Comprehensive data secure transmission method and system

Abstract

The invention relates to the technical field of data transmission, and particularly provides an integrated data secure transmission method and system, and the method comprises the steps: obtaining a preset data transmission request according to to-be-transmitted data; determining a computing capability parameter of the target receiver device according to the target receiver device identifier; determining a data security transmission strategy according to the data classification identifier and the target receiver equipment computing capability parameter; and analyzing whether an execution node type conforming to the type of the current node exists, if so, executing a safety operation corresponding to the execution node type conforming to the type of the current node according to the to-be-transmitted data, and then forwarding the to-be-transmitted data to the next node according to the transmission path. If not, forwarding the to-be-transmitted data and the security operations to the nodes conforming to the execution node type, and if not, forwarding the to-be-transmitted data and the security operations to the nodes conforming to the execution node type; according to the method, the real-time performance and the data security of industrial production can be considered at the same time.

Description

Technical Field

[0001] This application relates to the technical field of data transmission, and in particular, to a comprehensive data security transmission method and system. Background Art

[0002] Industrial production operations involve multiple key links such as data collection, control, monitoring, and management. The collected data is widely transmitted between components at different levels, such as field devices, controllers, monitoring systems, and management systems. Specifically, the existing industrial control system structure includes the bottom field layer, the middle control layer, the upper monitoring layer, and the top management layer. The devices corresponding to the field layer are usually various sensors and actuators, that is, the field layer is responsible for data collection and execution of control instructions. The devices corresponding to the control layer are usually programmable logic controllers or distributed control systems. The control layer can receive data from the field layer and generate control instructions to be sent to the field layer by logically processing and calculating the received data. The monitoring layer is usually a human-machine interface or a supervisory control and data acquisition system. The monitoring layer can visually display the production process status, receive operation instructions, and record historical data. The management layer is usually a manufacturing execution system or an enterprise resource planning system. The management layer is responsible for production planning, resource scheduling, quality management, and data analysis, etc.

[0003] Data transmission can occur between different levels and between different devices at the same level. The types of transmitted data are extremely diverse. For example, the transmitted data can be real-time measurement values, control instructions, device status information, fault and alarm information, production recipes, process parameters, maintenance records, or software update packages. Different types of data have significantly different security requirements due to their roles and sensitivities in the production process. For example, real-time control instructions have extremely low requirements for transmission delay (usually in milliseconds or even microseconds), and at the same time require extremely high integrity to avoid misoperations; production recipes and process parameters belong to core production knowledge and have extremely high requirements for confidentiality and integrity; alarm information requires high availability and high integrity to ensure that operators can obtain information in a timely and accurate manner; historical production data is often used for traceability and analysis and has relatively high requirements for confidentiality and integrity.

[0004] The devices deployed in the industrial control system vary greatly in computing power. Specifically, the devices in the field layer are all devices with highly limited resources, that is, the data processing capabilities of the devices in the field layer are limited, resulting in difficulty for the devices in the field layer to efficiently execute complex encryption tasks (such as asymmetric encryption, high-strength digital signatures). The devices in the control layer have medium data processing capabilities, that is, the devices in the control layer can execute some medium-complexity encryption tasks. The monitoring layer and the management layer have powerful data processing capabilities, that is, the monitoring layer and the management layer can execute highly complex encryption tasks.

[0005] Due to the diverse types of data and different security requirements, and the existing data transmission methods adopt a "one-size-fits-all" unified security policy (equivalent to encrypting all data with the same intensity), there are problems in the existing data transmission methods. That is, due to excessive encryption intensity, devices with limited data processing capabilities cannot encrypt the data in time, resulting in a significant increase in data transmission delay, the disruption of the real-time nature of industrial production, and due to insufficient encryption intensity, the security protection of important data is insufficient, important data is accidentally leaked or cannot be normally transmitted to the target device, leading to the interruption of industrial production.

[0006] Regarding the above problems, there is currently no effective technical solution. It should be noted that the above information disclosed in this part is only used to understand the background of the inventive concept, and therefore may include information that does not constitute the prior art. Summary of the Invention

[0007] The purpose of this application is to provide a comprehensive data security transmission method and system, which can effectively solve the problems that due to excessive encryption intensity, devices with limited data processing capabilities cannot encrypt the data in time, resulting in a significant increase in data transmission delay, the disruption of the real-time nature of industrial production, and due to insufficient encryption intensity, the security protection of important data is insufficient, important data is accidentally leaked or cannot be normally transmitted to the target device, leading to the interruption of industrial production.

[0008] In the first aspect, this application provides a comprehensive data security transmission method, which includes the following steps:

[0009] S1. Obtain a pre-set data transmission request according to the data to be transmitted. The data transmission request includes a data classification identifier, a transmission path, and a target recipient device identifier;

[0010] S2. Query a pre-constructed mapping relationship table of device identifiers and device computing capabilities according to the target recipient device identifier to obtain the target recipient device computing capability parameters;

[0011] S3. Determine a data security transmission strategy according to the data classification identifier and the target recipient device computing capability parameters. The data security transmission strategy includes at least one security operation and its corresponding execution node type;

[0012] S4. Analyze whether there is an execution node type that matches the type of the current node. If so, perform the security operation corresponding to the execution point type that matches the type of the current node on the data to be transmitted and add a security operation identifier to the data to be transmitted, and then forward the data to be transmitted to the next node according to the transmission path until all security operations are executed and the target recipient device receives the data to be transmitted. If not, forward the data to be transmitted and the security operation to a node that meets the execution node type.

