Data encryption transmission method, device, equipment and product

Abstract

The invention discloses a data encryption transmission method, device, equipment and product, and relates to the technical field of data communication, and the method comprises the steps: receiving a data query request sent by a user side, and according to the data query request, carrying out data query through an agent to obtain ciphertext data and a data token; and sending the ciphertext data and the data token to the user side, analyzing the data token by the user side through a preset communication key to obtain a symmetric key, and decrypting the ciphertext data based on the symmetric key to obtain a data query result. Therefore, the problem of low security of data transmission in the numerical control system is solved, and the security of data query is improved.

Description

Technical Field

[0001] The present application relates to the field of data communication technology, and in particular to a data encryption transmission method, device, equipment and product. Background Art

[0002] The interconnection between CNC equipment is the basis of intelligent manufacturing. Therefore, a variety of highly compatible communication protocols have been proposed and applied to the interconnection of CNC equipment to achieve tighter CNC system integration, such as MTConnect, OPC UA, umati, etc. in foreign countries. In recent years, my country has also proposed the NC-Link, an interconnection interface specification for CNC machine tools in smart factories. It is not only compatible with several other communication protocols, but also has unique advantages in real-time performance, transmission speed, etc., providing stronger guarantees for intelligent manufacturing.

[0003] As more and more equipment uses NC-Link, a large amount of data is generated and then collected locally or in the cloud for monitoring, analysis, and traceability diagnosis. However, the continuous expansion of data size will inevitably lead to a series of security risks in the process of data transmission, storage, and use, including data leakage, unauthorized access, etc. In addition, digital attacks are increasing, and attackers can easily obtain relevant information about equipment from digital information, and even maliciously operate the status of equipment, thereby causing a larger range of security incidents. However, several communication protocols including NC-Link only stipulate and restrict the communication format and interface specifications of data, but do not formulate detailed strategies for data security. Therefore, ensuring the data security of communication protocols in the industrial Internet environment has become an urgent issue.

[0004] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of this application is to provide a data encryption transmission method, device, equipment and product, aiming to solve the technical problem of low security of data transmission in numerical control systems.

[0006] To achieve the above purpose, the present application proposes a data encryption transmission method, which is applied to a numerical control system, the numerical control system includes an agent, and the method includes:

[0007] Receiving a data query request sent by a user terminal, and performing a data query through the agent according to the data query request to obtain ciphertext data and a data token;

[0008] The ciphertext data and the data token are sent to the user end, and the user end parses the data token through a preset communication key to obtain a symmetric key, and decrypts the ciphertext data based on the symmetric key to obtain a data query result.

[0009] In one embodiment, the step of performing data query through the proxy to obtain ciphertext data and data token according to the data query request includes:

[0010] Performing token verification on the data query request through the proxy to obtain a verification result;

[0011] If the verification result is passed, according to the data query request, the proxy queries the preset aggregation tree node to obtain the ciphertext data, and sends the ciphertext data to the trusted server, and the trusted server generates a decryption token based on the ciphertext data;

[0012] Receive a decryption token sent by the trusted server.

[0013] In one embodiment, the numerical control system further includes numerical control equipment and an adapter. Before the step of querying a preset aggregation tree node through the agent according to the data query request to obtain the ciphertext data, the method further includes:

[0014] Parsing the equipment information of the numerical control equipment to obtain equipment static data;

[0015] Encrypting the equipment static data and the equipment dynamic data generated by the numerical control equipment through the adapter to obtain an encrypted data block;

[0016] Based on the encrypted data block, a data summary is generated by the agent, and the aggregation tree node is updated by the data summary.

[0017] In one embodiment, the step of encrypting the equipment static data and the equipment dynamic data generated by the numerical control equipment through the adapter to obtain an encrypted data block includes:

[0018] Based on a preset sampling period, the adapter performs normalization processing on the equipment static data and the equipment dynamic data to obtain a data time block;

[0019] generating a message verification code according to the data time block;

[0020] The data time block and the message authentication code are encrypted by the adapter to obtain the encrypted data block.

[0021] In one embodiment, before the step of receiving a data query request sent by a user terminal, the method further includes:

[0022] Sending a server authentication request to a certification center, which reviews the server authentication request to obtain a first review result, and generating a server certificate if the first review result is passed;

[0023] Receiving the server certificate sent by the authentication center, sending the server certificate to the user terminal, and having the user terminal perform information review on the server certificate to obtain a second review result;

[0024] receiving the second audit result and the user certificate sent by the user terminal, performing information audit on the user certificate, and obtaining a third audit result;

[0025] A communication key is generated based on the second audit result and the third audit result, and the communication key is sent to the user terminal.

