A secure access method for industrial Internet identification data
By establishing encrypted tunnels, signature verification, timestamping, identity authentication and dynamic token systems in the middleware of industrial Internet identification data acquisition and interoperability system, the security risks existing in the middleware during data access application are solved, and secure access in a larger scope and deeper application scenarios are achieved.
Patent Information
- Application Number
- CN202411684015.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-22
- Publication Date
- 2025-04-08
AI Technical Summary
The existing industrial Internet identification data acquisition and intercommunication system middleware poses security risks in the data access application process, and it is difficult to achieve secure access in a larger scope and in-depth application scenarios.
By establishing encrypted tunnels, labeled data signature verification system, timestamp service system, identity authentication system and dynamic security token system, secure communication and data access between middleware and the industrial Internet identification service platform.
It effectively reduces the security risks of middleware, ensures the security of data access, and promotes secure access to middleware in larger scope and deeper application scenarios.
Smart Images
Figure CN119788308A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of industrial Internet, and specifically relates to a method for securely accessing industrial Internet identification data. Background Art
[0002] The Industrial Internet identification resolution system is the infrastructure of the Industrial Internet. The Industrial Internet identification data collection and intercommunication system middleware uses the Industrial Internet identification resolution system technology to solve the high complexity of the interconnection and intercommunication of various information systems or data of manufacturing enterprises. It involves various cross-domain, cross-platform, heterogeneous, and remote production and manufacturing or management information systems and sensitive data information within and outside the enterprise. With the deepening of application, the security requirements are gradually increasing. Therefore, in view of the current situation, it needs to be improved. Summary of the invention
[0003] In view of the above situation, in order to overcome the defects of the prior art, the present invention provides a method for secure access to industrial Internet identification data, which effectively solves the problems of how to reduce the security risks of middleware for industrial Internet identification data collection and intercommunication system, ensure the security of the middleware in the data access application process, and how to promote the access of the middleware in a larger range of industrial Internet identification data collection and intercommunication systems and in more in-depth application scenarios.
[0004] To achieve the above object, the present invention provides the following technical solution: a method for securely accessing industrial Internet identification data, characterized in that it comprises the following steps:
[0005] Step 1: Establish an encrypted tunnel. When the enterprise application system accesses the Industrial Internet Identity Service Platform, the Industrial Internet Identity Service Platform creates a middleware for it and creates a special middleware identity for the middleware. The communication between the middleware and the Industrial Internet Identity Service Platform must use the HTTPS channel. The middleware and the Industrial Internet Identity Service Platform perform SSL encrypted communication and need to verify the SSL certificate of the accessed server.
[0006] Step 2: Establish a signature verification system for identification data. When the enterprise application system accesses the Industrial Internet Identification Service Platform and establishes a new identification, the enterprise application system uses the middleware private key to sign the new identification data, obtains the signature value, and transmits the new identification and signature value to the Industrial Internet Identification Service Platform. The identification service platform obtains the middleware public key from the middleware identification, and uses the middleware public key to verify the new identification data and signature value. After the verification is passed, the identification service platform synchronously registers the identification and saves the signature value. If the verification fails, the error information will be fed back to the enterprise application system.
[0007] Step 3: Establish a timestamp service system. The enterprise application system prepares the identification data that needs to be timestamped through the middleware, performs timestamp operation on the identification data through the timestamp service, and synchronizes the identification data to the Industrial Internet Identification Service Platform. At the same time, it saves the corresponding timestamp by itself. When the middleware requests to obtain and use a certain identification data, the Industrial Internet Identification Service Platform parses the identification data and finds that the identification data has a corresponding timestamp. The Industrial Internet Identification Service Platform verifies the time content of the middleware request verification. If the verification fails, it means that the original text may be tampered with, or the operation time is not the time of the timestamp.
[0008] Step 4: Establish an identity authentication system. The enterprise application system sends the middleware account to the timestamp service system for timestamp operation. The middleware uses its own asymmetric private key to sign the original text formed by the account and timestamp to obtain the identity authentication signature value. The middleware account, timestamp and identity authentication signature value are sent to the Industrial Internet Identification Service Platform to request identity authentication. The Industrial Internet Identification Service Platform obtains the corresponding middleware identification according to the account information, parses the identification to obtain the middleware public key, and uses the public key to verify the original text composed of the account and timestamp and the identity authentication signature value. If the verification fails, access is denied. If the verification succeeds, a dynamic security token is issued to the middleware.