[0013] A comprehensive data security transmission method provided by this application can determine a data security transmission strategy according to the data classification identifier and the computing power parameter of the target receiving device, so as to avoid the situation of insufficient security protection for important data. Since this application can determine the data security transmission strategy according to the data classification identifier and the computing power parameter of the target receiving device, and this application can forward the data to be transmitted and the security operation to a node that can perform the security operation on the data to be transmitted in a timely manner when the current node cannot perform the security operation on the data to be transmitted in a timely manner, so as to avoid the situation that a device with limited data processing capacity cannot encrypt the data to be transmitted in a timely manner due to excessive encryption intensity. Therefore, this application can effectively solve the problems that a device with limited data processing capacity cannot encrypt the data in a timely manner due to excessive encryption intensity, the data transmission delay increases significantly, the real-time performance of industrial production is damaged, and due to too low encryption intensity, the security protection of important data is insufficient, important data is accidentally leaked or cannot be normally transmitted to the target device, resulting in industrial production interruption.

[0014] Optionally, step S3 includes:

[0015] S31. Query the pre-constructed mapping relationship table of data type, computing power parameter and security policy according to the data classification identifier and the computing power parameter of the target receiving device to determine the preliminary transmission strategy. The preliminary transmission strategy includes at least one preliminary security operation and its corresponding preliminary node type;

[0016] S32. Obtain the set of network condition parameters;

[0017] S33. Determine the security operation intensity adjustment coefficient and the execution node type adjustment strategy according to the set of network condition parameters;

[0018] S34. Adjust the operation intensity of all preliminary security operations according to the security operation intensity adjustment coefficient, and adjust all preliminary node types according to the execution node type adjustment strategy to obtain the data security transmission strategy. The data security transmission strategy is the preliminary transmission strategy after adjustment.

[0019] Optionally, the set of network condition parameters includes multiple network condition parameter scores, and step S33 includes:

[0020] S331. Determine the security operation type according to the preliminary security operation;

[0021] S332. Query the pre-constructed mapping relationship table of operation type and network condition parameter score weight combination according to the security operation type to determine the first weighted weight corresponding to different network state parameter scores in the set of network condition parameters;

[0022] S333. Calculate the network condition score based on all network status parameter scores and their corresponding first weighting weights.

[0023] S334. Query the pre - constructed mapping relation table of network condition score, operation intensity adjustment coefficient and node type adjustment strategy according to the network condition score, so as to obtain the safe operation intensity adjustment coefficient and execute the node type adjustment strategy.

[0024] Optionally, step S333 includes:

[0025] B1. Obtain the network communication protocol, and then query the pre - constructed mapping relation table of communication protocol and network status parameter score weight combination according to the network communication protocol, so as to determine the second weighting weights corresponding to different network status parameter scores in the network status parameter set.

[0026] B2. Calculate the network condition score based on all network status parameter scores, their corresponding first weighting weights and second weighting weights.

[0027] Optionally, the network status parameter scores are network congestion degree score, data packet loss rate score and resource occupancy rate score.

[0028] Optionally, step S34 includes:

[0029] S341. Analyze whether the safe operation intensity adjustment coefficient is less than or equal to the preset adjustment coefficient upper limit value and greater than or equal to the preset adjustment coefficient lower limit value. If so, adjust the operation intensity of all preliminary safe operations according to the safe operation intensity adjustment coefficient. If not, when the safe operation intensity adjustment coefficient is greater than the preset adjustment coefficient upper limit value, adjust the operation intensity of all preliminary safe operations according to the preset adjustment coefficient upper limit value, and when the safe operation intensity adjustment coefficient is less than the preset adjustment coefficient lower limit value, adjust the operation intensity of all preliminary safe operations according to the preset adjustment coefficient lower limit value.

[0030] Optionally, step S2 includes:

[0031] S21. Query the pre - constructed mapping relation table of device identifier and device computing ability according to the target recipient device identifier, so as to obtain the preliminary device computing ability parameter.

[0032] S22. Obtain the cumulative running duration of the target recipient device according to the target recipient device identifier, and then query the pre - constructed mapping relation table of device cumulative running duration and computing ability compensation coefficient according to the cumulative running duration of the target recipient device, so as to obtain the computing ability compensation coefficient.

[0033] S23. Calculate the target receiving device computing capability parameter based on the preliminary device computing capability parameter and the device computing capability compensation factor.

[0034] Optionally, the security levels of the security domains to which the nodes on the transmission path belong are all greater than or equal to the preset security level.

[0035] Optionally, the integrated data security transmission method further includes the steps of:

[0036] S5. After the target receiving device receives the data to be transmitted, control the target receiving device to decrypt, verify the signature, and / or perform integrity verification on the data to be transmitted according to the data classification identifier and all security operation identifiers.

[0037] In a second aspect, the present application also provides an integrated data security transmission system, which includes:

[0038] A data transmission request acquisition module, configured to acquire a pre-set data transmission request according to the data to be transmitted, where the data transmission request includes a data classification identifier, a transmission path, and a target receiving device identifier;

[0039] A computing capability parameter acquisition module, configured to query a pre-constructed mapping relationship table between device identifiers and device computing capabilities according to the target receiving device identifier to obtain the target receiving device computing capability parameter;

[0040] A data security transmission policy acquisition module, configured to determine a data security transmission policy according to the data classification identifier and the target receiving device computing capability parameter, where the data security transmission policy includes at least one security operation and its corresponding execution node type;

[0041] A data transmission module, configured to analyze whether there is an execution node type that matches the type of the current node. If so, perform the security operation corresponding to the execution point type that matches the type of the current node on the data to be transmitted and add a security operation identifier to the data to be transmitted, and then forward the data to be transmitted to the next node according to the transmission path until all security operations are executed and the target receiving device receives the data to be transmitted. If not, forward the data to be transmitted and the security operation to a node that meets the execution node type.

[0042] A comprehensive data security transmission system provided by the present application can determine a data security transmission strategy according to a data classification identifier and a computing power parameter of a target receiving device, so as to avoid insufficient security protection for important data. Since the present application can determine a data security transmission strategy according to a data classification identifier and a computing power parameter of a target receiving device, and the present application can forward the data to be transmitted and the security operation to a node that can perform the security operation on the data to be transmitted in a timely manner when the current node cannot perform the security operation on the data to be transmitted in a timely manner, so as to avoid the situation that a device with limited data processing capacity cannot encrypt the data to be transmitted in a timely manner due to excessive encryption intensity. Therefore, the present application can effectively solve the problems that a device with limited data processing capacity cannot encrypt the data in a timely manner due to excessive encryption intensity, the data transmission delay increases significantly, the real-time performance of industrial production is damaged, and due to too low encryption intensity, the security protection of important data is insufficient, important data is accidentally leaked or cannot be normally transmitted to the target device, resulting in industrial production interruption.