[0026] In addition, to achieve the above purpose, the present application also proposes a data encryption transmission method, which is applied to a user end and includes:

[0027] Sending a data query request to the numerical control system, and the agent of the numerical control system performs data query according to the data query request to obtain ciphertext data and data token;

[0028] The ciphertext data and the data token sent by the agent are received, the data token is parsed by a preset communication key to obtain a symmetric key, and the ciphertext data is decrypted based on the symmetric key to obtain a data query result.

[0029] In one embodiment, before the step of sending a data query request to the numerical control system, the method further includes:

[0030] Based on the user information and equipment information of the user terminal, an identity authentication request is sent to an authentication center, and the authentication center reviews the identity authentication request to obtain a fourth review result, and generates a user certificate if the fourth review result is passed;

[0031] receiving a server certificate sent by the numerical control system, and performing information review on the server certificate to obtain a fifth review result;

[0032] Receive the user certificate sent by the authentication center, send the fifth audit result and the user certificate to the numerical control system, and the numerical control system conducts information audit on the user certificate to obtain a sixth audit result, and generates a communication key based on the fifth audit result and the sixth audit result;

[0033] Receive the communication key sent by the numerical control system.

[0034] In addition, to achieve the above purpose, the present application also proposes a data query device, the device is applied to a numerical control system, the numerical control system includes an agent, and the device includes:

[0035] A query module, used for receiving a data query request sent by a user terminal, and performing a data query through the agent according to the data query request to obtain ciphertext data and a data token;

[0036] The decryption module is used to send the ciphertext data and the data token to the user end, and the user end parses the data token through a preset communication key to obtain a symmetric key, and decrypts the ciphertext data based on the symmetric key to obtain a data query result.

[0037] In addition, to achieve the above-mentioned purpose, the present application also proposes a data encryption transmission device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, and the computer program is configured to implement the steps of the data encryption transmission method described above.

[0038] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the data encryption transmission method described above are implemented.

[0039] One or more technical solutions proposed in this application have at least the following technical effects:

[0040] The embodiment of the present application proposes a data encryption transmission method, device, equipment and computer program product, which receives a data query request sent by a user end, performs a data query through the agent according to the data query request to obtain ciphertext data and a data token; sends the ciphertext data and the data token to the user end, and the user end parses the data token through a preset communication key to obtain a symmetric key, and decrypts the ciphertext data based on the symmetric key to obtain a data query result. Thus, after receiving the data query request sent by the user end, a data query is performed according to the data query request to obtain the ciphertext data and the data token, and then the ciphertext data and the data token are handed over to the user end, and the user end decrypts the data through a preset communication key to obtain the data query result, which solves the problem of low security of data transmission in the numerical control system and improves the security of data query. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The accompanying drawings herein are incorporated in and constitute a part of the specification, illustrate embodiments consistent with the present application, and together with the description, are used to explain the principles of the present application.

[0042] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0043] Figure 1 A flowchart of the first embodiment of the data encryption transmission method of the present application is provided;

[0044] Figure 2 This is a schematic diagram of data transmission of a numerical control system in the prior art related to the data encryption transmission method of the present application;

[0045] Figure 3 This is a schematic diagram of the data encryption transmission method of the present application involving an agent performing data query;

[0046] Figure 4 A schematic diagram of the data encryption transmission method of the present application involving the storage of data generated by numerical control equipment;

[0047] Figure 5 A schematic diagram of the data encryption transmission method of this application involving the numerical control system and the user end performing identity authentication;

[0048] Figure 6 A flowchart of the second embodiment of the data encryption transmission method of the present application is provided;

[0049] Figure 7 This is a schematic diagram of the interaction between the user end and the numerical control system after the authentication is completed in the data encryption transmission method of this application;

[0050] Figure 8 This is a schematic diagram of the module structure of the data encryption transmission device according to an embodiment of the present application;

[0051] Fig. 9 This is a schematic diagram of the device structure of the hardware operating environment involved in the data encryption transmission method in the embodiment of the present application.

