Encrypted information storage system and method based on industrial control host

Abstract

The invention discloses an encrypted information storage system and method based on an industrial control host. The system comprises a solid-state storage unit, an interaction signal unit, a hardware verification unit, a software verification unit and a storage information management unit, the method is suitable for the encrypted information storage system based on the industrial control host so as to realize the access authority to the industrial control host. Through a multi-level verification mechanism, the difficulty of illegal access is greatly increased, and the risks of data leakage and hostile attacks are reduced; the interlocking mechanism ensures that the system can keep high security under any condition, and even if a certain verification link has a vulnerability, illegal access cannot be successful due to the existence of the interlocking mechanism; the encryption technology can effectively prevent data from being stolen or tampered in the storage and transmission process. Even if an attacker obtains the encrypted conversion data, the original data cannot be restored due to the lack of correct decryption key and verification information, so that the security of the encrypted information in the industrial control host is protected.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an encrypted information storage system based on an industrial control host and a method thereof. Background Art

[0002] Security issues brought about by the development of the industrial Internet: The development of the industrial Internet has transformed the original discrete and isolated manufacturing equipment into interconnected intelligent equipment, but it has also brought about a series of information security issues. The data of industrial control hosts and other equipment connected to the industrial Internet are facing the risk of external attacks and internal snooping.

[0003] The existing technology of industrial control system data storage has the following status and risks: 1. Storage media have security risks: When using removable storage media such as USB flash drives to install software or store data, the information is stored exposed and can be easily modified maliciously, which may become a springboard for attacks and introduce attacks into the industrial control host.

[0004] 2. The permission management method is not safe: the user name / password method is used for permission management, which has low security and the risk of password leakage, and it is impossible to bind the operator identity to the actual user.

[0005] 3. Data storage locations are vulnerable to attacks: Permission data and sensitive data are directly stored in general databases, with clear attack targets, and there is a risk of data leakage after long-term attacks.

[0006] 4. Limitations of traditional encryption methods: For example, the method of using the Basic Input Output System (BIOS) to set a password for the hard disk has problems such as the password being easily forgotten, the password being too simple, the password being cumbersome to enter every time the computer is turned on, the data being identifiable after the hard disk is transferred, and the password being easily cracked by hackers. Summary of the invention

[0007] The purpose of the present invention is to solve the information security technology problem that if only a simple symmetric encryption algorithm is used, once the key is stolen, the entire encryption system will collapse instantly, and the attacker can easily obtain and tamper with sensitive information in the industrial control host, such as production process data, equipment operating parameters, etc., thereby causing serious damage to the industrial production process.

[0008] To achieve the above object, one of the technical solutions adopted by the present invention is: an encrypted information storage system based on an industrial control host, the system comprising: A solid-state storage unit storing a solid-state PIN initial code set; An interactive signal unit, used for communicating with the requesting end; A hardware verification unit is configured with a preset hardware verification strategy, the hardware verification strategy responds to the verification information input by the requesting end, the hardware verification strategy includes a plurality of hardware verification instructions and corresponding hardware verification conditions, the hardware verification unit determines the corresponding hardware verification instruction according to the verification information, and sends the hardware verification instruction to the requesting end through the interactive signal unit to obtain hardware verification data, the hardware verification strategy verifies the hardware verification data through the corresponding hardware verification condition, and generates first verification information according to the verification result; A software verification unit, wherein the software verification unit is configured with a preset software verification strategy, and the software verification strategy is used to assign corresponding authority characteristics to the requesting end according to the first verification information; A storage information management unit is configured with a plurality of encryption information, different encryption information is configured with corresponding permission characteristics, and the storage information management unit configures the access rights of the corresponding requesting end to the encryption information according to the permission characteristics.

[0009] Furthermore, the hardware verification conditions include communication verification conditions, level verification conditions and data verification conditions. The communication verification conditions are configured with corresponding communication standards. If the fed-back hardware verification data conforms to the communication characterization, it is deemed to satisfy the corresponding communication verification conditions. The level verification conditions are configured with level mapping characteristics. If the fed-back hardware verification data conforms to the level verification characteristics, it is deemed to satisfy the corresponding level verification conditions. The data verification conditions include a content recognition range and a corresponding verification calculation algorithm. The corresponding hardware verification data is calculated by the verification calculation algorithm to obtain the corresponding actual recognition value. If the actual recognition value falls within the corresponding content recognition range, it is deemed to satisfy the corresponding data verification conditions.

[0010] Furthermore, the hardware verification unit also includes a data conversion strategy, which is configured with a number of data conversion conditions, each data conversion condition is indexed by a first conversion index value, the corresponding data conversion condition is called according to the first conversion index value, and the verification information is processed according to the data conversion condition to generate conversion information.

[0011] Furthermore, the first conversion index value is calculated by a verification index formula, and the verification index formula is configured as follows: , , , ,in, is the first conversion index value, is the first communication factor, is the first level factor, is the first data factor, is the preset communication type weight, is the preset level type weight, is the preset data type weight, , For the The condition weights of the communication verification conditions, For the The verification result value of each communication verification condition, is the total number of communication verification conditions corresponding to the hardware verification instructions, For the The level weight of each level verification condition, For the The level deviation function of the level verification condition, is the feedback level value during the verification process, is the total number of level verification conditions corresponding to the hardware verification instruction, For the The data weight of each data verification condition, For the The data content similarity of the data verification conditions, For the The data format similarity of the data verification conditions, The total number of data verification conditions corresponding to the hardware verification instructions.

[0012] Furthermore, the hardware verification unit also includes an encryption configuration strategy, which includes an encryption algorithm. The encryption configuration strategy generates an encryption factor based on the first communication factor, the first level factor, and the first data factor, and configures the encryption factor to the encryption algorithm to process the conversion information to generate encrypted conversion data.