[0009] Step 5: Establish a dynamic security token system. When the middleware's identity authentication passes, the Industrial Internet Identification Service Platform issues a new security dynamic token to the middleware and records the corresponding relationship between the security dynamic token and the middleware. When the middleware uses the dynamic security token to access the Industrial Internet Identification Service Platform, the Industrial Internet Identification Service Platform queries whether there is a dynamic security token record corresponding to the middleware based on the middleware information, and verifies it with the dynamic security token sent by the middleware. If the verification fails, the middleware needs to re-authenticate. If the verification passes, the middleware is allowed to access the Industrial Internet Identification Service Platform normally, and the remaining validity period of the security dynamic token is reset. The Industrial Internet Identification Service Platform periodically scans whether the security dynamic token is idle and timed out. When the remaining validity period expires, the security dynamic token and its corresponding middleware are deleted.
[0010] Preferably, the middleware proposed in step 1 includes a pair of asymmetric keys, and the asymmetric keys include a middleware public key and a middleware private key.
[0011] Preferably, the middleware public key information is stored in the information associated with the identifier, and the private key is encapsulated in the middleware, distributed to the enterprise along with the middleware, and connected to the enterprise application system.
[0012] Preferably, the middleware is embedded into the enterprise application system in the form of SDK. The enterprise application system calls the middleware to communicate with the Industrial Internet identification service platform to transmit business data information related to the Industrial Internet identification.
[0013] Preferably, the HTTPS channel proposed in step 1 adds SSL on the basis of HTTP, performs HTTP communication through a secure connection provided by the SSL / TLS protocol, and authenticates the server, encrypts communication content, and detects tampering.
[0014] Preferably, the SSL proposed in step 1 uses TCP to provide a reliable end-to-end security service, adopting a two-layer protocol, the lower layer is the SSL record layer, which is used to encapsulate different upper layer protocols, and the other layer is the encapsulated protocol, namely the SSL handshake protocol, which is used to allow the server and the client to negotiate encryption algorithms and encryption keys before transmitting application data.
[0015] Preferably, the security dynamic token proposed in step five is a non-repeating random number, using UUID; during the validity period of the dynamic security token, the Industrial Internet Identification Service Platform saves the relationship between the middleware and the dynamic security token in the Redis cache database.
[0016] Preferably, the UUID is used to identify the attribute type and is regarded as a unique identifier in all space and time, so that all elements in the distributed system can have unique identification information without the need to specify the identification information through a central control terminal.
[0017] Preferably, the Redis cache database supports storage of strings, linked lists, sets, ordered sets and hash types, and supports various sorting methods, periodically writes updated data to disk and writes modification operations to additional record files, and realizes master-slave synchronization on this basis.
[0018] Compared with the prior art, the beneficial effects of the present invention are: 1. The present invention, by establishing an encrypted tunnel and utilizing SSL channel encryption, ensures the confidentiality of the transmitted identification data information. Even if the transmitted information is intercepted, the ciphertext cannot obtain the real data information, thereby ensuring that the middleware communication object is the designated industrial Internet service platform object, and preventing access to fake phishing systems.
[0019] 2. The present invention ensures the data security in the Industrial Internet identification service platform by establishing a signature verification system for the identification data. When the verification fails, it can be considered that the data has been tampered with, or the operation object is not a designated legal object, and new identification is not allowed to be registered simultaneously on the Industrial Internet identification service platform.
[0020] 3. The present invention, by establishing a timestamp service system, is used in business scenarios where the authority of identification data operation time needs to be ensured, to prevent unauthorized and illegal identification data operations, and to provide authoritative time traceability verification.