[0052] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0053] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0054] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0055] The main solution of the embodiment of the present application is: perform token verification on the data query request through the agent to obtain a verification result; when the verification result is passed, query the preset aggregation tree node through the agent according to the data query request to obtain ciphertext data, and send the ciphertext data to the trusted server, and the trusted server generates a decryption token based on the ciphertext data; receive the decryption token sent by the trusted server. Parse the device information of the numerical control equipment to obtain equipment static data; encrypt through the adapter according to the equipment static data and the equipment dynamic data generated by the numerical control equipment to obtain an encrypted data block; based on the encrypted data block, generate a data summary through the agent, and update the aggregation tree node through the data summary. Based on the preset sampling period, the equipment static data and the equipment dynamic data are normalized through the adapter to obtain a data time block; generate a message verification code according to the data time block; encrypt the data time block and the message verification code through the adapter to obtain the encrypted data block. Send a server authentication request to the authentication center, and the authentication center will review the server authentication request to obtain a first review result. If the first review result is passed, a server certificate is generated; receive the server certificate sent by the authentication center, send the server certificate to the user end, and the user end will review the information of the server certificate to obtain a second review result; receive the second review result and the user certificate sent by the user end, and review the information of the user certificate to obtain a third review result; generate a communication key based on the second review result and the third review result, and send the communication key to the user end. Send a data query request to the CNC system, and the agent of the CNC system will perform a data query according to the data query request to obtain ciphertext data and a data token; receive the ciphertext data and the data token sent by the agent, parse the data token through the preset communication key to obtain a symmetric key, decrypt the ciphertext data based on the symmetric key, and obtain a data query result. Based on the user information and equipment information of the user terminal, an identity authentication request is sent to the authentication center, and the authentication center reviews the identity authentication request to obtain a fourth review result. When the fourth review result is passed, a user certificate is generated; the server certificate sent by the CNC system is received, and the server certificate is reviewed to obtain a fifth review result; the user certificate sent by the authentication center is received, and the fifth review result and the user certificate are sent to the CNC system, and the CNC system reviews the user certificate to obtain a sixth review result, and a communication key is generated based on the fifth review result and the sixth review result; the communication key sent by the CNC system is received.Thus, the problem of low security in data transmission in numerical control systems is solved, data query is realized, and the security of data query is improved. Based on the scheme of the present invention, a data encryption transmission method is designed based on the fact that as the data scale of numerical control systems continues to expand, a series of security risks inevitably arise in the process of data transmission, storage and use, including data leakage, unauthorized access, etc., which leads to an increasing number of digital attacks and thus low security. The effectiveness of the data encryption transmission method of the present invention is verified when querying data, and finally the accuracy of data query performed by the method of the present invention is significantly improved.

[0056] In this embodiment, for the convenience of description, the following description is made with the data encryption transmission device as the execution subject.

[0057] As more and more equipment in the existing technology uses NC-Link, a large amount of data is generated and then collected locally or in the cloud for monitoring, analysis, and traceability diagnosis. However, as the scale of data continues to expand, a series of security risks inevitably arise in the process of data transmission, storage, and use, including data leakage, unauthorized access, etc., resulting in an increasing number of digital attacks. Attackers can easily obtain relevant information about equipment from digital information, and can even maliciously operate the status of the equipment, thereby causing a larger range of security incidents. However, several communication protocols including NC-Link only stipulate and restrict the communication format and interface specifications of the data, but do not formulate detailed strategies for data security. Therefore, ensuring the data security of communication protocols in the industrial Internet environment has become an urgent issue.

[0058] The present application provides a solution, in which, in a numerical control system, an agent responds to data query requests from the user end, manages data and generates tokens. At the same time, the numerical control system also includes numerical control equipment and adapters, providing users with better data encryption services.

[0059] From the above embodiments, it can be seen that the present application receives a data query request sent by a user end, performs a data query through the agent according to the data query request, obtains ciphertext data and a data token; sends the ciphertext data and the data token to the user end, and the user end parses the data token through a preset communication key to obtain a symmetric key, and decrypts the ciphertext data based on the symmetric key to obtain a data query result. Thus, after receiving the data query request sent by the user end, a data query is performed according to the data query request to obtain ciphertext data and a data token, and then the ciphertext data and the data token are handed over to the user end, and the user end decrypts the data through a preset communication key to obtain a data query result, which solves the problem of low security of data transmission in the numerical control system and improves the security of data query.

[0060] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, a data encryption transmission device, etc. The following takes the data encryption transmission device as an example to illustrate this embodiment and the following embodiments.

[0061] Based on this, the present application embodiment provides a data encryption transmission method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the data encryption transmission method of the present application.