[0043] As can be seen from the above, a comprehensive data security transmission method and system provided by the present application can determine a data security transmission strategy according to a data classification identifier and a computing power parameter of a target receiving device, so as to avoid insufficient security protection for important data. Since the present application can determine a data security transmission strategy according to a data classification identifier and a computing power parameter of a target receiving device, and the present application can forward the data to be transmitted and the security operation to a node that can perform the security operation on the data to be transmitted in a timely manner when the current node cannot perform the security operation on the data to be transmitted in a timely manner, so as to avoid the situation that a device with limited data processing capacity cannot encrypt the data to be transmitted in a timely manner due to excessive encryption intensity. Therefore, the present application can effectively solve the problems that a device with limited data processing capacity cannot encrypt the data in a timely manner due to excessive encryption intensity, the data transmission delay increases significantly, the real-time performance of industrial production is damaged, and due to too low encryption intensity, the security protection of important data is insufficient, important data is accidentally leaked or cannot be normally transmitted to the target device, resulting in industrial production interruption. Brief Description of the Drawings

[0044] Figure 1 It is a flowchart of a comprehensive data security transmission method provided by an embodiment of the present application.

[0045] Figure 2 It is a schematic structural diagram of a comprehensive data security transmission system provided by an embodiment of the present application.

[0046] Reference numerals: 1, data transmission request acquisition module; 2, computing power parameter acquisition module; 3, data security transmission policy acquisition module; 4, data transmission module. Detailed implementation manners

[0047] Next, the technical solutions in the embodiments of the present application will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Components of the embodiments of the present application usually described and illustrated in the accompanying drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application claimed, but only represents selected embodiments of the present application. All other embodiments obtained by those skilled in the art based on the embodiments of the present application without creative efforts belong to the scope of protection of the present application.

[0048] It should be noted that similar reference numerals and letters represent similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of the present application, terms such as "first", "second", etc. are only used for distinguishing descriptions and cannot be understood as indicating or implying relative importance.

[0049] In the first aspect, as Figure 1 shown, the present application provides an integrated data security transmission method, which includes the following steps:

[0050] S1. Obtain a pre-set data transmission request according to the data to be transmitted. The data transmission request includes a data classification identifier, a transmission path, and a target recipient device identifier;

[0051] S2. Query a pre-constructed mapping relationship table between device identifiers and device computing capabilities according to the target recipient device identifier to obtain the target recipient device computing power parameters;

[0052] S3. Determine a data security transmission policy according to the data classification identifier and the target recipient device computing power parameters. The data security transmission policy includes at least one security operation and its corresponding execution node type;

[0053] S4. Analyze whether there is an execution node type that matches the type of the current node. If so, perform the security operation corresponding to the execution point type that matches the type of the current node on the data to be transmitted and add a security operation identifier to the data to be transmitted, and then forward the data to be transmitted to the next node according to the transmission path until all security operations are executed and the target recipient device receives the data to be transmitted. If not, forward the data to be transmitted and the security operation to a node that conforms to the execution node type.

[0054] The data to be transmitted in step S1 is the data that needs to be transmitted and is generated by the same device. Preferably, the data transmission request is a request generated by the device according to the data to be transmitted when the data to be transmitted is generated. The data transmission request includes a data classification identifier, a transmission path, and a target recipient device identifier. The data classification identifier can reflect the data type of the data to be transmitted. The transmission path can reflect the node sequence that the data to be transmitted needs to pass through from the sending device to the target recipient device. The target recipient device identifier is the unique identification mark of the target recipient device (the device that needs to receive the data to be transmitted). The unique identification mark can be used to distinguish different devices in the network to ensure that the data to be transmitted can be transmitted to the intended destination.

[0055] The working principle of step S2 is as follows: Since the computing power of the device can be obtained by pre-measuring, and each device corresponds to a unique identification mark, that is, in this application, before data transmission, a mapping relationship table of device identification and device computing power can be constructed according to all device computing powers and their corresponding unique identification marks by using the existing mapping relationship table construction method. The mapping relationship table stores the device computing powers corresponding to different unique identification marks. Therefore, step S2 can query the pre-constructed mapping relationship table of device identification and device computing power according to the target recipient device identifier through data query to obtain the target recipient device computing power parameter. The target recipient device computing power parameter in this embodiment can reflect the data processing ability of the target recipient device. The target recipient device computing power parameter can be the processor performance and memory capacity of the target recipient device, etc. It should be understood that the stronger the data processing ability of the target recipient device, the stronger the computing power and decryption ability of the target recipient device, and the target recipient device can receive the data to be transmitted with a higher encryption level.

[0056] Step S3 can determine the data security transmission policy by querying a pre-constructed mapping relationship table of data types, computing power parameters, and security policies based on the data classification identifier and the computing power parameter of the target receiving device. Since the data classification identifier can reflect the data type of the data to be transmitted, the data type of the data to be transmitted can reflect the importance of the data to be transmitted, and the computing power parameter of the target receiving device can reflect the data processing ability of the target receiving device, and step S3 determines the data security transmission policy based on the data classification identifier and the computing power parameter of the target receiving device, so step S3 is equivalent to customizing a data security transmission policy for the data to be transmitted according to the importance of the data to be transmitted and the data processing ability of the target receiving device, so as to avoid the situation that the target receiving device cannot calculate or decrypt the data to be transmitted in time due to the computing complexity or encryption degree of the data to be transmitted exceeding the data processing ability of the target receiving device, resulting in data delay and the real-time nature of work production being damaged in the case of the security transmission requirements of the data to be transmitted, that is, the present application can implement different intensities of encryption for different data to be transmitted. It should be understood that since the data to be transmitted needs to perform at least one security processing behavior, the data security transmission policy in this embodiment includes at least one security operation. This security operation belongs to the prior art, and its working principle will not be elaborated here. Since the encryption intensity corresponding to the security operation is a known value, and the data processing ability of the node is associated with the type of the node, this embodiment can determine the execution node type according to the security operation. The execution node type is the type of the node that can immediately execute this security operation, so that the data security transmission policy includes at least one security operation and its corresponding execution node type. It should be understood that if there are multiple types of nodes that can execute this security operation, the number of execution node types corresponding to the same security operation is multiple.

