Industrial data secure transmission method based on block chain

Abstract

The invention relates to the technical field of industrial data secure transmission, and discloses an industrial data secure transmission method based on a block chain, and the method comprises the steps: a server receives an industrial data request, obtains a user behavior feature vector, carries out the classification prediction, and calculates the legitimacy probability; the server sends the data key and the encrypted industrial data to the user side equipment to generate a user key, the data key and the encrypted industrial data are combined to obtain a combined key, and a second key is used for carrying out secondary encryption on the encrypted data to generate second encrypted industrial data; the requester and the proxy node are verified through the block chain verification information, and the combination key and the second encrypted data are inquired at the proxy node after the verification is passed; and the requester and the user side equipment obtain the data key through authority information authentication, decrypt the second encrypted data by using the combined key to obtain the first decrypted data, and decrypt the first decrypted data by using the data key to obtain the original industrial data. The method has the advantages that the risk of tampering in the data transmission process is effectively prevented, and the safety of industrial data transmission is guaranteed.

Description

Technical Field

[0001] The present invention relates to the technical field of secure industrial data transmission, and in particular to a blockchain-based secure industrial data transmission method. Background Art

[0002] At present, there is a risk of passive leakage in the process of industrial data transmission, such as industrial data being intercepted by hackers during transmission. Secondly, there is a risk of active tampering in the process of industrial data transmission. In response to various data transmission security issues in industrial data transmission, many security methods have been proposed, including differential privacy protection, proxy re-encryption, proxy obfuscation circuits, etc.

[0003] In the existing industrial data transmission process, if symmetric encryption is used, there are risks of privacy leakage and proxy attacks. Because the key of symmetric encryption is transmitted to the proxy, and the proxy has strong autonomy, the honesty and trustworthiness of the proxy cannot be guaranteed. If public key encryption is used, there are problems of large computing and communication volume. Because the key of public key encryption is encrypted by the user's public key, the user's public key is very long, and the computing and communication overhead is very large. Moreover, the proxy cannot decrypt the data, and it is directly decrypted by the user, while industrial sites generally do not have abundant computing resources.

[0004] In summary, the existing industrial data transmission methods cannot effectively prevent the risks of illegal access and tampering during the data transmission process, which is not conducive to ensuring the security of industrial data transmission. Summary of the invention

[0005] The present invention provides a blockchain-based industrial data security transmission method to effectively prevent the risks of illegal acquisition and tampering during data transmission and ensure the security of industrial data transmission.

[0006] In the first aspect, in order to solve the above technical problems, the present invention provides a blockchain-based industrial data security transmission method, comprising: The server receives the transmission request of industrial data sent by the user terminal device and obtains the user behavior feature vector; The server classifies and predicts the user behavior feature vector based on a preset dynamic authority verification model to obtain the legitimacy probability of the user request; The server judges the legitimacy probability, and when the legitimacy probability is greater than or equal to a preset probability threshold, sends the data key and the first encrypted industrial data to the user terminal device; The user terminal device generates a user key, combines the data key and the user key to obtain a combined key, and sends the combined key and the first encrypted industrial data to the proxy node; the proxy node performs secondary encryption according to the combined key and the first encrypted industrial data to obtain second encrypted industrial data; After the industrial data requester obtains the blockchain verification information and the industrial data source device permission information from the proxy node, the industrial data requester and the proxy node are verified through the blockchain verification information. After the verification is passed, the combined key and the second encrypted industrial data are queried on the proxy node; wherein the blockchain verification information and the industrial data source device permission information are stored on the blockchain through a blockchain smart contract; Authenticate the industrial data requester and the user terminal device through the industrial data source device authority information, and obtain the data key stored in the user terminal device after the authentication is passed; The industrial data requester decrypts the first decrypted data according to the combined key and the second encrypted industrial data, and decrypts the first decrypted data again using the data key to obtain the decrypted industrial data.

[0007] In an optional implementation, the training process of the dynamic permission verification model includes: Obtain the user's historical access data and historical behavior characteristics; Preprocessing the historical access data and the historical behavior features, and dividing them into β non-overlapping subsets, where β is a preset number; Dividing all the subsets into training set data and validation set data; Using the training set data as input data, constructing an initial dynamic permission verification model based on a random forest algorithm, and dynamically adjusting permissions of the initial dynamic permission verification model according to the verification set data to obtain a dynamic permission verification model; The following formula is used to dynamically adjust permissions: in, represents the feature value of the validation set data, and represents the adjustment parameters of the validation set data, Indicates the dynamically adjusted permission verification threshold.

[0008] In an optional implementation, the server performs classification prediction on the user behavior feature vector based on a preset dynamic authority verification model to obtain the legitimacy probability of the user request, including: Obtaining an output value of the user behavior feature vector; If the output value is less than It is considered illegal when If the output value is greater than or equal to When the act is deemed to be legal; The output value determined as a legitimate behavior is used to calculate the legitimacy probability of the user's request using a credibility algorithm; in, Indicates the dynamically adjusted permission verification threshold.