[0062] In this embodiment, the data encryption transmission method is applied to a numerical control system, the numerical control system includes an agent, and the method includes steps S05 to S06:

[0063] Step S05, receiving a data query request sent by the user terminal, and performing data query through the proxy according to the data query request to obtain ciphertext data and a data token;

[0064] Before explaining this embodiment, it should be clear that the interconnection between CNC equipment is the basis of intelligent manufacturing. Therefore, a variety of highly compatible communication protocols have been proposed and applied to the interconnection of CNC equipment to achieve tighter CNC system integration, such as MTConnect, OPC UA, umati, etc. in foreign countries. In recent years, my country has also proposed NC-Link, an interconnection interface specification for CNC machine tools in smart factories. It is not only compatible with several other communication protocols, but also has unique advantages in real-time performance, transmission speed, etc., providing stronger guarantees for intelligent manufacturing.

[0065] like Figure 2As shown in the figure, as more and more equipment uses NC-Link, a large amount of data is generated and then collected locally or in the cloud for monitoring, analysis, and traceability diagnosis. As the scale of data continues to expand, a series of security risks inevitably arise in the process of data transmission, storage, and use, including data leakage, unauthorized access, etc., resulting in an increasing number of digital attacks. Attackers can easily obtain relevant information about equipment from digital information, and can even maliciously operate the status of the equipment, thereby causing a wider range of security incidents.

[0066] However, several communication protocols, including NC-Link, only stipulate and restrict the communication format and interface specifications of data, but do not formulate detailed strategies for data security. Therefore, ensuring the data security of communication protocols in the industrial Internet environment has become an urgent issue.

[0067] Therefore, in this embodiment, a data encryption transmission method applied to a numerical control system is provided, wherein the numerical control system (CNC, Computer Numerical Control) is a technology that uses computer programs to control machine tools for automated processing. The numerical control system controls numerical control machine tools (such as numerical control lathes, numerical control milling machines, numerical control grinders, etc.) through programmed instructions to perform precision machining operations, thereby achieving efficient and high-precision machining. The numerical control system in this embodiment includes at least an agent, which enables the numerical control system to perform data query through the agent to obtain ciphertext data and data tokens when receiving a data query request sent by a user end.

[0068] Step S06, sending the ciphertext data and the data token to the user end, the user end parses the data token through a preset communication key to obtain a symmetric key, and decrypts the ciphertext data based on the symmetric key to obtain a data query result.

[0069] After obtaining the ciphertext data and data token, they are sent to the user end, which parses the data token through the preset communication key to obtain the symmetric key, and then decrypts the ciphertext data based on the symmetric key to obtain the data query result. Among them, the communication key in this embodiment is obtained after the user end and the CNC system are authenticated by the authentication center.

[0070] After receiving the data query request, the numerical control system performs corresponding data query and token acquisition through the proxy. Therefore, in the above step S05, according to the data query request, the proxy performs data query to obtain the ciphertext data and data token, the method further includes:

[0071] Step S051, performing token verification on the data query request through the proxy to obtain a verification result;

[0072] Step S055, when the verification result is passed, according to the data query request, the proxy queries the preset aggregation tree node to obtain the ciphertext data, and sends the ciphertext data to the trusted server, and the trusted server generates a decryption token based on the ciphertext data;

[0073] Step S056, receiving the decryption token sent by the trusted server.

[0074] In this embodiment, the ciphertext data and the decryption token are obtained as follows: Figure 3 As shown in the figure, when the user queries data through the application, the proxy first checks whether it has an access token. If the check fails, the query request is rejected. If it has an access token, the proxy locates the node in the aggregation tree according to the time period that the user needs to query, obtains the aggregated ciphertext data, and applies to the trusted server for a token to decrypt the ciphertext data.

[0075] Subsequently, the trusted server encapsulates the relevant decryption information into a token, encrypts the token using an encryption algorithm, and provides the encrypted token to the agent. After the agent obtains the token, it forwards the ciphertext data and the token to the user.

[0076] Finally, the user uses his own attribute key to decrypt the token, obtains the symmetric key based on the relevant decryption information in the token, uses the symmetric key to decrypt the ciphertext data, obtains the aggregated plaintext and message verification code, and can obtain the final data and verify its integrity.

[0077] In the numerical control system of this embodiment, in addition to the agent for data management and query, there are also numerical control equipment and adapters, which generate and encrypt data blocks to better ensure the security of data query. Therefore, before the above step S055, in which the agent queries the preset aggregation tree node to obtain the ciphertext data, the method also includes:

[0078] Step S052, parsing the equipment information of the numerical control equipment to obtain equipment static data;

[0079] Step S053, encrypting the equipment static data and the equipment dynamic data generated by the numerical control equipment through the adapter to obtain an encrypted data block;

[0080] Step S054: Based on the encrypted data block, generate a data summary through the agent, and update the aggregation tree node through the data summary.

