidate storage node; generating multiple candidate storage schemes based on the remaining computing resource information and remaining storage resource information of each candidate storage node; for each candidate storage scheme, determining the matching score corresponding to the candidate migration scheme based on a storage evaluation system, where the storage evaluation system includes multiple storage evaluation indicators and the weight corresponding to each storage evaluation indicator; determining the target storage scheme from the multiple candidate storage schemes based on the matching score corresponding to each candidate storage scheme.

[0013] Further, the storage management server generates multiple candidate storage schemes based on the remaining computing resource information and remaining storage resource information of each candidate storage node, including: generating multiple candidate storage schemes through a Monte Carlo model based on a constraint condition set, the remaining computing resource information and remaining storage resource information of the candidate storage nodes, where the candidate storage scheme includes the target storage node corresponding to each industrial data segment.

[0014] The present invention provides a data processing system, which includes an industrial data acquisition terminal, a verification code generation server, and a storage management server. The industrial data acquisition terminal is configured to send a verification code generation request message for requesting a verification code to the verification code generation server when performing industrial data reporting. The verification code generation server is configured to generate a dynamic verification code based on the verification code generation request message. The industrial data acquisition terminal is further configured to perform identity verification based on the dynamic verification code when receiving the dynamic verification code sent by the dynamic verification code generation server. The industrial data acquisition terminal is further configured to, when the identity verification is passed, convert the dynamic verification code into a digital matrix, determine the flag bits in the dynamic verification code, determine the target operation mode based on the values of the flag bits, where the target operation mode is one or a combination of addition, subtraction, exclusive NOR, and exclusive OR, perform operations on each key matrix included in the digital matrix and the initial key sequence based on the target operation mode to obtain an encrypted key sequence, where the number of key matrices included in the encrypted key sequence is the same as the number of key matrices included in the initial key sequence. The industrial data acquisition terminal is further configured to divide the industrial data to be reported based on the multiple key matrices to obtain multiple industrial data segments with the same number as the key matrices. The industrial data acquisition terminal is further configured to encrypt the multiple industrial data segments based on the encrypted key sequence to obtain multiple industrial data ciphertext segments. The industrial data acquisition terminal is further configured to upload the multiple industrial data ciphertext segments to the storage management server. The storage management server is configured to obtain information of multiple storage nodes and store the multiple industrial data ciphertext segments based on the information of the multiple storage nodes.

[0015] Compared with the prior art, the data processing method and system provided by the present invention at least have the following beneficial effects:

[0016] For each industrial data reporting, the identity of the industrial data acquisition terminal is first verified by requesting a verification code, and then the industrial data reporting is performed after the identity verification. In this process, the industrial data acquisition terminal automatically combines the dynamic verification code to construct an encrypted key sequence different from the initial key sequence and encrypts the industrial data based on the encrypted key sequence. The encrypted ciphertext is subsequently sent to multiple storage nodes for storage. Since the dynamic verification code is randomly generated by the verification code generation server, the key sequence corresponding to each industrial data to be reported is different. When decrypting, it is necessary to construct the corresponding decryption key sequence by combining the dynamic verification code sent by the verification code generation server at that time and the local initial key sequence. Therefore, even if multiple storage nodes are compromised, the industrial data will not be leaked, improving the security of the industrial data. Description of the Drawings

[0017] This specification will be further described by way of exemplary embodiments, which will be described in detail with reference to the accompanying drawings. These embodiments are not restrictive. In these embodiments, the same numbers represent the same structures, where:

[0018] Figure 1 is a schematic block diagram of a data processing system according to some embodiments of this specification;

[0019] Figure 2 is a schematic flowchart of a data processing method according to some embodiments of this specification. Detailed implementation manners

[0020] To more clearly illustrate the technical solutions of the embodiments of this specification, the accompanying drawings required for the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some examples or embodiments of this specification. For those of ordinary skill in the art, without creative efforts, this specification can also be applied to other similar scenarios based on these drawings. Unless obvious from the language context or otherwise stated, the same reference numerals in the figures represent the same structures or operations.