[0013] Furthermore, the hardware verification unit also includes a position generation strategy and a window generation strategy, the position generation strategy is used to generate a verification position, the window generation strategy is used to generate a verification window, the verification position points to the initial position of the solid-state PIN initial code set during verification, the verification window is used to determine the verification PIN code used as a reference from the solid-state PIN initial code set during verification, and the hardware verification unit compares the encrypted conversion data with the verification PIN code used as a reference to generate a verification result.

[0014] Further, the position generation strategy includes initial position starting point data of a number of solid-state PIN initial code sets and corresponding position generation conditions; The position generation condition is configured with a corresponding security transmission standard. If the transmission data of the solid-state storage unit meets the security transmission characterization, it is deemed to meet the corresponding security transmission verification condition, and the corresponding verification position starting point data is generated. The verification position starting point data is compared with the initial position starting point data of the solid-state PIN initial code set. If the comparison is consistent, the initial position of the solid-state PIN initial code set is successfully determined; The window generation strategy retrieves an initial verification window from a preset window information table according to the initial position of the solid-state PIN initial code set, extracts a conversion index condition in the conversion information through a verification feature extraction sub-algorithm, processes the initial verification window according to the conversion index condition to generate a conversion verification window, and sends the conversion verification window to a pre-configured window mirror to determine the verification window in the solid-state PIN initial code set.

[0015] Further, when the generation of the first verification information needs to satisfy a first verification information generation condition, the first verification information is obtained by a first verification information calculation formula; The first verification information generation condition includes a verification times condition and a verification matching degree condition; The verification times condition is: the verification times of the communication verification condition is not greater than the preset times, the verification times of the level verification condition is not greater than the preset times, and the verification times of the data verification condition is not greater than the preset times; The verification matching condition is as follows: for the communication verification condition, if the communication encryption conversion data completely conforms to the communication representation, the matching degree is 100%; if there is a deviation in the communication encryption conversion data format or the communication protocol that exceeds the preset deviation range, the matching degree is set according to the degree of deviation, and the matching degree is 90%; The level verification conditions are: if the level encrypted conversion data fully meets the level verification characteristics, the matching degree is 100%; if the level encrypted conversion data fluctuates within the allowable error range, the matching degree is determined according to the degree of fluctuation, and the matching degree is 90%; For the data verification condition, the encrypted conversion data is compared based on the closeness to the center value of the content recognition range. If the encrypted conversion data is within ±5% of the preset content recognition range center value, the match degree is 90%; if it is close to the boundary but still within the range, the match degree is 90%; The first verification information calculation formula is: , in, is the first verification information; is the number of verifications; is the maximum number of authentications allowed; is the weight of the number of verifications; To verify the matching; The weight for verifying the matching degree.

[0016] Furthermore, the software verification strategy includes a number of software verification data and corresponding software verification conditions; The software verification condition includes a first verification information verification condition and a software input window verification condition; The first verification information verification condition is configured with a corresponding first verification information verification standard, and if the data of the first verification information meets the information verification representation, it is deemed to meet the corresponding first verification information verification condition; The first verification information verification standard is: ; The software input window verification condition is configured with a corresponding window verification standard. If the PIN input code data entered in the software input window meets the window verification characterization, it is deemed to meet the corresponding software input window verification condition; The software input window verification standard is to perform a preset hash operation on the PIN input code and the verification PIN code to obtain a PIN input code hash value and a verification PIN code hash value, and the PIN input code hash value and the verification PIN code hash value must be compared and consistent.

[0017] Another technical solution adopted by the present invention is: an encrypted information storage method, which is applicable to the above-mentioned encrypted information storage system based on the industrial control host to implement access rights to the industrial control host, and the method includes: S1. The user connects the solid-state storage unit to the industrial control host through an interface to complete the solid-state PIN initial code collection and storage. The solid-state PIN initial code set is stored in the storage information management unit; Through the position generation strategy, if the secure transmission is completed, the initial position of the solid-state PIN initial code set is successfully determined; If the secure transmission is not completed, a reminder page will pop up on the external monitor of the industrial control host; S2. Using the window generation strategy, according to the initial position of the solid-state PIN initial code set in S1, the corresponding initial verification window is searched in the preset window information table, and the conversion information is processed using the verification feature extraction sub-algorithm, and the initial verification window is processed according to the extracted conversion index condition, and the conversion verification window is sent to the pre-configured window mirrorer, and the window mirrorer matches the conversion verification window with the solid-state PIN initial code set to determine the verification window, and the solid-state PIN initial code in the verification window area is used as the reference verification PIN code; S3, obtaining encrypted conversion data through data conversion strategy and encryption configuration strategy; S4, using the hardware verification unit to compare the encrypted data in S3 with the reference verification PIN code in S2 for data integrity. When the encrypted data and the reference verification PIN code are consistent, the verification result is passed; S5, bringing the encrypted converted data of S3 into the first verification information generation condition, calculating and obtaining the first verification information and sending it to the software verification unit; S6. If the first verification information meets the first verification information verification standard , the software input window verification condition in the software verification is triggered; S7. Enter the PIN input code in the software input window, perform a preset hash operation on the PIN input code and the verification PIN code according to the software input window verification standard, obtain the PIN input code hash value and the verification PIN code hash value, and when the PIN input code hash value and the verification PIN code hash value are consistent, the verification result is passed; S8, controlling access rights to the encrypted information through the storage information management unit according to the verification results of S4 and S7; If the verification results of S4 and S7 are both passed, access to the industrial control host is granted; Otherwise, access is denied, completing the dynamic interlocking of the hardware verification unit and the software verification unit for the encrypted information.