[0057] Since the execution node type of this embodiment is the type of node that can execute the security operation in a timely manner, step S4 can analyze whether the current node can execute the security operation in a timely manner by analyzing whether there is an execution node type that matches the type of the current node. If so, perform the security operation corresponding to the execution point type that matches the type of the current node on the data to be transmitted and add a security operation identifier (an identifier that can reflect the security operations performed on the data to be transmitted by the current node, and the target receiving device can know which security operations have been performed on the data to be transmitted based on the security operation identifier) to the data to be transmitted, and then forward the data to be transmitted to the next node according to the transmission path until all security operations have been performed and the target receiving device receives the data to be transmitted. If not, it means that the current node cannot execute the security operation in a timely manner, and using the current node to perform the security operation on the data to be transmitted will result in a situation where the current node cannot execute the security operation on the data to be transmitted in a timely manner due to the encryption strength corresponding to the security operation being greater than the data processing capacity of the current node, the data transmission delay increases significantly, and the real-time nature of industrial production is damaged. Therefore, at this time, it is necessary to forward the data to be transmitted and the security operation to a node that meets the execution node type, that is, this embodiment is equivalent to forwarding the data to be transmitted and the security operation to a node that can execute the security operation in a timely manner when the current node cannot execute the security operation in a timely manner to ensure the real-time nature and security of data transmission. It should be understood that when forwarding the data to be transmitted to the next node according to the transmission path and there are unexecuted security operations, this embodiment needs to analyze whether there is an execution node type corresponding to the unexecuted security operation that matches the type of the node, and when forwarding the data to be transmitted and the security operation to a node that meets the execution node type, the forwarded node will perform the security operation corresponding to the node type on the data to be transmitted, and after the forwarded node completes the execution of the security operation, forward the data to be transmitted to the next node according to the transmission path.

[0058] A comprehensive data security transmission method provided by the present application can determine a data security transmission strategy according to a data classification identifier and a computing power parameter of a target receiving device, so as to avoid insufficient security protection for important data. Since the present application can determine a data security transmission strategy according to a data classification identifier and a computing power parameter of a target receiving device, and the present application can forward the data to be transmitted and the security operation to a node that can perform the security operation on the data to be transmitted in a timely manner when the current node cannot perform the security operation on the data to be transmitted in a timely manner, so as to avoid the situation that a device with limited data processing capacity cannot encrypt the data to be transmitted in a timely manner due to excessive encryption intensity. Therefore, the present application can effectively solve the problems that a device with limited data processing capacity cannot encrypt the data in a timely manner due to excessive encryption intensity, the data transmission delay increases significantly, the real-time performance of industrial production is damaged, and due to too low encryption intensity, the security protection of important data is insufficient, important data is accidentally leaked or cannot be normally transmitted to the target device, resulting in industrial production interruption.

[0059] In some preferred embodiments, step S3 includes:

[0060] S31. Query a pre-constructed mapping relationship table of data type, computing power parameter and security policy according to the data classification identifier and the computing power parameter of the target receiving device to determine a preliminary transmission strategy, where the preliminary transmission strategy includes at least one preliminary security operation and its corresponding preliminary node type;

[0061] S32. Obtain a set of network condition parameters;

[0062] S33. Determine a security operation intensity adjustment coefficient and an execution node type adjustment strategy according to the set of network condition parameters;

[0063] S34. Adjust the operation intensity of all preliminary security operations according to the security operation intensity adjustment coefficient, and adjust all preliminary node types according to the execution node type adjustment strategy to obtain a data security transmission strategy, where the data security transmission strategy is the preliminary transmission strategy after adjustment.

[0064] Step S32 can obtain a set of network condition parameters by using existing network monitoring tools or network monitoring devices. Specifically, the set of network condition parameters in this embodiment includes multiple network condition parameters, and the network condition parameters can reflect the real-time state of the network (equivalent to the current network state). Step S33 can determine the security operation intensity adjustment coefficient and execute the node type adjustment strategy by querying a pre-constructed combination of network condition parameters, operation intensity adjustment coefficient, and node type adjustment strategy according to the set of network condition parameters. The security operation intensity adjustment coefficient can reflect the degree of modification of the security operation intensity under the current network state. For example, when the current network state is poor, the security operation intensity adjustment coefficient indicates reducing the length of the encryption key, and when the current network state is good, the security operation intensity adjustment coefficient indicates increasing the length of the encryption key. The executed node type adjustment strategy can reflect whether it is necessary to change the execution node type of the security operation under the current network state. For example, when the current network state is good, the executed node type adjustment strategy is to select a node type with a data processing capacity less than that of the preliminary node type and a data processing capacity that meets the requirements of the security operation as the execution node type or use the preliminary node type as the execution node type. When the current network state is poor, the executed node type adjustment strategy is to select a node type with a data processing capacity greater than that of the preliminary node type as the execution node type. Step S34 can adjust the operation intensity of the preliminary security operation according to the security operation intensity adjustment coefficient by multiplying the operation intensity of the preliminary security operation by the security operation intensity adjustment coefficient. Since this embodiment can dynamically adapt the data security transmission strategy to the current network environment by first adjusting the operation intensity of all preliminary security operations according to the security operation intensity adjustment coefficient and then adjusting all preliminary node types according to the executed node type adjustment strategy, this embodiment can, when the network condition is poor, reduce the security operation intensity and / or select a node type with appropriate data processing capacity to timely execute the security operation and reduce the data transmission delay caused by poor network condition, and when the network condition is good, enhance the data security of the data to be transmitted without destroying the real-time nature of industrial production by increasing the security operation intensity and / or selecting a node type with appropriate data processing capacity, thus effectively preventing the situation where the security operation cannot be timely executed due to poor network condition, the data transmission delay increases significantly, and the real-time nature of industrial production is damaged.

