Methods and systems for secure storage and verification of industrial data in a trusted computing environment

Abstract

This invention relates to the field of data storage and verification technology, specifically to a method and system for secure storage and verification of industrial data in a trusted computing environment. It includes: acquiring industrial sensor data; determining a simulated time point sequence; matching the simulated time point sequence and a scattered time point sequence according to their permutation order to obtain time point pairs, and determining an ascending time difference absolute value sequence; determining anomalies based on the ascending time difference absolute value sequence; acquiring a process fluctuation threshold; when the anomaly is less than or equal to the process fluctuation threshold, constructing a Merkle tree based on the descending time difference absolute value sequence to determine the target data; when the anomaly is greater than the process fluctuation threshold, performing enhanced verification on the industrial sensor data and constructing a Merkle tree; and encrypting, storing, and verifying the industrial sensor data based on the Merkle tree. This invention effectively overcomes the problem of frequent data verification chain reconstruction caused by high-frequency industrial data acquisition in traditional methods.

Description

Technical Field

[0001] This invention relates to the field of data storage and verification technology, specifically to a method and system for secure storage and verification of industrial data in a trusted computing environment. Background Technology

[0002] In industrial control systems, sensor monitoring data typically exhibits a continuous time characteristic—process parameters (such as temperature, pressure, and flow rate) at adjacent sampling points often maintain a relatively stable numerical relationship. However, when abnormal operating conditions occur on the production line (such as equipment failure), raw material changes, or human interference (such as malicious command injection), this continuity is broken, manifesting as drastic fluctuations or jumps in key parameters within a short period of time.

[0003] Industrial sensor data itself will also exhibit a certain degree of normal fluctuation. That is, while the overall data conforms to the basic law of continuous and stable process parameters, the data itself will also have reasonable local fluctuations due to factors such as normal equipment vibration and slight differences in raw materials.

[0004] Sensor monitoring data is highly sensitive and requires extremely high real-time performance. If existing methods employ strong verification mechanisms (such as building a complete data verification chain point-by-point) for all sensor data, significant performance bottlenecks will arise: frequent verification chain reconstruction consumes substantial computing resources, leading to reduced emergency response capabilities when the system is attacked by malicious commands due to excessive computational demands on verification operations. This conflict between security and real-time performance may cause verification delays when the system is operating at full capacity on the production line, thereby affecting normal processes and creating safety hazards. Summary of the Invention

[0005] This invention provides a method and system for secure storage and verification of industrial data in a trusted computing environment to solve existing problems.

[0006] The industrial data secure storage and verification method in a trusted computing environment of the present invention adopts the following technical solution:

[0007] One embodiment of the present invention provides a method for secure storage and verification of industrial data in a trusted computing environment, the method comprising the following steps:

[0008] Acquire industrial sensor data, which includes numerical data and the time corresponding to the numerical data;

[0009] Based on industrial sensor data, determine the simulated time point sequence;

[0010] The simulated time point sequence and the time scatter sequence are matched according to the order of arrangement to obtain time point pairs, and the ascending time difference absolute value sequence is determined based on the time point pairs; wherein, the time scatter sequence is obtained by arranging the numerical data in chronological order.

[0011] Anomalies in industrial sensor data are determined based on the ascending sequence of absolute time differences.

[0012] Obtain the process fluctuation threshold. When the anomaly is less than or equal to the process fluctuation threshold, construct a Merkle tree based on the descending time difference absolute value sequence to determine the target data. The elements in the descending time difference absolute value sequence and the ascending time difference absolute value sequence are the same but in reverse order.

[0013] When the anomaly exceeds the process fluctuation threshold, the industrial sensor data is enhanced and verified, and a Merkle tree is constructed.

[0014] Industrial sensor data is encrypted, stored, and verified using a Merkle tree.

[0015] Optionally, based on industrial sensor data, a simulated time point sequence is determined, specifically including:

[0016] Numerical data are clustered based on data similarity to obtain numerical data clusters;

[0017] The numerical data in each cluster of numerical data is sorted according to time sequence to obtain a time series scatter plot.

[0018] Obtain the coordinates of each data point in the time series scatter plot and calculate the coordinates of the center point. Determine the data point with the smallest time difference from the center point as the initial point.

[0019] The simulation time point sequence is determined based on the initial point.

[0020] Optionally, the simulation time point sequence is determined based on the initial point, specifically including:

[0021] Using the initial point as the termination point, the time corresponding to the initial point is iteratively decreased according to a preset time length to obtain the first incremental simulated time point sequence;

[0022] Starting from the initial point, the time corresponding to the initial point is iteratively increased according to a preset time length to obtain the second incremental simulated time point sequence;

[0023] The first and second incremental simulated time point sequences are concatenated, and duplicate initial points are removed to obtain the simulated time point sequence.