[0018] Compared with the prior art, the present invention has the following beneficial effects: 1. From the secure transmission verification of the solid-state PIN initial code set, to the data integrity comparison of the encrypted conversion data and the reference verification PIN code, to the calculation of the first verification information and the hash operation comparison of the window verification conditions, each step provides a guarantee for the security of the system. This multi-level verification mechanism greatly increases the difficulty of illegal access and reduces the risk of data leakage and malicious attacks. In order to break through the layers of verification, the attacker needs to master the PIN code, crack the hash operation, and bypass multiple verification conditions at the same time, which is almost impossible in actual operation.

[0019] 2. The dynamic interlocking mechanism of the hardware verification unit and the software verification unit further enhances the security of the system. Access rights are granted only when all conditions of hardware verification and software verification are met. This interlocking mechanism ensures that the system maintains a high level of security under any circumstances. Even if a certain verification link has a loophole, illegal access cannot succeed due to the existence of the interlocking mechanism. If an attacker attempts to gain access rights by tampering with the software verification results, but the hardware verification unit fails, the system will still deny access.

[0020] 3. The encrypted conversion data is obtained through the data conversion strategy and encryption configuration strategy, which makes the information stored in the system exist in encrypted form. Encryption technology can effectively prevent data from being stolen or tampered with during storage and transmission. Even if the attacker obtains the encrypted conversion data, the original data cannot be restored due to the lack of the correct decryption key and verification information, thus protecting the security of the encrypted information in the industrial control host. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1The figure is a flow chart of the method for storing encrypted information based on an industrial control host of the present invention. DETAILED DESCRIPTION

[0022] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the encryption information storage system based on the industrial control host and the method thereof provided by the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0023] Example 1 The invention discloses an encrypted information storage system based on an industrial control host, the system comprising: a solid-state storage unit storing a solid-state PIN initial code set.

[0024] Specifically, compared with traditional storage methods, the solid-state storage unit itself has better physical stability and is not easily disturbed by external environments such as magnetic fields and vibrations. It can effectively reduce the risk of leakage of the PIN initial code set due to physical damage. At the same time, its internal storage structure is relatively closed and difficult to be directly accessed illegally from the outside, providing a reliable physical isolation protection barrier for the PIN initial code set. At the same time, when the system performs the verification process, it can quickly retrieve the solid-state PIN initial code set, reduce the verification waiting time caused by data reading delays, make the entire hardware verification link more efficient and smooth, and improve the timeliness of the system response request end, especially in the scenario where the industrial control host has high real-time requirements, fast PIN code set acquisition can ensure business continuity and avoid system freezes or delays caused by slow verification. Solid-state storage units usually have high error correction capabilities. Even in the case of a certain degree of data error or slight damage, the stored PIN initial code set can still be accurately restored to ensure that the verification process is not disturbed by data integrity issues, and ensure that the basic code values ​​relied on by subsequent links such as hardware verification units and software verification units are accurate and correct, thereby maintaining the stable operation of the entire encrypted information storage system. As an independent storage module, the solid-state storage unit can be easily integrated into the industrial control host architecture and work closely with the hardware verification unit, interactive signal unit, etc. During system design and upgrade, it is convenient to uniformly plan and maintain the storage strategy of the PIN initial code set, update the code set, optimize the storage layout and other operations, thereby reducing system complexity and improving maintainability.

[0025] The system also includes an interactive signal unit for communicating with the requesting end.

[0026] Specifically, the interactive signal unit ensures that all kinds of instructions and data can be transmitted accurately and timely between the system and the requesting end. Whether it is the verification information required by the hardware verification unit or the permission granting result fed back by the software verification unit, it relies on the stable transmission of the interactive signal unit to avoid information blocking and make the entire verification and authorization process seamless. When the requesting end initiates an access request, the interactive signal unit can quickly deliver the request to each key unit of the system, and at the same time immediately transmit the system's processing progress and results back to the requesting end. For example, when the hardware verification fails, the requesting end is informed of the cause of the error in a timely manner, so that the operator can quickly adjust the strategy and improve the overall real-time interactive experience of the system. With its communication function, users can monitor the interactive data between the requesting end and the system in real time. When a fault or abnormality occurs, by analyzing the communication log recorded by the interactive signal unit, the root cause of the problem can be accurately located, whether it is a network connection failure, data transmission error, or a requesting end compatibility problem, etc., greatly improving the efficiency of system debugging and maintenance.

[0027] The system also includes a hardware verification unit configured with a preset hardware verification strategy, the hardware verification strategy responds to the verification information input by the requesting end, the hardware verification strategy includes a plurality of hardware verification instructions and corresponding hardware verification conditions, the hardware verification unit determines the corresponding hardware verification instruction according to the verification information, and sends the hardware verification instruction to the requesting end through the interactive signal unit to obtain hardware verification data, the hardware verification strategy verifies the hardware verification data through the corresponding hardware verification condition, and generates first verification information according to the verification result; Specifically, the hardware verification unit can quickly determine the corresponding hardware verification instruction according to the input verification information, and can generate different verification instructions for different verification information, avoiding blind attempts of various instructions, saving verification time, and ensuring verification efficiency; the first verification information generated by the hardware verification unit can provide accurate hardware verification results for the software verification unit, ensuring that the solid-state PIN initial code set cannot be obtained through continuous input of verification information, and the verification information and the solid-state PIN initial code set are isolated through hardware verification instructions, and the requesting end is verified to be credible, avoiding external offensive devices from accessing and obtaining key information. At the same time, the software verification unit can perform more in-depth verification and analysis on this basis, and realize the collaborative work and comprehensive verification of software and hardware.

[0028] Furthermore, the hardware verification conditions include communication verification conditions, level verification conditions and data verification conditions. The communication verification conditions are configured with corresponding communication standards. If the fed-back hardware verification data meets the communication characterization, the corresponding communication verification conditions are deemed to be met.

