Low-delay data security transmission method and device for nuclear power industry Internet of Things

Abstract

The invention discloses a low-latency data security transmission method and device for the Internet of Things of the nuclear power industry, and the method comprises the following steps: S1, segmenting collected data according to a data segmentation strategy, and carrying out the group signature of each segmented block data; step S2, compressing the block data, performing encryption preprocessing after establishing transmission connection, and executing residual encryption processing during data transmission; s3, the sending end sends the encrypted ciphertext, and the encrypted ciphertext is sent to the receiving end through different paths according to the pseudo-random table; and S4, performing data reduction on the received data, and constructing a layered integrity verification architecture to perform integrity verification on the received data. The method has the technical effects of high data transmission security and low time delay.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data transmission security of nuclear power plant Internet of Things, and in particular to a low-delay data security transmission method and device for nuclear power industry Internet of Things. BACKGROUND

[0002] With the development of nuclear power technology, the operation safety and stability of nuclear power plants have attracted widespread attention. Under the production environment of nuclear power plants, data interaction through networks occurs from time to time. Nuclear power industry Internet of Things has characteristics such as multi-region transmission, large transmission flow, and long transmission link. In the data transmission process, there are security risks such as data interception and tampering. Existing industrial Internet of Things data security transmission schemes generally use encryption to protect personal privacy. However, with the development of artificial intelligence technologies such as machine learning, simply encrypting data will not be enough to meet the privacy protection requirements of data transmission. Attackers can analyze intercepted data without decrypting the payload content, extract data features and transmission features, and classify data to capture sensitive information.

[0003] Considering the security requirements commonly existing in industrial Internet of Things, such as protecting business secrets, preventing penetration, and avoiding damage, it is essential to encrypt and verify the integrity of communication between devices. Limited by the limited processor performance of most industrial Internet of Things devices, using standard encryption technology to encrypt and verify messages will cause a large communication delay, which is unacceptable in nuclear power industry Internet of Things that has low delay requirements. Therefore, in nuclear power industry Internet of Things, achieving low-delay secure communication is a crucial but extremely contradictory goal. How to develop a data transmission method with fast transmission speed and high security to improve the security of data transmission and improve the information security of nuclear power plants has become a problem that needs to be solved. SUMMARY

[0004] Therefore, it is necessary to provide a low-delay data security transmission method and device for nuclear power industry Internet of Things to effectively solve the technical problem of high delay under the requirement of nuclear power data security transmission.

[0005] The present application provides a low-delay data security transmission method for nuclear power industry Internet of Things, comprising the following steps: Step S1, according to the data segmentation strategy, the collected data is segmented, and each segmented data block is respectively group signed; Step S2, the segmented data is compressed, and encryption preprocessing is performed after establishing a transmission connection, and the remaining encryption processing is performed during data transmission; Step S3, the sending end sends the encrypted ciphertext, and sends it to the receiving end through different paths according to the pseudo-random table; Step S4, data restoration is performed on the received data, and a layered integrity verification architecture is constructed to verify the integrity of the received data.

[0006] Preferably, the step S1 is specifically: According to the data characteristics of the collected data, a data segmentation strategy is selected for data segmentation, which includes segmenting data in a set number of measurement point data as a data packet, segmenting data in a set time as a data packet, segmenting data in a set number of records as a data packet, and segmenting data in a set size of data file as a data packet. After data segmentation, a group signature of anonymous identity is performed on each of the segmented data to avoid exposure of data sources.

[0007] Preferably, the step S2 is specifically: A plurality of data compression strategies are set, and a corresponding data compression strategy is adaptively selected according to the characteristics of the segmented data to dynamically optimize the compression rate.

[0008] Preferably, the step S2 is specifically: A plurality of different encryption modes are used for encryption, and a corresponding mode of encryption is preprocessed after the transmission connection is established, and the remaining encryption processing is performed during data transmission, the encryption mode includes CTR layered encryption mode and CBC-MAC template optimization mode.

[0009] Preferably, the CTR layered encryption mode is specifically: a long connection is established before the arrival of plaintext data, the edge side device simultaneously completes identity authentication and key exchange, and negotiates a symmetric key and an initial calculator with the receiving end; according to the symmetric key and the initial calculator, an encryption calculation is performed, a plurality of calculator key streams are pre-generated, and the key stream blocks are cached to the memory queue; when the plaintext data arrives, the key stream is taken out from the memory queue, an XOR calculation is performed, and the ciphertext obtained by the XOR calculation is directly sent; after the long connection is established, the receiving end synchronously pre-generates a decryption key stream, and restores the plaintext through the same symmetric key and the initial calculator; The CBC-MAC template optimization mode is specifically: a pre-processing encryption template is set for a fixed field in the collected data, and CBC-MAC encryption calculation is performed on the fixed field using the pre-processing encryption module after the transmission connection is established, and the encryption calculation result and the last fast state are cached; real-time encryption is performed on the dynamic field during data transmission, the dynamic field is filled to a standard block size, only the dynamic field is subjected to CBC-MAC encryption calculation, and the complete encryption result is generated in combination with the last fast state.