[0024] The number of iterations increasing and decreasing is the same, and the number of elements in the simulated time series is the same as the number of industrial sensor data.

[0025] Optionally, based on the time point pairs, an ascending sequence of absolute values ​​of time differences is determined, specifically including:

[0026] Calculate the absolute value of the time difference for each time point pair to obtain a sequence of absolute values ​​of time differences;

[0027] Sort the absolute value sequence of time differences in ascending order to obtain the ascending absolute value sequence of time differences.

[0028] Optionally, anomalies in industrial sensor data can be determined based on the ascending sequence of absolute time differences, specifically including:

[0029] The Otsu multi-threshold segmentation algorithm is used to segment the ascending time difference absolute value sequence to obtain at least two segments. The mean of all elements in the segment with the largest element value among the at least two segments is calculated to obtain the element representative value.

[0030] The anomaly ratio is obtained by calculating the ratio of the number of elements in the segment with the largest element value among at least two segments to the number of elements in the sequence of absolute values ​​of ascending time differences.

[0031] The anomaly is obtained by multiplying the ratio of anomalies by the representative value of the element.

[0032] Optionally, a Merkle tree is constructed based on the descending sequence of absolute time differences to determine the target data, specifically including:

[0033] The label value is obtained by multiplying the anomaly and the number of elements in the industrial sensor data.

[0034] Sort the absolute value sequence of time differences in descending order of values ​​to obtain a descending absolute value sequence of time differences;

[0035] Encrypt the descending sequence of absolute time difference values ​​to obtain ciphertext data;

[0036] The encrypted data is divided into N data blocks according to a preset segmentation rule;

[0037] If the tag value is greater than the sum of the number of elements in the first n data blocks and less than or equal to the sum of the number of elements in the first n+1 data blocks, the first n+1 data blocks are selected as the target hash blocks.

[0038] Construct a Merkle tree based on the hash value of each target hash block.

[0039] Optionally, after enhancing and validating the industrial sensor data, a Merkle tree is constructed, specifically including:

[0040] The Otsu multi-threshold segmentation algorithm is used to segment the absolute value sequence of time difference to obtain at least two time difference segments;

[0041] Industrial sensor data is encrypted to obtain encrypted ciphertext data, and the encrypted ciphertext data is then segmented to obtain encrypted ciphertext data segments.

[0042] Encrypt at least two time difference segments to obtain at least two time difference segment ciphertexts;

[0043] Construct a standard Merkle tree based on the encrypted ciphertext data segment, and construct a differential Merkle tree based on the segmented ciphertext divided by at least two time differences;

[0044] Construct a Merkle tree based on the standard Merkle tree and the differential Merkle tree.

[0045] Optionally, a Merkle tree is constructed based on the hash value of each target hash block, specifically including:

[0046] Calculate the hash value of each target hash block and use it as a leaf node of the Merkle tree;

[0047] Calculate the hash value of the parent node of the adjacent leaf node based on the hash value of the adjacent leaf node;

[0048] Iteratively calculate the parent node until the hash value of the root node of the Merkle tree is obtained, thus completing the construction of the Merkle tree.

[0049] Optionally, before determining the simulated time sequence based on industrial sensor data, the method further includes:

[0050] Industrial sensor data is divided into blocks according to a preset time length to obtain at least two data units;

[0051] Based on industrial sensor data, a simulated time series is determined, specifically including:

[0052] Based on the industrial sensor data in each data unit, determine the simulated time point sequence for each data unit.

[0053] This invention proposes an industrial data security storage and verification system under a trusted computing environment, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the steps of the industrial data security storage and verification method under the trusted computing environment.

[0054] The beneficial effects of the technical solution of the present invention are:

[0055] In this embodiment of the invention, a differentiated integrity verification mechanism is achieved through dynamic analysis of production data fluctuation characteristics. Specifically, the system monitors the fluctuation intensity of sensor data in real time within each sampling period and compares it with preset multi-level process thresholds. Based on the comparison results, an adaptive verification strategy is selected: fine verification is used for high-fluctuation data in critical processes, while lightweight verification is used for low-fluctuation data under stable operating conditions. This adaptive verification mechanism based on operating condition characteristics effectively solves the problem of frequent data verification chain reconstruction caused by high-frequency acquisition of industrial data in traditional methods. Attached Figure Description

[0056] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0057] Figure 1 A flowchart illustrating a method for secure storage and verification of industrial data in a trusted computing environment, as provided in an embodiment of the present invention;

[0058] Figure 2 This is a schematic diagram of industrial data curves provided in one embodiment of the present invention;

[0059] Figure 3 This is a schematic diagram of clustering results provided in one embodiment of the present invention;

[0060] Figure 4 This is a time-series scatter plot of a cluster provided in one embodiment of the present invention;

[0061] Figure 5 This is a schematic diagram showing the connection between time points;

[0062] Figure 6 A schematic diagram of a Merkle tree;

[0063] Figure 7 This is a schematic diagram illustrating the process of obtaining a double-verification hash pair.

