Industrial data security management method and system based on data security platform

Abstract

The invention discloses an industrial data security management method and system based on a data security platform, and the method comprises the following steps: collecting multi-source heterogeneous data of an industrial enterprise, including equipment basic data, equipment operation data, business data and the like; cleaning and converting the collected data, and screening and clearing repeated and redundant data in the data to be used; carrying out security management on the data by adopting a dynamic desensitization and data encryption mode; after data desensitization and encryption, data needs to be safely stored, conventional data needs to be directly stored in a lake, sensitive data needs to be stored in a sensitive area, encrypted data is stored in an encryption area through algorithm encryption, and the encrypted data needs to be used after being decrypted by a secret key during use; after the data is safely stored, services need to be uniformly provided to the outside, and the data application service capability is constructed. By adopting the technical scheme, the data security is fully guaranteed while industrial data is valuable to convert, and continuous energization is performed on multiple fields such as research and development, production and sales of enterprises.

Description

Technical Field

[0001] The present invention belongs to the technical field of data security, and relates to an industrial data security management method and system based on a data security platform. Background Art

[0002] At present, with the rapid development of the industrial Internet, the rapid growth of industrial data has brought huge challenges to industrial enterprises. Due to the lack of unified data security management tools, the circulation and storage of industrial data have the following risks and challenges:

[0003] Data leakage risk: As the amount of industrial data grows, the risk of data leakage becomes increasingly serious. Hackers may target industrial data in the fields of energy, manufacturing, etc., and steal sensitive information by attacking industrial control systems or databases.

[0004] Cross-border flow risks: The security risks of cross-border flow of industrial data are also prominent, involving important sensitive data such as R&D design, production and manufacturing, which may threaten corporate production and operation, national economic development and even national security.

[0005] Difficulty in protection: There are security risks in all links of the entire life cycle of industrial data. From data collection, transmission, storage to use, each link may become a target of hacker attacks. At the same time, industrial data is highly real-time, and traditional security technologies such as encryption transmission are difficult to cope with, which increases the difficulty of protection.

[0006] Existing technologies require dedicated personnel to store data. In industrial scenarios, massive amounts of data are stored on hard disks or USB flash drives, resulting in a waste of resources. At the same time, if the hard disk or USB flash drive is lost, data leakage is likely to occur, and data security is difficult to ensure. Summary of the invention

[0007] The purpose of the present invention is to provide an industrial data security management method and system based on a data security platform to improve the security of massive data in storage, transmission and use and avoid data leakage.

[0008] In order to achieve the above object, the basic scheme of the present invention is: an industrial data security management method based on a data security platform, comprising the following steps:

[0009] Collect multi-source heterogeneous data from industrial enterprises, including equipment basic data, equipment operation data, and business data, and perform pre-processing;

[0010] Dynamic desensitization and data encryption are used to securely manage multi-source heterogeneous data of industrial enterprises;

[0011] The data storage area of ​​the data security platform is divided into a general area, a sensitive area, and an encrypted area. Regular expressions, machine learning, and natural language processing (NLP) intelligent algorithms are used to detect the types of multi-source heterogeneous data of industrial enterprises. If the data is regular data, it is stored in the general area. If the data is sensitive data, it is stored in the sensitive area. If the data is data to be encrypted, it is desensitized and encrypted and then stored in the encrypted area. When using it, it needs to be decrypted with a secret key.

[0012] After the data is securely stored, it is necessary to provide services to the outside world in a unified manner and build data application service capabilities.

[0013] The working principle and beneficial effects of this basic solution are: Preventing data leakage: Industrial big data may contain a large amount of sensitive information, such as production data, customer information, R&D design, etc. Through data desensitization and encryption, this information can be effectively prevented from being accessed or leaked without authorization, protecting the company's business secrets and customer privacy.

[0014] Compliance assurance: With the increasingly stringent data protection regulations, such as GDPR (General Data Protection Regulation), enterprises need to properly process data to meet compliance requirements. Data desensitization and encryption is one of the important means to ensure data compliance.