[0065] In some preferred embodiments, the set of network condition parameters includes multiple network condition parameter scores, and step S33 includes:

[0066] S331. Determine the security operation type according to the preliminary security operation;

[0067] S332. Query the pre-constructed mapping relation table of operation type and network condition parameter scoring weight combination according to the security operation type to determine the first weighting weights corresponding to different network state parameter scores in different network condition parameter sets in the network condition parameter set;

[0068] S333. Calculate the network condition score according to all network state parameter scores and their corresponding first weighting weights;

[0069] S334. Query the pre-constructed mapping relation table of network condition score, operation intensity adjustment coefficient and node type adjustment strategy according to the network condition score to obtain the security operation intensity adjustment coefficient and the execution node type adjustment strategy.

[0070] The network condition parameter score of this embodiment is the score determined according to the network condition parameter. Specifically, this embodiment can obtain the network condition parameter score by querying the pre-constructed mapping relation table of network condition parameter and parameter score according to the network condition parameter. Determining the security operation type according to the preliminary security operation in step S331 belongs to the prior art, and its principle will not be elaborated here in detail. Step S332 determines the first weighting weights corresponding to different network state parameter scores in different network condition parameter sets in the network condition parameter set by querying the pre-constructed mapping relation table of operation type and network condition parameter scoring weight combination according to the security operation type. These first weighting weights can reflect the sensitivity of different network condition parameter scores under a specific security operation type. The specific process of step S333 is: calculate the preliminary scores of each network state parameter score according to the network state parameter score and its corresponding first weighting weight respectively; sum up all the preliminary scores to obtain the network condition score. Since the sensitivity of different types of security operations to the same network state parameter is different, this embodiment can determine the first weighting weights corresponding to different network state parameter scores in different network condition parameter sets in the network condition parameter set based on the security operation type, and calculate the network condition score according to all network state parameter scores and their corresponding first weighting weights. Therefore, this embodiment is equivalent to considering the sensitivity of the current security operation type to different network condition parameters when calculating the network condition score, thereby effectively improving the accuracy and reliability of the network condition score, and further effectively improving the accuracy and reliability of the security operation intensity adjustment and reducing the situation that the data transmission delay increases or the data security decreases due to the inappropriate size of the security operation intensity adjustment coefficient.

[0071] In some preferred embodiments, step S334 includes:

[0072] A1. Query the pre-constructed mapping relation table of network condition scores, operation intensity adjustment coefficients, and node type adjustment strategies according to the network condition score to obtain the first preliminary operation intensity adjustment coefficient and execute the node type adjustment strategy;

[0073] A2. Query the pre-constructed mapping relation table of data types and operation intensity adjustment coefficients according to the data classification identifier to obtain the second preliminary operation intensity adjustment coefficient;

[0074] A3. Calculate the safe operation intensity adjustment coefficient based on the first preliminary operation intensity adjustment coefficient and the second preliminary operation intensity adjustment coefficient.

[0075] The mapping relation table of data types and operation intensity adjustment coefficients in this embodiment preferably stores the corresponding relationship between different data classification identifiers and the corresponding second preliminary operation intensity adjustment coefficients. For example, in this mapping relation table, the operation intensity adjustment coefficients corresponding to control instructions and production recipes are 0.95, and the operation intensity adjustment coefficient corresponding to ordinary logs is 0.8. Step A3 can calculate the safe operation intensity adjustment coefficient by multiplying the first preliminary operation intensity adjustment coefficient by the second preliminary operation intensity adjustment coefficient. Since different types of data have different requirements for adjusting the safe operation intensity. For example, the allowable adjustment range of the safe operation intensity for control instructions and production recipes is smaller than that for ordinary logs, and this embodiment can meet the adjustment requirements of the transmitted data for the safe operation intensity by first determining the second preliminary operation intensity adjustment coefficient according to the data classification identifier and then calculating the safe operation intensity adjustment coefficient based on the first preliminary operation intensity adjustment coefficient and the second preliminary operation intensity adjustment coefficient. Therefore, this embodiment can further improve the accuracy and reliability of the safe operation intensity adjustment and reduce the situation of increased data transmission delay or decreased data security caused by inappropriate magnitudes of the safe operation intensity adjustment coefficient.

[0076] In some preferred embodiments, step S333 includes:

[0077] B1. Obtain the network communication protocol, and then query the pre-constructed mapping relation table of communication protocols and network condition parameter score weight combinations according to the network communication protocol to determine the second weighted weights corresponding to different network state parameter scores in the network condition parameter set;

[0078] B2. Calculate the network condition score based on all network state parameter scores and their corresponding first weighted weights and second weighted weights.

[0079] Step B1 can obtain the network communication protocol by reading system configuration or network interface information. The network communication protocol is the specific protocol type used for current data transmission (such as Modbus TCP, EtherNet / IP, or Profine). The mapping relation table of the communication protocol and the network condition parameter scoring weight combination in this embodiment stores the network condition parameter scoring weight combinations corresponding to different communication protocols. The network condition parameter scoring weight combination includes the weighted weights corresponding to different network state parameter scores in the network condition parameter set. For example, for a communication protocol with high real-time requirements, the weighted weight of the network state parameter score corresponding to the packet loss rate is greater than the weighted weight of the network state parameter score corresponding to the congestion degree. For a bandwidth-sensitive protocol, the weighted weight of the network state parameter score corresponding to the congestion degree is greater than the weighted weight of the network state parameter score corresponding to the packet loss rate. The specific process of Step B2 can be: calculate the preliminary scores of each network state parameter score according to the network state parameter score and its corresponding first weighted weight and second weighted weight respectively; sum up all the preliminary scores to obtain the network condition score. Since this embodiment determines the second weighted weight corresponding to different network state parameter scores in the network condition parameter set according to the network communication protocol, and calculates the network condition score according to all network state parameter scores and their corresponding first weighted weight and second weighted weight, this embodiment is equivalent to comprehensively considering the sensitivity of the current security operation type to different network condition parameters and the sensitivity of the current network communication protocol to different network condition parameters when calculating the network condition score, thereby further improving the accuracy and reliability of the network condition score, and further improving the accuracy and reliability of the security operation intensity adjustment and reducing the situation that the data transmission delay increases or the data security decreases due to the inappropriate size of the security operation intensity adjustment coefficient.