[0064] Figure 8 This is a structural diagram of an industrial data security storage and verification system in a trusted computing environment provided in an embodiment of the present invention. Detailed Implementation

[0065] To further illustrate the technical means and effects adopted by the present invention to achieve its intended purpose, the following, in conjunction with the accompanying drawings and preferred embodiments, details the specific implementation, structure, features, and effects of the industrial data security storage and verification method in a trusted computing environment proposed by the present invention. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics in one or more embodiments can be combined in any suitable form.

[0066] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0067] The following description, in conjunction with the accompanying drawings, details the specific scheme of the industrial data security storage and verification method provided by the present invention under a trusted computing environment.

[0068] This invention provides a method and system for secure storage and verification of industrial data in a trusted computing environment. Please refer to [link / reference]. Figure 1 The diagram illustrates a flowchart of a method for secure storage and verification of industrial data in a trusted computing environment according to an embodiment of the present invention. The method includes the following steps:

[0069] S101. Acquire industrial sensor data, which includes numerical data and the time corresponding to the numerical data.

[0070] In one specific embodiment, industrial sensor data can be acquired through an industrial sensor data acquisition system, specifically:

[0071] The system first connects to a highly trusted data source (such as a SCADA system, industrial sensor network, or MES production execution system) and ensures communication security through industrial-grade encrypted transmission (either TLS 1.3 or GMTLS 1.1) and two-way authentication. Industrial-grade FPGAs (Field-Programmable Gate Arrays) or dedicated ASICs (Application-Specific Integrated Circuits) are used to accelerate industrial protocol stacks (such as OPC UA, Profinet, etc.) to reduce communication latency in real-time control. Simultaneously, an Industrial Security Module (ISM) is deployed for key management and protocol encryption to ensure hardware-level security protection for the industrial fieldbus.

[0072] At the data acquisition layer, sensor data streams are captured using a sliding window mechanism (e.g., fixed sampling period or triggered by abnormal events) based on industrial real-time network interface cards (NICs) (such as TSN time-sensitive networks or industrial-grade RDMA architecture) and high-availability industrial control servers (such as industrial real-time hosts). Data within the window is temporarily stored in an industrial real-time database (such as a time-series database or shared memory architecture) and synchronized with industrial-grade time synchronization equipment (such as the IEEE 1588 precision clock protocol) to ensure microsecond-level synchronization accuracy. Acquired data can include timestamps (atomic clock or GPS synchronization), process parameters (such as temperature, pressure, flow rate, etc., supporting real-time FPGA parsing of industrial protocols), and device status (reducing CPU interrupts through direct DMA memory access). All raw data is written to industrial-grade non-volatile storage (industrial SSDs or persistent memory) and appended with data checksums (such as hardware-level CRC or industrial-grade digital signatures), providing an immutable foundation for subsequent data storage and process traceability. Figure 2 As shown, Figure 2 This is a schematic diagram of industrial data curves provided according to an embodiment of the present invention. Figure 2 As shown, industrial data can include timestamps (hardware clock source calibration, as shown on the horizontal axis in the figure), the quantity of products produced (as shown on the vertical axis, or the quantity of input materials and other data).

[0073] S102. Determine the simulated time point sequence based on industrial sensor data.

[0074] In this embodiment, determining the simulated time point sequence based on industrial sensor data specifically includes:

[0075] Numerical data are clustered based on data similarity to obtain numerical data clusters;

[0076] The numerical data in each cluster of numerical data is sorted according to time sequence to obtain a time series scatter plot.

[0077] Obtain the coordinates of each data point in the time series scatter plot and calculate the coordinates of the center point. Determine the data point with the smallest time difference from the center point as the initial point.

[0078] The simulation time point sequence is determined based on the initial point.

[0079] Determining the simulation time sequence based on the initial point specifically includes:

[0080] Using the initial point as the termination point, the time corresponding to the initial point is iteratively decreased according to a preset time length to obtain the first incremental simulated time point sequence;

[0081] Starting from the initial point, the time corresponding to the initial point is iteratively increased according to a preset time length to obtain the second incremental simulated time point sequence;

[0082] The first and second incremental simulated time point sequences are concatenated, and duplicate initial points are removed to obtain the simulated time point sequence.

[0083] The number of iterations increasing and decreasing is the same, and the number of elements in the simulated time series is the same as the number of industrial sensor data.