[0015] Safely share data: In the industrial field, data sharing is an important means to promote industry innovation and development. However, data sharing is often accompanied by the risk of data leakage. Through data desensitization and encryption, data can be safely shared while ensuring data security, promoting cross-enterprise and cross-industry cooperation and communication.

[0016] Furthermore, the method for preprocessing the collected multi-source heterogeneous data of industrial enterprises is as follows:

[0017] Collect and clean multi-source heterogeneous data of industrial enterprises, delete duplicate and redundant data, complete missing parts, and correct or delete incorrect data;

[0018] Perform data conversion, specifically:

[0019] Use SQL or Python to perform data conversion through scripts to convert data from one format or structure to another format or structure to achieve the basic conditions for identifying sensitive data and privacy data.

[0020] Realize unified storage and standardized management of massive, multi-source data in industrial scenarios.

[0021] Furthermore, the visible scope of sensitive data is preset for different users, and restricted user roles are determined;

[0022] Use regular expressions to identify sensitive data such as ID card numbers and mobile phone numbers;

[0023] Use machine learning and natural language processing (NLP) intelligent algorithms to automatically identify and classify unstructured data such as text and images;

[0024] Adopt dynamic data desensitization solutions to desensitize structured data in sensitive areas;

[0025] If the data is identified as encrypted data, the encrypted data and the secret key are stored in the encryption area through the encryption algorithm.

[0026] Realize automatic and intelligent identification of sensitive data.

[0027] Furthermore, the method of presetting the visible scope of sensitive data for different users and determining the restricted user roles is as follows:

[0028] Use a role-based access control (RBAC) system to ensure that users can only access data permitted by their roles;

[0029] Authorize different departments and positions to read, write, and modify data of different sensitivities;

[0030] The authorization policy is:

[0031] (1) Basic user roles:

[0032] Ordinary employees: can only access low-sensitivity data directly related to their work;

[0033] Department head: can access all low-sensitivity data of the department, as well as some medium-sensitivity data;

[0034] Senior management: can access company-wide data, but highly sensitive data may require special authorization;

[0035] (2) Restricted user roles:

[0036] Data administrator: responsible for the management and maintenance of data, but does not directly access sensitive data content, but manages data access permissions;

[0037] Compliance and Auditors: Responsible for supervising the compliance use and auditing of data. They can access the access records of all data but cannot directly view the data content.

[0038] Restricted access employees: employees who need to occasionally access certain sensitive data due to work needs and need special authorization and have limited access rights;

[0039] (3) Highly sensitive data access roles:

[0040] Highly Sensitive Data Access: Limited to a small number of specific personnel who need access to highly sensitive data to support decision-making or compliance work.

[0041] Preset the visibility scope of sensitive data for different users and determine restricted user roles.

[0042] Furthermore, the method of adopting a dynamic data desensitization scheme to desensitize structured data in sensitive areas is:

[0043] Dynamic decryption technology is used to match desensitization rules according to user identity information and the data to be accessed; desensitized data is output to ensure the invisibility of the original data;

[0044] The stored sensitive data needs to be provided with unified external services to build data application service capabilities, specifically:

[0045] The sensitive data that needs to be opened is made public in the form of API. During the data request execution process, it is determined whether the current user or role has the authority to access the original data. If not, SQL rewriting technology is used to desensitize the sensitive data without changing the original data in the database. For example, if the original data is 123456, the data queried by the user is 123**6 through dynamic desensitization.

[0046] For unstructured data, since it is impossible to use replacement or masking desensitization methods, it is necessary to restrict unauthorized users and roles from accessing and using sensitive unstructured data;

[0047] The data in the encrypted area that needs to be opened is opened to the public in the form of an API. During the execution of the data request, it is determined whether the current user or role has the authority to decrypt the data. If so, the secret key is returned. After the user obtains the secret key, he or she can decrypt the data and access the plaintext data.

[0048] The data in the encryption area that needs to be opened is made public in the form of an API. During the data request execution process, it is determined whether the current user or role has the authority to decrypt the data. If so, the secret key is returned. After the user obtains the secret key, he or she can decrypt the data and access the plaintext data. This solution uses the RSA encryption algorithm, which is currently the most influential public key encryption algorithm and is generally considered to be one of the best public key schemes. RSA is the first algorithm that can be used for both encryption and digital signatures. It can resist all known cryptographic attacks and has been recommended by ISO as a public key data encryption standard.

