A method, system, medium and device for encryption and decryption of communication between upper and lower computers

Abstract

The present invention relates to the field of industrial communication technology, and in particular to a method, system, medium, and device for encryption and decryption of communication between upper and lower computers. The method comprises randomly generating a plurality of first keys and storing them in a key pool, generating a second key to encrypt the key pool and sending it to a lower computer, generating a setting message comprising a first SM3 check value, a random number index, a second timestamp, and setting content, encrypting the setting message using the first key in the key pool and sending it to the lower computer, obtaining a reply message sent by the lower computer after performing SM3 verification, random number index verification, and second timestamp verification on the setting message, decrypting the reply message using the first key of the encrypted setting message, and obtaining setting status information in the reply message. The present invention improves the security and integrity of industrial control system data during transmission through two encryptions of the upper computer and triple security verification of the lower computer, and effectively prevents security risks such as data leakage and tampering.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial communication, and in particular to a method, system, medium and equipment for encryption and decryption of communication between upper and lower computers. Background Art

[0002] With the widespread adoption of industrial control systems, communication security between host and slave computers has become a critical issue. Industrial control systems often involve critical industrial processes and sensitive data. If this data is illegally accessed or tampered with during transmission, it can severely impact production and even threaten the security of the entire system. Traditional communication methods have numerous security deficiencies, especially when facing modern hacker attacks. Therefore, developing an efficient and reliable encryption method for communication between host and slave computers is crucial. Summary of the Invention

[0003] The technical problem to be solved by the embodiments of the present invention is to provide a method, system, medium and device for encrypting and decrypting communication between upper and lower computers, so as to solve the problem of insufficient security of communication between upper and lower computers in the prior art.

[0004] The present invention discloses a method for encrypting and decrypting communication between upper and lower computers, which is applied to a host computer. The method comprises:

[0005] randomly generating a plurality of first keys, and storing the plurality of first keys in a key pool;

[0006] In response to receiving a key pool acquisition request from a lower computer, generating a second key with a first timestamp, encrypting the key pool using the second key, and sending the encrypted key pool to the lower computer;

[0007] In response to receiving an operation instruction to set a value on the lower computer, generating a value setting message including a first SM3 check value, a random number index, a second timestamp, and a value setting content, performing SM4 encryption on the value setting message using a first key in a key pool, and sending the encrypted value setting message to the lower computer;

[0008] Obtain a reply message sent by the lower computer after performing SM3 verification, random number index verification, and second timestamp verification on the set value message, wherein the reply message is encrypted using the first key used to encrypt the set value message;

[0009] The reply message is decrypted using the first key of the encrypted setting message to obtain the setting status information in the reply message.

[0010] Optionally, generating a second key with the first timestamp and encrypting the key pool using the second key includes:

[0011] Obtain a first timestamp corresponding to the current time, where the first timestamp includes a byte string with time accuracy to a hierarchical level;

[0012] A custom string is used to combine the first timestamp and the custom string to generate a second key;

[0013] The second key is used to encrypt the key pool using the SM4 algorithm, and the encrypted key pool is integrity checked using the SM3 algorithm.

[0014] Optionally, generating a setting message including a first SM3 check value, a random number index, a second timestamp, and setting content includes:

[0015] According to the received set value content, a random number index is randomly generated at a predetermined time interval, and the random number index is used as the unique code of the set value content, and the random number corresponding to the subsequently received set value content is index+1;

[0016] Get the second timestamp corresponding to the current time, which includes a byte string with time accurate to the second level;

[0017] Combine the random number index, the second timestamp, and the set value content in sequence to generate an initial message;

[0018] The initial message is hashed using the SM3 algorithm to obtain a first SM3 check value, and the first SM3 check value is placed in the header of the initial message to obtain a value-set message.

[0019] Optionally, using the first key in the key pool to perform SM4 encryption on the value message includes:

[0020] Sequentially numbering multiple first keys in the key pool;

[0021] At predetermined intervals, a random number keyRandom is randomly generated from the numbered numbers, so that the random number keyRandom corresponds to the number of the first key in the key pool;

[0022] The first key pair value message corresponding to the random number keyRandom is used to perform SM4 encryption.