[0009] In an optional implementation, the server judges the legitimacy probability, and when the legitimacy probability is greater than or equal to a preset probability threshold, sends the data key and the first encrypted industrial data to the user terminal device, including: The server determines the legitimacy probability: When the legitimacy probability is less than a preset probability threshold, the user's request is rejected; When the legitimacy probability is greater than or equal to a preset probability threshold, the user's verification information and industrial data source device permission information are stored on the blockchain to generate a data key; Performing preliminary encryption using an encryption algorithm based on the pre-acquired original industrial data and the data key to obtain first encrypted industrial data; The data key and the first encrypted industrial data are sent to a user terminal device.

[0010] In an optional implementation manner, the user terminal device generates a user key, and combines the data key and the user key to obtain a combined key, including: The user terminal device inputs the user key as plain text and uses the data key as an encryption key; The user key is encrypted using the data key through the SM4 encryption algorithm to obtain the combined key.

[0011] In an optional implementation, after the industrial data requester obtains the blockchain verification information and the industrial data source device authority information from the proxy node, the industrial data requester and the proxy node are verified through the blockchain verification information, and after the verification is passed, the combined key and the second encrypted industrial data are queried on the proxy node, including: Obtain blockchain verification information and industrial data source equipment permission information; The industrial data requester and the proxy node verify each other through the blockchain verification information: If the authority information provided by the industrial data requester is consistent with the blockchain verification information, the combined key can be queried on the proxy node; If the authority information provided by the industrial data requester does not match the blockchain verification information, then re-acquire the blockchain verification information and the industrial data source device authority information; According to the combined key, the second encrypted industrial data is queried and obtained.

[0012] In an optional implementation, the authentication between the industrial data requester and the user terminal device through the industrial data source device authority information, and obtaining the data key stored in the user terminal device after the authentication is passed, includes: If the identity information and permission information provided by the industrial data requester match the permission information stored in the user terminal device, then obtaining the data key stored in the user terminal device; If the identity information and permission information provided by the industrial data requester do not match the permission information stored in the user-end device, the blockchain verification information and industrial data source device permission information are re-obtained.

[0013] In an optional implementation manner, the industrial data requester decrypts the first decrypted data according to the combined key and the second encrypted industrial data, and decrypts the first decrypted data again using the data key to obtain the decrypted industrial data, including: The industrial data requester obtains the combined key and the data key through the proxy node; Obtaining second encrypted industrial data by querying on the proxy node through the combined key; decrypting the second encrypted industrial data to obtain first decrypted data; The first decrypted data is decrypted again using the data key to obtain decrypted industrial data.

[0014] In a second aspect, the present invention also provides an electronic device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, the blockchain-based industrial data secure transmission method described in any one of the above is implemented.

[0015] In a third aspect, the present invention also provides a computer-readable storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the above-mentioned blockchain-based industrial data security transmission methods.

[0016] Compared with the prior art, the present invention has the following beneficial effects: The present invention discloses a method for secure transmission of industrial data based on blockchain, the method comprising: a server receiving a transmission request for industrial data sent by a user terminal device, and obtaining a user behavior feature vector; the server classifies and predicts the user behavior feature vector based on a preset dynamic authority verification model, obtains the legitimacy probability of the user request, and when the legitimacy probability is greater than or equal to a preset probability threshold, sends a data key and first encrypted industrial data to the user terminal device; the user terminal device generates a user key, combines the data key and the user key to obtain a combined key, and sends the combined key and the first encrypted industrial data to an agent node; the agent node performs secondary encryption based on the combined key and the first encrypted industrial data The industrial data requester obtains the blockchain verification information and the industrial data source device authority information from the proxy node, and then verifies the industrial data requester and the proxy node through the blockchain verification information. After the verification is passed, the combination key and the second encrypted industrial data are queried on the proxy node; the industrial data requester and the user-end device are authenticated through the industrial data source device authority information, and the data key stored in the user-end device is obtained after the authentication is passed; the industrial data requester decrypts the first decrypted data according to the combination key and the second encrypted industrial data, and uses the data key to decrypt the first decrypted data again to obtain the decrypted industrial data. In summary, the present invention can effectively prevent the risk of illegal acquisition and tampering during data transmission, and ensure the security of industrial data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a flowchart of a blockchain-based industrial data security transmission method provided by the first embodiment of the present invention. DETAILED DESCRIPTION

[0018] At present, there is a risk of passive leakage in the process of industrial data transmission, such as industrial data being intercepted by hackers during transmission. Secondly, there is a risk of active tampering in the process of industrial data transmission. In response to various data transmission security issues in industrial data transmission, many security methods have been proposed, including differential privacy protection, proxy re-encryption, proxy obfuscation circuits, etc.