[0021] Figure 1 is a schematic block diagram of a data processing system according to some embodiments of this specification, as Figure 1 shown, a data processing system may include an industrial data acquisition terminal, a verification code generation server, and a storage management server.

[0022] The industrial data acquisition terminal is used to send verification code generation request information for requesting a verification code to the verification code generation server when performing industrial data reporting.

[0023] The verification code generation server is used to generate a dynamic verification code based on the verification code generation request information.

[0024] The industrial data acquisition terminal is further used to perform identity verification based on the dynamic verification code when receiving the dynamic verification code sent by the dynamic verification code generation server.

[0025] The industrial data acquisition terminal is further used to, when the identity verification is passed, convert the dynamic verification code into a digital matrix, determine the flag bit in the dynamic verification code, determine the target operation method based on the value of the flag bit, where the target operation method is one or a combination of addition, subtraction, exclusive NOR, and exclusive OR, perform operations on each key matrix included in the digital matrix and the initial key sequence based on the target operation method to obtain an encrypted key sequence, where the number of key matrices included in the encrypted key sequence is the same as the number of key matrices included in the initial key sequence.

[0026] The industrial data acquisition terminal is also used to segment the industrial data to be reported based on multiple key matrices, obtaining multiple industrial data segments with the same number as the key matrices.

[0027] The industrial data acquisition terminal is also used to encrypt the multiple industrial data segments based on an encryption key sequence, obtaining multiple encrypted industrial data segments.

[0028] The industrial data acquisition terminal is also used to upload the multiple encrypted industrial data segments to the storage management server.

[0029] The storage management server is used to obtain the information of multiple storage nodes and store the multiple encrypted industrial data segments based on the information of the multiple storage nodes.

[0030] Under the above mechanism, if the storage management server and multiple storage nodes are hacked, only the ciphertext and the initial key sequence that cannot decrypt the ciphertext are obtained. If a hacker needs to control the storage management server to retrieve the verification code in the verification code generation server, then the identity verification system in the verification code generation server also needs to be breached. Therefore, in the above system, the security of the historical industrial data reported by the industrial data acquisition terminal can be maximally guaranteed.

[0031] Figure 2 It is a schematic flowchart of a data processing method shown in some embodiments of this specification, as Figure 2 shown: A data processing method in this embodiment may include steps S210 to S280:

[0032] S210, when performing industrial data reporting, the industrial data acquisition terminal sends a verification code generation request message for requesting a verification code to the verification code generation server;

[0033] Among them, the verification code generation request message includes the device information of the industrial data acquisition terminal, for example, the device unique identification code and the device location information, etc.

[0034] S220, the verification code generation server performs permission verification based on the device information of the industrial data acquisition terminal included in the verification code generation request message and generates a dynamic verification code;

[0035] The verification code generation server performs permission verification based on the device information of the industrial data acquisition terminal included in the verification code generation request message according to the pre-stored device information of each industrial data acquisition terminal.

[0036] S230, when receiving the dynamic verification code sent by the dynamic verification code generation server, the industrial data acquisition terminal performs identity verification based on the dynamic verification code;

[0037] Among them, when the industrial data acquisition end returns the dynamic verification code to the verification code generation server, and the verification code generation server determines that the previous and subsequent verification codes are consistent, it assigns permissions to the corresponding account, and subsequent industrial data reporting operations can be performed. The above identity verification mechanism has been applied to a large number of industrial data processing scenarios and will not be elaborated here.

[0038] S240, when the identity verification is passed, the industrial data acquisition end converts the dynamic verification code into a digital matrix, determines the flag bit in the dynamic verification code, determines the target operation method based on the value of the flag bit, and performs operations on the digital matrix and each key matrix included in the initial key sequence based on the target operation method to obtain an encrypted key sequence;

[0039] Among them, the target operation method is one or a combination of addition, subtraction, exclusive NOR, and exclusive OR, and the number of key matrices included in the encrypted key sequence is the same as the number of key matrices included in the initial key sequence.

[0040] Among them, the initial key sequence stored locally is obtained by encrypting and transmitting it through the storage management server in advance. This application adopts the symmetric encryption method, and the same initial key sequence is stored in both the industrial data acquisition end and the storage management server. To ensure the security of the encrypted key sequence stored locally, mechanisms such as SSL / TLS encrypted email transmission, segmented transmission, and multiple signatures can be used for transmission.