[0049] Through data masking, restricted access, and data encryption and decryption methods, the security of data use is guaranteed, making data use manageable and controllable.

[0050] Furthermore, the RSA algorithm is used as the encryption algorithm, and blockchain technology is introduced to store encrypted data and secret keys separately. The encrypted data is stored on the disk, and the secret keys use the decentralized storage method in blockchain technology. The secret keys are not stored on a single server, but are distributed on multiple nodes in the network.

[0051] Simple operation and easy to use.

[0052] The present invention also provides an industrial data security management system based on a data security platform, comprising a processing unit, wherein the processing unit executes the method of the present invention to perform industrial data security management.

[0053] The system has a simple structure and provides a solid technical foundation for enterprises to achieve efficient, secure and flexible data management. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 It is a flow chart of the industrial data security management method based on the data security platform of the present invention;

[0055] Figure 2 It is a schematic diagram of sensitive data identification code of the industrial data security management method based on the data security platform of the present invention;

[0056] Figure 3 It is a flow chart of NLP text extraction of unstructured data in the industrial data security management method based on the data security platform of the present invention;

[0057] Figure 4 It is a schematic diagram of the dynamic decryption result of the industrial data security management method based on the data security platform of the present invention. DETAILED DESCRIPTION

[0058] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.

[0059] In the description of the present invention, it is necessary to understand that the terms "longitudinal", "lateral", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating the orientation or position relationship, are based on the orientation or position relationship shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention.

[0060] In the description of the present invention, unless otherwise specified and limited, it should be noted that the terms "installed", "connected" and "connected" should be understood in a broad sense. For example, it can be a mechanical connection or an electrical connection, or it can be the internal connection between two components. It can be a direct connection or an indirect connection through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to the specific circumstances.

[0061] The present invention discloses an industrial data security management method based on a data security platform, which can protect the security of industrial data by collecting industrial data and integrating data security management tools and methods. Figure 1 As shown, the industrial data security management method based on the data security platform includes the following steps:

[0062] Collect multi-source heterogeneous data from industrial enterprises, including equipment basic data, equipment operation data, and business data, and perform pre-processing;

[0063] Dynamic desensitization and data encryption are used to securely manage multi-source heterogeneous data of industrial enterprises;

[0064] The data storage area of ​​the data security platform is divided into a general area, a sensitive area, and an encrypted area. Regular expressions, machine learning, and natural language processing (NLP) intelligent algorithms are used to detect the types of multi-source heterogeneous data of industrial enterprises. If the data is regular data, it is stored in the general area. If the data is sensitive data, it is stored in the sensitive area. If the data is data to be encrypted, it is desensitized and encrypted and then stored in the encrypted area. When using it, it needs to be decrypted with a secret key.

[0065] After the data is securely stored, it is necessary to provide services to the outside world in a unified manner and build data application service capabilities.

[0066] In a preferred embodiment of the present invention, the method for preprocessing the collected multi-source heterogeneous data of industrial enterprises is:

[0067] Collect and clean multi-source heterogeneous data of industrial enterprises, delete duplicate and redundant data, complete missing parts, and correct or delete incorrect data;

[0068] Perform data conversion, specifically:

[0069] Use SQL or Python to perform data conversion through scripts, converting data from one format or structure to another format or structure to achieve the basic conditions for identifying sensitive data and privacy data. ;

[0070] Data cleaning methods include the following methods:

[0071] (1) Duplicate data: deletion method;

[0072] (2) Missing data: ① Deletion method: Deletion method refers to directly deleting missing observations when the proportion of missing observations is very low (such as less than 10%), or directly deleting these missing variables when the missing proportion of certain variables is very high (such as more than 90%); ② Replacement method: Replacement method refers to directly replacing those missing values ​​with a certain constant. For example, for continuous variables, the mean or median can be used for replacement, and for discrete variables, the mode can be used for replacement; ③ Interpolation method: Interpolation method refers to predicting missing values ​​based on other non-missing variables or observations. Common interpolation methods include regression interpolation, K nearest neighbor interpolation, Lagrange interpolation, etc.