[0084] Before determining the simulated time-point sequence based on industrial sensor data, the method further includes:

[0085] Industrial sensor data is divided into blocks according to a preset time length to obtain at least two data units;

[0086] Based on industrial sensor data, a simulated time series is determined, specifically including:

[0087] Based on the industrial sensor data in each data unit, determine the simulated time point sequence for each data unit.

[0088] Specifically, before determining the simulated time sequence, the industrial sensor data can be divided into blocks according to a preset time length to obtain at least two data units. The subsequent processing methods for the industrial sensor data in S102-S106 can be the processing methods for each data unit. That is, each data unit is analyzed as the industrial sensor data in S101. The subsequent S102-S105 are also based on each data unit as the industrial sensor data to be analyzed.

[0089] In the following embodiments, each data unit is used as an example to analyze and explain industrial sensor data.

[0090] Optionally, the preset time length can be set according to actual needs, without specific restrictions. It can be five minutes or ten minutes.

[0091] In one specific embodiment, taking a preset time length of five minutes as an example, the system divides the continuously acquired process parameters into five-minute basic time units, with the data in each sampling cycle serving as an independent storage and verification unit.

[0092] Industrial real-time data is sensitive and sampled at high frequencies. Performing full verification on all collected data (such as building a complete data verification chain point by point) would overload the system's computational load. Under malicious network attacks, the control system might lose its real-time responsiveness due to resource exhaustion. Therefore, this embodiment implements a differentiated verification strategy based on the criticality of the data, ensuring security while maintaining system efficiency.

[0093] In industrial control systems, sensor time-series data typically exhibit process continuity characteristics—process parameters (such as temperature, pressure, and flow rate) at adjacent sampling points often maintain a stable numerical trend. However, when the system experiences equipment failure (such as mechanical jamming), raw material abnormalities (such as impurity contamination), or human interference (such as malicious parameter tampering), this continuity is disrupted, manifesting as sudden changes or abnormal jumps in key parameters within a short period of time.

[0094] To address this characteristic, this embodiment performs multi-dimensional temporal clustering analysis on the raw data of each sampling period to calculate the consistency between the data point acquisition time sequence and the parameter spatial distribution: Under normal operating conditions, temporally adjacent sampling points should also maintain a continuous distribution in the parameter space, at which point the temporal-spatial correlation coefficient remains stable; when a significant deviation between the two is detected (such as a sudden change in parameter values ​​but a continuous time series, or abnormal clustering of parameter spatial distribution), it indicates that an abnormal state has occurred in the production process.

[0095] For each data unit, the plaintext value is clustered based on data similarity, resulting in multiple clusters where values ​​within the same cluster are similar. This similarity can be represented using {1 - absolute value of the difference}. For example... Figure 3 As shown, Figure 3 This is a schematic diagram of clustering results provided in one embodiment of the present invention. Figure 3 As shown, Figure 3 The text shows multiple clusters obtained by clustering plaintext data within a data unit based on similarity (only five clusters are shown here). Specifically, the vertical axis intervals (for example, all values ​​belonging to cluster 2 are within the vertical axis interval of 93-96) show that all values ​​within the same cluster are similar.

[0096] For each cluster, a time-series scatter plot is obtained based on the chronological order of the values. For each cluster's time-series scatter plot, the center coordinates are calculated using the coordinates of all points. The scatter point with the smallest time difference from the center coordinates is designated as the initial point. The scatter plot expands outwards from the initial point, time-by-time, until the number of data points obtained from the expansion equals the number of data points in the corresponding cluster. These expanded data points are recorded as simulated time points (i.e., simulated time point sequences). This indicates that if the distribution of these data points conforms to the industrial production pattern where data points are more similar the closer the time, then the distribution of these data points can be represented by the time distribution of the simulated time points. Figure 4 As shown, Figure 4 The above is a time series scatter plot of five clusters provided in one embodiment of the present invention.

[0097] S103. Match the simulated time point sequence and the time scatter sequence according to the order of arrangement to obtain time point pairs, and determine the ascending time difference absolute value sequence based on the time point pairs; wherein, the time scatter sequence is obtained by arranging the numerical data in chronological order.

[0098] In this embodiment, the ascending sequence of absolute time difference values ​​is determined based on the time point pairs, specifically including:

[0099] Calculate the absolute value of the time difference for each time point pair to obtain a sequence of absolute values ​​of time differences;

[0100] Sort the absolute value sequence of time differences in ascending order to obtain the ascending absolute value sequence of time differences.

[0101] In one specific embodiment, multiple point pairs are obtained by connecting simulated time points of the same order with points on the time series scatter plot (i.e., points in the time scatter sequence), and then the time pairs corresponding to each point pair are obtained.