[0029] Specifically, the communication standard can be any one of RS-232 or RS-485 communication standards: when the RS-232 communication standard is selected, it is used for communication between the industrial control host and the external equipment, and specifies the signal level, data format (start bit, data bit, check bit, stop bit), transmission rate, etc. In this application, the signal level adopts negative logic, -3V to -15V represents logic "1", and +3V to +15V represents logic "0".

[0030] When the RS-485 communication standard is selected, multiple devices are supported to communicate on the bus. It has the advantages of strong anti-interference ability and long transmission distance. In this application, the signal level adopts negative logic, -2V to -6V represents logic "1", and +2V to +6V represents logic "0". The interface signal level is lower than RS-232-C, and it is not easy to damage the chip of the interface circuit.

[0031] By configuring the corresponding communication standards, it is possible to ensure that data transmission and interaction between hardware devices are carried out according to predetermined rules, reduce data transmission errors, loss or disorder, and ensure the accuracy of communication content. In network communications, following specific communication protocol standards can ensure that data packets are sent, received and parsed correctly.

[0032] Furthermore, the level verification condition is configured with a level mapping feature. If the feedback hardware verification data meets the level verification feature, it is deemed to meet the corresponding level verification condition; however, achieving a clear level mapping relationship helps the receiving end to accurately interpret the signal sent by the sending end, thereby avoiding misjudgment or distortion of the signal during transmission.

[0033] Specifically, whether the fed-back hardware verification data conforms to the level mapping feature can be determined by using a comparator, a gate circuit or a processor.

[0034] When a comparator is used, the level of the feedback hardware verification data is used as one input of the comparator, and the other input is connected to a known reference level. When the voltage difference between the two input ports exceeds the threshold voltage of the comparator, the output port will generate a high level or low level signal to determine whether the level of the verification data meets the expected level verification feature. If the present invention is applied to detect whether a signal is a high level, the signal can be connected to one input terminal of the comparator, and the other input terminal of the comparator can be connected to a determined high level reference voltage. If the comparator output is a high level, it means that the feedback hardware verification data meets the high level verification feature.

[0035] When using a gate circuit, the level signal to be detected is used as an input signal of the gate circuit, and the other input signal is connected to a known level signal or voltage reference source, and then the judgment is made based on the output signal of the gate circuit. As in the present invention, the output signal of the AND gate circuit is high only when all input signals are high level; the output signal of the OR gate circuit is high level as long as one input signal is high level. Through this logical relationship, it can be judged whether the level of the hardware verification data meets the specific level verification characteristics.

[0036] When passing through the processor, the hardware system needs to include a microcontroller or processor, which can convert the analog level signal into a digital value through its built-in analog-to-digital converter (ADC), and then judge whether the hardware verification data meets the level verification characteristics according to the preset level range or threshold in the software. The industrial control main chip reads the voltage value through the GPIO pin and compares it with the internally set threshold. If it is higher than the threshold, it is judged as a high level, and if it is lower than the threshold, it is judged as a low level.

[0037] Furthermore, the data verification condition includes a content recognition range and a corresponding verification calculation algorithm. The corresponding hardware verification data is calculated by the verification calculation algorithm to obtain a corresponding actual recognition value. If the actual recognition value falls within the corresponding content recognition range, it is deemed to meet the corresponding data verification condition.

[0038] If the actual identification value does not fall within the corresponding content identification range, it may mean that an error or tampering has occurred in the data during transmission or processing. Timely discovery and measures should be taken to ensure the authenticity and reliability of the data. In the encryption system of this application, the data can be verified by the calculation algorithm to detect whether it has been illegally modified. This enables the ability to check the accuracy and integrity of the data, ensure that the data is within a reasonable range and conforms to the expected format and logic, and provide a reliable basis for subsequent processing and decision-making of the system, avoiding system crashes or erroneous operations caused by data errors. Accurate verification of data in the encryption system ensures the security and correct execution of verification.

[0039] The present invention provides an accurate basis for judging whether the communication is normal through clear communication characterization. If the feedback hardware verification data conforms to the communication characterization, it means that the communication process is stable and the data transmission is accurate, which reduces the system errors and data loss caused by communication failures; the level mapping feature clarifies the conversion relationship and standard between different levels, ensuring that the signal will not be distorted or lost due to level mismatch during transmission and processing; the content recognition range and verification calculation algorithm provide quantitative standards for judging the correctness of the data. Only when the actual recognition value falls into the corresponding content recognition range, the data is considered to meet the requirements, effectively avoiding data errors and misjudgments, that is, through the three dimensions of communication verification, level verification and data verification, the reliability of the device is further verified, and external attack device access is again avoided.

[0040] Furthermore, the hardware verification unit also includes a data conversion strategy, which is configured with a number of data conversion conditions, each data conversion condition is indexed by a first conversion index value, the corresponding data conversion condition is retrieved according to the first conversion index value, and the verification information is processed according to the data conversion condition to generate conversion information. By configuring the data conversion conditions and retrieving and applying them with the first conversion index value as the index, flexible and efficient data processing can be achieved, the accuracy and reliability of hardware verification can be ensured, and the verification information and verification results can be separated and protected again inside the device to prevent unexpected interactions and influences between them and other parts of the device; they are placed in a relatively independent and secure environment, reducing the risk of damage or leakage caused by external attacks or internal failures, and preventing attackers or unauthorized personnel from using known verification results to infer verification information, or to infer verification results through verification information, thereby obtaining sensitive information inside the device or bypassing the security verification mechanism.