[0019] In the existing industrial data transmission process, if symmetric encryption is used, there are risks of privacy leakage and proxy attacks. Because the key of symmetric encryption is transmitted to the agent, and the agent has strong autonomy, the honesty and trustworthiness of the agent cannot be guaranteed. If public key encryption is used, there are problems of large computing and communication volume. Because the key of public key encryption is encrypted by the user's public key, the user's public key is very long, and the computing and communication overhead is very large. Moreover, the agent cannot decrypt the data, and it is directly decrypted by the user, while the industrial site generally does not have abundant computing resources. However, the existing industrial data transmission method cannot effectively prevent the risk of illegal acquisition and tampering during the data transmission process, which is not conducive to ensuring the security of industrial data transmission.

[0020] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] To solve the above problems, refer to Figure 1 The first embodiment of the present invention provides a blockchain-based industrial data security transmission method, comprising the following steps: S11, the server receives a transmission request for industrial data sent by a user terminal device and obtains a user behavior feature vector; S12, the server classifies and predicts the user behavior feature vector based on a preset dynamic authority verification model to obtain a legitimacy probability of the user request; S13, the server determines the legitimacy probability, and when the legitimacy probability is greater than or equal to a preset probability threshold, sends the data key and the first encrypted industrial data to the user terminal device; S14, the user terminal device generates a user key, combines the data key and the user key to obtain a combined key, and sends the combined key and the first encrypted industrial data to the proxy node; the proxy node performs secondary encryption according to the combined key and the first encrypted industrial data to obtain second encrypted industrial data; S15, after the industrial data requester obtains the blockchain verification information and the industrial data source device permission information from the proxy node, the industrial data requester and the proxy node are verified through the blockchain verification information, and after the verification is passed, the combined key and the second encrypted industrial data are queried on the proxy node; wherein the blockchain verification information and the industrial data source device permission information are stored on the blockchain through a blockchain smart contract; S16, authenticating the industrial data requester and the user terminal device through the industrial data source device authority information, and obtaining the data key stored in the user terminal device after the authentication is passed; S17, the industrial data requester decrypts the first decrypted data according to the combined key and the second encrypted industrial data, and decrypts the first decrypted data again using the data key to obtain the decrypted industrial data.

[0022] The present invention discloses a method for secure transmission of industrial data based on blockchain, the method comprising: a server receiving a transmission request for industrial data sent by a user terminal device, and obtaining a user behavior feature vector; the server classifies and predicts the user behavior feature vector based on a preset dynamic authority verification model, obtains the legitimacy probability of the user request, and when the legitimacy probability is greater than or equal to a preset probability threshold, sends a data key and first encrypted industrial data to the user terminal device; the user terminal device generates a user key, combines the data key and the user key to obtain a combined key, and sends the combined key and the first encrypted industrial data to an agent node; the agent node performs secondary encryption based on the combined key and the first encrypted industrial data The industrial data requester obtains the blockchain verification information and the industrial data source device authority information from the proxy node, and then verifies the industrial data requester and the proxy node through the blockchain verification information. After the verification is passed, the combination key and the second encrypted industrial data are queried on the proxy node; the industrial data requester and the user-end device are authenticated through the industrial data source device authority information, and the data key stored in the user-end device is obtained after the authentication is passed; the industrial data requester decrypts the first decrypted data according to the combination key and the second encrypted industrial data, and uses the data key to decrypt the first decrypted data again to obtain the decrypted industrial data. In summary, the present invention can effectively prevent the risk of illegal acquisition and tampering during data transmission, and ensure the security of industrial data transmission.

[0023] In step S11, the server receives a transmission request for industrial data sent by a user-end device and obtains a user behavior feature vector.

[0024] It should be noted that the data sources of industrial data transmission requests include sensors, PLCs, CNC machine tools, industrial robots, etc. Obtain industrial data transmission requests through physical connection and network configuration: Physically connect data acquisition devices, such as industrial intelligent gateways, to industrial equipment, and realize data transmission through communication interfaces such as Ethernet and serial ports.

[0025] The user behavior feature vector is a mathematical tool used to represent user behavior characteristics. It combines multiple user behavior features into a vector form. These features include the user's historical access data and historical behavior characteristics. The user's historical access data refers to the user's access records on the website or application, including Visit time, visited pages, visit duration, visit path and visit frequency, etc.; User historical behavior characteristics refer to the user's various behavioral performances on the website or application, including browsing behavior, interactive behavior, search behavior and retention behavior, etc.

[0026] To obtain the user behavior feature vector, it is necessary to collect various types of user behavior data, such as the user's historical access data and historical behavior features, and then convert the extracted features into numerical form and combine them into a vector. For example, the user's historical access data and historical behavior features can be represented as a vector. Finally, the obtained user behavior feature vector is normalized to improve accuracy.

[0027] In step S12, the server classifies and predicts the user behavior feature vector based on a preset dynamic authority verification model to obtain the legitimacy probability of the user request.