[0080] In some preferred embodiments, the network state parameter scores are the network congestion degree score, the data packet loss rate score, and the resource occupancy rate score. The network congestion degree score in this embodiment can reflect the traffic load on the network transmission path. The data packet loss rate score in this embodiment can reflect the proportion of data lost during transmission. The resource occupancy rate score in this embodiment can reflect the usage of network computing resources. This embodiment can calculate the network congestion degree score based on the ratio of network interface traffic to bandwidth. This embodiment can calculate the data packet loss rate score based on the difference between the number of sent data packets and the number of received confirmed data packets within a specific time period. This embodiment can calculate the resource occupancy rate score based on the CPU utilization rate and memory utilization rate of the node.

[0081] In some preferred embodiments, Step S34 includes:

[0082] S341. Analyze whether the safety operation intensity adjustment coefficient is less than or equal to the preset adjustment coefficient upper limit value and greater than or equal to the preset adjustment coefficient lower limit value. If so, adjust the operation intensity of all preliminary safety operations according to the safety operation intensity adjustment coefficient. If not, when the safety operation intensity adjustment coefficient is greater than the preset adjustment coefficient upper limit value, adjust the operation intensity of all preliminary safety operations according to the preset adjustment coefficient upper limit value, and when the safety operation intensity adjustment coefficient is less than the preset adjustment coefficient lower limit value, adjust the operation intensity of all preliminary safety operations according to the preset adjustment coefficient lower limit value.

[0083] This embodiment can analyze whether the safety operation intensity adjustment coefficient is within the allowable range by analyzing whether the safety operation intensity adjustment coefficient is less than or equal to the preset adjustment coefficient upper limit value and greater than or equal to the preset adjustment coefficient lower limit value. If so, the operation intensity of the preliminary safety operation can be directly adjusted using this safety operation intensity adjustment coefficient. If not, when the safety operation intensity adjustment coefficient is greater than the preset adjustment coefficient upper limit value, adjust the operation intensity of all preliminary safety operations according to the preset adjustment coefficient upper limit value, and when the safety operation intensity adjustment coefficient is less than the preset adjustment coefficient lower limit value, adjust the operation intensity of all preliminary safety operations according to the preset adjustment coefficient lower limit value. This embodiment is equivalent to directly using the safety operation intensity adjustment coefficient to adjust the operation intensity of the preliminary safety operation when the safety operation intensity adjustment coefficient is within the allowable range and using the preset adjustment coefficient upper limit value or the preset adjustment coefficient lower limit value to adjust the operation intensity of the preliminary safety operation when the safety operation intensity adjustment coefficient is outside the allowable range. Therefore, this embodiment can effectively avoid the situation where the operation intensity of the preliminary safety operation is excessively enhanced due to an overly large safety operation intensity adjustment coefficient, resulting in increased data transmission delay and device processing burden, as well as the situation where the operation intensity of the preliminary safety operation is excessively weakened due to an overly small safety operation intensity adjustment coefficient, leading to a decline in data security.

[0084] In some preferred embodiments, both the preset upper limit value of the adjustment coefficient and the preset lower limit value of the adjustment coefficient are determined based on the data classification identifier and the set of network condition parameters. Since both the preset upper limit value of the adjustment coefficient and the preset lower limit value of the adjustment coefficient in this embodiment are determined based on the data classification identifier and the set of network condition parameters, and the data classification identifier can reflect the type of data to be transmitted, while the set of network condition parameters can reflect the current network environment, this embodiment is equivalent to dynamically adjusting the preset upper limit value and the preset lower limit value of the adjustment coefficient according to the type of data to be transmitted and the current network environment, so that the finally determined data security transmission strategy can better balance the data security requirements, the device computing power, and the network transmission efficiency, thereby effectively improving the reliability of data transmission. Specifically, this embodiment can determine the preset upper limit value and the preset lower limit value of the adjustment coefficient by querying a pre-constructed mapping relationship table of data types, network condition parameter combinations, upper limit values of adjustment coefficients, and lower limit values of adjustment coefficients according to the data classification identifier and the set of network condition parameters.

[0085] In some preferred embodiments, step S2 includes:

[0086] S21. Query a pre-constructed mapping relationship table of device identifiers and device computing capabilities according to the target recipient device identifier to obtain preliminary device computing capability parameters;

[0087] S22. Obtain the cumulative running duration of the target recipient device according to the target recipient device identifier, and then query a pre-constructed mapping relationship table of device cumulative running duration and computing capability compensation coefficient according to the cumulative running duration of the target recipient device to obtain the computing capability compensation coefficient of the device;

[0088] S23. Calculate the target recipient device computing capability parameters according to the preliminary device computing capability parameters and the computing capability compensation coefficient of the device.

[0089] This embodiment can use a timer to calculate the cumulative running duration of the device. Specifically, when the device starts running, the timer starts timing, and when the device stops running, the timer stops timing. Therefore, this embodiment can obtain the cumulative running duration of the target recipient device by using the timer corresponding to the target recipient device, and the cumulative running duration of the target recipient device is the cumulative running duration of the target recipient device. The mapping relationship table of device cumulative running duration and computing capability compensation coefficient in this embodiment stores the computing capability compensation coefficients corresponding to different device cumulative running durations. It should be understood that since the device performance gradually decays as the cumulative running duration increases, that is, the greater the cumulative running duration of the target recipient device, the weaker the performance and data processing ability of the target recipient device, the cumulative running duration of the target recipient device in this embodiment is negatively correlated with the computing capability compensation coefficient of the device.

