Industrial internet data encryption transmission method, system and device, and storage medium

Abstract

The application relates to the technical field of industrial internet, and specifically provides an industrial internet data encryption transmission method, system, device and storage medium, which comprises the following steps: establishing a plurality of encryption transmission channels between an industrial device and a superior terminal; continuously monitoring a network environment of the encryption transmission channel adopted between the industrial device and the superior terminal, wherein the network environment comprises a network quality quantitative value, an encryption component capability quantitative value and a compliance requirement quantitative value; determining an optimal encryption transmission channel according to the network environment, and switching the encryption transmission channel adopted between the industrial device and the superior terminal into the optimal encryption transmission channel; obtaining flow fluctuation before and after the encryption transmission channel is switched, and compensating the flow fluctuation by generating pseudo flow. The application can simultaneously meet the real-time performance and security of industrial data transmission, and further improves the data security through flow control.

Description

Technical Field

[0001] This invention belongs to the field of industrial internet technology, specifically relating to an industrial internet data encryption transmission method, system, device, and storage medium. Background Technology

[0002] Industrial data transmission demands extremely high levels of real-time performance and security. In critical sectors such as smart manufacturing and energy, data latency exceeding milliseconds can lead to control command failures, while insufficient encryption can result in significant risks such as the leakage of production parameters or malicious manipulation of equipment.

[0003] Current industrial systems commonly use pre-configured fixed encryption methods (such as a single AES-256 or static IPSec tunnel), which have significant drawbacks: First, when high-strength encryption algorithms (such as RSA-2048) are run on resource-constrained industrial terminals, the encryption and decryption delay can reach tens of milliseconds, which seriously affects real-time control; Second, fixed encryption modes will form characteristics such as periodic data packet length and sending intervals, which attackers can use to locate key nodes through traffic analysis, and then carry out replay attacks or man-in-the-middle attacks. Summary of the Invention

[0004] In view of the above-mentioned shortcomings of the prior art, the present invention provides an industrial internet data encryption transmission method, system, device and storage medium to solve the above-mentioned technical problems.

[0005] In a first aspect, the present invention provides a method for encrypted data transmission in the industrial internet, comprising: Establish multiple encrypted transmission channels between industrial equipment and upstream terminals; Continuously monitor the network environment of the encrypted transmission channel used between industrial equipment and upstream terminals. The network environment includes network quality quantification value, encryption component capability quantification value, and compliance requirement quantification value. The optimal encrypted transmission channel is determined based on the network environment, and the encrypted transmission channel used between the industrial equipment and the upper-level terminal is switched to the optimal encrypted transmission channel. The system acquires traffic fluctuations before and after switching encrypted transmission channels, and compensates for these fluctuations by generating pseudo-traffic.

[0006] In one optional implementation, multiple encrypted transmission channels are established between the industrial equipment and the upstream terminal, including: Multiple transmission channels are established between industrial equipment and upstream terminals, and these transmission channels are compatible with multiple communication protocols. Obtain the encryption algorithms that can be used for each transmission channel, and record the combination of encryption algorithm and transmission channel as an encrypted transmission channel; The industrial equipment and the upper-level terminal negotiate and generate corresponding keys for each encrypted transmission channel.

[0007] In one optional implementation, the network environment of the encrypted transmission channel in operation is continuously monitored. This network environment includes quantitative values ​​for network quality, encryption component capabilities, and compliance requirements, including: Predict bandwidth and latency fluctuation entropy, and record the weighted sum of bandwidth and latency fluctuation entropy as the network quality quantification value; Obtain the battery health and CPU temperature of the encryption component, and record the weighted sum of the battery health and CPU temperature as the quantification value of the encryption component's capabilities; Based on the function and location of the industrial equipment and the pre-defined encryption algorithm selection rules, a quantitative value for compliance requirements is generated.

[0008] In an optional implementation, determining the optimal encrypted transmission channel based on the network environment includes: The network quality quantification value, encryption component capability quantification value, and compliance requirement quantification value are normalized to obtain the network quality coefficient, encryption component capability coefficient, and compliance requirement coefficient. The marginal contribution values ​​of each factor are calculated using the network quality coefficient, the encryption component capability coefficient, and the compliance requirement coefficient. The decision value is obtained by weighted summing of the marginal contribution values ​​of the network quality coefficient, encryption component capability coefficient, and compliance requirement coefficient. Based on the pre-defined correspondence between the decision value range and the encrypted transmission channel, and the decision value itself, the optimal encrypted transmission channel is determined.

[0009] In an optional implementation, the marginal contribution value is calculated using the network quality coefficient, the encryption component capability coefficient, and the compliance requirement coefficient, including: Marginal contribution is calculated using the following formula:

[0010] Where M={N,D,C}, N is the network quality coefficient, N∈[0,1]; D is the device capability coefficient, D∈[0,1]; C is the compliance requirement coefficient, C∈{0.3,0.7}, 0.3 is general compliance, 0.7 is mandatory compliance; the characteristic function v(S) is defined as the maximum utility of the alliance S; i∈{N,D,C} The marginal contribution to the network quality coefficient. The marginal contribution to the energy coefficient of the equipment. Marginal contribution of compliance requirement coefficient.