[0028] Obtaining an output value of the user behavior feature vector; If the output value is less than It is considered illegal when If the output value is greater than or equal to When the act is deemed to be legal; The output value determined as a legitimate behavior is used to calculate the legitimacy probability of the user's request using a credibility algorithm; in, Indicates the dynamically adjusted permission verification threshold.

[0029] It should be noted that the output value of the user behavior feature vector is a multi-dimensional numerical vector used to represent the user's behavior characteristics. This vector may include the user's historical access data and historical behavior characteristics, etc., which are converted into numerical form after processing.

[0030] Credibility algorithm is a method for evaluating the degree to which a hypothesis or conclusion is true. It is used in uncertainty reasoning to determine the credibility of a hypothesis by calculating the trust growth and distrust growth.

[0031] The credibility is calculated by the following formula: in, Indicates the credibility of the current user behavior. Indicates the growth of trust, Indicates distrust of growth.

[0032] To calculate the legitimacy probability of a user request using a credibility algorithm, it is necessary to first obtain the output value of the user behavior feature vector that is determined to be a legitimate behavior, and then use similarity calculation methods such as cosine similarity and Euclidean distance to calculate the similarity between the current user's behavior feature vector and the legitimate behavior; then determine the trust growth and distrust growth: Trust Growth ( ): When the current user's behavior feature vector has a high similarity with the legitimate behavior, the trust growth is large, indicating that the current user's behavior is closer to the legitimate behavior.

[0033] Distrust Growth ( ): When the similarity is low, the distrust growth is large, indicating that the current user behavior is very different from the legitimate behavior.

[0034] Finally, the above formula is used to calculate the credibility result. , indicating that the legitimacy of the current user behavior is highly likely; when , indicating that the probability of the legitimacy of the current user behavior is low; when , indicating that the legitimacy probability of the current user behavior is neutral.

[0035] The legitimacy probability of the user request is calculated based on the credibility and the set threshold. , then the legitimacy probability can be set to 80%.

[0036] Furthermore, the training process of the dynamic permission verification model includes: Obtain the user's historical access data and historical behavior characteristics; Preprocessing the historical access data and the historical behavior features, and dividing them into β non-overlapping subsets, where β is a preset number; Dividing all the subsets into training set data and validation set data; Using the training set data as input data, constructing an initial dynamic permission verification model based on a random forest algorithm, and dynamically adjusting permissions of the initial dynamic permission verification model according to the verification set data to obtain a dynamic permission verification model; The following formula is used to dynamically adjust permissions: in, represents the feature value of the validation set data, and represents the adjustment parameters of the validation set data, Indicates the dynamically adjusted permission verification threshold.

[0037] It should be noted that the selection of the number of subsets is usually based on the size of the data set and computing resources, and a cross-validation method can be used. For example, the selection of this method is 10; the user's historical access data refers to the user's access records on the website or application, including access time, access pages, access duration, access path, and access frequency; the user's historical behavioral characteristics refer to the user's various behavioral performances on the website or application, including browsing behavior, interactive behavior, search behavior, and retention behavior. The adjustment parameters of the validation set data are obtained through parameter tuning during the model training process and analysis of the expected feature values ​​of the validation set data.

[0038] The training set data and the validation set data are two parts of the data set used to evaluate model performance: the training set is the data set used to train the model, that is, the model learns and adjusts parameters through these data to minimize the prediction error; the validation set is the data set used to verify the generalization ability of the model, that is, to evaluate the performance of the model on unseen data to prevent the model from overfitting. The training set is used to train the model to help the model learn how to map from input to output; the validation set is used to evaluate the generalization ability of the model, that is, the model's ability to predict new data.

[0039] The dynamic permission verification model is a permission management mechanism that allows the system to dynamically adjust the user's permissions at runtime based on the user's real-time behavior, environmental conditions, or preset rules. Unlike traditional static permission management, dynamic permission management does not rely on pre-defined roles and permissions, but can flexibly grant or revoke permissions based on real-time conditions. The dynamic permission verification model is highly adaptable and can handle dynamic factors such as role changes and user behavior changes to adapt to changing business needs. It can also dynamically adjust permissions based on real-time conditions to improve application responsiveness and user experience.

[0040] The random forest algorithm is an ensemble learning method and a supervised learning algorithm, mainly used for classification and regression tasks. It builds multiple decision trees and combines their results to improve the accuracy and robustness of predictions. The core idea of ​​the random forest includes two "randomnesses". The first is the random selection of samples: during the training process, each time a decision tree is trained, samples are randomly selected from the training set using replacement sampling; the second is the random selection of features: when each node of the decision tree is split, a part of the features is randomly selected from all the features for splitting, instead of using all the features. The random forest algorithm can effectively reduce the risk of overfitting and improve the prediction accuracy of the model by integrating the results of multiple decision trees; the random forest algorithm is highly robust to noise and outliers: because it is an integration of multiple decision trees, even if some decision trees are affected by noise or outliers, the performance of the overall model will not be greatly affected.