[0073] (3) Outlier processing: Outliers refer to data that are far from normal values, that is, "out of place" data. ① Delete outliers - if they are obviously abnormal and the number is small, they can be deleted directly; ② Do not process - if the algorithm is not sensitive to outliers, then it can be ignored, but if the algorithm is sensitive to outliers, it is best not to use this method, such as some algorithms based on distance calculation, including kmeans, knn, etc.; ③ Mean value replacement - small loss of information, simple and efficient; ④ Treat as missing values ​​- can be processed in the same way as missing values.

[0074] The above data cleaning methods will be used in this solution.

[0075] Data conversion method:

[0076] (1) Scripting: Perform data transformations through scripting using SQL or Python to write code to extract and transform data.

[0077] (2) ETL Tools: ETL (Extract, Transform, Load) tools can take away most of the pain of scripting transformations by automating the process.

[0078] This solution adopts a scripting approach, using SQL or Python to perform data conversion through scripts, converting data from one format or structure to another format or structure to achieve the basic conditions for identifying sensitive data and privacy data.

[0079] In a preferred solution of the present invention, the visible range of sensitive data is preset for different users, and the restricted user roles are determined;

[0080] like Figure 2 As shown, regular expressions are used to identify sensitive data structured as ID card numbers and mobile phone numbers;

[0081] like Figure 3 As shown, machine learning and natural language processing (NLP) intelligent algorithms are used to automatically identify and classify unstructured data such as text and images;

[0082] Adopt a dynamic data desensitization solution to desensitize the structured data in the sensitive area;

[0083] If the data is identified as encrypted data, the encrypted data and the secret key are stored in the encrypted area through an encryption algorithm. Preferably, the RSA algorithm is used as the encryption algorithm, and the blockchain technology is introduced to store the encrypted data and the secret key separately. The encrypted data is stored on the disk, and the secret key adopts the decentralized storage method in the blockchain technology. The secret key is not stored on a single server but distributed on multiple nodes in the network.

[0084] In this solution, the RSA algorithm is used for encryption. The RSA encryption process includes the following steps:

[0085] 1. Key generation:

[0086] Randomly select two unequal prime numbers p and q.

[0087] Calculate the product n of p and q, that is, n = p×q.

[0088] Calculate the Euler's totient function φ(n) of n according to the formula: φ(n) = (p - 1)(q - 1).

[0089] Randomly select an integer e, with the condition that 1 < e < φ(n) and e is relatively prime to φ(n).

[0090] Calculate the modular multiplicative inverse d of e with respect to φ(n), that is, find an integer d such that the remainder of ed divided by φ(n) is 1.

[0091] 2. Encryption process:

[0092] Use the public key (n, e) to encrypt the plaintext to obtain the ciphertext.

[0093] In a preferred solution of the present invention, the sensitive area data to be opened is对外开放 in the form of an API. During the execution of the data request, it is judged whether the current user and role have the permission to access the original data. If there is no permission, the SQL rewriting technology is adopted to desensitize the sensitive data without changing the original data in the database.

[0094] As Figure 4 shown, the original data ID is 210123763434460027. Through dynamic desensitization, the data queried by the user is 210***********0027;

[0095] The encrypted area data to be opened is对外开放 in the form of an API. During the execution of the data request, it is judged whether the current user and role have the permission to decrypt the data. If there is permission, the secret key is returned. After the user obtains the secret key, the data is decrypted to access the plaintext data. The decryption steps are as follows:

[0096] 1. Key generation:

[0097] Randomly select two unequal prime numbers p and q.

[0098] Calculate the product n of p and q, i.e., n = p×q.

[0099] Calculate the Euler's totient function φ(n) of n according to the formula: φ(n) = (p - 1)(q - 1).

[0100] Randomly select an integer e, with the conditions that 1 < e < φ(n) and e is relatively prime to φ(n).

[0101] Calculate the modular multiplicative inverse d of e with respect to φ(n), i.e., find an integer d such that the remainder of ed divided by φ(n) is 1.

[0102] 2. Decryption process:

[0103] Use the private key (n, d) to decrypt the ciphertext and recover the plaintext.