[0023] The present invention also discloses a method for encrypting and decrypting communication between upper and lower computers, which is applied to a lower computer. The method comprises:

[0024] In response to receiving a setting message sent by a host computer, sending a key pool acquisition request to the host computer, and receiving a key pool sent by the host computer, wherein the key pool includes a second key with a first timestamp;

[0025] generating a decryption key with a third timestamp, where the third timestamp is consistent with the first timestamp, and decrypting the key pool using the decryption key;

[0026] Obtaining the first key used by the host computer to encrypt the value-setting message from the decrypted key pool, and decrypting the value-setting message using the obtained first key;

[0027] According to the first SM3 check value, random number index, and second timestamp added by the host computer in the value setting message, the decrypted value setting message is subjected to SM3 check, random number index check, and second timestamp check;

[0028] Perform a setting operation according to the verified setting message, generate a reply message, use the first key used to encrypt the setting message to perform SM4 encryption on the reply message, and send the encrypted reply message to the upper computer.

[0029] Optionally, performing SM3 verification, random number index verification, and second timestamp verification on the decrypted value setting message includes:

[0030] According to the decrypted set value message, the first SM3 check value in the set value message is removed and saved, and the set value message after the first SM3 check value is removed is hashed using the SM3 algorithm to obtain a second SM3 check value. If the second SM3 check value is inconsistent with the first SM3 check value, the set value message is discarded;

[0031] If the second SM3 check value is consistent with the first SM3 check value, compare the random number index in the set message with the random number index of the previously received set message. If the random number index in the set message is not the index + 1 of the random number in the previous set message, discard the set message.

[0032] If the random number index in the set message is the index of the random number in the previous set message + 1, obtain the fourth timestamp corresponding to the current time. If the fourth timestamp does not correspond to the second timestamp, discard the set message;

[0033] If the fourth timestamp corresponds to the second timestamp, a setting operation is performed according to the setting content in the setting message, and a reply message including the second SM3 check value, the random number index, the fourth timestamp and the setting success is generated after the setting operation.

[0034] The present invention also discloses a host computer interaction system, which applies the above-mentioned communication encryption and decryption method between the upper and lower computers. The host computer interaction system includes:

[0035] A key pool generation module, configured to randomly generate a plurality of first keys and store the plurality of first keys in a key pool;

[0036] a key pool encryption module, configured to generate a second key with a first timestamp in response to receiving a key pool acquisition request from a lower computer, encrypt the key pool using the second key, and send the encrypted key pool to the lower computer;

[0037] a value setting message sending module, configured to generate a value setting message including a first SM3 check value, a random number index, a second timestamp, and a value setting content in response to receiving an operation instruction to set a value on the lower computer, perform SM4 encryption on the value setting message using a first key in a key pool, and send the encrypted value setting message to the lower computer;

[0038] A reply message receiving module is used to obtain a reply message sent by the lower computer after performing SM3 verification, random number index verification, and second timestamp verification on the value setting message, wherein the reply message is encrypted using the first key used to encrypt the value setting message;

[0039] The reply message decryption module is used to decrypt the reply message using the first key of the encrypted setting message to obtain the setting status information in the reply message.

[0040] The present invention also discloses a lower-computer interaction system, which is applied to the above-mentioned upper- and lower-computer communication encryption and decryption method. The lower-computer interaction system includes:

[0041] A key pool acquisition module, configured to, in response to receiving a setting message sent by a host computer, send a key pool acquisition request to the host computer, and receive a key pool sent by the host computer, wherein the key pool includes a second key with a first timestamp;

[0042] a key pool decryption module, configured to generate a decryption key with a third timestamp, the third timestamp being consistent with the first timestamp, and decrypt the key pool using the decryption key;

[0043] A value setting message decryption module is used to obtain the first key used by the host computer to encrypt the value setting message from the decrypted key pool, and use the obtained first key to decrypt the value setting message;

[0044] The value setting message verification module is used to perform SM3 verification, random number index verification, and second timestamp verification on the decrypted value setting message according to the first SM3 verification value, random number index, and second timestamp added by the host computer in the value setting message;

[0045] The reply message encryption module is used to perform a setting operation according to the verified setting message and generate a reply message, use the first key of the encrypted setting message to perform SM4 encryption on the reply message, and send the encrypted reply message to the upper computer.