[0021] 4. The present invention, by establishing an identity authentication and dynamic security token system, can ensure the process of confirming the user's legal identity and authority when the user uses the enterprise application system to call the middleware SDK interface to access the Industrial Internet identification service platform. The identity authentication system is a high-intensity access identity confirmation and a secure login behavior with correct authorization realized by a dual-factor technology of digital signature verification and timestamp. This method is more secure and more difficult to attack. When the enterprise application system completes the identity authentication and confirmation for the first time, a dynamic security token is issued. During the prescribed rule period, only the dynamic security token is required to access the services of the Industrial Internet identification service platform, which greatly reduces the performance loss caused by the high security of the identity authentication system. BRIEF DESCRIPTION OF THE DRAWINGS
[0022] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention.
[0023] In the attached picture:
[0024] Figure 1 This is a framework diagram of the method for secure access to industrial Internet identification data of the present invention;
[0025] Figure 2 This is a framework diagram of step one in the method for securely accessing industrial Internet identification data of the present invention. DETAILED DESCRIPTION
[0026] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments; based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.
[0027] See also Figure 1-Figure 2 The present invention provides a method for securely accessing industrial Internet identification data, comprising the following steps:
[0028] Step 1: Establish an encrypted tunnel. When the enterprise application system accesses the Industrial Internet Identity Service Platform, the Industrial Internet Identity Service Platform creates a middleware for it and creates a special middleware identity for the middleware. The communication between the middleware and the Industrial Internet Identity Service Platform must use the HTTPS channel. The middleware and the Industrial Internet Identity Service Platform perform SSL encrypted communication and need to verify the SSL certificate of the accessed server.
[0029] Step 2: Establish a signature verification system for identification data. When the enterprise application system accesses the Industrial Internet Identification Service Platform and establishes a new identification, the enterprise application system uses the middleware private key to sign the new identification data, obtains the signature value, and transmits the new identification and signature value to the Industrial Internet Identification Service Platform. The identification service platform obtains the middleware public key from the middleware identification, and uses the middleware public key to verify the new identification data and signature value. After the verification is passed, the identification service platform synchronously registers the identification and saves the signature value. If the verification fails, the error information will be fed back to the enterprise application system.
[0030] Step 3: Establish a timestamp service system. The enterprise application system prepares the identification data that needs to be timestamped through the middleware, performs timestamp operation on the identification data through the timestamp service, and synchronizes the identification data to the Industrial Internet Identification Service Platform. At the same time, it saves the corresponding timestamp by itself. When the middleware requests to obtain and use a certain identification data, the Industrial Internet Identification Service Platform parses the identification data and finds that the identification data has a corresponding timestamp. The Industrial Internet Identification Service Platform verifies the time content of the middleware request verification. If the verification fails, it means that the original text may be tampered with, or the operation time is not the time of the timestamp.
[0031] Step 4: Establish an identity authentication system. The enterprise application system sends the middleware account to the timestamp service system for timestamp operation. The middleware uses its own asymmetric private key to sign the original text formed by the account and timestamp to obtain the identity authentication signature value. The middleware account, timestamp and identity authentication signature value are sent to the Industrial Internet Identification Service Platform to request identity authentication. The Industrial Internet Identification Service Platform obtains the corresponding middleware identification according to the account information, parses the identification to obtain the middleware public key, and uses the public key to verify the original text composed of the account and timestamp and the identity authentication signature value. If the verification fails, access is denied. If the verification succeeds, a dynamic security token is issued to the middleware.
[0032] Step 5: Establish a dynamic security token system. When the middleware's identity authentication passes, the Industrial Internet Identification Service Platform issues a new security dynamic token to the middleware and records the corresponding relationship between the security dynamic token and the middleware. When the middleware uses the dynamic security token to access the Industrial Internet Identification Service Platform, the Industrial Internet Identification Service Platform queries whether there is a dynamic security token record corresponding to the middleware based on the middleware information, and verifies it with the dynamic security token sent by the middleware. If the verification fails, the middleware needs to re-authenticate. If the verification passes, the middleware is allowed to access the Industrial Internet Identification Service Platform normally, and the remaining validity period of the security dynamic token is reset. The Industrial Internet Identification Service Platform periodically scans whether the security dynamic token is idle and timed out. When the remaining validity period expires, the security dynamic token and its corresponding middleware are deleted.