[0041] To avoid the high risk brought by using the same key to encrypt all industrial data, this application directly uses the dynamic verification code sent by the verification code generation server to construct the initial key sequence, thereby obtaining a unique encrypted key sequence. To improve the security of industrial data.

[0042] S250, the industrial data acquisition end divides the industrial data to be reported based on multiple key matrices to obtain multiple industrial data segments with the same number as the key matrices;

[0043] This application uses the AES algorithm for encryption. In the AES encryption algorithm, the length of the plaintext is fixed at 128bit (i.e., 16 bytes), but the industrial data reported each time is generally greater than 128bit. Therefore, the industrial data needs to be divided before encryption to meet the encryption conditions of the AES encryption algorithm.

[0044] S260, the industrial data acquisition end encrypts the multiple industrial data segments based on the encrypted key sequence to obtain multiple industrial data ciphertext segments;

[0045] The industrial data ciphertext fragments are encrypted based on the constructed encryption key sequence. Therefore, the encryption key sequences corresponding to multiple industrial data ciphertext fragments corresponding to different industrial data are different, thereby improving the security of industrial data.

[0046] S270. The industrial data acquisition terminal uploads multiple industrial data ciphertext fragments to the storage management server.

[0047] S280. The storage management server obtains information on multiple storage nodes and stores multiple industrial data ciphertext fragments based on the information on multiple storage nodes.

[0048] Specifically, it includes:

[0049] Based on the remaining computing resource information and remaining storage resource information of each storage node, filter multiple storage nodes to determine at least one candidate storage node.

[0050] Based on the remaining computing resource information and remaining storage resource information of each candidate storage node, generate multiple candidate storage schemes.

[0051] For each candidate storage scheme, based on the storage evaluation system, determine the matching score corresponding to the candidate migration scheme. Among them, the storage evaluation system includes multiple storage evaluation indicators and the weight corresponding to each storage evaluation indicator. The multiple storage evaluation indicators can include the storage load balance indicator of the candidate storage node and the industrial data fragment distribution balance indicator, etc.

[0052] Based on the matching score corresponding to each candidate storage scheme, determine the target storage party from multiple candidate storage schemes.

[0053] Multiple candidate storage schemes can be generated through the Monte Carlo model based on the constraint condition set, the remaining computing resource information and remaining storage resource information of the candidate storage nodes. Among them, the candidate storage scheme includes the target storage node corresponding to each industrial data fragment. The constraint condition set can include the minimum remaining computing resource constraint and the minimum remaining storage resource constraint of the candidate storage nodes.

[0054] Construct the initial key sequence stored locally based on the verification code to obtain the encryption key sequence, including:

[0055] S310. Convert the dynamic verification code into a digital matrix and determine the flag bit in the dynamic verification code. The flag bit is one of the verification code bits.

[0056] The dynamic verification code of this application is an 8-bit hexadecimal number, and the converted digital matrix is a 4*4 matrix. Therefore, 0 can be assigned in front of or behind each verification code digit, and after obtaining a 16-bit number, the corresponding 4*4 digital matrix can be obtained.

[0057] The flag bit in the dynamic verification code can be determined according to the order, such as the first bit; it can also be determined according to the value, such as a bit of the maximum value or a bit of the minimum value; this application does not make any limitation here. The value of the flag bit is used to determine the operation method for constructing the subsequent encryption key sequence.

[0058] In this embodiment, the target operation method is determined based on the value of the flag bit and the pre-constructed operation method relationship table, where the operation method relationship table includes the corresponding relationship between the value of the flag bit and the operation method.

[0059] S320, determine the target operation method based on the value of the flag bit, where the target operation method is one or a combination of addition, subtraction, exclusive NOR, and exclusive OR;

[0060] S330, perform operations on the digital matrix and each key matrix based on the target operation method to obtain the encryption key sequence.