[0046] The present invention also discloses a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, it implements the above-mentioned method for encrypting and decrypting communication between upper and lower computers applied to the upper computer, or implements the above-mentioned method for encrypting and decrypting communication between upper and lower computers applied to the lower computer.

[0047] The present invention also discloses a computer device, including a memory, a processor, and a computer program stored in the memory and runnable on the processor. When the processor executes the computer program, it implements the above-mentioned method for encrypting and decrypting communication between upper and lower computers applied to the upper computer, or implements the above-mentioned method for encrypting and decrypting communication between upper and lower computers applied to the lower computer.

[0048] Compared with the prior art, the method and system for encrypting and decrypting communication between upper and lower computers provided by the embodiments of the present invention have the following beneficial effects:

[0049] A key pool containing multiple randomly generated first keys is generated by the host computer. The key pool is then dynamically encrypted using a second key with a first timestamp before being sent to the slave computer. When setting a value, a random number index is generated and used as the unique code for the set value content. A set value message containing a first SM3 check value, a random number index, a second timestamp, and the set value content is generated, and the set value message is SM4 encrypted using the first key in the key pool. When the slave computer receives the set value message, it first decrypts the key pool, then obtains the first encryption key from the key pool and decrypts the set value message. The decrypted set value message undergoes triple security verification using the first SM3 check value, the random number index, and the second timestamp. This significantly improves the security and integrity of industrial control system data during transmission. The dynamic key pool and regularly updated random number index enhance the system's anti-attack capabilities, effectively preventing security risks such as data leakage and tampering. This not only helps improve the security of the slave computer's set value but also provides a solid technical guarantee for the stable operation of the industrial control system. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments, in which:

[0051] Figure 1 A schematic block diagram of the steps of a method for encrypting and decrypting communication between a host computer and a lower computer provided in an embodiment of the present invention;

[0052] Figure 2 A schematic block diagram of the steps of an encryption and decryption method for communication between a lower computer and an upper computer provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0053] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. Now, in conjunction with the accompanying drawings, the preferred embodiments of the present invention will be described in detail.

[0054] The present invention discloses a method for encrypting and decrypting communication between upper and lower computers, which is applied to the upper computer, such as Figure 1 As shown, the encryption and decryption method for communication between upper and lower computers includes:

[0055] S101, randomly generate multiple first keys, and store the multiple first keys in a key pool;

[0056] S102: In response to receiving a key pool acquisition request from the lower computer, generating a second key with a first timestamp, encrypting the key pool using the second key, and sending the encrypted key pool to the lower computer;

[0057] S103, in response to receiving an operation instruction to set a value for the lower computer, generating a value setting message including a first SM3 check value, a random number index, a second timestamp, and a value setting content, performing SM4 encryption on the value setting message using a first key in the key pool, and sending the encrypted value setting message to the lower computer;

[0058] S104. Obtain a reply message sent by the lower computer after performing SM3 verification, random number index verification, and second timestamp verification on the set value message, where the reply message is encrypted using the first key used to encrypt the set value message;

[0059] S105: Decrypt the reply message using the first key used to encrypt the setting message, and obtain setting status information in the reply message.

[0060] As mentioned above, the SM3 Hash Algorithm is a cryptographic hash function used in applications such as digital signatures, message authentication codes, and data integrity checks. The SM4 Block Cipher Algorithm is a symmetric key encryption algorithm used for data encryption. The index in the random number index is a symbol representing a specific number consisting of a byte string, for example, index=11111111.

