An industrial Internet encryption method and system based on blockchain evidence storage

Abstract

The present invention discloses an industrial Internet encryption method and system based on blockchain evidence storage, which relates to the fields of information security and blockchain technology, and includes the following steps: when the industrial Internet system generates industrial data to be encrypted, it synchronously generates identification information that is strongly bound to the content for the industrial data. The present invention establishes a strong binding relationship between encrypted data and blockchain evidence storage by embedding dynamic device fingerprints and multi-dimensional feature information in the encrypted data, combining double encryption with a joint hash mechanism, and significantly improving the data tamper-proof and anti-counterfeiting capabilities. The adoption of block weighting and two-way reconstruction verification strategies enhances the system's sensitivity and detection capabilities to minor tampering and local forgery, and can effectively protect the integrity, authenticity and high credibility of data in the industrial Internet in complex industrial environments, solving the security risks of decoupling evidence from data in the existing technology.

Description

Technical Field

[0001] The present invention relates to the field of information security and blockchain technology, and specifically to an industrial Internet encryption method and system based on blockchain evidence storage. Background Art

[0002] Industrial Internet encryption based on blockchain evidence refers to the integration of blockchain technology in the industrial Internet environment to achieve security protection and trusted evidence of industrial data during encrypted transmission and storage. Its core concept is that when various devices, systems, and platforms in the industrial Internet interact with data, they first use encryption algorithms (such as symmetric or asymmetric encryption) to encrypt the data to ensure the confidentiality and integrity of the data during transmission and storage. At the same time, important characteristic information of the data (such as hash value, timestamp, signature) is uploaded to the chain as evidence information. With the help of the tamper-proof and traceable characteristics of the blockchain, credible records and anti-counterfeiting evidence of industrial data behavior can be achieved. This method can effectively prevent security risks such as tampering, forgery, and repudiation of industrial data during transmission, storage, and use, thereby improving data security and credibility in the industrial Internet environment.

[0003] The existing technology has the following deficiencies: In the existing technology, in the industrial Internet encryption process based on blockchain evidence, there is a common risk of "decoupling of blockchain evidence information from the actual encrypted data", that is, the evidence information cannot form a strong binding relationship with the actual encrypted data. In actual applications, evidence usually only records the hash value or summary of the encrypted data. However, if the encrypted data is replaced or tampered with during storage, transmission or system integration, even if the tampered data is recalculated with the hash value and uploaded to the chain, it is difficult for the system to detect data anomalies in time. This is especially easy to carry out when the attacker has partial evidence or on-chain data interfaces. This decoupling problem will directly threaten the integrity and credibility of industrial data, and may cause key control instructions, production process parameters or equipment configurations to be tampered with without detection, thereby causing production failures, equipment damage and even major safety accidents. For industrial Internet systems with high security requirements, the impact of this problem is extremely serious.

[0004] The above information disclosed in this Background section is only for enhancement of understanding of the background of the present disclosure and therefore it may contain information that does not form the prior art that is already known to a person of ordinary skill in the art. Summary of the Invention

[0005] The purpose of the present invention is to provide an industrial Internet encryption method and system based on blockchain evidence storage. By embedding dynamic device fingerprints and multi-dimensional feature information in encrypted data, combined with double encryption and joint hashing mechanisms, a strong binding relationship between encrypted data and blockchain evidence storage is established, significantly improving the data's tamper-proof and anti-counterfeiting capabilities. The use of block weighting and bidirectional reconstruction verification strategies enhances the system's sensitivity and detection capabilities to minor tampering and local forgery. It can effectively protect the integrity, authenticity, and high reliability of data in the industrial Internet in complex industrial environments, solving the security risks of decoupling evidence storage from data in the prior art, and addressing the problems in the above-mentioned background technology.

[0006] In order to achieve the above objectives, the present invention provides the following technical solution: an industrial Internet encryption method based on blockchain evidence storage, comprising the following steps:

[0007] When the Industrial Internet system generates industrial data to be encrypted, it will simultaneously generate identification information that is strongly bound to the content of the industrial data. The identification information includes but is not limited to data fingerprint information, device fingerprint information, generation timestamp, and data usage environment information.

[0008] The industrial data is encrypted to obtain encrypted data; at the same time, the identification information is embedded in the metadata of the encrypted data so that the identification information and the encrypted data are bound one-to-one;

[0009] Performing joint hashing on the encrypted data and the embedded identification information to generate a joint hash value;

[0010] The joint hash value is stored on the blockchain through the blockchain evidence module to form a blockchain evidence record, and the integrity of the evidence data, the generation device, and the time consistency are verified through the smart contract;

[0011] During data transmission and storage, consistency verification is performed between the on-chain joint hash value and the joint hash value recalculated from the encrypted data and its identification information received on the receiving side to ensure that the received data has not been tampered with;

[0012] Before using the data, verify whether the identification information in the encrypted data is consistent with the identification information bound in the blockchain evidence record, and confirm that the binding relationship between the encrypted data and the evidence is complete and valid. If there is inconsistency, block data decryption and use.

[0013] Preferably, the data fingerprint information in the identification information is generated by a combination of multiple features, including a multi-dimensional feature hash of the data content, a unique device identifier of the data generating device, operating system environment information, and timestamp information. The data fingerprint generated by the fusion of multi-dimensional features can uniquely characterize the industrial data itself and its generation environment, thereby improving the binding accuracy of data and evidence, and preventing misjudgment of homologous data due to environmental differences.

[0014] Preferably, a double encryption mechanism is adopted during the encryption process of encrypted data. The first layer is symmetric encryption to ensure data transmission efficiency, and the second layer is asymmetric encryption to encrypt the metadata part of the embedded identification information to ensure the security of data fingerprints and metadata in an open environment. Even if the encrypted part of the main data is cracked, the attacker cannot obtain the complete identification information, thereby ensuring the consistency of the evidence and the integrity of the data.