[0011] In an optional implementation, the marginal contribution values ​​of the network quality coefficient, the encryption component capability coefficient, and the compliance requirement coefficient are weighted and summed to obtain a decision value, including: Constructing network quality coefficient weights Encryption component capability coefficient weight And compliance requirement coefficient weight The optimization objective function is:

[0012] Among them, W pred W is the decision value corresponding to the weight values. real The optimal decision value is manually labeled, and Regret is the regret value of historical decisions, which is the difference between the actual and optimal returns. A Gaussian process model is constructed based on the aforementioned objective function. The model is then iteratively optimized using a Bayesian algorithm to obtain the desired results. , and The dynamic value; Calculate the decision value:

[0013] The marginal contribution to the network quality coefficient. The marginal contribution to the energy coefficient of the equipment. Marginal contribution of compliance requirement coefficient.

[0014] In one optional implementation, the traffic fluctuations before and after the encrypted transmission channel switching are obtained, and the traffic fluctuations are compensated by generating pseudo-traffic, including: Based on a pre-built traffic feature library, the original traffic features of the encrypted transmission channel before the switchover and the new traffic features of the encrypted transmission channel after the switchover are obtained. Based on the differences between the new traffic characteristics and the original traffic characteristics, pseudo traffic is generated.

[0015] Secondly, the present invention provides an industrial internet data encryption transmission system, comprising: The basic setup module is used to establish multiple encrypted transmission channels between industrial equipment and upper-level terminals; The environmental monitoring module is used to continuously monitor the network environment of the encrypted transmission channel used between industrial equipment and the upper-level terminal. The network environment includes network quality quantification value, encryption component capability quantification value, and compliance requirement quantification value. The channel switching module is used to determine the optimal encrypted transmission channel based on the network environment and switch the encrypted transmission channel used between the industrial equipment and the upper-level terminal to the optimal encrypted transmission channel. The traffic compensation module is used to obtain the traffic fluctuations before and after the encrypted transmission channel switching, and to compensate for the traffic fluctuations by generating pseudo traffic.

[0016] Thirdly, a device is provided, comprising: Memory is used to store encrypted data transmission programs for the Industrial Internet; A processor is configured to implement the steps of the industrial internet data encryption transmission method provided in the first aspect when executing the industrial internet data encryption transmission program.

[0017] Fourthly, a computer-readable storage medium is provided, on which an industrial internet data encryption transmission program is stored, wherein when the industrial internet data encryption transmission program is executed by a processor, the steps of the industrial internet data encryption transmission method provided in the first aspect are implemented.

[0018] The beneficial effects of this invention are that the industrial internet data encryption transmission method, system, device, and storage medium provided by this invention, by dynamically switching the optimal encryption channel and adaptively selecting a low-latency algorithm (such as the lightweight ChaCha20) based on network quality, control the encryption and decryption time to the millisecond level, meeting the real-time requirements of industrial control commands. The multi-channel mechanism combined with traffic compensation technology effectively obfuscates traffic characteristics, preventing attackers from carrying out replay or man-in-the-middle attacks through pattern analysis, while ensuring that the encryption strength meets the requirements of the information security compliance standard through compliance quantification.

[0019] Furthermore, the design principle of this invention is reliable, the structure is simple, and it has a very wide range of application prospects. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a schematic flowchart of a method according to an embodiment of the present invention.

[0022] Figure 2 This is a schematic block diagram of a system according to an embodiment of the present invention.

[0023] Figure 3 This is a schematic diagram of the structure of a device provided in an embodiment of the present invention. Detailed Implementation

[0024] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this invention.

[0025] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention.

[0026] The industrial internet data encryption transmission method provided in this embodiment of the invention is executed by a computer device, and correspondingly, the industrial internet data encryption transmission system runs in the computer device.

[0027] Figure 1 This is a schematic flowchart illustrating a method according to an embodiment of the present invention. Wherein, Figure 1 The implementing entity can be an industrial internet data encryption transmission system. Depending on different requirements, the order of the steps in this flowchart can be changed, and some steps can be omitted.

[0028] like Figure 1 As shown, the method includes: S1. Establish multiple encrypted transmission channels between industrial equipment and upstream terminals; S2. Continuously monitor the network environment of the encrypted transmission channel used between industrial equipment and the upper-level terminal, wherein the network environment includes network quality quantification value, encryption component capability quantification value, and compliance requirement quantification value; S3. Determine the optimal encrypted transmission channel based on the network environment, and switch the encrypted transmission channel used between the industrial equipment and the upper-level terminal to the optimal encrypted transmission channel; S4. Obtain the traffic fluctuations before and after the encrypted transmission channel switching, and compensate for the traffic fluctuations by generating pseudo traffic.

[0029] In one embodiment of the present invention, based on step S1, the following will provide a possible embodiment and describe its specific implementation in a non-limiting manner.

[0030] S101. Multiple transmission channels are established between industrial equipment and the upper-level terminal, and the transmission channels are compatible with multiple communication protocols.

[0031] 1. Transmission channel types and applicable scenarios.

[0032] Wired channel: Industrial Ethernet (EtherNet / IP, PROFINET) is used for high real-time scenarios (such as production line control), supports the IEEE 802.3 standard, and requires the configuration of industrial-grade switches (supporting ring network redundancy, such as the Hirschmann RSPE series).

[0033] Communication protocol: OPCUA over TCP is used for data modeling and transmission, or Modbus TCP protocol (port 502) can be used directly.

[0034] Serial communication (RS-485 / RS-232) is suitable for upgrading old equipment, with a transmission distance of up to 1200 meters (RS-485). It requires an isolation converter (such as MOXAUC-7450).

[0035] Communication protocols: ModbusRTU (master-slave mode), DNP3 (power industry), or custom binary protocols.