[0061] Through the implementation of the above-mentioned embodiment of the method for communication encryption and decryption between upper and lower computers, the upper computer first generates a key pool containing multiple randomly generated first keys, and then dynamically encrypts the key pool using a second key with a first timestamp before sending it to the lower computer. When setting the value, a random number index is generated, and the random number index is used as the unique code of the setting content. A setting message containing a first SM3 check value, a random number index, a second timestamp, and the setting content is generated, and the setting message is SM4 encrypted using the first key in the key pool. The first SM3 check value is obtained by verifying the setting message including the random number index, the second timestamp, and the setting content based on the SM3 cryptographic hash algorithm, and the setting message is encrypted using the first key in the key pool as the secret key of the SM4 block cipher algorithm.

[0062] When the lower computer receives a setting message, it first decrypts the key pool, then obtains the first encryption key from the key pool and decrypts the setting message. The decrypted setting message is subjected to triple security verification of the first SM3 check value, the random number index, and the second timestamp. This significantly improves the security and integrity of the industrial control system data during transmission, and enhances the system's anti-attack capability through the dynamic key pool and regularly updated random number index, effectively preventing security risks such as data leakage and tampering. This not only helps to improve the security of the lower computer setting, but also provides a solid technical guarantee for the stable operation of the industrial control system.

[0063] Preferably, the host computer serves as the server and the slave computer serves as the client. After the slave computer starts up, it establishes a link with the host computer. When the power control system (PCS) for both the host and slave computers is started, the host computer creates a key management thread. After the key management thread starts up, it maintains a 16×16 matrix password generation table, populating it sequentially from 0 to 255. When generating the first key, a for loop is used to generate a 16-byte first key from the password generation table. This loop is then repeated 24 times to generate 24 first keys. These 24 first keys are stored in a vector to form a key pool. A vector is a template container in a language program, similar to a dynamic array, that can store elements of different types.

[0064] Furthermore, generating a second key with the first timestamp and encrypting the key pool using the second key includes:

[0065] Obtain a first timestamp corresponding to the current time, where the first timestamp includes a byte string with time accuracy to a hierarchical level;

[0066] A custom string is used to combine the first timestamp and the custom string to generate a second key;

[0067] The second key is used to encrypt the key pool using the SM4 algorithm, and the encrypted key pool is integrity checked using the SM3 algorithm.

[0068] Through the implementation of the above-mentioned embodiment of the encryption and decryption method for communication between the upper and lower computers, the lower computer communicates with the upper computer to obtain the key pool. Before sending the key pool, the upper computer needs to encrypt the key pool. The first timestamp is the current time accurate to the minute, for example: 202410151126, which is composed of the first 6 bytes of the second key, for example: 20-24-10-15-11-26. Preferably, the last ten digits of the second key are a custom string, for example: Lwty@aU*nZ. The first timestamp and the custom string are made to form a 16-bit second key together, and the second key is used as the key of the SM4 algorithm to encrypt the key pool, and the SM3 algorithm is used for integrity verification, and then sent to the lower computer. The lower computer can compose a decryption key according to the current time, decrypt the key pool, and store it in the memory for standby use.

[0069] Furthermore, a setting message including a first SM3 check value, a random number index, a second timestamp, and setting content is generated, including:

[0070] According to the received set value content, a random number index is randomly generated at a predetermined time interval, and the random number index is used as the unique code of the set value content, and the random number corresponding to the subsequently received set value content is index+1;

[0071] Get the second timestamp corresponding to the current time, which includes a byte string with time accurate to the second level;

[0072] Combine the random number index, the second timestamp, and the set value content in sequence to generate an initial message;

[0073] The initial message is hashed using the SM3 algorithm to obtain a first SM3 check value, and the first SM3 check value is placed in the header of the initial message to obtain a value-set message.