[0015] Preferably, before the joint hash value is generated, the encrypted data and its identification information are preprocessed through a Merkle tree structure to form a Merkle tree root node containing the data block hash and the identification information hash, and the root node hash value is used as the input for subsequent joint hashing, thereby further improving the immutability of the hash result and the high-intensity consistency verification capability, and effectively resisting attacks in which the identification information is tampered with individually.

[0016] Preferably, the joint hash value adopts an improved weighted multi-level hash generation algorithm, and the specific steps are as follows:

[0017] Divide the encrypted data into n data blocks and calculate the hash value of each block as follows:

[0018] H i =SHA256(D i )

[0019] , where D i It is the data block, which means the i-th data block after the encrypted data is divided. The purpose of the block is to improve the refinement of the hash and prevent tamperers from escaping verification by simply tampering with a small amount of data. i is the hash value of the i-th data block, that is, the i-th block D after the original encrypted data is divided i Use the SHA256 algorithm to hash the i-th data block and generate a unique hash value for the block;

[0020] Blocks can be reasonably divided according to factors such as data structure, functional classification, information sensitivity or data generation time to improve the sophistication and flexibility of the hashing process;

[0021] Divide the identification information into m feature items, and calculate the hash value of each feature item as follows:

[0022] F j =SHA256(I j )

[0023] , where I j is the identification information feature item, F j is the hash value of the feature item. Each identification feature item is hashed with SHA256 to generate a fixed-length feature hash.j The hash value of the jth identification information feature item, i.e., the jth identification information feature I associated with the data j The result of a separate hash calculation, SHA256 is a hash function;

[0024] The feature items shall at least include data fingerprint, device unique identifier, operating system environment information, timestamp information and security policy identifier to ensure the comprehensiveness and accuracy of the evidence information;

[0025] Perform weighted aggregation on all block hash values ​​to obtain the intermediate hash. The calculation expression is as follows:

[0026]

[0027] , where w i is the weight coefficient of the i-th data block, H M is the weighted aggregate value of the block hash, and n is the total number of data blocks

[0028] The weights are assigned according to the importance, sensitivity and core degree of the data in the industrial control process, and satisfy ∑w i =1;

[0029] Perform weighted aggregation on all feature hash values ​​to obtain the identity hash. The calculation expression is as follows:

[0030]

[0031] , where v j is the weighted coefficient of the jth identification information feature item, m is the total number of identification information feature items, F M It is the weighted aggregate value of the feature hash, which is the weighted comprehensive hash result of all feature items and can represent the integrity characteristics of the environment and source information of the entire encrypted data;

[0032] The weight is determined based on the strength of each feature in integrity verification and security protection, and satisfies ∑v j =1;

[0033] The intermediate hash and the identity hash are aggregated to generate the final joint hash. The calculation expression is as follows:

[0034] J H =SHA512(H M ||F M )

[0035] , where J H It is the final joint hash value. As the core hash for data on-chain storage, it fully expresses the content integrity and environmental binding of industrial data. SHA512 is a hash function.

[0036] Joint hashing has the dual properties of data block integrity and identification information consistency;

[0037] Combine the hash value and the weighted coefficient w of the data block i and the weighted coefficient v of the identification information feature item j Together, they are uploaded to the chain as evidence data, and the hash generation process is fully restored during subsequent verification, fundamentally improving the binding strength and non-tamperability of blockchain evidence and data.

[0038] Preferably, the smart contract automatically performs consistency checks during the evidence storage and verification stage, including cross-verification of the generation timestamp, device fingerprint, operating environment in the encrypted data and the on-chain environmental information in the blockchain network, to ensure that the encrypted data is generated in a trusted generation environment. If there is a timestamp anomaly, device fingerprint mismatch, or environmental information contradiction, the evidence storage and subsequent data usage process will be directly terminated to ensure the authenticity of the blockchain evidence information and the credibility of the data.

[0039] Preferably, the data receiving end completes the consistency check through a double verification mechanism. The first verification is the integrity verification based on the joint hash value, and the second verification is the comparison verification based on the identification information of the blockchain memory certificate and the identification information extracted from the decrypted data. Only when both verifications are passed, the data is allowed to enter the decryption and subsequent business processing flow, thereby effectively preventing the occurrence of "fake evidence and real tampering" attacks in the industrial Internet scenario.

[0040] Preferably, when the recipient discovers verification inconsistencies, an abnormal alarm and event chain process is immediately triggered, automatically recording abnormal data packets, abnormal device IDs, data reception time, and detailed reasons for verification failures. Automatic evidence collection and alarms are achieved through smart contracts to ensure that data security incidents can be quickly and accurately traced and responded to.

[0041] Preferably, the decryption verification process adopts a two-way reconstruction verification mechanism, and the specific steps are as follows:

[0042] Extract the encrypted data block D from the received data i 'And the process of extracting the characteristic items of the identification information embedded in the metadata uses parsing and parsing integrity detection to ensure that the receiving side can correctly obtain all the verification information;

[0043] Calculate the block hash and identification feature hash in the received data respectively. The calculation expressions are as follows:

[0044]

[0045] , where D i ' is the i-th data block extracted from the received encrypted data by the receiving side, H i' is the block hash value calculated for the i-th data block received, F j ' is the characteristic hash value calculated for the j-th identification information characteristic item received;

[0046] De-noising and format standardization are performed on the extraction process to eliminate the impact of data format differences in different environments on the consistency of hash results;

[0047] Based on the received hash value, calculate the block weighted hash and identity weighted hash. The calculation expression is as follows:

[0048]

[0049] , where H M ' is the weighted hash value of the receiving side block, F M ' is the weighted hash value of the feature on the receiving side;

[0050] The weighting factor remains exactly the same as the original encryption side, ensuring the equivalence of the verification process;

[0051] The joint hash calculation on the receiving side is as follows:

[0052] J H '=SHA512(H M '|F M ')

[0053] , where J H ' is the joint hash value calculated by the receiving side (the party receiving the data), and the joint hash value J stored on the blockchain H Perform one-to-one comparisons. If the verification results are consistent, the data integrity and consistency are preliminarily determined;

[0054] The identification information feature items extracted by the receiving side are further compared item by item and level by level with the original identification information stored in the blockchain to ensure that the data environment information, generation time, and key information of the device fingerprint are completely consistent;

[0055] If the joint hash and identification information are consistent, the data is considered to have passed verification, and subsequent decryption and business processing are allowed;

[0056] If there is any inconsistency in the joint hash, the decryption process will be immediately interrupted, triggering an abnormal alarm and security incident handling process to ensure sufficient response and handling capabilities when facing active attacks or data tampering.

[0057] Preferably, an industrial Internet encryption system based on blockchain evidence storage includes an identification information generation module, an encryption and identification binding module, a joint hash generation module, a blockchain evidence storage and consistency verification module, a joint hash consistency verification module, and a decryption and identification integrity verification module:

[0058] Identification information generation module: When the industrial Internet system generates industrial data to be encrypted, it will synchronously generate identification information that is strongly bound to the content of the industrial data. The identification information includes but is not limited to data fingerprint information, device fingerprint information, generation timestamp, and data usage environment information;

[0059] The encryption and identification binding module encrypts the industrial data to obtain encrypted data; at the same time, the identification information is embedded in the metadata of the encrypted data, so that the identification information and the encrypted data are bound one by one;

[0060] A joint hash generation module performs a joint hash process on the encrypted data and its embedded identification information to generate a joint hash value;

[0061] The blockchain evidence storage and consistency verification module stores the joint hash value on the blockchain through the blockchain evidence storage module to form a blockchain evidence record, and verifies the integrity of the evidence data, the generation device, and the time consistency through the smart contract;

[0062] The joint hash consistency verification module performs consistency verification during data transmission and storage by comparing the on-chain joint hash value with the joint hash value recalculated from the encrypted data and its identification information received by the receiving side, ensuring that the received data has not been tampered with.

[0063] The decryption and identification integrity verification module verifies whether the identification information in the encrypted data is consistent with the identification information bound in the blockchain evidence record before the data is used, and confirms that the binding relationship between the encrypted data and the evidence is complete and valid. If there is any inconsistency, the data decryption and use will be blocked.

[0064] In the above technical solution, the technical effects and advantages provided by the present invention are:

[0065] The present invention establishes a strong binding relationship between encrypted data and blockchain evidence by embedding dynamic device fingerprints and multi-dimensional data feature information in encrypted data, which can effectively solve the problem of decoupling evidence information from actual encrypted data in the prior art. By integrating the hardware characteristics, environmental information, timestamp and data characteristics of the device and completing the embedding during the encryption stage, a high degree of consistency between the data and its generation environment is guaranteed. Even if an attacker obtains the encrypted data, he cannot complete the forged effective evidence without knowing or being able to forge the device fingerprint and environmental characteristics, which significantly improves the anti-counterfeiting ability of the evidence, avoids the security risk of data being able to pass evidence verification after forgery, and improves the credibility and security of data in the industrial Internet environment.

[0066] The present invention introduces a double encryption and joint hash mechanism in the encryption and evidence storage process, which can effectively improve the system's detection and protection capabilities against data tampering and forgery. By using symmetric encryption and asymmetric encryption for industrial data content and identification information respectively, and combining the Merkle tree structure with weighted aggregation to generate a joint hash, the evidence information has higher attack resistance and verifiability. The receiving end ensures that the data and identification information are complete, consistent and trustworthy throughout the life cycle through double decryption and reconstruction verification. Compared with traditional solutions that only rely on a single hash or simple evidence storage, the present invention can more finely capture fine-grained tampering behaviors, including complex attacks such as local field tampering, instruction replay, and device environment forgery, to ensure the business security of industrial control systems.

[0067] The present invention effectively improves the sensitivity to partial data tampering and the ability to perform multi-dimensional security verification in complex industrial scenarios by designing a block weighting and bidirectional reconstruction verification mechanism. The block weighting mechanism allows the assignment of differentiated weights to fields of different importance in industrial data and identification information, and can provide higher security for key fields such as control instructions, equipment fingerprints, process parameters, etc. At the same time, the bidirectional reconstruction mechanism ensures that the receiving end and the blockchain evidence storage end can fully reproduce the encryption, evidence storage and hash calculation processes during the verification process, eliminating the risk of forgery under one-way hash verification. Even if the attacker only makes minor modifications to some low-sensitivity fields, it can be detected in time through the joint hash difference, ensuring that the system can still guarantee the integrity, authenticity and high reliability of the data in the face of complex attacks and abnormal situations. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction to the drawings required for use in the embodiments will be given below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0069] Figure 1 This is a flow chart of an industrial Internet encryption method based on blockchain evidence storage according to the present invention.

[0070] Figure 2 This is a module schematic diagram of an industrial Internet encryption system based on blockchain evidence storage in the present invention.

[0071] Figure 3 This is a system mind map of the industrial Internet encryption system based on blockchain evidence storage in the present invention.

[0072] Figure 4 This is a mind map of the method of industrial Internet encryption method based on blockchain evidence storage in the present invention. DETAILED DESCRIPTION

[0073] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these example embodiments are provided so that the description of this disclosure will be thorough and complete and will fully convey the concepts of the example embodiments to those skilled in the art.