[0036] Wireless channel, 5G / 4G (LTE), used for remote monitoring scenarios, requires industrial-grade CPE equipment (such as Huawei 5G industrial module MH5000), and supports APN / VPDN private network access.

[0037] Communication protocol: MQTT over TLS (port 8883), or CoAP protocol (lightweight IoT protocol, port 5684).

[0038] Wi-Fi (IEEE 802.11n / ac) is suitable for interconnecting devices within a factory LAN. It requires the deployment of an industrial-grade AP (such as Cisco Aironet 1850) and supports WPA3-Enterprise certification.

[0039] Communication protocol: OPCUA over HTTPS (port 443), or HTTP / 2 protocol (for RESTful API data interaction).

[0040] NB-IoT / LoRa is suitable for low-power, wide-coverage scenarios (such as sensor data acquisition) and requires connection to an operator's IoT platform (such as Alibaba Cloud LinkWAN).

[0041] Communication protocol: LWM2M (lightweight M2M protocol) or custom JSON format encapsulation.

[0042] 2. Multi-channel redundancy design.

[0043] Automatic switching between wired and wireless channels is achieved by using Link Aggregation-Link-Convergence-Cycle (LACP) or Multipath Transmission-TCP (MPTCP) technologies.

[0044] Example: Industrial Ethernet is the primary channel, and 5G is the backup channel. Fault switching is achieved through VRRP (Virtual Router Redundancy Protocol) (switching time < 50ms).

[0045] S102. Obtain the encryption algorithms that can be used for each transmission channel, and record the combination of encryption algorithm and transmission channel as encrypted transmission channel.

[0046] Different encryption algorithms are adapted to different transmission channels, and the impact on security and performance must be considered comprehensively. For example: Industrial Ethernet (OPCUA): It uses the highly secure AES-256-GCM algorithm for data encryption, combines it with ECDSA-SHA384 for authentication, and uses HKDF for key derivation; this combination has a small impact on throughput, which is controlled within 10%.

[0047] ModbusRTU: It adopts the lightweight SRP-6a secure remote cryptographic protocol and ChaCha20-Poly1305 encryption algorithm, which has a low impact on performance and a throughput decrease of no more than 5%, making it suitable for upgrading old equipment.

[0048] MQTToverTLS: This scheme uses RSA-4096 for certificate exchange, AES-128-CCM for transmission encryption, and SHA-384 for message digest. It offers high security but has a significant impact on throughput, approximately 15%.

[0049] CoAPoverDTLS: For resource-constrained devices, it uses ECC-256 elliptic curve cryptography, combined with AES-128-GCM and Poly1305 algorithms, to keep the throughput impact to around 8% while ensuring a certain level of security.

[0050] The key is identified using a 5-tuple: {Channel Type, Physical Interface, Communication Protocol, Encryption Algorithm, Key Version}. Example: Wireless-5G-MQTT-AES256GCM-V1, used to identify a version 1 key channel based on a 5G channel, MQTT protocol, and AES-256-GCM encryption.

[0051] Dynamic binding mechanism: Associates channels and algorithms through device configuration files (such as XML format), supporting hot switching (such as communication is not interrupted when upgrading from AES-128 to AES-256).

[0052] S103. Negotiate and generate corresponding keys for each encrypted transmission channel between the industrial equipment and the upper-level terminal.

[0053] 1. Key negotiation protocol.

[0054] Certificate-based key exchange (suitable for high-security scenarios), process: Industrial equipment and upstream terminals each generate ECDSA key pairs (private key stored locally, public key stored in CA-issued X.509 certificate). Negotiate a temporary session key (master key MK) via a TLS handshake (such as the ECDHE-ECDSA-AES256-GCM-SHA384 suite). The data encryption key (DEK) and identity authentication key (AIK) are derived from MK, using the HKDF algorithm (the salt value is the device MAC address + timestamp).

[0055] Pre-shared key (PSK) mechanism (suitable for resource-constrained devices), process: Before the device leaves the factory, a PSK (such as a 32-byte random key) is burned into the secure element (SE, such as NXP A71CH). Key negotiation is performed through the SRP protocol to prevent PSK leakage during transmission (calculation formula: S=g^abmodN, where g is the generator and N is a large prime number). The session key is generated by PSKXOR(Device ID||Timestamp) and is updated hourly.

[0056] 2. Key Management System (KMS) Integration.

[0057] A hierarchical key architecture is adopted: Root key (RK): Stored in a hardware security module (HSM, such as ThalesLunaSA) and accessed via an API interface.

[0058] Zone Key (ZMK): Divided by factory / workshop, transmitted to the device gateway using RK encryption.

[0059] Device Key (DK): Unique to each device, distributed encrypted by ZMK, and stored in the device's secure storage area (such as ARMTrustZone).

[0060] Key lifecycle management: Generation: Generated using a True Random Number Generator (TRNG), with an entropy value ≥ 256 bits.

[0061] Distribution: Encrypted transmission via out-of-band channels (such as USB security tokens) or OTA (Over-The-Air) (using AES-256-CBC mode, IV randomly generated).

[0062] Rotation: Updated periodically (e.g., weekly) via a key negotiation protocol. Old keys must be destroyed after HMAC-SHA256 verification.

[0063] The following is an example of key derivation: SM2 key negotiation formula:

[0064] d A and d B The private keys for the client and server are randomly generated integers.

[0065] PB=d B ⋅G: The server's public key, derived from the private key d B The elliptic curve base point G is generated.

[0066] r A The client calculates a temporary value using the hash function H1 (SM3) to ensure that the negotiation process is unpredictable.