[0041] Furthermore, the first conversion index value is calculated by a verification index formula, and the verification index formula is configured as follows: , , , ,in, is the first conversion index value, is the first communication factor, is the first level factor, is the first data factor, is the preset communication type weight, is the preset level type weight, is the preset data type weight, , For the The condition weights of the communication verification conditions, For the The verification result value of each communication verification condition, is the total number of communication verification conditions corresponding to the hardware verification instructions, For the The level weight of each level verification condition, For the The level deviation function of the level verification condition, is the feedback level value during the verification process, is the total number of level verification conditions corresponding to the hardware verification instruction, For the The data weight of each data verification condition, For the The data content similarity of the data verification conditions, For the The data format similarity of the data verification conditions, The total number of data verification conditions corresponding to the hardware verification instructions.

[0042] Specifically, in the process of converting the verification information into other forms of conversion information, the first conversion index value is calculated through the verification index formula, so that the first conversion index value is not certain and predictable, ensuring that the verification information and the conversion information are in a strict isolation state inside the device or system, preventing unnecessary interactions and interference between them and other irrelevant information. It has a high degree of uncertainty, thereby increasing the difficulty for attackers to obtain the original verification information, and ensuring that the verification information and the conversion information are in a strict isolation state inside the device or system, preventing unnecessary interactions and interference between them and other irrelevant information, and reducing information leakage and error propagation caused by incomplete or inaccurate isolation, which means that under the premise of ensuring the above uncertainty and isolation accuracy, the entire system can still effectively perform the verification process, that is, it can accurately judge whether the verification result meets expectations based on the verification information and conversion information, and stably and reliably complete the verification of the hardware verification information.

[0043] Furthermore, the hardware verification unit also includes an encryption configuration strategy, which includes an encryption algorithm. The encryption configuration strategy generates an encryption factor based on the first communication factor, the first level factor, and the first data factor, and configures the encryption factor in the encryption algorithm to process the conversion information to generate encrypted conversion data. Through the encryption configuration strategy, the generated encryption factor and encryption algorithm encrypt the data, making it difficult for attackers to easily interpret the data content. Because there is no correct encryption factor and corresponding encryption algorithm knowledge, even if the attacker obtains the encrypted conversion data, it is difficult to restore the original conversion information, thereby ensuring the integrity and authenticity of the data. At the same time, the encrypted conversion data can be effectively managed and verified in the storage information management unit, which is convenient for system integration and overall security improvement.

[0044] Furthermore, the hardware verification unit also includes a position generation strategy and a window generation strategy, the position generation strategy is used to generate a verification position, the window generation strategy is used to generate a verification window, the verification position points to the initial position of the solid-state PIN initial code set during verification, the verification window is used to determine the verification PIN code used as a reference from the solid-state PIN initial code set during verification, and the hardware verification unit compares the encrypted conversion data with the verification PIN code used as a reference to generate a verification result.

[0045] Specifically, the position generation strategy specifies the initial position of the solid-state PIN initial code set during verification. This is like determining which page to start looking for the password in a password book, avoiding blindly searching the entire code set. The obtained reference verification PIN code is uncertain, which increases the difficulty of reversely obtaining the solid-state PIN initial code; at the same time, it reduces the possibility of verification errors; the window generation strategy generates a verification window to determine the verification PIN code as a reference. This allows the verification process to focus on a specific and targeted code set range, ensuring that the selected verification PIN code is a valid code that meets the current verification requirements.

[0046] Specifically, the position generation strategy includes initial position starting point data of several solid-state PIN initial code sets and corresponding position generation conditions; The position generation condition is configured with a corresponding security transmission standard. If the transmission data of the solid-state storage unit conforms to the security transmission characterization, it is deemed to meet the corresponding security transmission verification condition, and the corresponding verification position starting point data is generated. The verification position starting point data is compared with the initial position starting point data of the solid-state PIN initial code set. If the comparison is consistent, the initial position of the solid-state PIN initial code set is successfully determined.

[0047] The window generation strategy retrieves the initial verification window from the preset window information table according to the initial position of the solid-state PIN initial code set, extracts the conversion index condition in the conversion information through the verification feature extraction sub-algorithm, processes the initial verification window according to the conversion index condition to generate a conversion verification window, and sends the conversion verification window to the pre-configured window mirror to determine the verification window in the solid-state PIN initial code set. The means of determining the initial position and the window are different, and the conversion verification window is generated according to the initial position and the characteristics of the conversion information, and has randomness. The window mirror makes the actual verification window generated unable to be known to the outside, and the solid-state PIN initial code set cannot be known.

[0048] Specifically, the preset window information table includes parameters such as the window size and starting position; the verification feature extraction sub-algorithm is used to extract the conversion index condition from the conversion information, and this conversion index condition will be used to process the initial verification window; the window mirror can be a pre-configured tool or module used to determine the final verification window according to the conversion verification window in the solid-state PIN initial code set.

[0049] Further, when the generation of the first verification information needs to satisfy a first verification information generation condition, the first verification information is obtained by a first verification information calculation formula; The first verification information generation condition includes a verification times condition and a verification matching degree condition; The verification times condition is: the verification times of the communication verification condition is not greater than the preset times, the verification times of the level verification condition is not greater than the preset times, and the verification times of the data verification condition is not greater than the preset times; Specifically, the preset number of times can be set according to the user, such as the preset number of times is 3 times.

[0050] The verification matching condition is as follows: for the communication verification condition, if the communication encryption conversion data completely conforms to the communication representation, the matching degree is 100%; if there is a deviation in the communication encryption conversion data format or the communication protocol that exceeds the preset deviation range, the matching degree is set according to the degree of deviation, and the matching degree is 90%; Specifically, the preset deviation range is set according to the user, for example, the preset deviation range is that the deviation range of the data transmission delay is within ±10 milliseconds.