[0074] The present invention provides Figure 1 The industrial Internet encryption method based on blockchain evidence storage shown includes the following steps:

[0075] When the Industrial Internet system generates industrial data to be encrypted, it will simultaneously generate identification information that is strongly bound to the content of the industrial data. The identification information includes but is not limited to data fingerprint information, device fingerprint information, generation timestamp, and data usage environment information.

[0076] The data fingerprint information in the identification information is generated by a combination of multiple features, including the multi-dimensional feature hash of the data content, the device unique identifier of the data generating device, the operating system environment information and timestamp information. The data fingerprint generated by the fusion of multi-dimensional features can uniquely represent the industrial data itself and its generation environment, improve the binding accuracy of data and evidence, and prevent the misjudgment of homologous data due to environmental differences.

[0077] The industrial data is encrypted to obtain encrypted data; at the same time, the identification information is embedded in the metadata of the encrypted data so that the identification information and the encrypted data are bound one-to-one;

[0078] During the encryption process of encrypted data, a double encryption mechanism is adopted. The first layer is symmetric encryption to ensure data transmission efficiency, and the second layer is asymmetric encryption to encrypt the metadata part of the embedded identification information to ensure the security of data fingerprints and metadata in an open environment. Even if the encrypted part of the main data is cracked, the attacker cannot obtain the complete identification information, thereby ensuring the consistency of the evidence and data integrity.

[0079] Performing joint hashing on the encrypted data and the embedded identification information to generate a joint hash value;

[0080] Before the joint hash value is generated, the encrypted data and its identification information are preprocessed through the Merkle tree structure to form a Merkle tree root node containing the data block hash and the identification information hash. The root node hash value is used as the input for subsequent joint hashes, further improving the immutability of the hash result and the high-strength consistency verification capability, effectively resisting attacks in which the identification information is tampered with individually.

[0081] The joint hash value adopts an improved weighted multi-level hash generation algorithm. The specific steps are as follows:

[0082] Divide the encrypted data into n data blocks and calculate the hash value of each block as follows:

[0083] H i =SHA256(D i )

[0084] , where D i It is the data block, which means the i-th data block after the encrypted data is divided. The purpose of the block is to improve the refinement of the hash and prevent tamperers from escaping verification by simply tampering with a small amount of data. i is the hash value of the i-th data block, that is, the i-th block D after the original encrypted data is divided i Use the SHA256 algorithm to hash the i-th data block and generate a unique hash value for the block;

[0085] Blocks can be reasonably divided according to factors such as data structure, functional classification, information sensitivity or data generation time to improve the sophistication and flexibility of the hashing process;

[0086] Divide the identification information into m feature items, and calculate the hash value of each feature item as follows:

[0087] F j =SHA256(I j )

[0088] , where I j is the identification information feature item, F j is the hash value of the feature item. Each identification feature item is hashed with SHA256 to generate a fixed-length feature hash. j The hash value of the jth identification information feature item, i.e., the jth identification information feature I associated with the data j The result of a separate hash calculation, SHA256 is a hash function;

[0089] The feature items shall at least include data fingerprint, device unique identifier, operating system environment information, timestamp information and security policy identifier to ensure the comprehensiveness and accuracy of the evidence information;

[0090] Perform weighted aggregation on all block hash values ​​to obtain the intermediate hash. The calculation expression is as follows:

[0091]

[0092] , where w i is the weight coefficient of the i-th data block, H M is the weighted aggregate value of the block hash, and n is the total number of data blocks

[0093] The weights are assigned according to the importance, sensitivity and core degree of the data in the industrial control process, and satisfy ∑w i =1;

[0094] Perform weighted aggregation on all feature hash values ​​to obtain the identity hash. The calculation expression is as follows:

[0095]

[0096] , where v j is the weighted coefficient of the jth identification information feature item, m is the total number of identification information feature items, F M It is the weighted aggregate value of the feature hash, which is the weighted comprehensive hash result of all feature items and can represent the integrity characteristics of the environment and source information of the entire encrypted data;

[0097] The weight is determined based on the strength of each feature in integrity verification and security protection, and satisfies ∑v j =1;

[0098] The intermediate hash and the identity hash are aggregated to generate the final joint hash. The calculation expression is as follows:

[0099] J H =SHA512(H M ‖F M )

[0100] , where J H It is the final joint hash value. As the core hash for data on-chain storage, it fully expresses the content integrity and environmental binding of industrial data. SHA512 is a hash function.

[0101] Joint hashing has the dual properties of data block integrity and identification information consistency;

[0102] Combine the hash value and the weighted coefficient w of the data block i and the weighted coefficient v of the identification information feature item j Together, they are uploaded to the chain as evidence data, and the hash generation process is fully restored during subsequent verification, fundamentally improving the binding strength and non-tamperability of blockchain evidence and data.

[0103] The joint hash value is stored on the blockchain through the blockchain evidence module to form a blockchain evidence record, and the integrity of the evidence data, the generation device, and the time consistency are verified through the smart contract;

[0104] During the evidence storage and verification stage, the smart contract automatically performs consistency checks, including cross-verification of the generation timestamp, device fingerprint, operating environment in the encrypted data and the on-chain environmental information in the blockchain network, to ensure that the encrypted data is generated in a trusted generation environment. If there is a timestamp anomaly, device fingerprint mismatch, or environmental information contradiction, the evidence storage and subsequent data usage process will be directly terminated to ensure the authenticity of the blockchain evidence information and the credibility of the data.