[0067] Z: A shared secret value generated by both parties through elliptic curve dot product operations, used to derive the master key.

[0068] K: The final negotiated 256-bit master key, expressed using a key derivation function (KDF) to the coordinates x of the shared secret value. Z and y Z Process and generate.

[0069] HKDF Extended AES Key Formula: PRK=HMAC−SM3(salt,SKM),AES_key=HMAC−SM3(PRK,info∣∣0x01); salt: A random salt value used to increase the randomness of the key derivation process.

[0070] SKM: Initial key material (e.g., master key K).

[0071] PRK: Pseudo-random key, generated by combining salt and initial key using the HMAC-SM3 algorithm.

[0072] AES_key: An extended AES-256 key, generated by rehashing the PRK and application information (info) using HMAC-SM3.

[0073] SM4 key extension formula: K SM4 =SM3(K init |0x01)⊕SM3(K init |0x02) Kinit: The first 128 bits of the master key.

[0074] SM3(⋅): The Chinese national cryptographic standard SM3 hash function is used to generate fixed-length hash values.

[0075] XOR operation ⊕: XORs the two hash results to enhance the randomness and collision resistance of the key.

[0076] Output: The final 128-bit SM4 key.

[0077] In one embodiment of the present invention, based on step S2, the following will provide a possible embodiment and describe its specific implementation in a non-limiting manner.

[0078] S201. Predict bandwidth and latency fluctuation entropy, and record the weighted sum of bandwidth and latency fluctuation entropy as the network quality quantification value.

[0079] Bandwidth fluctuation entropy: Sampling period: 1 second / sampling, sliding window length = 60 (i.e., 1 minute of data).

[0080] Kalman filter bandwidth prediction formula:

[0081] State equation: Predicts the bandwidth estimate at the current time step. Based on the estimate from the previous moment and control input u k−1 (e.g., historical bandwidth changes).

[0082] Covariance update: Let Q be the covariance matrix representing the prediction error, and let Q be the process noise covariance.

[0083] Kalman gain: dynamically adjusted based on prediction error and observation noise R to determine the observed value z. k (Actual bandwidth) adjustment weights on the estimated value.

[0084] Final estimate: By combining predicted and observed values, a more accurate bandwidth estimate is obtained. .

[0085] Time delay fluctuation entropy: Sampling method: Send ICMP echo packets (TTL=64), record the round-trip time (RTT), and send once every 500ms.

[0086] RTT fluctuation entropy calculation formula:

[0087] t i : Round-trip time (RTT) of the i-th data packet.

[0088] p i Delay t i The probability distribution throughout the entire time delay sequence.

[0089] Shannon entropy H: quantifies the degree of disorder in latency fluctuations. The higher the entropy value, the more severe the network jitter.

[0090] S202. Obtain the battery health and CPU temperature of the encryption component, and record the weighted sum of the battery health and CPU temperature as the quantification value of the encryption component's capabilities.

[0091] Battery health assessment: The battery management system (BMS) data is read via the SMBus protocol to obtain the current capacity C. now and design capacity C design .

[0092] Calculate health status:

[0093] CPU temperature monitoring: Temperature acquisition: Embedded devices: Read via the SoC's internal temperature sensor (such as STM32's TSENSE), with a resolution of 0.1℃.

[0094] x86 devices: CPU core temperature is obtained via LM-Sensors or WMI interface.

[0095] Temperature threshold: Normal range: 0℃~60℃ (no impact on encryption performance).

[0096] Warning range: 61℃~80℃ (encryption throughput decreases by 3% for every 5℃ increase).

[0097] Danger range: >80℃ (triggers thermal throttling, automatically switching to a low-complexity algorithm).

[0098] Weighted sum calculation: Weight configuration: Battery-powered devices: w battery = 0.7,w temp = 0.3; Wired power supply equipment: w battery = 0.2, w temp = 0.8.

[0099] Capability Quantification Value (CQV):

[0100] Among them, T max and T min This is a fixed value that is set.

[0101] S203. Generate a quantitative value for compliance requirements based on the function and location of the industrial equipment and the pre-set encryption algorithm selection rules.

[0102] Industrial equipment can be divided into three categories according to its function: critical control equipment, monitoring equipment, and non-critical equipment. Different categories correspond to different safety levels and compliance requirements. Key control equipment: mainly including PLCs, DCS controllers, etc. These devices are related to the core control links of industrial production and have the highest security level. They must use encryption algorithms of AES-256-GCM or higher to ensure the security and integrity of data transmission and control commands.

[0103] Monitoring equipment: including sensors, RTUs, etc., mainly responsible for data monitoring and acquisition. The security level is medium and must support the AES-128-CBC encryption algorithm to ensure the confidentiality of monitoring data during transmission.

[0104] Non-critical equipment, such as HMIs and printers, has relatively low importance in industrial production processes and the lowest security level. Depending on the actual situation, simple security processing of data can be performed using methods such as SHA-256 hash verification.

[0105] Geographic location compliance rules, regional division: Core production area: requires encryption modules with EAL4+ security certification and key length ≥ 256 bits.

[0106] Factory boundary: EAL2 level encryption is allowed, but the key must be updated regularly (every 24 hours).

[0107] Remote work area: Must meet GDPR / Level 3 security protection requirements and support data encryption when leaving the country.

[0108] Compliance Quantification Value Calculation: (1) Rule matching: Function matching: Query the pre-configured security level matrix by device ID.

[0109] Location matching: Look up the geographic location database by GPS location or IP address.