[0102] like Figure 5 As shown, Figure 5 This is a schematic diagram showing the connection between time points. Figure 5 In the diagram, the top side represents the simulated time points, and the bottom side represents the points on the time series scatter plot of this cluster. The time points corresponding to the point pairs connected by the dashed lines are denoted as time pairs.

[0103] The smaller the difference between two moments in a time pair between the simulated time point and the time series scatter plot, the more closely the cluster conforms to the rule that industrial parameter values ​​are similar when the time points are close together.

[0104] For each time pair within each cluster, the absolute value of the time difference between the two elements in that time pair is calculated. This results in a sequence of absolute time difference values ​​for all time pairs, denoted as the time difference sequence. The element with the largest difference in the time difference sequence is then identified. The larger the value of this element, the less regular the distribution of the scattered points in the time series becomes. Therefore, the elements in the time difference sequence are arranged in ascending order to obtain an ascending sequence (i.e., an ascending sequence of absolute time difference values).

[0105] S104. Determine the anomalies corresponding to industrial sensor data based on the ascending time difference absolute value sequence.

[0106] In this embodiment, the anomalies of industrial sensor data are determined based on the ascending sequence of absolute time difference values, specifically including:

[0107] The Otsu multi-threshold segmentation algorithm is used to segment the ascending time difference absolute value sequence to obtain at least two segments. The mean of all elements in the segment with the largest element value among the at least two segments is calculated to obtain the element representative value.

[0108] The anomaly ratio is obtained by calculating the ratio of the number of elements in the segment with the largest element value among at least two segments to the number of elements in the sequence of absolute values ​​of ascending time differences.

[0109] The anomaly is obtained by multiplying the ratio of anomalies by the representative value of the element.

[0110] In one specific embodiment, the elements in the ascending sequence are segmented using the Otsu multi-threshold segmentation method to obtain multiple segments. The last segment (i.e., the segment with the largest element value among at least two segments) is taken as the larger element segment of the time difference sequence. The mean of all elements in the larger element segment is calculated, and this mean is used as the representative value (i.e., the element representative value) of the larger element in the time difference sequence. The ratio of the number of elements in the larger element segment to the number of elements in the ascending sequence is obtained as the anomaly ratio. The product of the anomaly ratio and the element representative value is calculated and denoted as the anomaly, representing the degree of abnormal fluctuation in the data of this cluster.

[0111] Optionally, the representative value of the element can be normalized and denoted as the larger representative value. The method for obtaining anomalies can also be the product of the ratio of the number of anomalies and the larger representative value; no specific restrictions are imposed here.

[0112] S105. Obtain the process fluctuation threshold. When the anomaly is less than or equal to the process fluctuation threshold, determine the target data and construct a Merkle tree based on the descending time difference absolute value sequence. When the anomaly is greater than the process fluctuation threshold, perform enhancement verification on the industrial sensor data and construct a Merkle tree. The elements of the descending time difference absolute value sequence and the ascending time difference absolute value sequence are the same but in reverse order.

[0113] In one embodiment of the present invention, constructing a Merkle tree based on the descending time difference absolute value sequence of target data specifically includes:

[0114] The label value is obtained by multiplying the anomaly and the number of elements in the industrial sensor data.

[0115] Sort the absolute value sequence of time differences in descending order of values ​​to obtain a descending absolute value sequence of time differences;

[0116] Encrypt the descending time difference absolute value sequence (the encryption method here can be either the SM4 encryption algorithm or the AES encryption algorithm) to obtain ciphertext data;

[0117] The encrypted data is divided into N data blocks according to a preset segmentation rule;

[0118] If the tag value is greater than the sum of the number of elements in the first n data blocks and less than or equal to the sum of the number of elements in the first n+1 data blocks, the first n+1 data blocks are selected as the target hash blocks.

[0119] A Merkle tree is constructed based on the hash value of each target hash block (which can be either a hash value generated by the SM3 digest algorithm or a hash value generated by the SHA1 digest algorithm).

[0120] Based on the hash value of each target hash block, a Merkle tree is constructed, specifically including:

[0121] Calculate the hash value of each target hash block and use it as a leaf node of the Merkle tree;

[0122] Calculate the hash value of the parent node of the adjacent leaf node based on the hash value of the adjacent leaf node;

[0123] Iteratively calculate the parent node until the hash value of the root node of the Merkle tree is obtained, thus completing the construction of the Merkle tree.

[0124] After enhancing and validating industrial sensor data and constructing a Merkle tree, the process includes:

[0125] The Otsu multi-threshold segmentation algorithm is used to segment the absolute value sequence of time difference to obtain at least two time difference segments;

[0126] Industrial sensor data is encrypted to obtain encrypted ciphertext data, and the encrypted ciphertext data is then segmented to obtain encrypted ciphertext data segments.