[0104] In a preferred embodiment of the present invention, for different users, the visible range of sensitive data is preset, and the method for determining restricted user roles is as follows:

[0105] Adopt a role-based access control (RBAC) system to ensure that users can only access the data permitted by their roles;

[0106] For data with different sensitivity levels, authorize it to different departments and positions, including read, write, and modify permissions;

[0107] The authorization policy is:

[0108] (1) Basic user roles:

[0109] Ordinary employees: Can only access low-sensitivity data directly related to their own work;

[0110] Department heads: Can access all low-sensitivity data of their own departments, as well as some medium-sensitivity data;

[0111] Senior management: Can access the data of the entire company, but special authorization may be required for highly sensitive data;

[0112] (2) Restricted user roles:

[0113] Data administrators: Responsible for the management and maintenance of data, but do not directly access the content of sensitive data, but manage the access rights to data;

[0114] Compliance and auditors: Responsible for supervising the compliant use of data and auditing, can access all access records of data, but cannot directly view the data content;

[0115] Restricted access employees: employees who need to occasionally access certain sensitive data due to work needs and need special authorization and have limited access rights;

[0116] (3) Highly sensitive data access roles:

[0117] Highly Sensitive Data Access: Limited to a small number of specific personnel who need access to highly sensitive data to support decision-making or compliance work.

[0118] In a preferred embodiment of the present invention, a method for desensitizing structured data in a sensitive area by adopting a dynamic data desensitization scheme is as follows:

[0119] Dynamic decryption technology is used to match desensitization rules according to user identity information and the data to be accessed; desensitized data is output to ensure the invisibility of the original data;

[0120] The stored sensitive data needs to be provided with unified external services to build data application service capabilities, specifically:

[0121] The sensitive data that needs to be opened is made public in the form of API. During the data request execution process, it is determined whether the current user or role has the authority to access the original data. If not, SQL rewriting technology is used to desensitize the sensitive data without changing the original data in the database. For example, if the original data is 123456, the data queried by the user is 123**6 through dynamic desensitization.

[0122] For unstructured data, since it is impossible to use replacement or masking desensitization methods, it is necessary to restrict unauthorized users and roles from accessing and using sensitive unstructured data;

[0123] The data in the encrypted area that needs to be opened is opened to the public in the form of an API. During the execution of the data request, it is determined whether the current user or role has the authority to decrypt the data. If so, the secret key is returned. After the user obtains the secret key, he or she can decrypt the data and access the plaintext data.

[0124] The data in the encryption area that needs to be opened is made public in the form of an API. During the data request execution process, it is determined whether the current user or role has the authority to decrypt the data. If so, the secret key is returned. After the user obtains the secret key, he or she can decrypt the data and access the plaintext data. This solution uses the RSA encryption algorithm, which is currently the most influential public key encryption algorithm and is generally considered to be one of the best public key schemes. RSA is the first algorithm that can be used for both encryption and digital signatures. It can resist all known cryptographic attacks and has been recommended by ISO as a public key data encryption standard.

[0125] Through data masking, restricted access, and data encryption and decryption methods, the security of data use is guaranteed, making data use manageable and controllable.

[0126] The present invention also provides an industrial data security management system based on a data security platform, comprising a processing unit, and the processing unit executes the method of the present invention to perform industrial data security management.

[0127] This solution innovatively adopts the method of building a separate database and physically isolating the core sensitive information for storage and management, ensuring the security and controllability of the core sensitive data.

[0128] This solution uses regular expressions, machine learning, and natural language processing (NLP) intelligent algorithms to efficiently and conveniently identify sensitive data, reduce the workload of manual classification and labeling, greatly reduce labor costs, and improve production efficiency.

[0129] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0130] Although the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

Claims

1. An industrial data security management method based on a data security platform, characterized in that: The steps include: Collect multi-source heterogeneous data from industrial enterprises, including equipment basic data, equipment operation data, and business data, and perform pre-processing; Dynamic desensitization and data encryption are used to securely manage multi-source heterogeneous data of industrial enterprises; The data storage area of ​​the data security platform is divided into a general area, a sensitive area, and an encrypted area. The types of multi-source heterogeneous data of industrial enterprises are detected through regular expressions, machine learning, and natural language processing (NLP) intelligent algorithms. If the data is regular data, it is stored in the general area. If the data is sensitive data, it is stored in the sensitive area. If the data is data to be encrypted, it is desensitized and encrypted and stored in the encrypted area. When using it, it needs to be decrypted with a secret key. After the data is securely stored, it is necessary to provide services to the outside world in a unified manner and build data application service capabilities.