[0081] In the above embodiment, it is clear that the agent obtains data from the aggregation tree node. In the actual use process, each node of the aggregation tree is updated by the adapter and the numerical control equipment. Figure 4 As shown, the CNC equipment continuously generates data, including static data and dynamic data. The static data is the inherent attribute of the CNC equipment, such as manufacturer, equipment model, rated power, etc., while the dynamic data usually refers to the real-time operation data of the equipment during the processing. These data are helpful to monitor, optimize and improve the processing accuracy, production efficiency and health status of the equipment. The dynamic data in this embodiment includes but is not limited to the operation status, bearing position, running program file name, processing process data and equipment health monitoring data, etc.;

[0082] Then, the equipment static data and the equipment dynamic data are sent to the adapter for encryption to obtain an encrypted data block;

[0083] Finally, when the data time block sent by the adapter arrives at the agent, the agent is used to verify whether the adapter is registered. If it is registered, the agent generates a data summary for each data time block, inserts the data summary into the aggregation tree, and updates the value of the corresponding node. If it is not registered, the data time block will be directly rejected.

[0084] In order to make the query of the aggregation tree node faster, in this embodiment, the encrypted data block is generated by the adapter. Therefore, in the above step S053, according to the equipment static data and the equipment dynamic data generated by the numerical control equipment, the adapter is encrypted to obtain the encrypted data block, which includes:

[0085] Step S0531, based on a preset sampling period, the adapter performs normalization processing on the equipment static data and the equipment dynamic data to obtain a data time block;

[0086] Step S0532, generating a message verification code according to the data time block;

[0087] Step S0533: encrypt the data time block and the message verification code through the adapter to obtain the encrypted data block.

[0088] The adapter collects data generated by the CNC equipment at certain time intervals according to the sampling period specified in the CNC equipment information model;

[0089] The collected data is then normalized and divided into data time blocks according to the upload cycle. Normalization is a common technique in data preprocessing, which aims to convert data of different dimensions and ranges into a unified standard form.

[0090] Finally, a message verification code is generated for each data time block, and the two are encrypted and uploaded to the agent. The message verification code is usually a string of numbers or letters sent to the user by the system or application to verify the user's identity. The verification code is usually sent via SMS, email or other messaging methods to ensure the security of the user when performing certain operations (such as logging in, registering, changing passwords, paying, etc.). The verification code is usually valid for a limited period of time and needs to be obtained again after expiration.

[0091] In order to ensure that the numerical control device will not be maliciously attacked, the data system in this embodiment also needs to perform two-way authentication with the user end. Therefore, in step S05 of the scheme of this embodiment, before the step of receiving the data query request sent by the user end, the method further includes:

[0092] Step S01, sending a server authentication request to a certification center, which reviews the server authentication request to obtain a first review result, and generates a server certificate if the first review result is passed;

[0093] Step S02, receiving the server certificate sent by the authentication center, sending the server certificate to the user terminal, and the user terminal performing information review on the server certificate to obtain a second review result;

[0094] Step S03, receiving the second audit result and the user certificate sent by the user terminal, performing information audit on the user certificate, and obtaining a third audit result;

[0095] Step S04: Generate a communication key based on the second audit result and the third audit result, and send the communication key to the user terminal.

[0096] The identity authentication service in this embodiment is as follows Figure 5 As shown, SSL two-way authentication based on domestic encryption is used to provide identity information registration, credential issuance, user information management and destruction, and login authentication functions for various users. The authentication service is composed of a CA center, an authentication server, and digital certificate users.

[0097] The specific authentication process is as follows:

[0098] (1) Authentication server: The NC-Link server serves as the authentication server, which centrally stores the identity information, permission information, and certificate information of devices and users. Server certificates, security components, and authentication interfaces are deployed on the authentication server for identity authentication between devices and servers or between users and servers.

[0099] (2) Digital certificate users: Digital certificate users must download the CA digital certificate and personal digital certificate from the CA certification center, establish a connection with the certification server through two-way authentication, and enable equipment to upload data. Users can easily access equipment within their authority. The identity information of the user's digital certificate must be consistent with the user information registered in the certification system to achieve reliable identity authentication.

[0100] This embodiment adopts the above scheme, specifically by receiving a data query request sent by the user end, and according to the data query request, performing data query through the agent to obtain ciphertext data and data token; sending the ciphertext data and the data token to the user end, and the user end parses the data token through a preset communication key to obtain a symmetric key, and decrypts the ciphertext data based on the symmetric key to obtain a data query result. Therefore, after receiving the data query request sent by the user end, performing data query according to the data query request to obtain ciphertext data and data token, and then handing the ciphertext data and data token to the user end, and the user end decrypts the data through a preset communication key to obtain the data query result, which solves the problem of low security of data transmission in the numerical control system and improves the security of data query.