[0074] Through the implementation of the above-mentioned embodiment of the value setting communication encryption and decryption method between the upper and lower computers, preferably, when the upper computer applies PCS to set the value of the lower computer, the message is first assembled. The structure of the value setting message is 32-bit SM3 check value + 8-bit random number index + 8-bit second timestamp + value setting content. When the upper computer sends the value setting message for the first time, this random number index is sent to the lower computer as a unique code. When setting the value subsequently, the random number of the value setting message sent is index+1. For example, if the random number index of the value setting message sent for the first time is 11111111, then the random number index of the value setting message sent for the second time is 11111112. That is, each value setting message corresponds to a unique random number index to prevent the same value setting message from being hijacked and sent again. The 8-byte random number index is randomly generated and replaced every hour. By regularly updating the random number index, the system's anti-attack capability can be enhanced, effectively preventing security risks such as data leakage and tampering. The second timestamp is accurate to the second level and is represented by 8 bytes. This allows the lower computer to verify the timestamp of the set value message and ensure that the current time at the time of verification is within two seconds of the time of the second timestamp in the set value message. Finally, the SM3 algorithm is used to perform an integrity check on the set value message to ensure the data integrity of the set value message. By performing a hash operation on the set value message, a 32-byte SM3 check value can be generated and placed in the header of the set value message, allowing the lower computer to quickly locate and extract the hash value for integrity verification.

[0075] Furthermore, using the first key in the key pool to perform SM4 encryption on the value message includes:

[0076] Sequentially numbering multiple first keys in the key pool;

[0077] At predetermined intervals, a random number keyRandom is randomly generated from the numbered numbers, so that the random number keyRandom corresponds to the number of the first key in the key pool;

[0078] The first key pair value message corresponding to the random number keyRandom is used to perform SM4 encryption.

[0079] Through the implementation of the above-mentioned embodiment of the encryption and decryption method for communication between upper and lower computers, the keyRandom in the random number keyRandom is a representation symbol, which represents the random key number. For example, the key pool includes 24 first keys, and the multiple first keys in the key pool are numbered from 1 to 24 in sequence. Then, keyRandom, which is a random number, is a byte randomly generated from 1 to 24. That is, when the random number keyRandom=1, it corresponds to the first key numbered 1 in the key pool, so that the lower computer can obtain the encrypted first key from the key pool according to the random number keyRandom. Preferably, the random number keyRandom is changed every hour. Through the dynamic key pool, the system's anti-attack capability is further enhanced, effectively preventing security risks such as data leakage and tampering.

[0080] The present invention also discloses a method for encrypting and decrypting communication between upper and lower computers, which is applied to the lower computer, such as Figure 2 As shown, the encryption and decryption method for communication between upper and lower computers includes:

[0081] S201, in response to receiving a setting message sent by a host computer, sending a key pool acquisition request to the host computer, and receiving a key pool sent by the host computer, where the key pool includes a second key with a first timestamp;

[0082] S202: Generate a decryption key with a third timestamp, where the third timestamp is consistent with the first timestamp, and use the decryption key to decrypt the key pool;

[0083] S203: Obtain the first key used by the host computer to encrypt the value-setting message from the decrypted key pool, and decrypt the value-setting message using the obtained first key;

[0084] S204, according to the first SM3 check value, random number index, and second timestamp added by the host computer in the value setting message, perform SM3 check, random number index check, and second timestamp check on the decrypted value setting message;

[0085] S205 , performing a setting operation according to the verified setting message, generating a reply message, performing SM4 encryption on the reply message using the first key used to encrypt the setting message, and sending the encrypted reply message to the upper computer.

[0086] Furthermore, the decrypted set value message is subjected to SM3 verification, random number index verification, and second timestamp verification, including:

[0087] According to the decrypted set value message, the first SM3 check value in the set value message is removed and saved, and the set value message after the first SM3 check value is removed is hashed using the SM3 algorithm to obtain a second SM3 check value. If the second SM3 check value is inconsistent with the first SM3 check value, the set value message is discarded;

[0088] If the second SM3 check value is consistent with the first SM3 check value, compare the random number index in the set message with the random number index of the previously received set message. If the random number index in the set message is not the index + 1 of the random number in the previous set message, discard the set message.