[0041] In step S13, the server determines the legitimacy probability, and when the legitimacy probability is greater than or equal to a preset probability threshold, the server sends the data key and the first encrypted industrial data to the user terminal device.

[0042] The server determines the legitimacy probability: When the legitimacy probability is less than a preset probability threshold, the user's request is rejected; When the legitimacy probability is greater than or equal to a preset probability threshold, the user's verification information and industrial data source device permission information are stored on the blockchain to generate a data key; Performing preliminary encryption using an encryption algorithm based on the pre-acquired original industrial data and the data key to obtain first encrypted industrial data; The data key and the first encrypted industrial data are sent to a user terminal device.

[0043] It should be noted that the data key refers to the key used to encrypt or decrypt data. In cryptography, the data key is specifically used to encrypt the data itself, not to encrypt other keys. The data key can be a key used for symmetric encryption, or a public key or private key in asymmetric encryption; in this embodiment, a symmetric encryption key is selected. The data key can protect data security: the data key is the core of data encryption, through which plaintext data is converted into ciphertext, thereby preventing unauthorized access and data leakage. Only users with the correct key can decrypt and access the original data. During the transmission and storage of data, the data key can prevent data from being tampered with. Through encryption, the integrity and consistency of the data can be guaranteed. This method exemplarily sets the preset probability threshold to 80%.

[0044] An encryption algorithm is used for preliminary encryption to obtain the first encrypted industrial data. A data key can be selected through the industrial data source device and saved in the device. Then verification information is generated and sent to the user. The user fills in the verification information and returns it. If the verification is successful, the data key is used to encrypt the original industrial data to generate the first encrypted industrial data.

[0045] In step S14, the user-end device generates a user key, combines the data key and the user key to obtain a combined key, and sends the combined key and the first encrypted industrial data to the proxy node; the proxy node performs secondary encryption based on the combined key and the first encrypted industrial data to obtain second encrypted industrial data.

[0046] The user terminal device inputs the user key as plain text and uses the data key as an encryption key; The user key is encrypted using the data key through the SM4 encryption algorithm to obtain the combined key.

[0047] It should be noted that a user key is a key used to encrypt and decrypt data for identity authentication and data protection. It can be a key used for symmetric encryption or a public and private key pair in asymmetric encryption. User keys are used in security systems to ensure that only authorized users can access or operate specific data or resources.

[0048] The SM4 encryption algorithm is a symmetric encryption algorithm used to encrypt and decrypt data. The SM4 encryption algorithm has a key length of 128 bits and a data block size of 128 bits. The SM4 encryption algorithm has high security. It uses a complex encryption algorithm and a long key length, making it extremely difficult to crack and effectively protecting the confidentiality of data. The SM4 encryption algorithm is designed to resist a variety of known cryptographic attacks, such as differential cryptanalysis and linear cryptanalysis, and has high security.

[0049] Combining keys means combining multiple keys or key fragments, such as data keys and user keys, to form a new key for encrypting or decrypting data. This combination can be achieved by splicing, mixing or regularizing multiple key fragments. By combining multiple keys, the difficulty of cracking can be increased, because the attacker needs to crack multiple key fragments at the same time to obtain the complete combined key; combining keys can use key fragments from different sources to provide a more complex encryption mechanism, thereby improving the security of the system.

[0050] In a specific application scenario, for example, in the KDC solution, each user only saves his own private key and the public key of KDC; when user A wants to have a conversation with user B, user A needs to send a request encrypted with his own private key to KDC, indicating that user A wants to have a conversation with user B; after receiving the request, KDC generates a key K of a symmetric encryption algorithm that can be used for secret conversations between user A and user B, and then returns a response to user A, which contains the key K encrypted with user A's public key and the key K encrypted with user B's public key; user A sends the part encrypted with user B's public key to user B, and user B decrypts it to obtain the session key K, completing the automatic key distribution process. In this process, the data key (session key K) is generated by KDC, and the user key (user's private key and public key) is used for the request and response of encryption and decryption of industrial data, and combined with the key (session key K) for subsequent encrypted communication.

[0051] In step S15, after the industrial data requester obtains the blockchain verification information and the industrial data source device permission information from the proxy node, the industrial data requester and the proxy node are verified through the blockchain verification information. After the verification is passed, the combined key and the second encrypted industrial data are queried on the proxy node; wherein the blockchain verification information and the industrial data source device permission information are stored on the blockchain through a blockchain smart contract.

[0052] Obtain blockchain verification information and industrial data source equipment permission information; The industrial data requester and the proxy node verify each other through the blockchain verification information: If the authority information provided by the industrial data requester is consistent with the blockchain verification information, the combined key can be queried on the proxy node; If the authority information provided by the industrial data requester does not match the blockchain verification information, then re-acquire the blockchain verification information and the industrial data source device authority information; According to the combined key, the second encrypted industrial data is queried and obtained.