[0110] Algorithm compliance: Compare the currently used encryption algorithm with the rule base and calculate a compliance score.

[0111] Compliance Quantification Value (RQV):

[0112] Among them, rules i Compliance {0, 0.5, 1} (non-compliant / partially compliant / fully compliant), w i The weights are the rule weights (e.g., function weight 0.6, location weight 0.4).

[0113] In one embodiment of the present invention, based on step S3, the following will provide a possible embodiment and describe its specific implementation in a non-limiting manner.

[0114] S301. Normalize the network quality quantification value, encryption component capability quantification value, and compliance requirement quantification value to obtain the network quality coefficient, encryption component capability coefficient, and compliance requirement coefficient.

[0115] The minimum and maximum values ​​are updated hourly, and the dynamic boundary is calculated using a sliding window (length = 24 hours) to adapt to changes in the network environment.

[0116] Example: If the network quality suddenly deteriorates during a certain period, causing the maximum NQV value to increase from 0.8 to 0.95, dynamic adjustment can be used to avoid the normalized coefficients being overly concentrated at the low end.

[0117] S302. Calculate the marginal contribution value of each using the network quality coefficient, encryption component capability coefficient, and compliance requirement coefficient.

[0118] Marginal contribution is calculated using the following formula:

[0119] Where M={N,D,C}, N is the network quality coefficient, N∈[0,1]; D is the device capability coefficient, D∈[0,1]; C is the compliance requirement coefficient, C∈{0.3,0.7}, 0.3 is general compliance, 0.7 is mandatory compliance; the characteristic function v(S) is defined as the maximum utility of the alliance S; i∈{N,D,C} The marginal contribution to the network quality coefficient. The marginal contribution to the energy coefficient of the equipment. Marginal contribution of compliance requirement coefficient.

[0120] Detailed calculation steps: Measure the current environmental parameters: N=0.6 (bandwidth 60Mbps, RTT=120ms), D=0.4 (battery 35%, temperature coefficient 0.7), C=0.7 (mandatory compliance).

[0121] Calculate the utility value of all sub-coalitions: 1. Single-member sub-alliance.

[0122] {N} (Network Node Only): When the network node operates independently, its utility value is 50. This includes core capabilities such as basic bandwidth provision and routing optimization, but lacks device connectivity and compliance certification.

[0123] {D} (End Device Only): Isolated devices can only perform local data processing, with a utility value of 30. Due to the lack of network connectivity, data transmission or compliance verification is impossible.

[0124] {C} (Compliance Auditor Only): The utility value of the standalone compliance module is 20, which is reflected in static capabilities such as rule base maintenance, and does not actually participate in business flow supervision.

[0125] 2. Dual-member sub-alliance.

[0126] {N,D} (Network + Device): The efficiency of their collaboration jumps to 90. The network provides real-time connectivity to devices (improving data transmission efficiency by 40%), and devices provide feedback on network status data (optimizing topology discovery speed by 25%), but the lack of compliance review may lead to data breach risks.

[0127] {N,C} (Network + Compliance): Utility value is 80. The compliance module performs encrypted auditing of network traffic (blocking 15 unauthorized accesses per hour), but the lack of connection to actual devices prevents the policy from being dynamically adjusted.

[0128] {D,C} (Device + Compliance): Utility value is 60. The compliance module directly monitors the device operation logs (intercepting 8 unauthorized operations per minute), but due to limitations in local processing capabilities, the response latency increases by 200ms.

[0129] 3. Full member sub-alliance ({N,D,C}).

[0130] When the three parties work together, the utility reaches its maximum value of 150, exhibiting superadditivity. Network layer: Provides 5G ultra-low latency connectivity for devices (latency <10ms); Device layer: Real-time reporting of environmental data (sampling rate increased to 1kHz); Compliance layer: Dynamically implement GDPR data filtering (sensitive information interception rate of 99.9%).

[0131] At this point, the total utility is 50% higher than the sum of the utilities of each independent sub-alliance (50+30+20=100), reflecting the synergistic effect.

[0132] 4. Marginal contribution calculation (based on Shapley value).

[0133] Taking the calculation of N's contribution as an example: Added in order of first position: {N} → Utility 50 (no change in contribution); The order of addition is 2nd: Add the following after {D}: {D}→{D,N} Utility increment = 90-30=60; Add the following after {C}: {C}→{C,N} Utility increment = 80-20=60; The order of addition is the 3rd position: {D,C}→{D,C,N}. Utility increment = 150-60=90; The final Shapley value of N is:

[0134] Similarly, ϕ can be calculated. D =36.67,ϕ C =20.

[0135] S303. The marginal contribution values ​​of the network quality coefficient, encryption component capability coefficient, and compliance requirement coefficient are weighted and summed to obtain the decision value.

[0136] Network quality coefficient weights are set in layers based on business needs. Encryption component capability coefficient weight And compliance requirement coefficient weight Initial value: Compliance-first type (finance, government):

[0137] Performance-first (live video streaming, IoT):

[0138] Energy-saving equipment (mobile terminals, wearable devices):

[0139] Constructing network quality coefficient weights Encryption component capability coefficient weight And compliance requirement coefficient weight The optimization objective function is:

[0140] Among them, W pred W is the decision value corresponding to the weight values. real The optimal decision value is manually labeled, and Regret is the regret value of historical decisions, which is the difference between the actual and optimal returns. A Gaussian process model is constructed based on the aforementioned objective function. The model is then iteratively optimized using a Bayesian algorithm to obtain the desired results. , and Dynamic value: Constructing a Gaussian process model: .