[0089] If the random number index in the set message is the index of the random number in the previous set message + 1, obtain the fourth timestamp corresponding to the current time. If the fourth timestamp does not correspond to the second timestamp, discard the set message;

[0090] If the fourth timestamp corresponds to the second timestamp, a setting operation is performed according to the setting content in the setting message, and a reply message including the second SM3 check value, the random number index, the fourth timestamp and the setting success is generated after the setting operation.

[0091] By implementing the above-described embodiment of the method for encrypting and decrypting communication between a host and a lower computer, after the lower computer completes verification of the set-value message, it replies to the upper computer with a message indicating a successful operation. The reply message consists of a 32-bit SM3 checksum + a random number index + a fourth timestamp + a successful operation, and is encrypted using the previous encryption key. After encryption, it is sent to the upper computer. Preferably, the times corresponding to the fourth timestamp and the second timestamp are both accurate to the second level and represented using 8 bytes, so as to ensure that the time difference between the fourth timestamp and the second timestamp in the set-value message during verification by the lower computer is within two seconds.

[0092] After sending a set message, the host computer waits for a reply message from the slave computer. Upon receiving the reply message, it performs SM4 decryption on the reply message using the same first key and then verifies the SM3 checksum, random number index, and fourth timestamp using the same verification method as the slave computer. If the reply message indicates a successful set, the host computer returns a set success status message to the server. If the host computer times out and does not receive a reply message, it returns a set failure status message to the server.

[0093] The present invention also discloses a host computer interaction system, which applies the above-mentioned communication encryption and decryption method between the upper and lower computers. The host computer interaction system includes:

[0094] A key pool generation module, configured to randomly generate a plurality of first keys and store the plurality of first keys in a key pool;

[0095] a key pool encryption module, configured to generate a second key with a first timestamp in response to receiving a key pool acquisition request from a lower computer, encrypt the key pool using the second key, and send the encrypted key pool to the lower computer;

[0096] a value setting message sending module, configured to generate a value setting message including a first SM3 check value, a random number index, a second timestamp, and a value setting content in response to receiving an operation instruction to set a value on a lower machine, perform SM4 encryption on the value setting message using a first key in a key pool, and send the encrypted value setting message to the lower machine;

[0097] The reply message receiving module is used to obtain the reply message sent by the lower computer after performing SM3 verification, random number index verification, and second timestamp verification on the value setting message. The reply message is encrypted using the first key used to encrypt the value setting message;

[0098] The reply message decryption module is used to decrypt the reply message using the first key of the encrypted setting message to obtain the setting status information in the reply message.

[0099] The present invention also discloses a lower-computer interaction system, which is applied to the above-mentioned upper- and lower-computer communication encryption and decryption method. The lower-computer interaction system includes:

[0100] A key pool acquisition module is configured to, in response to receiving a setting message sent by the host computer, send a key pool acquisition request to the host computer, and receive a key pool sent by the host computer, where the key pool includes a second key with a first timestamp;

[0101] a key pool decryption module, configured to generate a decryption key with a third timestamp, the third timestamp being consistent with the first timestamp, and decrypt the key pool using the decryption key;

[0102] The value setting message decryption module is used to obtain the first key used by the host computer to encrypt the value setting message from the decrypted key pool, and use the obtained first key to decrypt the value setting message;

[0103] The value setting message verification module is used to perform SM3 verification, random number index verification, and second timestamp verification on the decrypted value setting message according to the first SM3 verification value, random number index, and second timestamp added by the host computer in the value setting message;

[0104] The reply message encryption module is used to perform a setting operation according to the verified setting message and generate a reply message, use the first key of the encrypted setting message to perform SM4 encryption on the reply message, and send the encrypted reply message to the upper computer.

[0105] The present invention also discloses a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, it implements the above-mentioned method for encrypting and decrypting communication between upper and lower computers applied to a host computer, or implements the above-mentioned method for encrypting and decrypting communication between upper and lower computers applied to a slave computer.