[0105] During data transmission and storage, consistency verification is performed between the on-chain joint hash value and the joint hash value recalculated from the encrypted data and its identification information received on the receiving side to ensure that the received data has not been tampered with;

[0106] The data receiving end completes the consistency check through a double verification mechanism. The first verification is the integrity verification based on the joint hash value, and the second verification is the comparison verification based on the identification information of the blockchain memory certificate and the identification information extracted from the decrypted data. Only when both verifications are passed, the data is allowed to enter the decryption and subsequent business processing flow, thereby effectively preventing the occurrence of "fake evidence and real tampering" attacks in the industrial Internet scenario.

[0107] Before using the data, verify whether the identification information in the encrypted data is consistent with the identification information bound to the blockchain evidence record, and confirm that the binding relationship between the encrypted data and the evidence is complete and valid. If there is any inconsistency, block the data decryption and use;

[0108] When the recipient discovers verification inconsistencies, an abnormal alarm and event chain process will be immediately triggered, automatically recording the abnormal data packet, abnormal device ID, data reception time and detailed reasons for verification failure. Automatic evidence collection and alarm will be achieved through smart contracts to ensure that data security incidents can be traced and responded to quickly and accurately.

[0109] The decryption verification process adopts a two-way reconstruction verification mechanism. The specific steps are as follows:

[0110] Extract the encrypted data block D from the received data i 'And the process of extracting the characteristic items of the identification information embedded in the metadata uses parsing and parsing integrity detection to ensure that the receiving side can correctly obtain all the verification information;

[0111] Calculate the block hash and identification feature hash in the received data respectively. The calculation expressions are as follows:

[0112]

[0113] , where D i ' is the i-th data block extracted from the received encrypted data by the receiving side, H i ' is the block hash value calculated for the i-th data block received, Fj ' is the characteristic hash value calculated for the j-th identification information characteristic item received;

[0114] De-noising and format standardization are performed on the extraction process to eliminate the impact of data format differences in different environments on the consistency of hash results;

[0115] Based on the received hash value, calculate the block weighted hash and identity weighted hash. The calculation expression is as follows:

[0116]

[0117] , where H M ' is the weighted hash value of the receiving side block, F M ' is the weighted hash value of the feature on the receiving side;

[0118] The weighting factor remains exactly the same as the original encryption side, ensuring the equivalence of the verification process;

[0119] The joint hash calculation on the receiving side is as follows:

[0120] J H '=SHA512(H M '|F M ')

[0121] , where J H ' is the joint hash value calculated by the receiving side (the party receiving the data), and the joint hash value J stored on the blockchain H Perform one-to-one comparisons. If the verification results are consistent, the data integrity and consistency are preliminarily determined;

[0122] The identification information feature items extracted by the receiving side are further compared item by item and level by level with the original identification information stored in the blockchain to ensure that the data environment information, generation time, and key information of the device fingerprint are completely consistent;

[0123] If the joint hash and identification information are consistent, the data is considered to have passed verification, and subsequent decryption and business processing are allowed;

[0124] If there is any inconsistency in the joint hash, the decryption process will be immediately interrupted, triggering an abnormal alarm and security incident handling process to ensure sufficient response and handling capabilities when facing active attacks or data tampering.

[0125] Implementation method one: In this implementation method, in view of the characteristics of the industrial Internet environment, such as the wide distribution of devices, complex environment, and diverse data flow, a storage and binding mechanism based on dynamic device fingerprints and multi-dimensional data features is designed. In the encrypted data generation stage, the industrial Internet system first automatically collects the dynamic fingerprint information of the device. The dynamic fingerprint information not only includes the fixed physical information of the device, such as the device's hardware serial number, MAC address, motherboard serial number, and firmware version, but also further combines the device's operating system version at the time of data generation, built-in security module version, network access environment (such as IP address, access gateway ID), current production environment code (such as production workshop number, production line ID) and high-precision timestamp and other dynamic parameters. These dynamic information can reflect the subtle changes of the device at different times and in different environments, effectively avoiding the problem that traditional static fingerprints are easily counterfeited.

[0126] After completing the fingerprint information collection, the system will extract the content features of the industrial data to be encrypted according to the business type. Content feature extraction is not only based on the hash calculation of the entire data (such as SHA-256), but also can calculate local hashes in blocks for key fields in the industrial data (such as control instructions, production parameters, and process configurations) to obtain a more granular multi-dimensional feature hash set. Subsequently, the system forms identification information by combining the dynamic device fingerprint with the data feature hash set, and embeds the identification information into the metadata structure of the encrypted data. For example, the identification information is directly used as an extension header of the encrypted data, or embedded in a specific reserved field in the encrypted data to form a one-to-one binding between the encrypted data and the identification information.

[0127] The system then uses a joint hashing mechanism to perform multiple layers of hashing on the encrypted data content and identification information, generating a joint hash value. This joint hash value is then stored on a dedicated blockchain network. Smart contracts within the blockchain automatically verify the hash structure, timestamp consistency, and device ID authenticity, ensuring the authenticity of the stored information. The on-chain record fully preserves the joint hash value, device fingerprint summary, timestamp, and operating environment summary information.

[0128] During data reception and subsequent use, the receiving device or system extracts the embedded identification information and data content from the encrypted data, recalculates the joint hash value, and compares it with the blockchain's stored value to ensure that the data has not been tampered with from generation to reception. Furthermore, the recipient can determine whether the data originated from the expected trusted device and trusted environment based on the device fingerprint, timestamp, and environmental information recorded in the blockchain's stored evidence. If verification fails, the system immediately blocks data decryption and service calls, preventing forged or tampered data from being erroneously executed.