[0010] Preferably, the encryption processing in the step S2 adopts a hybrid encryption mode: generating a public key and a private key used for asymmetric encryption; The sending end uses the symmetric encryption key to perform AES encryption on the plaintext data to form ciphertext data; The public key is sent to the sending end, and the symmetric encryption key is encrypted using the public key to form an encryption key; The ciphertext data and the encryption key are sent to the receiving end.

[0011] Preferably, the step S3 is specifically: The sending end sends the encrypted ciphertext, disperses the ciphertext to different transmission paths through a pseudo-random table, and sends the ciphertext to the receiving end through different propagation paths, and performs data aggregation at the data receiving end, wherein the different propagation paths include different root master stations.

[0012] Preferably, the step S4 of restoring the received data is specifically: According to the configuration information and the tool, the data restoration operation is performed: the encrypted key is decrypted according to the private key to obtain a decrypted key, and the ciphertext data is decrypted and restored using the key; according to the data compression mode, the data is decompressed; the group signature is opened at the root node, and the data is recombined according to the signature of each data packet to restore the original data.

[0013] Preferably, the step S4 of constructing a layered integrity verification architecture to verify the integrity of the received data is specifically: The layered integrity verification architecture is constructed, and the integrity verification is performed in two stages of data segmentation and data recombination; in the data segmentation stage, the reliability of the block source is verified according to the group signature; in the data recombination stage, the integrity of the whole data is verified according to the hash value comparison.

[0014] The application also provides a low-latency data security transmission device for a nuclear power industry Internet of Things, which comprises a memory and a processor, the memory stores a computer program, and the computer program is executed by the processor to realize the low-latency data security transmission method for the nuclear power industry Internet of Things.

[0015] Compared with the prior art, the present application has the beneficial effects that: on the one hand, the present application realizes data secret transmission based on segmented interference, introduces group signature and pseudo-random path forwarding technology on the basis of traditional block transmission, the anonymized identity used by the group signature makes the data characteristics untraceable, avoiding exposure of the data source, the pseudo-random path forwarding technology makes the data transmission mode untraceable, and it is difficult for an attacker to intercept complete data through a single path, resisting machine learning attacks based on traffic analysis, such as data classification and sensitive information capture. On the other hand, low-latency optimization is realized through pre-connection encryption, aiming at the situation of limited computing power on the edge side of the nuclear power industry Internet of Things, encryption preprocessing and template-based fast verification technology are introduced to reduce encryption and verification delay during transmission, and meet the millisecond-level response requirement of the industrial scene. BRIEF DESCRIPTION OF DRAWINGS

[0016] The drawings described herein are used to provide further understanding of the present application, and form a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application, and do not constitute improper limitations on the present application. In the drawings: Fig. 1 is a flowchart of an embodiment of a low-latency data security transmission method for a nuclear power industry Internet of Things provided by the present application; Figure 2 is Figure 1 a schematic diagram of an embodiment of a data security transmission process in the embodiment shown; Figure 3 is Figure 1 a flowchart of an embodiment of a data hybrid encryption mode in the embodiment shown. DETAILED DESCRIPTION

[0017] The preferred embodiments of the present application will be described in detail below with reference to the accompanying drawings, which form a part of the present application, and are used to explain the principles of the embodiments of the present application, and are not used to limit the scope of the present application.

[0018] Embodiment one Please refer to Figure 1 , the low-latency data security transmission method for a nuclear power industry Internet of Things in the embodiment includes the following steps: Step S1, according to a data segmentation strategy, the collected data is segmented, and each segmented block data is respectively group signed; Step S2, the segmented data is compressed, and encryption preprocessing is performed after establishing a transmission connection, and the remaining encryption processing is performed during data transmission; Step S3, the sending end sends the encrypted ciphertext, and sends it to the receiving end through different paths according to the pseudo-random table; Step S4, the received data is restored, and a hierarchical integrity verification architecture is constructed to verify the integrity of the received data.

[0019] The embodiment is directed to the characteristics of nuclear power industry Internet of Things cloud edge multi-region transmission, large transmission flow, long transmission link, etc., and proposes a data reliable transmission method, which realizes data secret transmission based on segmentation interference and dynamic compression optimization, and realizes safe low-latency transmission based on connection preprocessing.