[0106] The present invention also discloses a computer device, including a memory, a processor, and a computer program stored in the memory and runnable on the processor. When the processor executes the computer program, it implements the above-mentioned method for encrypting and decrypting communication between upper and lower computers applied to the upper computer, or implements the above-mentioned method for encrypting and decrypting communication between upper and lower computers applied to the lower computer.

[0107] The present invention is described based on flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to specific embodiments. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0108] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0109] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0110] It should be understood that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Those skilled in the art may modify the technical solutions described in the above embodiments, or replace some of the technical features therein with equivalents; and all these modifications and replacements should fall within the scope of protection of the present invention.

Claims

1. A method for encrypting and decrypting communication between upper and lower computers, characterized in that: Applied to the host computer, the encryption and decryption method for communication between the host and host computers includes: randomly generating a plurality of first keys, and storing the plurality of first keys in a key pool; In response to receiving a key pool acquisition request from a lower computer, generating a second key with a first timestamp, encrypting the key pool using the second key, and sending the encrypted key pool to the lower computer, including: Obtain a first timestamp corresponding to the current time, where the first timestamp includes a byte string with time accuracy to a hierarchical level; A custom string is used to combine the first timestamp and the custom string to generate a second key; The second key is used to encrypt the key pool using the SM4 algorithm, and the encrypted key pool is integrity checked using the SM3 algorithm; In response to receiving an operation instruction to set a value for the lower machine, generating a setting message including a first SM3 check value, a random number index, a second timestamp, and setting content, including: According to the received set value content, a random number index is randomly generated at a predetermined time interval, and the random number index is used as the unique code of the set value content, and the random number corresponding to the subsequently received set value content is index+1; Get the second timestamp corresponding to the current time, which includes a byte string with time accurate to the second level; Combine the random number index, the second timestamp, and the set value content in sequence to generate an initial message; Performing a hash calculation on the initial message using the SM3 algorithm to obtain a first SM3 check value, and placing the first SM3 check value in the header of the initial message to obtain a value-set message; Use the first key in the key pool to perform SM4 encryption on the value setting message, and send the encrypted value setting message to the lower computer; Obtain a reply message sent by the lower computer after performing SM3 verification, random number index verification, and second timestamp verification on the set value message, wherein the reply message is encrypted using the first key used to encrypt the set value message; The reply message is decrypted using the first key of the encrypted setting message to obtain the setting status information in the reply message.

2. The encryption and decryption method for communication between upper and lower computers according to claim 1, characterized in that: The generating of a setting message including a first SM3 check value, a random number index, a second timestamp, and setting content includes: According to the received set value content, a random number index is randomly generated at a predetermined time interval, and the random number index is used as the unique code of the set value content, and the random number corresponding to the subsequently received set value content is index+1; Get the second timestamp corresponding to the current time, which includes a byte string with time accurate to the second level; Combine the random number index, the second timestamp, and the set value content in sequence to generate an initial message; The initial message is hashed using the SM3 algorithm to obtain a first SM3 check value, and the first SM3 check value is placed in the header of the initial message to obtain a value-set message.

3. The encryption and decryption method for communication between upper and lower computers according to claim 1, characterized in that: The using the first key in the key pool to perform SM4 encryption on the value message includes: Sequentially numbering multiple first keys in the key pool; At predetermined intervals, a random number keyRandom is randomly generated from the numbered numbers, so that the random number keyRandom corresponds to the number of the first key in the key pool; The first key pair value message corresponding to the random number keyRandom is used to perform SM4 encryption.