[0129] This solution significantly enhances the ability to strongly bind encrypted data to blockchain evidence within the Industrial Internet environment, effectively resolving the issue of data and evidence being decoupled in existing technologies and ensuring data security across multiple dimensions, including integrity, authenticity, and environmental consistency. Furthermore, thanks to the use of dynamic device fingerprints, even if an attacker successfully replicates a device's static characteristics, they will be unable to forge the same dynamic fingerprint information across different time and environment, further enhancing the system's ability to resist forgery.

[0130] Implementation Method 2: This implementation method addresses the high value, high sensitivity, and high risk of data in the Industrial Internet environment. It designs an anti-counterfeiting mechanism based on double encryption and joint hashing, focusing on addressing risks such as man-in-the-middle attacks, evidence forgery, and data tampering during the transmission and storage of industrial data. This solution clearly distinguishes the security levels of "data content" and "data fingerprint information" in the system design, and uses separate encryption and verification mechanisms for different types of information to establish a more robust encryption and evidence storage system.

[0131] During specific implementation, the industrial Internet system first collects the fingerprint information and data characteristics of the device and forms complete identification information. The identification information covers the device's unique identifier (such as device ID, manufacturer code), current operating environment information (such as network environment, production area ID), data generation time, system security policy version, etc. After generating the identification information, the system performs a double encryption operation: the first encryption uses a symmetric encryption algorithm (such as AES) to encrypt the entire industrial data in a high-speed and efficient manner to ensure the encryption performance of the data during network transmission; the second encryption uses an asymmetric encryption algorithm (such as RSA or ECC) to encrypt the identification information and jointly encapsulate it with the first encrypted data to form the final encrypted data packet.

[0132] During data storage, the system extracts the jointly encapsulated encrypted data and identification information and performs multi-level hash operations on the data blocks and identification information blocks using the Merkle tree structure. By constructing a layered Merkle tree, it effectively records fine-grained data information within the stored evidence, enhancing tamper detection capabilities and preventing attackers from circumventing overall hash verification by modifying local data. Ultimately, the system uses the Merkle tree root hash as the combined hash value and stores it on-chain through the blockchain's storage module.

[0133] At the data receiving end, the receiving system first parses the encrypted data packet, sequentially completing symmetric decryption to obtain the original data and asymmetric decryption to extract the identification information. It then reconstructs the Merkle tree to calculate the root hash and compares it with the joint hash value stored on the blockchain for consistency. If verification passes, it indicates that the data has not been tampered with throughout the entire process from generation, transmission, storage, to reception. If verification fails, the system immediately blocks the use of the data and issues an alarm.

[0134] This implementation solves the security risk in the existing technology through a double encryption mechanism, in which attackers can forge or replace encrypted data, resulting in valid evidence but abnormal data. At the same time, it utilizes the layered hash mechanism of the Merkle tree to improve the precision and security of evidence and ensure a strong binding relationship between data and evidence.

[0135] Implementation method three: This implementation method innovatively adopts a block weighting and two-way reconstruction mechanism to solve the problem of decoupling industrial Internet data from blockchain evidence. It processes industrial data and its identification information in blocks, generates a joint hash through weight control, and verifies the data through two-way reconstruction at the receiving end, effectively improving the system's ability to ensure data integrity, consistency and environmental credibility.

[0136] Specifically, during the encrypted data generation phase, the system first divides the encrypted industrial data into blocks based on the characteristics of the data content. For example, the control instruction area, configuration parameter area, and status monitoring data area are divided into different data blocks. At the same time, the collected identification information is also split into multiple parts, including device fingerprints, timestamps, environmental information, security policy versions, etc., and independent feature hashes are generated for each. The system assigns preset weights to each data block and feature hash. The weights can be set based on the actual security requirements of the industrial application. For example, the control instruction area and device fingerprint items can be given higher weights to increase their influence in the joint hash.

[0137] The system then performs a weighted aggregation on the data block hash and the identification feature hash to obtain the block weighted hash value and feature weighted hash value, and then uses the hash fusion function to generate a joint hash value as the final on-chain evidence data. When storing evidence, the system synchronizes information such as the block partitioning scheme, the weight parameters of each block and feature, the joint hash value, the device fingerprint summary, and the timestamp on the chain.

[0138] At the receiving end, after receiving the encrypted data, the system first extracts the data blocks and identification features according to the same block and weighting rules, calculates the block weighted hash and feature weighted hash, respectively, and reconstructs the receiving end's joint hash value. The receiving system then compares this with the blockchain evidence. If the two are completely consistent, it proves that the data has not been tampered with throughout its lifecycle from generation to reception. At the same time, the receiving end also compares each item of extracted identification information with the identification features in the evidence to ensure that the identification information has not been forged or replaced. If the joint hash value does not match or the identification information is inconsistent, the system immediately terminates the decryption and business process and automatically reports the exception.

[0139] This implementation effectively increases the system's sensitivity to partial tampering through a block-weighted mechanism. Even if an attacker only slightly tampers with low-weight blocks or identifying information within the data, the weight aggregation will result in inconsistent joint hash values ​​and be detected. Furthermore, a bidirectional reconstruction verification mechanism ensures that the verification process fully aligns the data on the evidence chain with the received data, eliminating the common flaw of one-way evidence storage that is susceptible to forgery and significantly improving the security and credibility of encrypted evidence storage for the Industrial Internet.

[0140] The present invention establishes a strong binding relationship between encrypted data and blockchain evidence by embedding dynamic device fingerprints and multi-dimensional data feature information in encrypted data, which can effectively solve the problem of decoupling evidence information from actual encrypted data in the prior art. By integrating the hardware characteristics, environmental information, timestamp and data characteristics of the device and completing the embedding during the encryption stage, a high degree of consistency between the data and its generation environment is guaranteed. Even if an attacker obtains the encrypted data, he cannot complete the forged effective evidence without knowing or being able to forge the device fingerprint and environmental characteristics, which significantly improves the anti-counterfeiting ability of the evidence, avoids the security risk of data being able to pass evidence verification after forgery, and improves the credibility and security of data in the industrial Internet environment.