[0101] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated in the following. Figure 6 The data encryption transmission method is applied to the user end, and the method includes steps S11 to S12:

[0102] Step S11, sending a data query request to the numerical control system, and the agent of the numerical control system performs data query according to the data query request to obtain ciphertext data and data token;

[0103] Step S12, receiving the ciphertext data and the data token sent by the agent, parsing the data token through a preset communication key to obtain a symmetric key, decrypting the ciphertext data based on the symmetric key, and obtaining a data query result.

[0104] When the user end of this embodiment performs data query, it sends a data query request to the numerical control system, and the agent of the numerical control system performs data query to obtain ciphertext data and data tokens, and then sends the ciphertext data and data tokens to the user end.

[0105] After the client receives the ciphertext data and the data token, it can parse the data token using the pre-acquired communication key to obtain the symmetric key, and then decrypt the ciphertext data using the symmetric key to obtain the final data query result.

[0106] In this embodiment, in order to ensure the controllability of access to CNC equipment and prevent unauthorized users from accessing or unauthorized access, it is necessary to provide a trusted authorization management service on the premise that the user identity is authentic and reliable, to protect the CNC equipment from illegal or unauthorized access and to prevent information leakage. In this embodiment, the homomorphic encryption algorithm is introduced into the NC-Link access control. The homomorphic encryption algorithm is an algorithm that ensures data confidentiality. It supports calculations on ciphertexts. The result obtained by decrypting the calculated ciphertext is consistent with the result obtained by the same calculation of the plaintext. Most of the existing homomorphic encryption algorithms use asymmetric encryption algorithms, such as the Paillier algorithm, the ElGamal algorithm, the RSA algorithm, etc. The data producer uses a public key to encrypt the data, and the user uses a private key to decrypt the data. However, its huge computational complexity and slow encryption speed make the performance far below expectations when encrypting large amounts of data in NC-Link CNC equipment.

[0107] This scheme adopts a homomorphic symmetric encryption algorithm and supports homomorphic functions implemented by addition. Assuming that c represents the ciphertext generated by the encryption algorithm and D(c) represents the decryption operation of the ciphertext, the additive homomorphic function can be expressed as That is, the decrypted result after adding the ciphertexts is equal to the sum of the decrypted results of the ciphertexts. Additive homomorphism can support direct operations on ciphertexts without decryption, thereby greatly improving the computational efficiency of the encryption algorithm.

[0108] The encryption algorithm uses a key derived from a key derivation tree. The key is generated using a pseudo-random number generator based on a hash function and a key derivation function. The key and the data time block correspond one-to-one, achieving one-time one-key. It is semantically secure. Assuming that the sender needs to send [t i ,t i+1 The plain text of the time period m i ∈Z n , n is 2 64 , first locate t from the key derivation tree i and t i+1 The leaf node N corresponding to the moment i and N i+1 , and calculate the key k according to the key derivation function i =F(N li ) and k i+1 =F(N li+1 ), then the encrypted ciphertext ci of plaintext mi is:

[0109] c i =Enc(m i )=(m i +k i -m i+1 )mod n

[0110] The plaintext mi is encrypted using the keys corresponding to the two moments ti and ti+1. The corresponding ciphertext ci decryption formula is:

[0111] m i =Dec(c i )=(c i -k i +k i+1 )mod n

[0112] In order to reflect the additive homomorphism of the encryption algorithm, the additive homomorphic operation ⊕ of two ciphertexts ci and cj is defined, and its mathematical expression formula is:

[0113]

[0114] The additive homomorphism of ciphertext during decryption is as follows:

[0115]

[0116] Then the plain text m i and m j The addition formula is:

[0117] (m i +m j )=(c i -k i +k i+1 +c j -k j +k j+1 )mod n.

[0118] Since the authentication between the numerical control system and the user end is a two-way authentication, the solution of this embodiment also requires the user to perform corresponding operations. Therefore, before the above step S11, the step of sending a data query request to the numerical control system, the method further includes:

[0119] Step S07, based on the user information and equipment information of the user terminal, sending an identity authentication request to the authentication center, and the authentication center reviews the identity authentication request to obtain a fourth review result, and generates a user certificate if the fourth review result is passed;

[0120] Step S08, receiving the server certificate sent by the numerical control system, and performing information review on the server certificate to obtain a fifth review result;

[0121] Step S09, receiving the user certificate sent by the authentication center, sending the fifth audit result and the user certificate to the numerical control system, and the numerical control system performs information audit on the user certificate to obtain a sixth audit result, and generates a communication key based on the fifth audit result and the sixth audit result;

[0122] Step S10, receiving the communication key sent by the numerical control system.