4. A method for encrypting and decrypting communication between upper and lower computers, characterized in that: Applied to the lower computer, the encryption and decryption method for communication between the upper and lower computers includes: In response to receiving a setting message sent by a host computer, sending a key pool acquisition request to the host computer, and receiving a key pool sent by the host computer, wherein the key pool includes a second key with a first timestamp; generating a decryption key with a third timestamp, where the third timestamp is consistent with the first timestamp, and decrypting the key pool using the decryption key; Obtaining the first key used by the host computer to encrypt the value-setting message from the decrypted key pool, and decrypting the value-setting message using the obtained first key; According to the first SM3 check value, random number index, and second timestamp added by the host computer in the value setting message, the decrypted value setting message is subjected to SM3 check, random number index check, and second timestamp check, including: According to the decrypted set value message, the first SM3 check value in the set value message is removed and saved, and the set value message after the first SM3 check value is removed is hashed using the SM3 algorithm to obtain a second SM3 check value. If the second SM3 check value is inconsistent with the first SM3 check value, the set value message is discarded; If the second SM3 check value is consistent with the first SM3 check value, compare the random number index in the set message with the random number index of the previously received set message. If the random number index in the set message is not the index + 1 of the random number in the previous set message, discard the set message. If the random number index in the set message is the index of the random number in the previous set message + 1, obtain the fourth timestamp corresponding to the current time. If the fourth timestamp does not correspond to the second timestamp, discard the set message; If the fourth timestamp corresponds to the second timestamp, a setting operation is performed according to the setting content in the setting message, and a reply message including the second SM3 check value, the random number index, the fourth timestamp, and a setting success is generated after the setting operation; Perform a setting operation according to the verified setting message, generate a reply message, use the first key used to encrypt the setting message to perform SM4 encryption on the reply message, and send the encrypted reply message to the upper computer.

5. A host computer interaction system, characterized in that: The method for encrypting and decrypting communication between upper and lower computers according to any one of claims 1 to 3 is applied, wherein the upper computer interaction system comprises: A key pool generation module, configured to randomly generate a plurality of first keys and store the plurality of first keys in a key pool; a key pool encryption module, configured to generate a second key with a first timestamp in response to receiving a key pool acquisition request from a lower computer, encrypt the key pool using the second key, and send the encrypted key pool to the lower computer; a value setting message sending module, configured to generate a value setting message including a first SM3 check value, a random number index, a second timestamp, and a value setting content in response to receiving an operation instruction to set a value on the lower computer, perform SM4 encryption on the value setting message using a first key in a key pool, and send the encrypted value setting message to the lower computer; A reply message receiving module is used to obtain a reply message sent by the lower computer after performing SM3 verification, random number index verification, and second timestamp verification on the value setting message, wherein the reply message is encrypted using the first key used to encrypt the value setting message; The reply message decryption module is used to decrypt the reply message using the first key of the encrypted setting message to obtain the setting status information in the reply message.

6. A lower computer interaction system, characterized in that: The method for communication encryption and decryption between upper and lower computers according to claim 4 is applied, wherein the lower computer interaction system comprises: A key pool acquisition module, configured to, in response to receiving a setting message sent by a host computer, send a key pool acquisition request to the host computer, and receive a key pool sent by the host computer, wherein the key pool includes a second key with a first timestamp; a key pool decryption module, configured to generate a decryption key with a third timestamp, the third timestamp being consistent with the first timestamp, and decrypt the key pool using the decryption key; A value setting message decryption module is used to obtain the first key used by the host computer to encrypt the value setting message from the decrypted key pool, and use the obtained first key to decrypt the value setting message; The value setting message verification module is used to perform SM3 verification, random number index verification, and second timestamp verification on the decrypted value setting message according to the first SM3 verification value, random number index, and second timestamp added by the host computer in the value setting message; The reply message encryption module is used to perform a setting operation according to the verified setting message and generate a reply message, use the first key of the encrypted setting message to perform SM4 encryption on the reply message, and send the encrypted reply message to the upper computer.

7. A computer-readable storage medium, characterized in that A computer program is stored thereon, and when the computer program is executed by the processor, it implements the encryption and decryption method for communication between upper and lower computers of set values ​​applied to the upper computer as described in any one of claims 1-3, or implements the encryption and decryption method for communication between upper and lower computers of set values ​​applied to the lower computer as described in claim 4.

8. A computer device, characterized in that: The invention comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method for encrypting and decrypting communication between an upper and lower computer and a lower computer as described in any one of claims 1 to 3 is implemented, or the method for encrypting and decrypting communication between an upper and lower computer and a lower computer as described in claim 4 is implemented.

Images