[0053] It should be noted that blockchain verification information refers to information used to verify the integrity and authenticity of data in the blockchain. This information includes transaction hashes, blockchain hashes, Merkle trees, etc., which are used to ensure the immutability and consistency of blockchain data. The method of obtaining blockchain verification information can be through the use of a block browser, which allows users to search and browse blockchain data. Through the block browser, users can query specific information such as blocks, transactions, and addresses. For example, in a specific application scenario, users can obtain relevant verification information, such as the details of the transaction and the hash value of the block, by entering a transaction hash or block number.

[0054] A blockchain smart contract is a computer program that automatically executes, controls or records legal events and actions on a blockchain. It is a self-executing contract whose terms are written in code on the blockchain and automatically executed when the preset conditions are met. The code and execution results of a blockchain smart contract are publicly available on the blockchain, and all participants can verify the terms and execution of the contract, which enhances the transparency of the system; once a smart contract is deployed on the blockchain, its code and execution results will be permanently recorded and cannot be tampered with, ensuring the security and reliability of the contract.

[0055] Industrial data source device permission information refers to the permission settings for accessing and operating data source devices, such as sensors, PLCs, industrial robots, etc. in industrial environments. These permission information defines which users or systems can access the data of a specific device, which operations can be performed, such as reading, writing, modifying, etc., as well as the scope and restrictions of access. Industrial data source device permission information can prevent unauthorized users from accessing sensitive data through strict permission management, thereby protecting the data security of the enterprise and preventing data leakage; it can also ensure that only legitimate users or systems can access and operate data source devices, preventing data from being illegally tampered with or abused.

[0056] In step S16, the industrial data requester and the user-end device are authenticated through the industrial data source device authority information, and when the authentication is successful, the data key stored in the user-end device is obtained.

[0057] If the identity information and permission information provided by the industrial data requester match the permission information stored in the user terminal device, then obtaining the data key stored in the user terminal device; If the identity information and permission information provided by the industrial data requester do not match the permission information stored in the user-end device, the blockchain verification information and industrial data source device permission information are re-obtained.

[0058] It should be noted that industrial data source device permission information refers to the permission settings for accessing and operating data source devices, such as sensors, PLCs, industrial robots, etc. in industrial environments. These permission information defines which users or systems can access the data of specific devices, which operations can be performed, such as reading, writing, modifying, etc., as well as the scope and restrictions of access. Industrial data source device permission information can prevent unauthorized users from accessing sensitive data through strict permission management, thereby protecting the data security of the enterprise and preventing data leakage; it can also ensure that only legitimate users or systems can access and operate data source devices, preventing data from being illegally tampered with or abused.

[0059] In step S17, the industrial data requester decrypts the first decrypted data according to the combined key and the second encrypted industrial data, and decrypts the first decrypted data again using the data key to obtain the decrypted industrial data.

[0060] The industrial data requester obtains the combined key and the data key through the proxy node; Obtaining second encrypted industrial data by querying on the proxy node through the combined key; decrypting the second encrypted industrial data to obtain first decrypted data; The first decrypted data is decrypted again using the data key to obtain decrypted industrial data.

[0061] It should be noted that the first decrypted data obtained by decrypting the second encrypted industrial data is the above-mentioned first encrypted industrial data; the first decrypted data is decrypted again by using the data key to obtain the decrypted industrial data, which is the above-mentioned original industrial data.

[0062] A data key is a key used to encrypt or decrypt data. In cryptography, a data key is used specifically to encrypt the data itself, not other keys. A data key can be a key used for symmetric encryption, or a public key or private key in asymmetric encryption. Data keys can protect data security: data keys are the core of data encryption, which converts plaintext data into ciphertext to prevent unauthorized access and data leakage. Only users with the correct key can decrypt and access the original data. During data transmission and storage, data keys can prevent data from being tampered with. Through encryption, the integrity and consistency of data can be guaranteed.

[0063] Combining keys means combining multiple keys or key fragments, such as data keys and user keys, to form a new key for encrypting or decrypting data. This combination can be achieved by splicing, mixing or regularizing multiple key fragments. By combining multiple keys, the difficulty of cracking can be increased, because the attacker needs to crack multiple key fragments at the same time to obtain the complete combined key; combining keys can use key fragments from different sources to provide a more complex encryption mechanism, thereby improving the security of the system.

[0064] The following describes the working process of the present invention using a common scenario as an example. Figure 1 Schematic diagram of the working scenario of the method.