[0141] The present invention introduces a double encryption and joint hash mechanism in the encryption and evidence storage process, which can effectively improve the system's detection and protection capabilities against data tampering and forgery. By using symmetric encryption and asymmetric encryption for industrial data content and identification information respectively, and combining the Merkle tree structure with weighted aggregation to generate a joint hash, the evidence information has higher attack resistance and verifiability. The receiving end ensures that the data and identification information are complete, consistent and trustworthy throughout the life cycle through double decryption and reconstruction verification. Compared with traditional solutions that only rely on a single hash or simple evidence storage, the present invention can more finely capture fine-grained tampering behaviors, including complex attacks such as local field tampering, instruction replay, and device environment forgery, to ensure the business security of industrial control systems.

[0142] The present invention effectively improves the sensitivity to partial data tampering and the ability to perform multi-dimensional security verification in complex industrial scenarios by designing a block weighting and bidirectional reconstruction verification mechanism. The block weighting mechanism allows the assignment of differentiated weights to fields of different importance in industrial data and identification information, and can provide higher security for key fields such as control instructions, equipment fingerprints, process parameters, etc. At the same time, the bidirectional reconstruction mechanism ensures that the receiving end and the blockchain evidence storage end can fully reproduce the encryption, evidence storage and hash calculation processes during the verification process, eliminating the risk of forgery under one-way hash verification. Even if the attacker only makes minor modifications to some low-sensitivity fields, it can be detected in time through the joint hash difference, ensuring that the system can still guarantee the integrity, authenticity and high reliability of the data in the face of complex attacks and abnormal situations.

[0143] The present invention provides Figure 2 The industrial Internet encryption system based on blockchain evidence storage shown in the figure includes an identification information generation module, an encryption and identification binding module, a joint hash generation module, a blockchain evidence storage and consistency verification module, a joint hash consistency verification module, and a decryption and identification integrity verification module:

[0144] Identification information generation module: When the industrial Internet system generates industrial data to be encrypted, it will synchronously generate identification information that is strongly bound to the content of the industrial data. The identification information includes but is not limited to data fingerprint information, device fingerprint information, generation timestamp, and data usage environment information;

[0145] The encryption and identification binding module encrypts the industrial data to obtain encrypted data; at the same time, the identification information is embedded in the metadata of the encrypted data, so that the identification information and the encrypted data are bound one by one;

[0146] A joint hash generation module performs a joint hash process on the encrypted data and its embedded identification information to generate a joint hash value;

[0147] The blockchain evidence storage and consistency verification module stores the joint hash value on the blockchain through the blockchain evidence storage module to form a blockchain evidence record, and verifies the integrity of the evidence data, the generation device, and the time consistency through the smart contract;

[0148] The joint hash consistency verification module performs consistency verification during data transmission and storage by comparing the on-chain joint hash value with the joint hash value recalculated from the encrypted data and its identification information received by the receiving side, ensuring that the received data has not been tampered with.

[0149] The decryption and identification integrity verification module verifies whether the identification information in the encrypted data is consistent with the identification information bound in the blockchain evidence record before the data is used, and confirms that the binding relationship between the encrypted data and the evidence is complete and valid. If there is any inconsistency, the data decryption and use will be blocked.

[0150] An industrial Internet encryption method based on blockchain evidence provided by an embodiment of the present invention is implemented through the above-mentioned industrial Internet encryption system based on blockchain evidence. The specific method and process of an industrial Internet encryption system based on blockchain evidence are detailed in the embodiment of the above-mentioned industrial Internet encryption method based on blockchain evidence, which will not be repeated here.

[0151] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. An industrial Internet encryption method based on blockchain evidence storage, characterized in that: The following steps are involved: When the industrial Internet system generates industrial data to be encrypted, it will simultaneously generate identification information that is strongly bound to the content of the industrial data; The industrial data is encrypted to obtain encrypted data; at the same time, the identification information is embedded in the metadata of the encrypted data so that the identification information and the encrypted data are bound one-to-one; Performing joint hashing on the encrypted data and the embedded identification information to generate a joint hash value; The joint hash value is stored on the blockchain through the blockchain evidence module to form a blockchain evidence record, and the integrity of the evidence data, the generation device, and the time consistency are verified through the smart contract; During data transmission and storage, consistency verification is performed between the on-chain joint hash value and the joint hash value recalculated from the encrypted data and its identification information received on the receiving side to ensure that the received data has not been tampered with; Before using the data, verify whether the identification information in the encrypted data is consistent with the identification information bound to the blockchain evidence record, and confirm that the binding relationship between the encrypted data and the evidence is complete and valid. If there is any inconsistency, block the data decryption and use; The joint hash value adopts an improved weighted multi-level hash generation algorithm. The specific steps are as follows: Divide the encrypted data into n data blocks and calculate the hash value of each block; Divide the identification information into m feature items and calculate the hash value of each feature item; The feature items shall at least include data fingerprint, device unique identifier, operating system environment information, timestamp information and security policy identifier to ensure the comprehensiveness and accuracy of the evidence information; Perform weighted aggregation on all block hash values ​​to obtain the intermediate hash; Weights are assigned based on the importance, sensitivity, and coreness of the data in the industrial control process; Perform weighted aggregation on all feature hash values ​​to obtain the identification hash; The weight is determined based on the strength of each feature in integrity verification and security protection; The intermediate hash and the identity hash are aggregated to generate the final joint hash; Joint hashing has the dual properties of data block integrity and identification information consistency; The combined hash value, the weighted coefficient of the data block, and the weighted coefficient of the identification information feature item are uploaded to the chain as evidence data, and the hash generation process is fully restored during subsequent verification.