[0061] Among them, the digital matrix is a 4*4 matrix, and the key matrix is also a 4*4 matrix. Therefore, when performing operations, the numbers in the same position are corresponding operations. The target operation method is one of addition, subtraction, exclusive NOR, and exclusive OR, or combinations such as adding first and then exclusive NOR, subtracting first and then exclusive OR, etc., so as to transform each key matrix.

[0062] Segment the industrial data to obtain multiple industrial data segments with the same number as the key matrix, including:

[0063] S410, convert the industrial data into digital plaintext based on the ASCII conversion table; where the digital plaintext is in hexadecimal.

[0064] S420, segment the digital plaintext according to a fixed length to obtain multiple initial plaintext segments; this application uses the AES encryption algorithm for encryption, so the digital plaintext also needs to be segmented into initial plaintext segments of 128 bits in size, and the last initial plaintext segment is less than or equal to 128 bits.

[0065] S430, when the number of initial plaintext segments is less than the number of key matrices, add one or more empty segments after the multiple initial plaintext segments to obtain multiple industrial data segments so that the number of industrial data segments is equal to the number of key matrices; when the number of initial plaintext segments is greater than or equal to the number of key matrices, use the multiple initial plaintext segments as multiple industrial data segments.

[0066] In this embodiment, since the number of key matrices in the encryption key sequence is fixed, when the number of initial plaintext segments is less than the number of key matrices, padding is performed by adding empty segments at the rear. Among them, when the empty segments are encrypted subsequently, the resulting ciphertext is directly empty. When decrypting, if there is empty ciphertext, it can be directly restored to an empty segment.

[0067] Encrypting multiple industrial data segments based on the encryption key sequence to obtain multiple industrial data ciphertext segments, including:

[0068] S510, converting the industrial data segment into a plaintext matrix; each industrial data segment is 128 bits, that is, 16 bytes, so it can be directly converted into a 4*4 plaintext matrix required by the AES algorithm.

[0069] S520, aligning the key matrices in the encryption key sequence with multiple plaintext matrices in the arrangement order. When the number of key matrices is less than the number of plaintext matrices, add A×n + m key matrices after the already aligned encryption key sequence so that each plaintext matrix corresponds to a key matrix, where n is the number of key matrices in a complete encryption key sequence, A is an integer greater than or equal to 0, m = M - A×n, M is the number of plaintext matrices, and the added key matrices are arranged in the order in the encryption key sequence;

[0070] If the number of plaintext matrices is greater than the number of key matrices in the encryption key sequence, then copy the encryption key sequence and cyclically place it after the already aligned encryption key sequence until all plaintext matrices are aligned by a key matrix. At this time, remove the redundant key matrices to complete the preparation work before encryption. At this time, the number of added key matrices is A×n + m.

[0071] S530, performing AES encryption on the corresponding plaintext matrix based on each key matrix to obtain multiple industrial data ciphertext segments.

[0072] This application uses AES encryption. For each plaintext matrix and the corresponding key matrix, first perform an exclusive OR operation on the plaintext matrix and the key matrix to obtain the first matrix; then perform key expansion based on the key matrix to obtain 10 round keys, and then perform 9 rounds of the first encryption (including byte substitution, row shift, column confusion, and round key addition performed in sequence) on the first matrix based on the corresponding sub-keys, and perform the second encryption (including byte substitution, row shift, and round key addition performed in sequence) in the 10th round. Finally, obtain the industrial data ciphertext segment. Perform the above operations on all plaintext matrices and the corresponding key matrices to obtain multiple industrial data ciphertext segments.

[0073] In an embodiment of this application, after obtaining multiple industrial data ciphertext segments, it further includes:

[0074] Determine the encryption time of multiple industrial data ciphertext segments;

[0075] Construct a ciphertext based on multiple industrial data ciphertext segments and the encryption time, and send the ciphertext to the storage management server, so that the storage management server can obtain the corresponding verification code from the verification code generation server according to the encryption time to construct the initial key sequence in the storage management server.

[0076] Since this application uses dynamic encryption, the industrial data acquisition end automatically encrypts after passing the verification. Therefore, the encryption time of the industrial data ciphertext segments is basically the same as the time of passing the verification, but there may still be a slight difference. Therefore, the verification code corresponding to the verification time consistent with the encryption time ±(5 - 10)S is the verification code corresponding to the encryption time.