[0065] In a smart manufacturing factory, the sensor equipment of an automated production line needs to transmit the collected industrial data to the central server for analysis. The sensor equipment first sends a data transmission request to the server and provides its operation behavior feature vector; the server uses the preset dynamic permission verification model to analyze the feature vector and calculate the legitimacy probability of the request; when the probability reaches or exceeds the set threshold, the server sends the data key and the encrypted industrial data to the sensor equipment; the sensor equipment generates a user key and combines it with the data key to generate a combined key; then, it sends the combined key and encrypted data to the proxy node, and the proxy node uses the combined key to encrypt the data twice to generate a more secure second encrypted industrial data. After obtaining the blockchain verification information and device permission information, the industrial data requester confirms his identity with the proxy node through blockchain verification, and obtains the combined key and the second encrypted data from the proxy node after the verification is passed; then, the requester and the sensor equipment authenticate through the permission information, and obtains the data key after the authentication is passed; finally, the requester uses the combined key to decrypt the second encrypted data to obtain the first decrypted data, and then uses the data key to decrypt the first decrypted data, and finally obtains the decrypted industrial data.

[0066] In summary, the present invention discloses a method for secure transmission of industrial data based on blockchain, the method comprising: a server receiving a transmission request for industrial data sent by a user terminal device, and obtaining a user behavior feature vector; the server classifies and predicts the user behavior feature vector based on a preset dynamic authority verification model, obtains the legitimacy probability of the user request, and when the legitimacy probability is greater than or equal to a preset probability threshold, sends a data key and a first encrypted industrial data to the user terminal device; the user terminal device generates a user key, combines the data key and the user key to obtain a combined key, and sends the combined key and the first encrypted industrial data to a proxy node; the proxy node performs a classification prediction based on the combined key and the first encrypted industrial data. Secondary encryption to obtain the second encrypted industrial data; after the industrial data requester obtains the blockchain verification information and the industrial data source device authority information from the proxy node, the industrial data requester and the proxy node are verified through the blockchain verification information, and after the verification is passed, the combined key and the second encrypted industrial data are queried on the proxy node; the industrial data requester and the user-end device are authenticated through the industrial data source device authority information, and when the authentication is passed, the data key stored in the user-end device is obtained; the industrial data requester decrypts the first decrypted data according to the combined key and the second encrypted industrial data, and uses the data key to decrypt the first decrypted data again to obtain the decrypted industrial data. In summary, the present invention can effectively prevent the risk of illegal acquisition and tampering during data transmission, and ensure the security of industrial data transmission.

[0067] It should be noted that the embodiment of the present invention is used to execute all the process steps of a blockchain-based industrial data security transmission method of the above embodiment. The working principles and beneficial effects of the two correspond one to one, and thus will not be repeated here.

[0068] The embodiment of the present invention further provides an electronic device. The electronic device includes: a processor, a memory, and a computer program stored in the memory and executable on the processor, such as a data processing terminal program. When the processor executes the computer program, the steps in the above-mentioned embodiments of the industrial data security transmission method based on blockchain are implemented, such as Figure 1 Step S11 is shown.

[0069] Exemplarily, the computer program may be divided into one or more modules / units, which are stored in the memory and executed by the processor to implement the present invention. The one or more modules / units may be a series of computer program instruction segments capable of implementing specific functions, which are used to describe the execution process of the computer program in the electronic device.

[0070] The electronic device may be a computing device such as a desktop computer, a notebook, a PDA, and a smart tablet. The electronic device may include, but is not limited to, a processor and a memory. Those skilled in the art will appreciate that the above components are merely examples of electronic devices and do not constitute a limitation on the electronic device. The electronic device may include more or fewer components than the above components, or may combine certain components, or different components. For example, the electronic device may also include input and output devices, network access devices, buses, etc.

[0071] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the electronic device, and uses various interfaces and lines to connect various parts of the entire electronic device.

[0072] The memory can be used to store the computer program and / or module, and the processor realizes various functions of the electronic device by running or executing the computer program and / or module stored in the memory, and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0073] Wherein, if the module / unit integrated in the electronic device is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0074] The specific embodiments described above further illustrate the purpose, technical solutions and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. It is particularly pointed out that for those skilled in the art, any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of protection of the present invention.