[0051] The level verification conditions are: if the level encrypted conversion data fully meets the level verification characteristics, the matching degree is 100%; if the level encrypted conversion data fluctuates within the allowable error range, the matching degree is determined according to the degree of fluctuation, and the matching degree is 90%; For the data verification condition, the encrypted conversion data is compared based on the closeness to the center value of the content recognition range. If the encrypted conversion data is within ±5% of the preset content recognition range center value, the match degree is 90%; if it is close to the boundary but still within the range, the match degree is 90%; The first verification information calculation formula is: , in, is the first verification information; is the number of verifications; is the maximum number of authentications allowed; is the weight of the number of verifications; To verify the matching; The weight for verifying the matching degree.

[0052] Specifically, the number of verifications, the maximum number of verifications allowed, the weight of the number of verifications, the degree of verification matching, and the weight of the degree of verification matching can be set according to the user; For 5 times, is 0.5, is 0.5.

[0053] Specifically, by formulating detailed matching degree measurement standards for communication verification conditions, level verification conditions and data verification conditions respectively, the degree of compliance of hardware verification data with preset conditions can be comprehensively and accurately evaluated. In communication verification, not only the ideal situation of full compliance with communication characterization is considered, but also the slight deviation of format or protocol is quantitatively evaluated. This refined approach helps to grasp the actual status of the hardware more accurately. For level verification, considering the fluctuation of data within the allowable error range, the matching degree is reasonably set to avoid excessive negation of hardware performance due to small fluctuations. In terms of data verification, the matching degree is determined according to the proximity between the encrypted conversion data and the center value of the content recognition range, which can reflect the validity of the data in more detail. At the same time, if only strict verification standards are adopted, that is, the hardware verification is judged to have failed as long as there is one point that does not meet the preset conditions, some hardware that can actually still work normally may be misjudged. By setting different degrees of matching and comprehensively considering the number of verifications, small defects in the hardware and accidental mistakes in the verification process can be tolerated to a certain extent, avoiding overly strict verification. For example, in data verification, when the encrypted converted data is close to the boundary of the content recognition range but still within the range, it is given a 90% match instead of being directly judged as unqualified. This can avoid frequent rejection of hardware due to small fluctuations in the data.

[0054] The system also includes a software verification unit, which is configured with a preset software verification strategy, and the software verification strategy is used to assign corresponding permission characteristics to the requesting end according to the first verification information. The software verification conditions are divided into first verification information verification conditions and window verification conditions, and hardware-related information is verified from different angles to achieve layered verification assurance.

[0055] Specifically, the software verification strategy includes a number of software verification data and corresponding software verification conditions; The software verification condition includes a first verification information verification condition and a software input window verification condition; The first verification information verification condition is configured with a corresponding first verification information verification standard, and if the data of the first verification information meets the information verification representation, it is deemed to meet the corresponding first verification information verification condition; The first verification information verification standard is: .

[0056] Specifically, a clear value range is set through the first verification information verification standard to avoid overly loose or strict verification. By requiring the first verification information to be between 0.45 and 0.875, it is possible to screen out situations where the matching degree and the number of verifications are good in the hardware verification process. This range setting can effectively exclude situations where the hardware verification matching degree is too low or the number of verifications is too many, thereby improving the accuracy of the software verification in judging the hardware status.

[0057] The software input window verification condition is configured with a corresponding window verification standard. If the PIN input code data entered in the software input window meets the window verification characterization, it is deemed to meet the corresponding software input window verification condition; The software input window verification standard is to perform a preset hash operation on the PIN input code and the verification PIN code to obtain a PIN input code hash value and a verification PIN code hash value, and the PIN input code hash value and the verification PIN code hash value must be compared and consistent.

[0058] Specifically, a hash operation is used in the software input window verification condition to compare the PIN input code and the verification PIN code. The hash operation has the characteristics of one-way and collision resistance, which means that it is difficult to reverse the original PIN code from the hash value, and the probability of different PIN codes generating the same hash value is extremely low. Therefore, by comparing the hash value to verify the PIN code, it can effectively prevent the PIN code from being stolen or tampered with during the verification process, greatly improving the security and accuracy of the PIN code verification.

[0059] The system also includes a storage information management unit, which is configured with a number of encryption information, different encryption information is configured with corresponding authority characteristics, and the storage information management unit configures the corresponding request end's access rights to the encryption information according to the authority characteristics.

[0060] Specifically, by configuring permission features for different encrypted information, the storage information management unit can implement hierarchical access control. This means that only requesters with corresponding permissions can access specific encrypted information, thereby effectively preventing unauthorized access and data leakage. In an enterprise data storage system, highly confidential commercial confidential files can be set to be accessible only to senior management, while ordinary employees cannot obtain these sensitive information, greatly reducing the risk of data leakage.

[0061] The information itself is already encrypted, and combined with permission control, it provides double protection for data. Even if an attacker manages to obtain the storage medium, without the correct access rights and decryption keys, they will not be able to understand the content of the encrypted information.

[0062] Example 2 like Figure 1 As shown, the encryption information storage method is applicable to the encryption information storage system based on the industrial control host described in the above embodiment 1 to implement access rights to the industrial control host. The method includes: S1. The user connects the solid-state storage unit to the industrial control host through an interface to complete the solid-state PIN initial code collection and storage. The solid-state PIN initial code set is stored in the storage information management unit; Through the position generation strategy, if the secure transmission is completed, the initial position of the solid-state PIN initial code set is successfully determined; If the secure transmission is not completed, a reminder page will pop up on the external monitor of the industrial control host; S2. Using the window generation strategy, according to the initial position of the solid-state PIN initial code set in S1, the corresponding initial verification window is searched in the preset window information table, and the conversion information is processed using the verification feature extraction sub-algorithm, and the initial verification window is processed according to the extracted conversion index condition, and the conversion verification window is sent to the pre-configured window mirrorer, and the window mirrorer matches the conversion verification window with the solid-state PIN initial code set to determine the verification window, and the solid-state PIN initial code in the verification window area is used as the reference verification PIN code; Specifically, if the solid-state PIN initial code set is stored in a certain area in the memory in a certain order, the initial position can be a memory address or an index value. Assuming that the index corresponding to the initial position is i, the record corresponding to the index is searched in the window information table, which contains the parameters of the initial verification window, such as the window size i (assuming m code elements) and the starting position and other information.