[0123] The user sends an identity authentication request to the authentication center based on its own user information and the corresponding equipment information that needs to be controlled. The authentication center reviews the identity authentication request and generates a user certificate based on the user information and the corresponding equipment information that needs to be controlled if the review passes.

[0124] Then, the server certificate obtained by the CNC system from the certification center is received, and it is reviewed to obtain the review result of the server certificate;

[0125] Finally, the audit result of the server certificate and the obtained user certificate are sent to the CNC system. The CNC system audits the user certificate, obtains the audit result of the user certificate, and generates a communication key based on the audit result of the user certificate and the audit result of the server certificate and sends it to the user end.

[0126] The data control in this embodiment is as follows Figure 7 As shown, the user side has corresponding authentication information (including identity token and registered list), and can send data query requests to the CNC system.

[0127] This embodiment uses the above scheme, specifically by sending a data query request to the numerical control system, and the agent of the numerical control system performs data query according to the data query request to obtain ciphertext data and data token; receiving the ciphertext data and data token sent by the agent, parsing the data token through a preset communication key to obtain a symmetric key, and decrypting the ciphertext data based on the symmetric key to obtain a data query result. Therefore, after receiving the data query request sent by the user end, a data query is performed according to the data query request to obtain ciphertext data and data token, and then the ciphertext data and data token are handed over to the user end, and the user end decrypts the data through a preset communication key to obtain the data query result, which solves the problem of low security of data transmission in the numerical control system and improves the security of data query.

[0128] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the data encryption transmission method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0129] This application also provides a data encryption transmission device, please refer to Figure 8 , the device is applied to a numerical control system, the numerical control system includes an agent, and the device includes:

[0130] The query module 10 is used to receive a data query request sent by a user terminal, and perform a data query through the agent according to the data query request to obtain ciphertext data and a data token;

[0131] The decryption module 20 is used to send the ciphertext data and the data token to the user end, and the user end parses the data token through a preset communication key to obtain a symmetric key, and decrypts the ciphertext data based on the symmetric key to obtain a data query result.

[0132] The data encryption transmission device provided by the present application adopts the data encryption transmission method in the above embodiment, which can solve the technical problem that the data transmission in the numerical control system is not secure. Compared with the prior art, the beneficial effects of the data encryption transmission device provided by the present application are the same as the beneficial effects of the data encryption transmission method provided by the above embodiment, and the other technical features in the data encryption transmission device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0133] The present application provides a data encryption transmission device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the data encryption transmission method in the above-mentioned embodiment one.

[0134] Reference below Fig. 9 , which shows a schematic diagram of the structure of a data encryption transmission device suitable for implementing the embodiment of the present application. The data encryption transmission device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig. 9 The data encryption transmission device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0135] like Fig. 9As shown, the data encryption transmission device may include a processing device 1001 (such as a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the data encryption transmission device are also stored. The processing device 1001, ROM1002 and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the data encryption transmission device to communicate with other devices wirelessly or by wire to exchange data. Although the data encryption transmission device with various systems is shown in the figure, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or provided alternatively.

[0136] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0137] The data encryption transmission device provided by the present application adopts the data encryption transmission method in the above embodiment, which can solve the technical problem that the data transmission in the numerical control system is not secure. Compared with the prior art, the beneficial effects of the data encryption transmission device provided by the present application are the same as the beneficial effects of the data encryption transmission method provided by the above embodiment, and the other technical features in the data encryption transmission device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0138] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0139] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0140] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, wherein the computer-readable program instructions are used to execute the data encryption transmission method in the above-mentioned embodiment.

[0141] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0142] The computer-readable storage medium may be included in the data encryption transmission device; or may exist independently without being assembled into the data encryption transmission device.

[0143] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the data encryption transmission device, the data encryption transmission device: receives a data query request sent by the user end, and according to the data query request, performs data query through the agent to obtain ciphertext data and a data token; sends the ciphertext data and the data token to the user end, and the user end parses the data token through a preset communication key to obtain a symmetric key, and decrypts the ciphertext data based on the symmetric key to obtain a data query result.

[0144] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer or an external computer through any type of network, including a local area network (LAN) or a wide area network (WAN).

[0145] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0146] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0147] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned data encryption transmission method, and can solve the technical problem that the data transmission in the numerical control system is not secure. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the data encryption transmission method provided by the above-mentioned embodiment, and will not be elaborated here.