2. The industrial Internet encryption method based on blockchain evidence storage according to claim 1 is characterized in that: The data fingerprint information in the identification information is generated by a combination of multiple features, including the multi-dimensional feature hash of the data content, the device unique identifier of the data generating device, the operating system environment information and timestamp information. The data fingerprint generated by the fusion of multi-dimensional features can uniquely represent the industrial data itself and its generation environment, improve the binding accuracy of data and evidence, and prevent the misjudgment of homologous data due to environmental differences.

3. The industrial Internet encryption method based on blockchain evidence storage according to claim 1 is characterized in that: During the encryption process of encrypted data, a double encryption mechanism is adopted. The first layer is symmetric encryption to ensure data transmission efficiency, and the second layer is asymmetric encryption to encrypt the metadata part of the embedded identification information to ensure the security of data fingerprints and metadata in an open environment. Even if the encrypted part of the main data is cracked, the attacker cannot obtain the complete identification information, thereby ensuring the consistency of the evidence and data integrity.

4. The industrial Internet encryption method based on blockchain evidence storage according to claim 1 is characterized in that: Before the joint hash value is generated, the encrypted data and its identification information are preprocessed through the Merkle tree structure to form a Merkle tree root node containing the data block hash and the identification information hash. The root node hash value is used as the input for subsequent joint hashes, further improving the immutability of the hash result and the high-strength consistency verification capability, effectively resisting attacks in which the identification information is tampered with individually.

5. The industrial Internet encryption method based on blockchain evidence storage according to claim 1 is characterized in that: During the evidence storage and verification stage, the smart contract automatically performs consistency checks, including cross-verification of the generation timestamp, device fingerprint, operating environment in the encrypted data and the on-chain environmental information in the blockchain network, to ensure that the encrypted data is generated in a trusted generation environment. If there is a timestamp anomaly, device fingerprint mismatch, or environmental information contradiction, the evidence storage and subsequent data usage process will be directly terminated to ensure the authenticity of the blockchain evidence information and the credibility of the data.

6. The industrial Internet encryption method based on blockchain evidence storage according to claim 1 is characterized in that: The data receiving end completes the consistency check through a double verification mechanism. The first verification is the integrity verification based on the joint hash value, and the second verification is the comparison verification based on the identification information of the blockchain memory certificate and the identification information extracted from the decrypted data. Only when both verifications are passed, the data is allowed to enter the decryption and subsequent business processing flow, thereby effectively preventing the occurrence of "fake evidence and real tampering" attacks in the industrial Internet scenario.

7. The industrial Internet encryption method based on blockchain evidence storage according to claim 1 is characterized in that: When the recipient discovers verification inconsistencies, an abnormal alarm and event chain process will be immediately triggered, automatically recording the abnormal data packet, abnormal device ID, data reception time and detailed reasons for verification failure. Automatic evidence collection and alarm will be achieved through smart contracts to ensure that data security incidents can be traced and responded to quickly and accurately.

8. The industrial Internet encryption method based on blockchain evidence storage according to claim 1 is characterized in that: The decryption verification process adopts a two-way reconstruction verification mechanism. The specific steps are as follows: Extract the encrypted data blocks and the identification information features embedded in the metadata from the received data. The extraction process uses parsing and parsing integrity testing to ensure that the receiving side can correctly obtain all verification information. Calculate the block hash and identification feature hash in the received data respectively; De-noising and format standardization are performed on the extraction process to eliminate the impact of data format differences in different environments on the consistency of hash results; Based on the received hash value, calculate the block weighted hash and the identity weighted hash; The weighting factor remains exactly the same as the original encryption side, ensuring the equivalence of the verification process; Jointly calculate the joint hash on the receiving side; The identification information feature items extracted by the receiving side are further compared item by item and level by level with the original identification information stored in the blockchain to ensure that the data environment information, generation time, and key information of the device fingerprint are completely consistent; If the joint hash and identification information are consistent, the data is considered to have passed verification, and subsequent decryption and business processing are allowed; If there is any inconsistency in the joint hash, the decryption process will be immediately interrupted, triggering an abnormal alarm and security incident handling process.

9. An industrial Internet encryption system based on blockchain evidence storage, used to implement the industrial Internet encryption method based on blockchain evidence storage as described in any one of claims 1 to 8, characterized in that: It includes identification information generation module, encryption and identification binding module, joint hash generation module, blockchain evidence storage and consistency verification module, joint hash consistency verification module and decryption and identification integrity verification module: Identification information generation module: When the industrial Internet system generates industrial data to be encrypted, it will synchronously generate identification information that is strongly bound to the content of the industrial data; The encryption and identification binding module encrypts the industrial data to obtain encrypted data; at the same time, the identification information is embedded in the metadata of the encrypted data, so that the identification information and the encrypted data are bound one by one; A joint hash generation module performs a joint hash process on the encrypted data and its embedded identification information to generate a joint hash value; The blockchain evidence storage and consistency verification module stores the joint hash value on the blockchain through the blockchain evidence storage module to form a blockchain evidence record, and verifies the integrity of the evidence data, the generation device, and the time consistency through the smart contract; The joint hash consistency verification module performs consistency verification during data transmission and storage by comparing the on-chain joint hash value with the joint hash value recalculated from the encrypted data and its identification information received by the receiving side, ensuring that the received data has not been tampered with. The decryption and identification integrity verification module verifies whether the identification information in the encrypted data is consistent with the identification information bound in the blockchain evidence record before the data is used, and confirms that the binding relationship between the encrypted data and the evidence is complete and valid. If there is any inconsistency, the data decryption and use will be blocked.

Images