[0020] Specifically, as shown in Figure 2 The data sending end configures data segmentation, data compression, and data encryption mode after collecting data, writes into a configuration file, and issues the configuration file to the edge side for execution. Before sending the message, the terminal device first splits the message into n parts and performs group signature on each part, and then forwards the n new data to different objects according to a pseudo-random table. The split message is finally opened at the root node and recombined. A long connection is established before data transmission to reduce the delay caused by multiple connections, and low-latency optimization is performed through pre-connection encryption. In view of the computing power limitation of the edge side of the nuclear power industry Internet of Things, encryption preprocessing and template-based fast verification technology are introduced. After data processing by the edge side data sending end, data forwarding is performed, and the data receiving end automatically restores the data according to the configured data processing mode and verifies the integrity of the data to ensure the integrity of the data.

[0021] The embodiment is directed to the problem of insufficient privacy protection capability of the existing transmission scheme, and the transmitted data is segmented, compressed, group signed, and interfered to ensure the indistinguishability and security of sensitive data and the anonymity of identity information. Based on the segmentation interference technology, the security of data transmission is enhanced. Through pre-connection encryption, low-latency optimization is performed, and in view of the computing power limitation of the edge side of the nuclear power industry Internet of Things, encryption preprocessing and template-based fast verification technology are introduced to reduce encryption delay and integrity verification delay during transmission, and to meet the millisecond-level response requirement of the industrial scene.

[0022] Specifically, the step S1 is specifically: According to the data characteristics of the collected data, a data segmentation strategy is selected for data segmentation, and the data segmentation strategy includes segmenting data with a set number of measurement point data as a data packet, segmenting data with data within a set time as a data packet, segmenting data with a set number of record data as a data packet, and segmenting data with a data file of a set size as a data packet. After data segmentation, each of the segmented data is group signed with an anonymous identity to avoid exposing the data source.

[0023] First, the collected data is segmented according to the selected data segmentation strategy, and each part is group signed. The selectable data segmentation strategy includes: Measurement point data segmentation: segmenting data with 50 measurement point data as a data packet; Time series segmentation: Data is segmented by using data collected in one day as a data packet; Data record segmentation: Data is segmented into data packets of 10,000 records each; File size splitting: Data is split into packets with a file size of 50MB.

[0024] After data segmentation, each block is group-signed to avoid exposing the data source. Finally, a pseudo-random table is used to distribute the segmented data to different transmission paths, such as from leaf master stations to different root master stations, making it difficult for attackers to intercept complete data through a single path.

[0025] This embodiment addresses the insufficient privacy protection capabilities of existing transmission schemes by segmenting, compressing, group-signing, and interfering with transmitted data to ensure the indistinguishability and security of sensitive data, as well as the anonymity of identity information. Before sending a message, the terminal device first splits the message into n parts and performs group signing on each part. Then, the n new data pieces are forwarded to different objects according to a pseudo-random table. Finally, the segmented messages are unsigned and reassembled at the root node. This transmission framework has three layers, from top to bottom: the root master station, the leaf master stations, and the sensor group. Before sending a message, the sensors first segment the message into multiple parts and perform group signing on each part; then, they forward the segmented messages according to a pseudo-random table, allowing the messages to reach their destinations through different paths; finally, the root master station aggregates the segmented messages, unsigns them, and reassembles them to restore the original message.

[0026] Specifically, in step S2, the segmented data is compressed as follows: Multiple data compression strategies are set up, and the appropriate data compression strategy is adaptively selected according to the characteristics of the block data to dynamically optimize the compression ratio.

[0027] The data compression strategies selected in this embodiment include: LZ77 compression, which uses repeated characters in the data for compression; LZ78 compression, which dynamically constructs a data dictionary and performs character replacement; and ZIP compression, which is a traditional data compression method.

[0028] This embodiment uses adaptive compression strategies, such as data block comparison and dictionary encoding, to dynamically optimize the compression rate during the compression process, reduce transmission costs, better adapt to the heterogeneous data streams of the nuclear power industrial Internet of Things, and reduce invalid transmissions.