[0090] In some preferred embodiments, the security levels of the security domains to which the nodes on the transmission path belong are all greater than or equal to a preset security level. Since the security levels of the security domains to which the nodes on the transmission path in this embodiment belong are all greater than or equal to the preset security level, this embodiment can enable the network environment and nodes through which the data to be transmitted passes to have sufficient security protection capabilities, thereby effectively avoiding the occurrence of data theft, data tampering, or data loss caused by the data to be transmitted passing through a network area or node with insufficient security protection capabilities.

[0091] In some preferred embodiments, the comprehensive data security transmission method further includes the steps of:

[0092] S5. After the target receiving device receives the data to be transmitted, control the target receiving device to decrypt, verify the signature, and / or perform integrity verification on the data to be transmitted according to the data classification identifier and all security operation identifiers.

[0093] Since the data classification identifier can reflect the type of the data to be transmitted, and the security operation identifier can reflect the security operations performed on the data to be transmitted, after the target receiving device receives the data to be transmitted, this embodiment can control the target receiving device to decrypt, verify the signature, and / or perform integrity verification on the data to be transmitted according to the data classification identifier and all security operation identifiers. It should be understood that after the target receiving device in this embodiment receives the data to be transmitted, controlling the target receiving device to decrypt, verify the signature, and / or perform integrity verification on the data to be transmitted according to the data classification identifier and all security operation identifiers belongs to the prior art, and its working principle will not be elaborated in detail here.

[0094] As can be seen from the above, a comprehensive data security transmission method provided by the present application can determine a data security transmission strategy according to the data classification identifier and the computing power parameter of the target receiving device by determining the data security transmission strategy according to the data classification identifier and the computing power parameter of the target receiving device, so as to avoid insufficient security protection for important data. Since the present application can determine the data security transmission strategy according to the data classification identifier and the computing power parameter of the target receiving device, and the present application can forward the data to be transmitted and the security operations to a node that can perform the security operations on the data to be transmitted in a timely manner when the current node cannot perform the security operations on the data to be transmitted in a timely manner, so as to avoid the situation that a device with limited data processing capabilities cannot encrypt the data to be transmitted in a timely manner due to excessive encryption intensity. Therefore, the present application can effectively solve the problems that a device with limited data processing capabilities cannot encrypt the data in a timely manner due to excessive encryption intensity, the data transmission delay increases significantly, the real-time performance of industrial production is damaged, and due to too low encryption intensity, the security protection of important data is insufficient, important data is accidentally leaked or cannot be normally transmitted to the target device, resulting in industrial production interruption.

[0095] In a second aspect, as Figure 2 shown, the present application further provides an integrated data security transmission system, which includes:

[0096] A data transmission request acquisition module 1, configured to acquire a preset data transmission request according to the data to be transmitted, where the data transmission request includes a data classification identifier, a transmission path, and a target recipient device identifier;

[0097] A computing power parameter acquisition module 2, configured to query a pre-constructed mapping relationship table between device identifiers and device computing power according to the target recipient device identifier to obtain the target recipient device computing power parameter;

[0098] A data security transmission policy acquisition module 3, configured to determine a data security transmission policy according to the data classification identifier and the target recipient device computing power parameter, where the data security transmission policy includes at least one security operation and its corresponding execution node type;

[0099] A data transmission module 4, configured to analyze whether there is an execution node type that matches the type of the current node. If so, perform the security operation corresponding to the execution point type that matches the type of the current node on the data to be transmitted and add a security operation identifier to the data to be transmitted, and then forward the data to be transmitted to the next node according to the transmission path until all security operations are executed and the target recipient device receives the data to be transmitted. If not, forward the data to be transmitted and the security operation to a node that conforms to the execution node type.

[0100] An integrated data security transmission system provided by the present application includes a data transmission request acquisition module 1, a computing power parameter acquisition module 2, a data security transmission policy acquisition module 3, and a data transmission module 4. The integrated data security transmission system provided by this embodiment is used to execute the steps in an integrated data security transmission method provided in the above first aspect. The principle of the integrated data security transmission system provided by this embodiment is the same as the principle of the integrated data security transmission method provided in the above first aspect, and will not be elaborated in detail here.

[0101] As described above, a comprehensive data security transmission method and system provided by the present application can determine a data security transmission strategy according to a data classification identifier and a target recipient device computing capability parameter by determining the data security transmission strategy according to the data classification identifier and the target recipient device computing capability parameter, so as to avoid insufficient security protection for important data. Since the present application can determine the data security transmission strategy according to the data classification identifier and the target recipient device computing capability parameter, and the present application can forward the data to be transmitted and the security operation to a node that can perform the security operation on the data to be transmitted in a timely manner when the current node cannot perform the security operation on the data to be transmitted in a timely manner, so as to avoid the situation that a device with limited data processing capacity cannot encrypt the data to be transmitted in a timely manner due to excessive encryption intensity. Therefore, the present application can effectively solve the problems that a device with limited data processing capacity cannot encrypt the data in a timely manner due to excessive encryption intensity, the data transmission delay increases significantly, the real-time performance of industrial production is damaged, and the security protection of important data is insufficient due to too low encryption intensity, important data is accidentally leaked or cannot be normally transmitted to the target device, and industrial production is interrupted.

[0102] In the embodiments provided by the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the above unit division is only a logical function division, and there may be other division methods in actual implementation. For another example, multiple units or components can be combined or integrated into another robot, or some features can be ignored or not executed. Another point, the displayed or discussed coupling or direct coupling or communication connection between each other can be through some communication interfaces, and the indirect coupling or communication connection of the device or unit can be in electrical, mechanical or other forms.

[0103] In addition, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist alone, or two or more modules can be integrated to form an independent part.