2. The industrial data security management method based on the data security platform according to claim 1, characterized in that: The method for preprocessing the collected multi-source heterogeneous data of industrial enterprises is as follows: Collect and clean multi-source heterogeneous data of industrial enterprises, delete duplicate and redundant data, complete missing parts, and correct or delete incorrect data; Perform data conversion, specifically: Use SQL or Python to perform data conversion through scripts to convert data from one format or structure to another format or structure to achieve the basic conditions for identifying sensitive data and privacy data.

3. The industrial data security management method based on the data security platform according to claim 1, characterized in that: Preset the visible scope of sensitive data for different users and determine restricted user roles; Use regular expressions to identify sensitive data such as ID card numbers and mobile phone numbers; Use machine learning and natural language processing (NLP) intelligent algorithms to automatically identify and classify unstructured data such as text and images; Adopt dynamic data desensitization solutions to desensitize structured data in sensitive areas; If the data is identified as encrypted data, the encrypted data and the secret key are stored in the encryption area through the encryption algorithm.

4. The industrial data security management method based on the data security platform according to claim 3 is characterized in that: The method of presetting the visible scope of sensitive data for different users and determining the restricted user roles is as follows: Use a role-based access control (RBAC) system to ensure that users can only access data permitted by their roles; Authorize different departments and positions to read, write, and modify data of different sensitivities; The authorization policy is: (1) Basic user roles: Ordinary employees: can only access low-sensitivity data directly related to their work; Department head: can access all low-sensitivity data of the department, as well as some medium-sensitivity data; Senior management: can access company-wide data, but highly sensitive data may require special authorization; (2) Restricted user roles: Data administrator: responsible for the management and maintenance of data, but does not directly access sensitive data content, but manages data access permissions; Compliance and Auditors: Responsible for supervising the compliance use and auditing of data. They can access the access records of all data but cannot directly view the data content. Restricted access employees: employees who need to occasionally access certain sensitive data due to work needs and need special authorization and have limited access rights; (3) Highly sensitive data access roles: Highly Sensitive Data Access: Limited to a small number of specific personnel who need access to highly sensitive data to support decision-making or compliance work.

5. The industrial data security management method based on the data security platform according to claim 3, characterized in that: The method of using dynamic data desensitization scheme to desensitize structured data in sensitive areas is: Dynamic decryption technology is used to match desensitization rules according to user identity information and the data to be accessed; desensitized data is output to ensure the invisibility of the original data; The stored sensitive data needs to be provided with unified external services to build data application service capabilities, specifically: The sensitive data that needs to be opened is made public in the form of API. During the data request execution process, it is determined whether the current user or role has the authority to access the original data. If not, SQL rewriting technology is used to desensitize the sensitive data without changing the original data in the database. For unstructured data, since it is impossible to use replacement or masking desensitization methods, it is necessary to restrict unauthorized users and roles from accessing and using sensitive unstructured data; The data in the encrypted area that needs to be opened is opened to the public in the form of an API. During the execution of the data request, it is determined whether the current user or role has the authority to decrypt the data. If so, the secret key is returned. After the user obtains the secret key, he or she can decrypt the data and access the plaintext data.

6. The industrial data security management method based on the data security platform according to claim 3, characterized in that: The RSA algorithm is used as the encryption algorithm, and the blockchain technology is introduced to store encrypted data and secret keys separately. The encrypted data is stored on the disk, and the secret keys adopt the decentralized storage method in the blockchain technology. The secret keys are not stored on a single server, but distributed on multiple nodes in the network.

7. An industrial data security management system based on a data security platform, characterized in that: The invention comprises a processing unit, wherein the processing unit executes the method according to any one of claims 1 to 6 to perform industrial data security management.

Images