[0033] Among them, the middleware proposed in step one contains a pair of asymmetric keys, which include a middleware public key and a middleware private key. The middleware public key information is stored in the information associated with the identity, and the private key is encapsulated in the middleware, distributed to the enterprise with the middleware, and connected to the enterprise application system. The middleware is embedded in the enterprise application system in the form of SDK. The enterprise application system calls the middleware to communicate with the Industrial Internet Identity Service Platform to transmit business data information related to the Industrial Internet identity. The HTTPS channel proposed in step one adds SSL on the basis of HTTP, and performs HTTP communication through the secure connection provided by the SSL / TLS protocol, authenticates the server, encrypts the communication content, and detects tampering. The SSL proposed in step one uses TCP to provide a reliable end-to-end security service, using a two-layer protocol. The lower layer is the SSL record layer, which is used to encapsulate different upper layer protocols. , the other layer is the encapsulated protocol, namely the SSL handshake protocol, which is used to allow the server and the client to negotiate the encryption algorithm and encryption key before transmitting the application data. The security dynamic token proposed in step 5 is a non-repeating random number, using UUID; during the validity period of the dynamic security token, the Industrial Internet Identification Service Platform stores the relationship between the middleware and the dynamic security token in the Redis cache database. UUID is used to identify the attribute type and is regarded as a unique identifier in all space and time, so that all elements in the distributed system can have unique identification information without the need to specify the identification information through the central control end. The Redis cache database supports the storage of strings, linked lists, sets, ordered sets and hash types, and supports various different sorting methods. It periodically writes updated data to disk and writes modification operations to additional record files, and realizes master-slave synchronization on this basis.
[0034] By establishing an encrypted tunnel and using SSL channel encryption, the confidentiality of the transmitted identification data information is guaranteed. Even if the transmitted information is intercepted, the ciphertext cannot obtain the real data information. The middleware communication object is guaranteed to be the designated industrial Internet service platform object to prevent access to fake phishing systems. By establishing a signature data verification system, the data security in the industrial Internet identification service platform is guaranteed. When the verification fails, it can be considered that the data has been tampered with, or the operation object is not a designated legal object, and new identification is not allowed to be registered synchronously on the industrial Internet identification service platform. By establishing a timestamp service system, it is used in business scenarios that need to ensure the authority of the identification data operation time to prevent unauthorized and illegal identification data operations. It can also provide authoritative time traceability verification. By establishing an identity authentication and dynamic security token system, it can ensure that when users use enterprise application systems to access the Industrial Internet Identity Service Platform through the middleware SDK interface, the user's legal identity and authority are confirmed. The identity authentication system is a secure login behavior with high-intensity access identity confirmation and correct authorization achieved through digital signature verification and timestamp dual-factor technology. This method is more secure and more difficult to attack. When the enterprise application system completes the identity authentication and confirmation for the first time, a dynamic security token is issued. During the prescribed period, only the dynamic security token is required to access the services of the Industrial Internet Identity Service Platform, which greatly reduces the performance loss caused by the high security of the identity authentication system.
[0035] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.
[0036] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.
Claims
1. A method for secure access to industrial Internet identification data, characterized in that: The following steps are involved: Step 1: Establish an encrypted tunnel. When the enterprise application system accesses the Industrial Internet Identity Service Platform, the Industrial Internet Identity Service Platform creates a middleware for it and creates a special middleware identity for the middleware. The communication between the middleware and the Industrial Internet Identity Service Platform must use the HTTPS channel. The middleware and the Industrial Internet Identity Service Platform perform SSL encrypted communication and need to verify the SSL certificate of the accessed server. Step 2: Establish a signature verification system for identification data. When the enterprise application system accesses the Industrial Internet Identification Service Platform and establishes a new identification, the enterprise application system uses the middleware private key to sign the new identification data, obtains the signature value, and transmits the new identification and signature value to the Industrial Internet Identification Service Platform. The identification service platform obtains the middleware public key from the middleware identification, and uses the middleware public key to verify the new identification data and signature value. After the verification is passed, the identification service platform synchronously registers the identification and saves the signature value. If the verification fails, the error information will be fed back to the enterprise application system. Step 3: Establish a timestamp service system. The enterprise application system prepares the identification data that