[0127] Encrypt at least two time difference segments to obtain at least two time difference segment ciphertexts;

[0128] Construct a standard Merkle tree based on the encrypted ciphertext data segment, and construct a differential Merkle tree based on the segmented ciphertext divided by at least two time differences;

[0129] Construct a Merkle tree based on the standard Merkle tree and the differential Merkle tree.

[0130] For example, considering that industrial sensor data itself has reasonable process fluctuations, that is, under the basic rule that "the closer the sampling time, the closer the parameter value", local fluctuations within the allowable range will still occur due to factors such as normal equipment vibration and slight differences in raw materials. This embodiment establishes a process fluctuation threshold y by statistically analyzing the parameter fluctuations of a 10-minute sampling period under stable operating conditions. Then, the real-time monitoring data is compared with y, and the verification intensity is dynamically adjusted according to the degree of deviation.

[0131] If the anomaly is less than or equal to y, calculate the product of the anomaly and the amount of data in the data unit, denoted as the tag value c. When constructing the Merkle tree, only a portion of the encrypted data is used in the construction, rather than the entire data of the unit, thus reducing the computational load.

[0132] Obtain the absolute value of the time difference for each time pair in the unit, arrange them in descending order of absolute value to obtain a descending sequence (i.e., a descending sequence of absolute values ​​of time difference), and construct a Merkle tree as follows:

[0133] (1) Encrypt the descending sequence to obtain ciphertext data, and then divide the ciphertext data into data blocks of fixed size;

[0134] (2) Calculate the number of elements n1 in the first data block, and calculate the number of elements n2 in the first two data blocks. If c is greater than n1 and less than n2, then select the first two data blocks as the target hash blocks.

[0135] Calculate the number of elements n3 in the first three data blocks. If c is greater than n2 and less than or equal to n3, then select the first three data blocks as the target hash blocks.

[0136] Calculate the number of elements n4 in the first four data blocks. If c is greater than n3 and less than or equal to n4, then select the first four data blocks as the target hash blocks; and so on.

[0137] (3) Calculate the hash value of each target data block and use it as the leaf node of the Merkle tree;

[0138] (3) Combine the hash values ​​of two adjacent leaf nodes to calculate the hash value of the parent node;

[0139] (4) Calculate incrementally until the hash value of the root node of the entire tree is obtained.

[0140] like Figure 6 As shown, Figure 6 This is a schematic diagram of a Merkle tree. Figure 6In the diagram, L1, L2, L3, and L4 at the bottom represent the encrypted data blocks obtained from the segmentation. Then, their respective hash values ​​are obtained. The hash values ​​of adjacent blocks are merged to form a parent node. The parent node is iteratively calculated until the hash value of the root node of the Merkle tree is obtained, thus completing the construction of the Merkle tree.

[0141] Optionally, the preset segmentation rule can be the segmentation method described in the above embodiments, or it can be selected according to actual needs, without specific restrictions.

[0142] If the anomaly is greater than y, enhanced validation is required for this data segment.

[0143] To improve the reliability of data validation, a non-uniform block partitioning strategy is adopted when constructing the Merkle tree:

[0144] First, the time difference sequence (i.e., the absolute value sequence of time differences) in this unit is divided into multiple segments using the Otsu multi-threshold segmentation algorithm, with values ​​within the same segment being similar. This segmentation method makes it more likely that data points with large fluctuations will be divided into separate segments, thereby enhancing the ability to detect abnormal data—even if the original data has been tampered with, the true situation can be restored through the verification of the segmented structure.

[0145] The data in this unit is encrypted to obtain encrypted ciphertext data. Based on the correspondence between plaintext and ciphertext, the ciphertext is divided into multiple encrypted ciphertext data segments, completing the block division of the encrypted ciphertext data. After block division, a Merkle tree is constructed based on these blocks.

[0146] Encrypting at least two time difference segments yields at least two time difference segment ciphertexts. Alternatively, the time difference sequence can be encrypted to obtain ciphertext. Based on the correspondence between the ciphertext and the time difference elements, and combined with multiple segments of the time difference sequence, multiple segments of the ciphertext are obtained. Each segment is treated as a data block, and a difference Merkle tree is constructed using the same method.

[0147] like Figure 7 As shown, Figure 7 This diagram illustrates the process of obtaining a double-verification hash pair. A double-verification hash pair is formed by combining the root hash of a standard Merkle tree with the root hash of a differential Merkle tree; alternatively, a Merkle tree can be constructed to further enhance the robustness of data integrity verification.

[0148] Optionally, before S105, the absolute value sequence of time differences can be sorted in descending order of values ​​to obtain a descending absolute value sequence of time differences. There are no specific restrictions on the execution order of the descending absolute value sequence of time differences.