[0063] The conversion information may be a data packet including a modification password and a high security level, from which the algorithm extracts the conversion index condition that requires the verification window to be shifted to the left by m code elements.

[0064] When the conversion index condition is a translation operation, the initial verification window is translated in the specified direction and distance. For example, the initial verification window has a starting position of p and a size of n. The conversion index condition is to translate m code elements to the left. Then the starting position of the conversion verification window becomes pm, and the size remains n. Also, when the conversion index condition involves a change in the window size, such as expanding the window size to k times the original size, the new window size is n*k, and the starting position is adjusted as needed.

[0065] The window mirror will search for the area corresponding to the starting position and size of the conversion verification window in the solid-state PIN initial code set, and this area is the final verification window. It will be used for subsequent PIN code verification and other operations.

[0066] S3, obtaining encrypted conversion data through data conversion strategy and encryption configuration strategy; S4, using the hardware verification unit to compare the encrypted data in S3 with the reference verification PIN code in S2 for data integrity. When the encrypted data and the reference verification PIN code are consistent, the verification result is passed; S5, bringing the encrypted converted data of S3 into the first verification information generation condition, calculating and obtaining the first verification information and sending it to the software verification unit; S6. If the first verification information meets the first verification information verification standard , the software input window verification condition in the software verification is triggered; S7. Enter the PIN input code in the software input window, perform a preset hash operation on the PIN input code and the verification PIN code according to the software input window verification standard, obtain the PIN input code hash value and the verification PIN code hash value, and when the PIN input code hash value and the verification PIN code hash value are consistent, the verification result is passed; S8, controlling access rights to the encrypted information through the storage information management unit according to the verification results of S4 and S7; If the verification results of S4 and S7 are both passed, access to the industrial control host is granted; Otherwise, access is denied, completing the dynamic interlocking of the hardware verification unit and the software verification unit for the encrypted information.

[0067] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. An encrypted information storage system based on an industrial control host, characterized in that: The system includes: A solid-state storage unit storing a solid-state PIN initial code set; An interactive signal unit, used for communicating with the requesting end; A hardware verification unit is configured with a preset hardware verification strategy, the hardware verification strategy responds to the verification information input by the requesting end, the hardware verification strategy includes a plurality of hardware verification instructions and corresponding hardware verification conditions, the hardware verification unit determines the corresponding hardware verification instruction according to the verification information, and sends the hardware verification instruction to the requesting end through the interactive signal unit to obtain hardware verification data, the hardware verification strategy verifies the hardware verification data through the corresponding hardware verification condition, and generates first verification information according to the verification result; A software verification unit, wherein the software verification unit is configured with a preset software verification strategy, and the software verification strategy is used to assign corresponding authority characteristics to the requesting end according to the first verification information; A storage information management unit is configured with a plurality of encryption information, different encryption information is configured with corresponding permission characteristics, and the storage information management unit configures the access rights of the corresponding requesting end to the encryption information according to the permission characteristics.

2. The encrypted information storage system based on the industrial control host according to claim 1 is characterized in that: The hardware verification conditions include communication verification conditions, level verification conditions and data verification conditions. The communication verification conditions are configured with corresponding communication standards. If the fed-back hardware verification data conforms to the communication characterization, it is deemed to satisfy the corresponding communication verification conditions. The level verification conditions are configured with level mapping features. If the fed-back hardware verification data conforms to the level verification features, it is deemed to satisfy the corresponding level verification conditions. The data verification conditions include a content recognition range and a corresponding verification calculation algorithm. The corresponding hardware verification data is calculated by the verification calculation algorithm to obtain the corresponding actual recognition value. If the actual recognition value falls within the corresponding content recognition range, it is deemed to satisfy the corresponding data verification conditions.

3. The encrypted information storage system based on the industrial control host according to claim 2 is characterized in that: The hardware verification unit also includes a data conversion strategy, which is configured with a plurality of data conversion conditions. Each data conversion condition is indexed by a first conversion index value. The corresponding data conversion condition is retrieved according to the first conversion index value, and verification information is processed according to the data conversion condition to generate conversion information.

4. The encrypted information storage system based on the industrial control host according to claim 3 is characterized in that: The first conversion index value is calculated by a verification index formula, and the verification index formula is configured as follows: , , , ,in, is the first conversion index value, is the first communication factor, is the first level factor, is the first data factor, is the preset communication type weight, is the preset level type weight, is the preset data type weight, , For the The condition weights of the communication verification conditions, For the The verification result value of each communication verification condition, is the total number of communication verification conditions corresponding to the hardware verification instructions, For the The level weight of each level verification condition, For the The level deviation function of the level verification condition, is the feedback level value during the verification process, is the total number of level verification conditions corresponding to the hardware verification instruction, For the The data weight of each data verification condition, For the The data content similarity of the data verification conditions, For the The data format similarity of the data verification conditions, The total number of data verification conditions corresponding to the hardware verification instructions.

5. The encrypted information storage system based on the industrial control host according to claim 4 is characterized in that: The hardware verification unit also includes an encryption configuration strategy, which includes an encryption algorithm. The encryption configuration strategy generates an encryption factor based on a first communication factor, a first level factor, and a first data factor, and configures the encryption factor in the encryption algorithm to process the conversion information to generate corresponding encrypted conversion data.