[0148] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned data encryption transmission method when executed by a processor.

[0149] The computer program product provided by the present application can solve the technical problem that data transmission in a numerical control system is not secure. Compared with the prior art, the beneficial effects of the computer program product provided by the present application are the same as those of the data encryption transmission method provided by the above embodiment, and will not be elaborated here.

[0150] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A data encryption transmission method, characterized in that: The method is applied to a numerical control system, the numerical control system includes an agent, and the method includes: Receiving a data query request sent by a user terminal, and performing a data query through the agent according to the data query request to obtain ciphertext data and a data token; The ciphertext data and the data token are sent to the user end, and the user end parses the data token through a preset communication key to obtain a symmetric key, and decrypts the ciphertext data based on the symmetric key to obtain a data query result.

2. The method according to claim 1, characterized in that The step of performing data query through the proxy to obtain ciphertext data and data token according to the data query request includes: Performing token verification on the data query request through the proxy to obtain a verification result; If the verification result is passed, according to the data query request, the proxy queries the preset aggregation tree node to obtain the ciphertext data, and sends the ciphertext data to the trusted server, and the trusted server generates a decryption token based on the ciphertext data; Receive a decryption token sent by the trusted server.

3. The method according to claim 2, characterized in that The numerical control system further includes numerical control equipment and an adapter. Before the step of obtaining ciphertext data by querying a preset aggregation tree node through the proxy according to the data query request, the method further includes: Parsing the equipment information of the numerical control equipment to obtain equipment static data; Encrypting the equipment static data and the equipment dynamic data generated by the numerical control equipment through the adapter to obtain an encrypted data block; Based on the encrypted data block, a data summary is generated by the agent, and the aggregation tree node is updated by the data summary.

4. The method according to claim 3, characterized in that The step of encrypting the equipment static data and the equipment dynamic data generated by the numerical control equipment through the adapter to obtain an encrypted data block comprises: Based on a preset sampling period, the adapter performs normalization processing on the equipment static data and the equipment dynamic data to obtain a data time block; generating a message verification code according to the data time block; The data time block and the message authentication code are encrypted by the adapter to obtain the encrypted data block.

5. The method according to claim 1, characterized in that Before the step of receiving the data query request sent by the user terminal, the method further includes: Sending a server authentication request to a certification center, which reviews the server authentication request to obtain a first review result, and generating a server certificate if the first review result is passed; Receiving the server certificate sent by the authentication center, sending the server certificate to the user terminal, and having the user terminal perform information review on the server certificate to obtain a second review result; receiving the second audit result and the user certificate sent by the user terminal, performing information audit on the user certificate, and obtaining a third audit result; A communication key is generated based on the second audit result and the third audit result, and the communication key is sent to the user terminal.

6. A data encryption transmission method, characterized in that: The method is applied to a user terminal, and the method comprises: Sending a data query request to the numerical control system, and the agent of the numerical control system performs data query according to the data query request to obtain ciphertext data and data token; The ciphertext data and the data token sent by the agent are received, the data token is parsed by a preset communication key to obtain a symmetric key, and the ciphertext data is decrypted based on the symmetric key to obtain a data query result.

7. The method according to claim 6, characterized in that Before the step of sending a data query request to the numerical control system, the method further includes: Based on the user information and equipment information of the user terminal, an identity authentication request is sent to an authentication center, and the authentication center reviews the identity authentication request to obtain a fourth review result, and generates a user certificate if the fourth review result is passed; receiving a server certificate sent by the numerical control system, and performing information review on the server certificate to obtain a fifth review result; Receive the user certificate sent by the authentication center, send the fifth audit result and the user certificate to the numerical control system, and the numerical control system conducts information audit on the user certificate to obtain a sixth audit result, and generates a communication key based on the fifth audit result and the sixth audit result; Receive the communication key sent by the numerical control system.

8. A data encryption transmission device, characterized in that: The device is applied to a numerical control system, the numerical control system includes an agent, and the device includes: A query module, used for receiving a data query request sent by a user terminal, and performing a data query through the agent according to the data query request to obtain ciphertext data and a data token; The decryption module is used to send the ciphertext data and the data token to the user end, and the user end parses the data token through a preset communication key to obtain a symmetric key, and decrypts the ciphertext data based on the symmetric key to obtain a data query result.

9. A data encryption transmission device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the data encryption transmission method according to any one of claims 1 to 7.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the data encryption transmission method according to any one of claims 1 to 7 are implemented.

Images