[0141] Initialization phase: Input: Historical data D={x t ,y t}t=1N, where yt=[f1(x t ),...,fM(x t ),Regret(x t )] Model building: for each objective f i The GP model was trained independently by Regret.

[0142] Bayesian optimization iteration: Step 1: Based on the current GP model, calculate the acquisition function a(x); where a(x) = E[HVI(x)]; Step 2: Select candidate points x that maximize the acquisition function next ,

[0143] Step 3: Evaluate x next The target value fi(x) next ) and actual Regret; Step 4: Update the dataset D←D∪{x} next ,y next}; Step 5: Retrain the GP model and proceed to the next iteration.

[0144] Termination conditions: Preset fixed number of rounds (e.g., 100 times), overvolume improvement is less than the threshold ϵ (e.g., ΔHV < 1e−4), and the rate of decrease in Regret for K consecutive rounds is less than δ (e.g., K=5, δ=1%).

[0145] Calculate the decision value:

[0146] The marginal contribution to the network quality coefficient. The marginal contribution to the energy coefficient of the equipment. Marginal contribution of compliance requirement coefficient.

[0147] S304. Determine the optimal encrypted transmission channel based on the pre-set correspondence between the decision value range and the encrypted transmission channel, and the decision value.

[0148] For example, if W≥0.65, select SM4-CBC (compliance priority); if 0.5≤W<0.65, select AES-CTR (performance priority); if W<0.5, trigger an alarm and downgrade to AES-128.

[0149] In one embodiment of the present invention, based on step S4, the following will provide a possible embodiment and describe its specific implementation in a non-limiting manner.

[0150] S401. Based on a pre-built traffic feature library, obtain the original traffic features of the encrypted transmission channel before the switchover and the new traffic features of the encrypted transmission channel after the switchover.

[0151] Traffic characteristics can be categorized from four aspects: time series, structure, content, and behavior. Temporal characteristics: This mainly focuses on the distribution characteristics of traffic over time. Using a sliding window with a duration of 1 second and a step size of 0.1 seconds, data such as packet interval time, burst frequency, and traffic duration are statistically analyzed, and their mean, standard deviation, and skewness are calculated. For example, packet interval time reflects the regularity of data packet transmission intervals, while burst frequency reflects the concentration of traffic within a short period.

[0152] Structural characteristics: This focuses on the internal structure and protocol attributes of data packets. Tools such as NFStream or Scapy are used to parse IP, TCP, and UDP packets, extracting information such as packet size distribution and protocol header fields (e.g., TTL, window size). Packet size distribution shows the proportion of data packets of different sizes, while protocol field values ​​such as TTL and window size help analyze network transmission characteristics.

[0153] Content Features: Focusing on the encryption characteristics and protocol identification of traffic data, this feature calculates the entropy value of encrypted traffic to measure the degree of data corruption, and extracts protocol fingerprints, such as the TLS version, CipherSuite, and certificate information during the TLS handshake process. Higher encrypted traffic entropy values ​​generally indicate stronger data confidentiality, while protocol fingerprints can accurately identify the type of protocol used in communication.

[0154] Behavioral Characteristics: Based on NetFlow data, analyze behavioral patterns such as connection establishment frequency and port usage patterns. By statistically analyzing source / destination port distribution and calculating connection establishment success rate, it is possible to gain insights into the communication behavior patterns between devices in the network, such as determining whether there is abnormal port usage or frequent connection attempts.

[0155] An online learning algorithm (such as Isolation Forest) is used to update the abnormal baseline regularly, and the feature weights are adjusted through incremental learning every 24 hours.

[0156] Original traffic feature extraction: Within 5 minutes before channel switching, traffic samples are collected at 100ms intervals, and the following features are extracted: #Example: Extract TCP packet interval time features def extract_interarrival_time(pcap_file): packets = rdpcap(pcap_file) timestamps = [p.time for p in packets ifp.haslayer(TCP)] interarrival = [timestamps[i+1]- timestamps[i] for i inrange(len(timestamps)-1)]return { 'mean': np.mean(interarrival), 'std':np.std(interarrival), 'skewness': stats.skew(interarrival), 'kurtosis': stats.kurtosis(interarrival)}.

[0157] S402. Generate pseudo-traffic based on the differences between the new traffic characteristics and the original traffic characteristics.

[0158] When generating pseudo-traffic, to ensure its similarity to the original traffic characteristics, appropriate preservation strategies need to be adopted for different characteristic types: Temporal characteristics: By replicating the packet interval time distribution of the original traffic, a new timestamp is generated using an inverse transformation sampling method, thereby maintaining the distribution characteristics of the traffic in the time series and ensuring that the pseudo traffic is consistent with the original traffic in terms of packet sending interval patterns.

[0159] Structural features: The TTL in the IP / TCP header is fixed at 64, the window size is set to 65535, etc., and only the checksum and sequence number are modified to ensure that the internal structure and protocol attributes of the data packet remain basically unchanged and to maintain the similarity of network transmission characteristics.

[0160] Content features: Ensure that the entropy value of the encrypted traffic of the fake traffic is the same as that of the original traffic. By adjusting the parameters of the random number generator, the data disorder and confidentiality of the fake traffic are kept consistent with those of the original traffic, while retaining key content identifiers such as protocol fingerprints.

[0161] Behavioral characteristics: Simulate the connection establishment pattern of the original traffic, such as setting a new connection to be established every 5 seconds and controlling the distribution of connection duration, thereby replicating the behavioral patterns of inter-device communication in the original traffic and avoiding detection and identification due to differences in behavioral patterns.