6. The encrypted information storage system based on the industrial control host according to claim 5 is characterized in that: The hardware verification unit also includes a position generation strategy and a window generation strategy, the position generation strategy is used to generate a verification position, the window generation strategy is used to generate a verification window, the verification position points to the initial position of the solid-state PIN initial code set during verification, the verification window is used to determine a verification PIN code as a benchmark from the solid-state PIN initial code set during verification, and the hardware verification unit compares the encrypted conversion data with the verification PIN code as a benchmark to generate a verification result.

7. The encrypted information storage system based on the industrial control host according to claim 6 is characterized in that: The position generation strategy includes initial position starting point data of a plurality of solid-state PIN initial code sets and corresponding position generation conditions; The position generation condition is configured with a corresponding security transmission standard. If the transmission data of the solid-state storage unit meets the security transmission characterization, it is deemed to meet the corresponding security transmission verification condition, and the corresponding verification position starting point data is generated. The verification position starting point data is compared with the initial position starting point data of the solid-state PIN initial code set. If the comparison is consistent, the initial position of the solid-state PIN initial code set is successfully determined; The window generation strategy retrieves an initial verification window from a preset window information table according to the initial position of the solid-state PIN initial code set, extracts a conversion index condition in the conversion information through a verification feature extraction sub-algorithm, processes the initial verification window according to the conversion index condition to generate a conversion verification window, and sends the conversion verification window to a pre-configured window mirror to determine the verification window in the solid-state PIN initial code set.

8. The encrypted information storage system based on the industrial control host according to claim 7 is characterized in that: When the generation of the first verification information needs to meet the first verification information generation condition, the first verification information is obtained by using the first verification information calculation formula; The first verification information generation condition includes a verification times condition and a verification matching degree condition; The verification times condition is: the verification times of the communication verification condition is not greater than the preset times, the verification times of the level verification condition is not greater than the preset times, and the verification times of the data verification condition is not greater than the preset times; The verification matching condition is as follows: for the communication verification condition, if the communication encryption conversion data completely conforms to the communication representation, the matching degree is 100%; if there is a deviation in the communication encryption conversion data format or the communication protocol that exceeds the preset deviation range, the matching degree is set according to the degree of deviation, and the matching degree is 90%; The level verification conditions are: if the level encrypted conversion data fully meets the level verification characteristics, the matching degree is 100%; if the level encrypted conversion data fluctuates within the allowable error range, the matching degree is determined according to the degree of fluctuation, and the matching degree is 90%; For the data verification condition, the encrypted conversion data is compared based on the closeness to the center value of the content recognition range. If the encrypted conversion data is within ±5% of the preset content recognition range center value, the match degree is 90%; if it is close to the boundary but still within the range, the match degree is 90%; The first verification information calculation formula is: ， in, is the first verification information; is the number of verifications; is the maximum number of authentications allowed; is the weight of the number of verifications; To verify the matching; The weight for verifying the matching degree.

9. The encrypted information storage system based on the industrial control host according to claim 8 is characterized in that: The software verification strategy includes a number of software verification data and corresponding software verification conditions; The software verification condition includes a first verification information verification condition and a software input window verification condition; The first verification information verification condition is configured with a corresponding first verification information verification standard, and if the data of the first verification information meets the information verification representation, it is deemed to meet the corresponding first verification information verification condition; The first verification information verification standard is: ; The software input window verification condition is configured with a corresponding window verification standard. If the PIN input code data entered in the software input window meets the window verification characterization, it is deemed to meet the corresponding software input window verification condition; The software input window verification standard is to perform a preset hash operation on the PIN input code and the verification PIN code to obtain a PIN input code hash value and a verification PIN code hash value, and the PIN input code hash value and the verification PIN code hash value must be compared and consistent.

10. The encrypted information storage method is characterized in that: The method is applicable to the encrypted information storage system based on the industrial control host according to any one of claims 7 to 9 to implement access rights to the industrial control host, and the method comprises: S1. The user connects the solid-state storage unit to the industrial control host through an interface to complete the solid-state PIN initial code collection and storage. The solid-state PIN initial code set is stored in the storage information management unit; Through the position generation strategy, if the secure transmission is completed, the initial position of the solid-state PIN initial code set is successfully determined; If the secure transmission is not completed, a reminder page will pop up on the external monitor of the industrial control host; S2. Using the window generation strategy, according to the initial position of the solid-state PIN initial code set in S1, the corresponding initial verification window is searched in the preset window information table, and the conversion information is processed using the verification feature extraction sub-algorithm, and the initial verification window is processed according to the extracted conversion index condition, and the conversion verification window is sent to the pre-configured window mirrorer, and the window mirrorer matches the conversion verification window with the solid-state PIN initial code set to determine the verification window, and the solid-state PIN initial code in the verification window area is used as the reference verification PIN code; S3, obtaining encrypted conversion data through data conversion strategy and encryption configuration strategy; S4, using the hardware verification unit to compare the encrypted data in S3 with the reference verification PIN code in S2 for data integrity. When the encrypted data and the reference verification PIN code are consistent, the verification result is passed; S5, bringing the encrypted converted data of S3 into the first verification information generation condition, calculating and obtaining the first verification information and sending it to the software verification unit; S6. If the first verification information meets the first verification information verification standard , the software input window verification condition in the software verification is triggered; S7. Enter the PIN input code in the software input window, perform a preset hash operation on the PIN input code and the verification PIN code according to the software input window verification standard, obtain the PIN input code hash value and the verification PIN code hash value, and when the PIN input code hash value and the verification PIN code hash value are consistent, the verification result is passed; S8, controlling access rights to the encrypted information through the storage information management unit according to the verification results of S4 and S7; If both the verification results of S4 and S7 are passed, access to the industrial control host is granted; Otherwise, access is denied, completing the dynamic interlocking of the hardware verification unit and the software verification unit for the encrypted information.

Images