[0077] In this embodiment, if the background needs to retrieve the industrial data of the industrial data acquisition end, it also needs to first perform permission verification through the management host. After verification, the storage management server can obtain the corresponding verification code in the verification code generation server and construct the decryption key sequence in the same way as above to perform decryption. This prevents the storage management server from directly retrieving the verification code from the verification code generation server for decryption after being hijacked.

[0078] In an embodiment of this application, it further includes:

[0079] When requesting historical industrial data from the storage management server, send data query request information to the storage management server and the verification code generation server at the same time, where the data query request information includes the encryption time;

[0080] When receiving the ciphertext returned from the storage management server and the verification code returned from the verification code generation server, construct the initial key sequence stored locally based on the returned verification code to obtain the decryption key sequence, where the ciphertext returned from the storage management server and the verification code returned from the verification code generation server are generated based on the data query request information;

[0081] Decrypt the ciphertext returned from the storage management server based on the decryption key sequence to obtain the corresponding historical industrial data.

[0082] If a user needs to access the historical industrial data of an industrial data acquisition terminal, they only need to specify the generation time of the historical industrial data to be accessed (basically the same as the time when the verification is passed). With prior permission obtained, the corresponding ciphertext can be retrieved from the storage management server, and the corresponding verification code can be retrieved from the verification code generation server. Then, the key construction and decryption work are automatically performed in the background of the industrial data acquisition terminal, and finally, the obtained historical industrial data is presented to the industrial data acquisition terminal. The above process is automatically completed in the background of the industrial data acquisition terminal, thus realizing the dynamic encryption / decryption operation of historical industrial data.

[0083] In an embodiment of the present application, decrypting the ciphertext returned by the storage management server based on the decryption key sequence to obtain the corresponding historical industrial data includes:

[0084] Align each key matrix in the decryption key sequence with multiple industrial data ciphertext segments in the ciphertext returned by the storage management server;

[0085] When the number of key matrices is less than the number of industrial data ciphertext segments in the ciphertext, add A×n + l key matrices after the aligned decryption key sequence so that each industrial data ciphertext segment corresponds to a key matrix, where n is the number of key matrices in a complete decryption key sequence, A is an integer greater than or equal to 0, l = L - A×n, L is the number of industrial data ciphertext segments, and the added key matrices are arranged in the order in the decryption key sequence;

[0086] Perform the AES inverse operation on each industrial data ciphertext segment based on the corresponding key matrix to obtain multiple industrial data segments;

[0087] Construct the historical industrial data based on the multiple industrial data segments.

[0088] In the present application, the encryption process is basically the same as the decryption process. It is necessary to align the industrial data ciphertext segments with the constructed decryption key sequence and then perform the AES inverse operation respectively. The process of the AES inverse operation is prior art and will not be elaborated here.

[0089] A data processing method of the present invention. Every time industrial data is reported, the identity of the industrial data acquisition end is first verified by requesting a verification code, and then the industrial data reporting is executed after the identity is verified. In this process, the industrial data acquisition end automatically combines the dynamic verification code to construct an encryption key sequence different from the initial key sequence, and encrypts the industrial data based on the encryption key sequence. The encrypted ciphertext is subsequently sent to multiple storage nodes for storage. Since the dynamic verification code is randomly generated by the verification code generation server, the key sequence corresponding to each piece of industrial data to be reported is different. When decrypting, the corresponding decryption key sequence needs to be constructed by combining the dynamic verification code sent by the verification code generation server at that time and the local initial key sequence. Therefore, even if multiple storage nodes are compromised, the industrial data will not be leaked, improving the security of industrial data.

[0090] Finally, it should be understood that the embodiments described in this specification are only used to illustrate the principles of the embodiments of this specification. Other variations may also fall within the scope of this specification. Therefore, as an example rather than a limitation, alternative configurations of the embodiments of this specification can be considered to be consistent with the teachings of this specification. Accordingly, the embodiments of this specification are not limited to the embodiments explicitly introduced and described in this specification.