[0162] Pseudo-traffic injection strategy: Traffic mixing ratio: Dynamically adjusted based on characteristic differences, using the following formula: Pseudo-traffic percentage = min(1, k * feature difference) Where k is the adjustment coefficient (usually taken as 0.8) to ensure that the total flow characteristics are close to the original distribution.

[0163] Injection timing control: Within the first 30 seconds after channel switching, inject pseudo-traffic at an exponential decay rate (e.g., an initial proportion of 50%, decreasing by 10% every 5 seconds) to avoid sudden traffic changes triggering alarms in the detection system.

[0164] In some embodiments, the industrial internet data encryption transmission system may include multiple functional modules composed of computer program segments. The computer programs for each program segment in the industrial internet data encryption transmission system may be stored in the memory of a computer device and executed by at least one processor to perform (see details). Figure 1 (Description) The function of encrypted data transmission in the Industrial Internet.

[0165] In this embodiment, the industrial internet data encryption transmission system can be divided into multiple functional modules according to its functions, such as... Figure 2 As shown. The module referred to in this invention is a series of computer program segments that can be executed by at least one processor and perform a fixed function, and is stored in memory. In this embodiment, the functions of each module will be described in detail in subsequent embodiments.

[0166] The basic setup module is used to establish multiple encrypted transmission channels between industrial equipment and upper-level terminals; The environmental monitoring module is used to continuously monitor the network environment of the encrypted transmission channel used between industrial equipment and the upper-level terminal. The network environment includes network quality quantification value, encryption component capability quantification value, and compliance requirement quantification value. The channel switching module is used to determine the optimal encrypted transmission channel based on the network environment and switch the encrypted transmission channel used between the industrial equipment and the upper-level terminal to the optimal encrypted transmission channel. The traffic compensation module is used to obtain the traffic fluctuations before and after the encrypted transmission channel switching, and to compensate for the traffic fluctuations by generating pseudo traffic.

[0167] Figure 3The industrial internet data encryption transmission method provided in this application embodiment can be applied to devices. Those skilled in the art will understand that the device structure involved in the embodiments of this invention does not constitute a limitation on the device. A device may include more or fewer components than illustrated, or combine certain components, or have different component arrangements. In the embodiments of this invention, the device includes, but is not limited to, laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the embodiments of this application described and / or claimed herein.

[0168] The device 300 may include a processor 310, a memory 320, and a communication unit 330. These components communicate via one or more buses. Those skilled in the art will understand that the server structure shown in the figure does not constitute a limitation of the present invention. It may be a bus topology or a star topology, and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0169] The memory 320 can be used to store execution instructions of the processor 310. The memory 320 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. When the execution instructions in the memory 320 are executed by the processor 310, the device 300 is able to perform some or all of the steps in the above method embodiments.

[0170] The processor 310 serves as the control center of the storage device, connecting various parts of the electronic device via various interfaces and lines. It executes software programs and / or modules stored in the memory 320, and calls data stored in the memory to perform various functions of the electronic device and / or process data. The processor can be composed of integrated circuits (ICs), such as a single packaged IC or multiple packaged ICs with the same or different functions connected together. For example, the processor 310 may consist only of a central processing unit (CPU). In this embodiment of the invention, the CPU may have a single processing core or include multiple processing cores.

[0171] The communication unit 330 is used to establish a communication channel, enabling the storage device to communicate with other devices. It can receive user data sent by other devices or send user data to other devices.

[0172] The present invention also provides a computer storage medium, wherein the computer storage medium may store a program, which, when executed, may include some or all of the steps provided in the embodiments of the present invention. The storage medium may be a magnetic disk, an optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0173] Those skilled in the art will clearly understand that the techniques in the embodiments of the present invention can be implemented using software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solutions in the embodiments of the present invention, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, or any other medium capable of storing program code. It includes several instructions to cause a computer device (which may be a personal computer, a server, or a second device, network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention.

[0174] The same or similar parts between the various embodiments in this specification can be referred to mutually. In particular, the device embodiments are basically similar to the method embodiments, so the description is relatively simple, and the relevant parts can be referred to the description in the method embodiments.

[0175] In the embodiments provided by this invention, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between systems or modules may be electrical, mechanical, or other forms.

[0176] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0177] In addition, the functional modules in the various embodiments of the present invention can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module.

[0178] Although the present invention has been described in detail with reference to the accompanying drawings and preferred embodiments, the present invention is not limited thereto. Various equivalent modifications or substitutions can be made to the embodiments of the present invention by those skilled in the art without departing from the spirit and essence of the invention, and such modifications or substitutions should all be within the scope of the present invention. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should also be covered within the protection scope of the present invention.

Claims

1. A method for encrypted data transmission in the industrial internet, characterized in that, include: Establish multiple encrypted transmission channels between industrial equipment and upstream terminals; Continuously monitor the network environment of the encrypted transmission channel used between industrial equipment and upstream terminals. The network environment includes network quality quantification value, encryption component capability quantification value, and compliance requirement quantification value. The optimal encrypted transmission channel is determined based on the network environment, and the encrypted transmission channel used between the industrial equipment and the upper-level terminal is switched to the optimal encrypted transmission channel. The system acquires traffic fluctuations before and after switching encrypted transmission channels, and compensates for these fluctuations by generating pseudo-traffic. Among these, determining the optimal encrypted transmission channel based on the network environment includes: The network quality quantification value, encryption component capability quantification value, and compliance requirement quantification value are normalized to obtain the network quality coefficient, encryption component capability coefficient, and compliance requirement coefficient. The marginal contribution values ​​of each factor are calculated using the network quality coefficient, the encryption component capability coefficient, and the compliance requirement coefficient. The decision value is obtained by weighted summing of the marginal contribution values ​​of the network quality coefficient, encryption component capability coefficient, and compliance requirement coefficient. Based on the pre-defined correspondence between the decision value range and the encrypted transmission channel, and the decision value itself, the optimal encrypted transmission channel is determined.