[0104] In this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations.

[0105] The above description is only for the embodiments of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application can have various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A comprehensive data security transmission method, characterized in that The comprehensive data security transmission method includes the following steps: S1. Obtain a pre-set data transmission request according to the data to be transmitted. The data transmission request includes a data classification identifier, a transmission path, and a target recipient device identifier; S2. Query a pre-constructed mapping relationship table of device identifiers and device computing capabilities according to the target recipient device identifier to obtain the target recipient device computing capability parameters; S3. Determine a data security transmission policy according to the data classification identifier and the target recipient device computing capability parameters. The data security transmission policy includes at least one security operation and its corresponding execution node type; S4. Analyze whether there is an execution node type that matches the type of the current node. If so, perform the security operation corresponding to the execution point type that matches the type of the current node on the data to be transmitted and add a security operation identifier to the data to be transmitted, and then forward the data to be transmitted to the next node according to the transmission path until all the security operations are executed and the target recipient device receives the data to be transmitted. If not, forward the data to be transmitted and the security operation to a node that conforms to the execution node type.

2. The integrated data security transmission method according to claim 1, characterized in that Step S3 includes: S31. Query a pre-constructed mapping relationship table of data types, computing capability parameters, and security policies according to the data classification identifier and the target recipient device computing capability parameters to determine a preliminary transmission policy. The preliminary transmission policy includes at least one preliminary security operation and its corresponding preliminary node type; S32. Obtain a set of network condition parameters; S33. Determine a security operation intensity adjustment coefficient and an execution node type adjustment policy according to the set of network condition parameters; S34. Adjust the operation intensity of all the preliminary security operations according to the security operation intensity adjustment coefficient, and adjust all the preliminary node types according to the execution node type adjustment policy to obtain a data security transmission policy. The data security transmission policy is the preliminary transmission policy after adjustment.

3. The integrated data security transmission method according to claim 2, wherein The set of network condition parameters includes multiple network condition parameter scores. Step S33 includes: S331. Determine the security operation type according to the preliminary security operation; S332. Query a pre-constructed mapping relationship table of operation types and network condition parameter score weight combinations according to the security operation type to determine the first weighted weights corresponding to different network state parameter scores in the set of network condition parameters; S333. Calculate the network condition score according to all the network state parameter scores and their corresponding first weighted weights; S334. Query a pre-constructed mapping relationship table of network condition scores, security operation intensity adjustment coefficients, and execution node type adjustment policies according to the network condition score to obtain the security operation intensity adjustment coefficient and the execution node type adjustment policy.

4. The integrated data security transmission method according to claim 3, wherein Step S333 includes: B1. Obtain the network communication protocol, and then query the pre - constructed mapping relation table of communication protocol and network condition parameter scoring weight combination according to the network communication protocol to determine the second weighting weights corresponding to different network state parameter scores in the set of network condition parameters; B2. Calculate the network condition score according to all the network state parameter scores and their corresponding first weighting weights and second weighting weights.

5. The integrated data security transmission method according to claim 3, wherein The network state parameter scores are the network congestion degree score, the data packet loss rate score, and the resource occupancy rate score.

6. The integrated data security transmission method according to claim 2, wherein Step S34 includes: S341. Analyze whether the security operation intensity adjustment coefficient is less than or equal to the preset adjustment coefficient upper limit value and greater than or equal to the preset adjustment coefficient lower limit value. If so, adjust the operation intensity of all the preliminary security operations according to the security operation intensity adjustment coefficient. If not, when the security operation intensity adjustment coefficient is greater than the preset adjustment coefficient upper limit value, adjust the operation intensity of all the preliminary security operations according to the preset adjustment coefficient upper limit value, and when the security operation intensity adjustment coefficient is less than the preset adjustment coefficient lower limit value, adjust the operation intensity of all the preliminary security operations according to the preset adjustment coefficient lower limit value.

7. The integrated data security transmission method according to claim 1, wherein Step S2 includes: S21. Query the pre - constructed mapping relation table of device identifier and device computing power according to the target recipient device identifier to obtain the preliminary device computing power parameters; S22. Obtain the cumulative running duration of the target recipient device according to the target recipient device identifier, and then query the pre - constructed mapping relation table of device cumulative running duration and computing power compensation coefficient according to the cumulative running duration of the target recipient device to obtain the computing power compensation coefficient; S23. Calculate the target recipient device computing power parameters according to the preliminary device computing power parameters and the computing power compensation coefficient.

8. The integrated data security transmission method according to claim 1, characterized in that The security level of each security domain to which the nodes on the transmission path belong is greater than or equal to the preset security level.

9. The integrated data security transmission method according to claim 1, wherein The comprehensive data security transmission method further includes the step: S5. After the target recipient device receives the data to be transmitted, control the target receiving device to decrypt, verify the signature and / or perform integrity verification on the data to be transmitted according to the data classification identifier and all the security operation identifiers.

10. A comprehensive data security transmission system, characterized in that, The comprehensive data security transmission system includes: A data transmission request acquisition module, configured to obtain a pre - set data transmission request according to the data to be transmitted, where the data transmission request includes a data classification identifier, a transmission path, and a target recipient device identifier; A computing power parameter acquisition module, configured to query the pre - constructed mapping relation table of device identifier and device computing power according to the target recipient device identifier to obtain the target recipient device computing power parameters; A data security transmission policy acquisition module, configured to determine a data security transmission policy according to the data classification identifier and the target recipient device computing power parameters, where the data security transmission policy includes at least one security operation and its corresponding execution node type; The data transmission module is used to analyze whether there is an execution node type that matches the type of the current node. If so, it performs a security operation corresponding to the execution point type that matches the type of the current node on the data to be transmitted and adds a security operation identifier to the data to be transmitted, and then forwards the data to be transmitted to the next node according to the transmission path until all the security operations are executed and the target receiving device receives the data to be transmitted. If not, it forwards the data to be transmitted and the security operation to a node that conforms to the execution node type.

Images