Claims

1. A data processing method, characterized in that, Including: When performing industrial data reporting, an industrial data acquisition terminal sends a verification code generation request message for requesting a verification code to a verification code generation server, where the verification code generation request message includes device information of the industrial data acquisition terminal; The verification code generation server performs permission verification based on the device information of the industrial data acquisition terminal included in the verification code generation request message and generates a dynamic verification code; When receiving the dynamic verification code sent by the dynamic verification code generation server, the industrial data acquisition terminal performs identity verification based on the dynamic verification code; When the identity verification is passed, the industrial data acquisition terminal converts the dynamic verification code into a digital matrix, determines the flag bits in the dynamic verification code, determines the target operation method based on the values of the flag bits, where the target operation method is one or a combination of addition, subtraction, exclusive NOR, and exclusive OR, and performs operations on the digital matrix and each key matrix included in the initial key sequence based on the target operation method to obtain an encrypted key sequence, where the number of key matrices included in the encrypted key sequence is the same as the number of key matrices included in the initial key sequence; The industrial data acquisition terminal divides the industrial data to be reported based on the multiple key matrices to obtain multiple industrial data segments with the same number as the key matrices; The industrial data acquisition terminal encrypts the multiple industrial data segments based on the encrypted key sequence to obtain multiple industrial data ciphertext segments; The industrial data acquisition terminal uploads the multiple industrial data ciphertext segments to a storage management server; The storage management server obtains information of multiple storage nodes and stores the multiple industrial data ciphertext segments based on the information of the multiple storage nodes.

2. The data processing method according to claim 1, wherein The industrial data acquisition terminal determines the target operation method based on the value of the flag bit, including: Determining the target operation method based on the value of the flag bit and a pre-constructed operation method relationship table, where the operation method relationship table contains the corresponding relationship between the value of the flag bit and the operation method.

3. The data processing method according to claim 1, wherein The industrial data acquisition terminal divides the industrial data to be reported based on the multiple key matrices to obtain multiple industrial data segments with the same number as the key matrices, including: Converting the industrial data to be reported into digital plaintext based on the ASCII comparison table; Dividing the digital plaintext according to a fixed length to obtain multiple initial plaintext segments; When the number of the initial plaintext segments is less than the number of the key matrices, adding one or more empty segments after the multiple initial plaintext segments to obtain multiple industrial data segments so that the number of the industrial data segments to be reported is equal to the number of the key matrices; When the number of the initial plaintext segments is greater than or equal to the number of the key matrices, using the multiple initial plaintext segments as multiple industrial data segments.

4. A data processing method according to claim 3, characterized in that The industrial data acquisition terminal encrypts the multiple industrial data segments based on the encrypted key sequence to obtain multiple industrial data ciphertext segments, including: Converting the industrial data segments to be reported into plaintext matrices; Align the key matrices in the encrypted key sequence with multiple plaintext matrices in the arranged order. When the number of key matrices is less than the number of plaintext matrices, add A×n + m key matrices after the already aligned encrypted key sequence so that each plaintext matrix corresponds to a key matrix, where n is the number of key matrices in a complete encrypted key sequence, A is an integer greater than or equal to 0, m = M - A×n, M is the number of plaintext matrices, and the added key matrices are arranged in the order in the encrypted key sequence; Perform AES encryption on the corresponding plaintext matrix based on each key matrix to obtain multiple industrial data ciphertext segments.

5. A data processing method according to claim 1, characterized in that The industrial data acquisition terminal uploads the multiple industrial data ciphertext segments to the storage management server, including: Determine the encryption time of the multiple industrial data ciphertext segments; Construct a ciphertext based on the multiple industrial data ciphertext segments and the encryption time, and send the ciphertext and the multiple industrial data ciphertext segments to the storage management server so that the storage management server can obtain the corresponding dynamic verification code from the dynamic verification code generation server according to the encryption time to construct the initial key sequence in the storage management server.