2. The method according to claim 1, characterized in that, Multiple encrypted transmission channels are established between industrial equipment and upstream terminals, including: Multiple transmission channels are established between industrial equipment and upstream terminals, and these transmission channels are compatible with multiple communication protocols. Obtain the encryption algorithms that can be used for each transmission channel, and record the combination of encryption algorithm and transmission channel as an encrypted transmission channel; The industrial equipment and the upper-level terminal negotiate and generate corresponding keys for each encrypted transmission channel.

3. The method according to claim 1, characterized in that, Continuously monitor the network environment of the encrypted transmission channel in operation. This network environment includes quantitative values ​​for network quality, encryption component capabilities, and compliance requirements, including: Predict bandwidth and latency fluctuation entropy, and record the weighted sum of bandwidth and latency fluctuation entropy as the network quality quantification value; Obtain the battery health and CPU temperature of the encryption component, and record the weighted sum of the battery health and CPU temperature as the quantification value of the encryption component's capabilities; Based on the function and location of the industrial equipment and the pre-defined encryption algorithm selection rules, a quantitative value for compliance requirements is generated.

4. The method according to claim 1, characterized in that, The marginal contribution values ​​of the network quality coefficient, encryption component capability coefficient, and compliance requirement coefficient are calculated, including: Marginal contribution is calculated using the following formula: Where M={N,D,C}, N is the network quality coefficient, N∈[0,1]; D is the device capability coefficient, D∈[0,1]; C is the compliance requirement coefficient, C∈{0.3,0.7}, 0.3 is general compliance, 0.7 is mandatory compliance; the characteristic function v(S) is defined as the maximum utility of the alliance S; i∈{N,D,C} The marginal contribution to the network quality coefficient. The marginal contribution to the energy coefficient of the equipment. Marginal contribution of compliance requirement coefficient.

5. The method according to claim 1, characterized in that, The decision value is obtained by weighted summing the marginal contribution values ​​of the network quality coefficient, encryption component capability coefficient, and compliance requirement coefficient, including: Constructing network quality coefficient weights Encryption component capability coefficient weight And compliance requirement coefficient weight The optimization objective function is: Among them, W pred W is the decision value corresponding to the weight values. real The optimal decision value is manually labeled, and Regret is the regret value of historical decisions, which is the difference between the actual and optimal returns. A Gaussian process model is constructed based on the aforementioned objective function. The model is then iteratively optimized using a Bayesian algorithm to obtain the desired results. , and The dynamic value; Calculate the decision value: The marginal contribution to the network quality coefficient. The marginal contribution to the energy coefficient of the equipment. Marginal contribution of compliance requirement coefficient.

6. The method according to claim 1, characterized in that, Acquire traffic fluctuations before and after switching encrypted transmission channels, and compensate for these traffic fluctuations by generating pseudo-traffic, including: Based on a pre-built traffic feature library, the original traffic features of the encrypted transmission channel before the switchover and the new traffic features of the encrypted transmission channel after the switchover are obtained. Based on the differences between the new traffic characteristics and the original traffic characteristics, pseudo traffic is generated.

7. An industrial internet data encryption transmission system, characterized in that, include: The basic setup module is used to establish multiple encrypted transmission channels between industrial equipment and upper-level terminals; The environmental monitoring module is used to continuously monitor the network environment of the encrypted transmission channel used between industrial equipment and the upper-level terminal. The network environment includes network quality quantification value, encryption component capability quantification value, and compliance requirement quantification value. The channel switching module is used to determine the optimal encrypted transmission channel based on the network environment and switch the encrypted transmission channel used between the industrial equipment and the upper-level terminal to the optimal encrypted transmission channel. The traffic compensation module is used to obtain the traffic fluctuations before and after the encrypted transmission channel switching, and to compensate for the traffic fluctuations by generating pseudo traffic. Among these, determining the optimal encrypted transmission channel based on the network environment includes: The network quality quantification value, encryption component capability quantification value, and compliance requirement quantification value are normalized to obtain the network quality coefficient, encryption component capability coefficient, and compliance requirement coefficient. The marginal contribution values ​​of each factor are calculated using the network quality coefficient, the encryption component capability coefficient, and the compliance requirement coefficient. The decision value is obtained by weighted summing of the marginal contribution values ​​of the network quality coefficient, encryption component capability coefficient, and compliance requirement coefficient. Based on the pre-defined correspondence between the decision value range and the encrypted transmission channel, and the decision value itself, the optimal encrypted transmission channel is determined.

8. A device, characterized in that, include: Memory is used to store encryption transmission programs for industrial internet data; A processor, configured to implement the steps of the industrial internet data encryption transmission method as described in any one of claims 1-6 when executing the industrial internet data encryption transmission program.

9. A computer-readable storage medium storing a computer program, characterized in that, The readable storage medium stores an industrial internet data encryption transmission program, which, when executed by a processor, implements the steps of the industrial internet data encryption transmission method as described in any one of claims 1-6.

Images