[0149] S106. Based on the Merkle tree, encrypt and verify the industrial sensor data (the encryption process for encrypted storage is as described above for encrypting the absolute value sequence of descending time differences).

[0150] In this embodiment, the verification and data acquisition process may include:

[0151] 1. Identity Authentication: Log in to the system, complete multi-factor authentication (password + verification code / biometrics / hardware security token), and obtain a short-term valid access token.

[0152] 2. Transaction Verification: Submit the transaction ID to be verified. The system returns: transaction hash value, Merkle verification path (including adjacent node hashes), and official Merkle root hash (from the blockchain / trusted storage). The system calculates and verifies the hash chain locally, comparing it with the root hash to confirm its integrity.

[0153] 3. Obtain plaintext data: When applying for process data based on the verification results, you need to declare the purpose of use (such as quality traceability). The system will return production records (parameter values, equipment numbers, timestamps, etc.) that have been desensitized, and transmit them through an encrypted channel with an automatic time-sensitive destruction mechanism.

[0154] This invention is now complete.

[0155] In summary, this embodiment of the invention achieves a differentiated integrity verification mechanism by dynamically analyzing the fluctuation characteristics of production data. Specifically, the system monitors the fluctuation intensity of sensor data in real time within each sampling period and compares it with preset multi-level process thresholds. Based on the comparison results, it adaptively selects a verification strategy: fine verification is used for high-fluctuation data in critical processes, while lightweight verification is used for low-fluctuation data under stable operating conditions. This adaptive verification mechanism based on operating condition characteristics effectively solves the problem of frequent data verification chain reconstruction caused by high-frequency acquisition of industrial data in traditional methods.

[0156] This invention also proposes an industrial data security storage and verification system under a trusted computing environment. Please refer to [link / reference]. Figure 8 The diagram illustrates the structure of an industrial data security storage and verification system in a trusted computing environment provided by an embodiment of the present invention. The system includes: a data acquisition module 101, a data processing module 102, and a data verification module 103.

[0157] Data acquisition module 101 is used to acquire industrial sensor data, which includes numerical data and the time corresponding to the numerical data.

[0158] The data processing module 102 is used to determine a simulated time point sequence based on industrial sensor data; match the simulated time point sequence and the time scatter sequence according to the order of arrangement to obtain time point pairs, and determine an ascending time difference absolute value sequence based on the time point pairs; wherein, the time scatter sequence is obtained by arranging the numerical data in chronological order; determine the anomaly corresponding to the industrial sensor data based on the ascending time difference absolute value sequence; obtain the process fluctuation threshold, and when the anomaly is less than or equal to the process fluctuation threshold, construct a Merkle tree based on the target data determined by the descending time difference absolute value sequence; wherein, the elements of the descending time difference absolute value sequence and the ascending time difference absolute value sequence are the same but in reverse order; when the anomaly is greater than the process fluctuation threshold, perform enhanced verification on the industrial sensor data and then construct a Merkle tree;

[0159] The data verification module 103 is used to encrypt, store, and verify industrial sensor data according to the Merkle tree.

[0160] It should be noted that the system provided in the above embodiments is only an example of the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the computer device can be divided into different functional modules to complete all or part of the functions described above. In addition, the industrial data security storage and verification system and the industrial data security storage and verification method embodiment in the trusted computing environment provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiment, which will not be repeated here.

[0161] It should be noted that the order of the above embodiments of the present invention is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. The processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0162] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments.

[0163] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for secure storage and verification of industrial data in a trusted computing environment, characterized in that, include: Acquire industrial sensor data, which includes numerical data and the time corresponding to the numerical data; Based on the industrial sensor data, determine the simulated time point sequence; The simulated time point sequence and the time scatter sequence are matched according to the order of arrangement to obtain time point pairs, and the ascending time difference absolute value sequence is determined based on the time point pairs; wherein, the time scatter sequence is obtained by arranging the numerical data in chronological order; The anomalies corresponding to the industrial sensor data are determined based on the ascending time difference absolute value sequence. A process fluctuation threshold is obtained. When the anomaly is less than or equal to the process fluctuation threshold, a Merkle tree is constructed based on the target data determined by the descending time difference absolute value sequence. When the anomaly is greater than the process fluctuation threshold, the industrial sensor data is enhanced and verified, and a Merkle tree is constructed. The elements of the descending time difference absolute value sequence and the ascending time difference absolute value sequence are the same but in reverse order. The industrial sensor data is encrypted, stored, and verified based on the Merkle tree.