6. A data processing method according to claim 5, characterized in that, It also includes: When querying historical industrial data, the industrial data acquisition terminal sends data query request information to both the storage management server and the dynamic verification code generation server at the same time, where the data query request information includes the encryption time corresponding to the historical industrial data to be queried and the device information of the industrial data acquisition terminal; When the industrial data acquisition terminal receives the ciphertext returned from the storage management server and the verification code returned from the dynamic verification code generation server, construct the initial key sequence stored locally based on the returned verification code to obtain a decryption key sequence, where the ciphertext returned from the storage management server and the verification code returned from the dynamic verification code generation server are generated based on the data query request information; The industrial data acquisition terminal decrypts the ciphertext returned from the storage management server based on the decryption key sequence to obtain the corresponding historical industrial data.

7. A data processing method according to claim 6, characterized in that The industrial data acquisition terminal decrypts the ciphertext returned from the storage management server based on the decryption key sequence to obtain the corresponding historical industrial data, including: Align each key matrix in the decryption key sequence with the multiple industrial data ciphertext segments in the ciphertext returned from the storage management server; When the number of key matrices is less than the number of industrial data ciphertext segments in the ciphertext, add A×n + l key matrices after the already aligned decryption key sequence so that each industrial data ciphertext segment corresponds to a key matrix, where n is the number of key matrices in a complete decryption key sequence, A is an integer greater than or equal to 0, l = L - A×n, L is the number of industrial data ciphertext segments, and the added key matrices are arranged in the order in the decryption key sequence; Perform AES inverse operation on the corresponding industrial data ciphertext segment based on each key matrix to obtain multiple industrial data segments; Construct historical industrial data based on the multiple industrial data segments.

8. A data processing method according to any one of claims 1-7, characterized in that The storage management server stores the multiple industrial data ciphertext segments based on the information of the multiple storage nodes, including: Filter the multiple storage nodes based on the remaining computing resource information and remaining storage resource information of each storage node to determine at least one candidate storage node; Generate multiple candidate storage schemes based on the remaining computing resource information and remaining storage resource information of each candidate storage node; For each candidate storage scheme, determine the matching score corresponding to the candidate storage scheme based on the storage evaluation system, where the storage evaluation system includes multiple storage evaluation indicators and the weight corresponding to each storage evaluation indicator; Determine the target storage scheme from the multiple candidate storage schemes based on the matching score corresponding to each candidate storage scheme.

9. A data processing method according to claim 8, characterized in that, The storage management server generates multiple candidate storage schemes based on the remaining computing resource information and remaining storage resource information of each candidate storage node, including: Generate multiple candidate storage schemes through a Monte Carlo model based on a constraint set, the remaining computing resource information, and the remaining storage resource information of the candidate storage nodes, where the candidate storage scheme includes the target storage node corresponding to each industrial data segment.

10. A data processing system, characterized in that, It includes an industrial data acquisition terminal, a verification code generation server, and a storage management server; The industrial data acquisition terminal is used to send verification code generation request information for requesting a verification code to the verification code generation server when performing industrial data reporting; The verification code generation server is used to generate a dynamic verification code based on the verification code generation request information; The industrial data acquisition terminal is also used to perform identity verification based on the dynamic verification code when receiving the dynamic verification code sent by the dynamic verification code generation server; The industrial data acquisition terminal is also used to convert the dynamic verification code into a digital matrix when the identity verification is passed, determine the flag bit in the dynamic verification code, determine the target operation mode based on the value of the flag bit, where the target operation mode is one or a combination of addition, subtraction, exclusive NOR, and exclusive OR, and perform operations on the digital matrix and each key matrix included in the initial key sequence based on the target operation mode to obtain an encrypted key sequence, where the number of multiple key matrices included in the encrypted key sequence is the same as the number of multiple key matrices included in the initial key sequence; The industrial data acquisition terminal is also used to divide the industrial data to be reported based on the multiple key matrices to obtain multiple industrial data segments with the same number as the key matrices; The industrial data acquisition terminal is also used to encrypt the multiple industrial data segments based on the encrypted key sequence to obtain multiple industrial data ciphertext segments; The industrial data acquisition terminal is also used to upload the multiple industrial data ciphertext segments to the storage management server; The storage management server is used to obtain the information of multiple storage nodes and store the multiple industrial data ciphertext segments based on the information of the multiple storage nodes.

Images