Claims

1. A blockchain-based industrial data security transmission method, characterized in that: include: The server receives the transmission request of industrial data sent by the user terminal device and obtains the user behavior feature vector; The server classifies and predicts the user behavior feature vector based on a preset dynamic authority verification model to obtain the legitimacy probability of the user request; The server judges the legitimacy probability, and when the legitimacy probability is less than a preset probability threshold, rejects the user's request, and when the legitimacy probability is greater than or equal to the preset probability threshold, sends the data key and the first encrypted industrial data to the user terminal device; The user terminal device generates a user key, combines the data key and the user key to obtain a combined key, and sends the combined key and the first encrypted industrial data to the proxy node; The proxy node performs secondary encryption according to the combined key and the first encrypted industrial data to obtain second encrypted industrial data; After the industrial data requester obtains the blockchain verification information and the industrial data source device permission information from the proxy node, the industrial data requester and the proxy node are verified through the blockchain verification information. After the verification is passed, the combined key and the second encrypted industrial data are queried on the proxy node; wherein the blockchain verification information and the industrial data source device permission information are stored on the blockchain through a blockchain smart contract; Authenticate the industrial data requester and the user terminal device through the industrial data source device authority information, and obtain the data key stored in the user terminal device after the authentication is passed; The industrial data requester decrypts the first decrypted data according to the combined key and the second encrypted industrial data, and decrypts the first decrypted data again using the data key to obtain the decrypted industrial data; The server classifies and predicts the user behavior feature vector based on a preset dynamic authority verification model to obtain the legitimacy probability of the user request, including: Obtaining an output value of the user behavior feature vector; If the output value is less than the dynamically adjusted permission verification threshold, it is determined to be an illegal behavior; If the output value is greater than or equal to the dynamically adjusted permission verification threshold, it is determined to be a legal behavior; The output value judged as legal behavior is used to calculate the legitimacy probability of the user request using a credibility algorithm.

2. The method for secure transmission of industrial data based on blockchain according to claim 1 is characterized in that: The training process of the dynamic permission verification model includes: Obtain the user's historical access data and historical behavior characteristics; Preprocessing the historical access data and the historical behavior features, and dividing them into β non-overlapping subsets, where β is a preset number; Dividing all the subsets into training set data and validation set data; Using the training set data as input data, constructing an initial dynamic permission verification model based on a random forest algorithm, and dynamically adjusting permissions of the initial dynamic permission verification model according to the verification set data to obtain a dynamic permission verification model; The following formula is used to dynamically adjust permissions: in, represents the feature value of the validation set data, and represents the adjustment parameters of the validation set data, Indicates the dynamically adjusted permission verification threshold.

3. The method for secure transmission of industrial data based on blockchain according to claim 1 is characterized in that: The server judges the legitimacy probability, and when the legitimacy probability is less than a preset probability threshold, rejects the user's request, and when the legitimacy probability is greater than or equal to the preset probability threshold, sends the data key and the first encrypted industrial data to the user terminal device, including: The server determines the legitimacy probability: When the legitimacy probability is less than a preset probability threshold, the user's request is rejected; When the legitimacy probability is greater than or equal to a preset probability threshold, the user's verification information and industrial data source device permission information are stored on the blockchain to generate a data key; Performing preliminary encryption using an encryption algorithm based on the pre-acquired original industrial data and the data key to obtain first encrypted industrial data; The data key and the first encrypted industrial data are sent to a user terminal device.

4. The method for secure transmission of industrial data based on blockchain according to claim 1 is characterized in that: The user terminal device generates a user key, and combines the data key and the user key to obtain a combined key, including: The user terminal device inputs the user key as plain text and uses the data key as an encryption key; The user key is encrypted using the data key through the SM4 encryption algorithm to obtain the combined key.

5. The method for secure transmission of industrial data based on blockchain according to claim 1 is characterized in that: After the industrial data requester obtains the blockchain verification information and the industrial data source device authority information from the proxy node, the industrial data requester and the proxy node are verified through the blockchain verification information, and after the verification is passed, the combined key and the second encrypted industrial data are queried on the proxy node, including: Obtain blockchain verification information and industrial data source equipment permission information; The industrial data requester and the proxy node verify each other through the blockchain verification information: If the authority information provided by the industrial data requester is consistent with the blockchain verification information, the combined key is obtained by querying on the proxy node; If the authority information provided by the industrial data requester does not match the blockchain verification information, then re-acquire the blockchain verification information and the industrial data source device authority information; According to the combined key, the second encrypted industrial data is queried and obtained.

6. The method for secure transmission of industrial data based on blockchain according to claim 1 is characterized in that: The step of authenticating the industrial data requester and the user terminal device through the industrial data source device authority information, and obtaining the data key stored in the user terminal device after the authentication is passed, includes: If the identity information and permission information provided by the industrial data requester match the permission information stored in the user terminal device, then obtaining the data key stored in the user terminal device; If the identity information and permission information provided by the industrial data requester do not match the permission information stored in the user-end device, the blockchain verification information and industrial data source device permission information are re-obtained.

7. The method for secure transmission of industrial data based on blockchain according to claim 5 is characterized in that: The industrial data requester decrypts the first decrypted data according to the combined key and the second encrypted industrial data, and decrypts the first decrypted data again using the data key to obtain the decrypted industrial data, including: The industrial data requester obtains the combined key and the data key through the proxy node; Obtaining second encrypted industrial data by querying on the proxy node through the combined key; decrypting the second encrypted industrial data to obtain first decrypted data; The first decrypted data is decrypted again using the data key to obtain decrypted industrial data.

8. An electronic device, characterized in that: It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and when the processor executes the computer program, it implements the blockchain-based industrial data security transmission method as described in any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program, wherein, when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the blockchain-based industrial data security transmission method as described in any one of claims 1 to 7.

Images