2. The method for secure storage and verification of industrial data in a trusted computing environment according to claim 1, characterized in that, The step of determining the simulated time point sequence based on the industrial sensor data specifically includes: The numerical data are clustered according to data similarity to obtain numerical data clusters; The numerical data of each cluster in the numerical data cluster are sorted according to time sequence to obtain a time series scatter plot. Obtain the coordinate position of each numerical data in the time series scatter plot and calculate the center position coordinates. Determine the numerical data with the smallest time difference from the center position coordinates as the initial point. The simulation time point sequence is determined based on the initial point.

3. The method for secure storage and verification of industrial data in a trusted computing environment according to claim 2, characterized in that, The step of determining the simulated time point sequence based on the initial point specifically includes: Using the initial point as the termination point, the time corresponding to the initial point is iteratively decreased according to a preset time length to obtain the first incremental simulated time point sequence; Starting from the initial point, the time corresponding to the initial point is iteratively increased according to a preset time length to obtain a second incremental simulated time point sequence. The first incremental simulated time point sequence and the second incremental simulated time point sequence are concatenated, and duplicate initial points are removed to obtain the simulated time point sequence. The number of iterations increasing and decreasing are the same, and the number of elements in the simulated time point sequence is the same as the number of industrial sensor data.

4. The method for secure storage and verification of industrial data in a trusted computing environment according to claim 1, characterized in that, The step of determining the ascending sequence of absolute time difference values ​​based on the time point pairs specifically includes: Calculate the absolute value of the time difference for each pair of time points to obtain a sequence of absolute values ​​of time difference; The absolute value sequence of time differences is sorted in ascending order to obtain an ascending sequence of absolute value time differences.

5. The method for secure storage and verification of industrial data in a trusted computing environment according to claim 1, characterized in that, The step of determining the anomaly of the industrial sensor data based on the ascending time difference absolute value sequence specifically includes: The ascending time difference absolute value sequence is segmented using the Otsu multi-threshold segmentation algorithm to obtain at least two segments. The mean of all elements in the segment with the largest element value among the at least two segments is calculated to obtain the element representative value. The ratio of the number of elements in the segment with the largest element value among the at least two segments to the number of elements in the sequence of absolute values ​​of ascending time differences is used to obtain the anomaly ratio. The anomaly is obtained by multiplying the ratio of the number of anomalies by the representative value of the element.

6. The method for secure storage and verification of industrial data in a trusted computing environment according to claim 4, characterized in that, The step of constructing a Merkle tree based on the descending time difference absolute value sequence of the target data specifically includes: Calculate the product of the anomaly and the number of elements in the industrial sensor data to obtain the tag value; The absolute value sequence of time differences is sorted in descending order of values ​​to obtain a descending absolute value sequence of time differences. The descending time difference absolute value sequence is encrypted to obtain ciphertext data; The encrypted data is divided into N data blocks according to a preset segmentation rule; If the flag value is greater than the sum of the number of elements in the first n data blocks and less than or equal to the sum of the number of elements in the first n+1 data blocks, the first n+1 data blocks are selected as the target hash block. A Merkle tree is constructed based on the hash value of each target hash block.

7. The method for secure storage and verification of industrial data in a trusted computing environment according to claim 4, characterized in that, The process of enhancing and validating the industrial sensor data and constructing a Merkle tree specifically includes: The absolute value sequence of time difference is segmented using the Otsu multi-threshold segmentation algorithm to obtain at least two time difference segments; The industrial sensor data is encrypted to obtain encrypted ciphertext data, and the encrypted ciphertext data is segmented to obtain encrypted ciphertext data segments. Encrypt the at least two time difference segments to obtain at least two time difference segment ciphertexts; Based on the encrypted ciphertext data segment, a standard Merkle tree is constructed, and based on the at least two time differences, a differential Merkle tree is constructed. Construct a Merkle tree based on the standard Merkle tree and the differential Merkle tree.

8. The method for secure storage and verification of industrial data in a trusted computing environment according to claim 6, characterized in that, The step of constructing a Merkle tree based on the hash value of each target hash block specifically includes: Calculate the hash value of each target hash block and use it as a leaf node of the Merkle tree; Calculate the hash value of the parent node of the adjacent leaf node based on the hash value of the adjacent leaf node; Iteratively calculate the parent node until the hash value of the root node of the Merkle tree is obtained, thus completing the construction of the Merkle tree.

9. The method for secure storage and verification of industrial data in a trusted computing environment according to claim 1, characterized in that, Before determining the simulated time point sequence based on the industrial sensor data, the method further includes: The industrial sensor data is divided into blocks according to a preset time length to obtain at least two data units; The step of determining the simulated time point sequence based on the industrial sensor data specifically includes: Based on the industrial sensor data in each data unit, determine the simulated time point sequence for each data unit.

10. An industrial data security storage and verification system in a trusted computing environment, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the computer program is executed by the processor, it implements the steps of the industrial data secure storage and verification method in a trusted computing environment as described in any one of claims 1-9.

Images