needs to be timestamped through the middleware, performs timestamp operation on the identification data through the timestamp service, and synchronizes the identification data to the Industrial Internet Identification Service Platform. At the same time, it saves the corresponding timestamp by itself. When the middleware requests to obtain and use a certain identification data, the Industrial Internet Identification Service Platform parses the identification data and finds that the identification data has a corresponding timestamp. The Industrial Internet Identification Service Platform verifies the time content of the middleware request verification. If the verification fails, it means that the original text may be tampered with, or the operation time is not the time of the timestamp. Step 4: Establish an identity authentication system. The enterprise application system sends the middleware account to the timestamp service system for timestamp operation. The middleware uses its own asymmetric private key to sign the original text formed by the account and timestamp to obtain the identity authentication signature value. The middleware account, timestamp and identity authentication signature value are sent to the Industrial Internet Identification Service Platform to request identity authentication. The Industrial Internet Identification Service Platform obtains the corresponding middleware identification according to the account information, parses the identification to obtain the middleware public key, and uses the public key to verify the original text composed of the account and timestamp and the identity authentication signature value. If the verification fails, access is denied. If the verification succeeds, a dynamic security token is issued to the middleware. Step 5: Establish a dynamic security token system. When the middleware's identity authentication passes, the Industrial Internet Identification Service Platform issues a new security dynamic token to the middleware and records the corresponding relationship between the security dynamic token and the middleware. When the middleware uses the dynamic security token to access the Industrial Internet Identification Service Platform, the Industrial Internet Identification Service Platform queries whether there is a dynamic security token record corresponding to the middleware based on the middleware information, and verifies it with the dynamic security token sent by the middleware. If the verification fails, the middleware needs to re-authenticate. If the verification passes, the middleware is allowed to access the Industrial Internet Identification Service Platform normally, and the remaining validity period of the security dynamic token is reset. The Industrial Internet Identification Service Platform periodically scans whether the security dynamic token is idle and timed out. When the remaining validity period expires, the security dynamic token and its corresponding middleware are deleted.
2. According to claim 1, a method for secure access to industrial Internet identification data is characterized in that: The middleware proposed in step 1 includes a pair of asymmetric keys, and the asymmetric keys include a middleware public key and a middleware private key.
3. According to claim 2, a method for securely accessing industrial Internet identification data is characterized in that: The middleware public key information is stored in the information associated with the identifier, and the private key is encapsulated in the middleware, distributed to the enterprise along with the middleware, and connected to the enterprise application system.
4. According to claim 3, a method for securely accessing industrial Internet identification data is characterized in that: The middleware is embedded in the enterprise application system in the form of SDK. The enterprise application system calls the middleware to communicate with the Industrial Internet Identification Service Platform and transmits business data information related to the Industrial Internet Identification.
5. According to claim 4, a method for securely accessing industrial Internet identification data is characterized in that: The HTTPS channel proposed in step 1 adds SSL on the basis of HTTP, performs HTTP communication through the secure connection provided by the SSL / TLS protocol, and authenticates the server, encrypts the communication content, and detects tampering.
6. A method for securely accessing industrial Internet identification data according to claim 5, characterized in that: The SSL proposed in step 1 uses TCP to provide a reliable end-to-end security service, using a two-layer protocol. The lower layer is the SSL record layer, which is used to encapsulate different upper layer protocols, and the other layer is the encapsulated protocol, namely the SSL handshake protocol, which is used to allow the server and the client to negotiate encryption algorithms and encryption keys before transmitting application data.
7. The method for securely accessing industrial Internet identification data according to claim 1 is characterized in that: The security dynamic token proposed in step five is a non-repeating random number, using UUID; during the validity period of the dynamic security token, the Industrial Internet Identification Service Platform saves the relationship between the middleware and the dynamic security token in the Redis cache database.
8. A method for securely accessing industrial Internet identification data according to claim 7, characterized in that: The UUID is used to identify the attribute type and is regarded as a unique identifier in all space and time, so that all elements in the distributed system can have unique identification information without the need to specify the identification information through a central control terminal.
9. The method for securely accessing industrial Internet identification data according to claim 7 is characterized in that: The Redis cache database supports the storage of strings, linked lists, sets, ordered sets and hash types, and supports various sorting methods. It periodically writes updated data to disk and writes modification operations to additional record files, and on this basis realizes master-slave synchronization.