[0029] Taking into account factors such as data transmission volume and security of the nuclear power industrial IoT platform, this paper integrates and improves two main networks commonly used in industrial IoT, and uses data compression preprocessing to reduce transmission traffic and energy consumption. The server sends TCP packets containing some data to the client. The controller module extracts data from the incoming TCP packets, including the client IP address, and aggregates the data. Aggregation is accomplished in two ways: comparison and dictionary usage. Comparison is achieved by comparing the current packet with the previous ten packets to send changed blocks instead of identical blocks. The second method is to find the most frequently occurring data blocks in the incoming packets. These data blocks are input into a dictionary and encoded with a character set; the more frequently a data block appears, the shorter the character set length. Simultaneously, checks are performed to ensure that the compressed data block does not become larger than the original data block. In this case and other cases, such as when data cannot be aggregated by comparison or dictionary, the controller sends the uncompressed data to the receiver. The aggregated data is then packaged into a UDP packet and sent to the receiver.

[0030] In secure communication, latency primarily stems from two sources: the connection establishment process, including authentication and key exchange, and encryption and integrity verification. In the low-latency scenario of this embodiment, IoT devices typically establish long-term connections, meaning the connection establishment overhead only occurs once. Therefore, continuous encryption and integrity verification are the main sources of latency.

[0031] For encryption and integrity verification, this embodiment employs pre-encryption. Commonly used encryption modes in block ciphers include Counter Mode (CTR) and Cipher Block Linking Mode (CBC), and also have integrity verification functionality (CBC-MAC). Pre-encryption is suitable for CTR mode. CTR mode can be divided into two stages: the first stage uses the key and an accumulating counter to calculate the keystream, which involves a large amount of computation; the second stage XORs the keystream with the plaintext to obtain the ciphertext, which involves a small amount of computation. For long connections, the key and initial counter are known after the connection is established. Pre-encryption allows the keystream to be calculated during the preprocessing stage, so that only a lightweight XOR operation is performed before data transmission. For CBC-MAC mode, this embodiment uses template-based fast integrity verification. In CBC-MAC mode, the encryption process of each block depends on the previous block, which does not allow for pre-computation of the keystream. However, messages in the nuclear power industry IoT have a certain structure, with some fields being the same across different messages. These fields can be moved to the beginning of the message to form a template. The template is encrypted first during the preprocessing stage, and once the data to be transmitted is determined, the IoT device only needs to encrypt the remaining blocks. The two modes are described in detail below. Specifically, the CTR layered encryption mode involves: establishing a long connection before plaintext data arrives; the edge device simultaneously completes authentication and key exchange, and negotiates a symmetric key and an initial calculator with the receiving end; performing encryption calculations based on the symmetric key and the initial calculator, pre-generating keystreams for multiple calculators, and caching keystream blocks in a memory queue; when plaintext data arrives, retrieving the keystreams from the memory queue, performing an XOR calculation, and directly sending the ciphertext obtained from the XOR calculation; after the long connection is established, the receiving end synchronously pre-generates a decryption keystream, and uses the same symmetric key and the initial calculator to reconstruct the plaintext.

[0032] CTR mode employs a layered encryption method. After the connection is established, a keystream is pre-computed. Keystream computation is a computationally intensive phase, while only a lightweight XOR operation is performed during transmission. The specific process is as follows: Establish a long connection: Establish a long connection before plaintext data arrives. At this time, the edge device completes identity authentication and key exchange, and negotiates the symmetric key and initial calculator with the receiving end. Perform encryption preprocessing: perform encryption calculations based on the symmetric key and the initial calculator, pre-generate key streams for N calculators, and cache the key stream blocks in a memory queue; Real-time data transmission: When plaintext data arrives, the key stream is retrieved from the queue, a lightweight XOR calculation is performed, and the ciphertext obtained by the XOR calculation is sent directly.

[0033] After the long connection is established, the receiving end synchronously pre-generates a decryption key stream, and then XORs the plaintext with the same symmetric key and the initial counter.

[0034] Specifically, the CBC-MAC template optimization mode is as follows: a pre-processing encryption template is set for fixed fields in the collected data. After the transmission connection is established, the pre-processing encryption module is used to perform CBC-MAC encryption calculation on the fixed fields, and the encryption calculation result and the final block state are cached. For dynamic fields in the collected data, real-time encryption is performed during data transmission. The dynamic fields are filled to the standard block size, and CBC-MAC encryption calculation is performed only on the dynamic fields. The complete encryption result is generated by combining the final block state.

[0035] In CBC-MAC mode, a template optimization approach is used. Fixed fields in the message are moved to the beginning to form a template, the template is pre-processed and encrypted, and dynamic fields are encrypted in real time. The specific process is as follows: Template definition: Taking a device alarm message as an example, its data structure is "Device ID + Timestamp + Alarm Code + Alarm Content". Among them, the Device ID is a fixed feature, while the Timestamp, Alarm Code, and Alarm Content are dynamic features. Therefore, the fixed field "Device ID" is extracted from the message, combined into a template, and the remaining fields are defined as dynamic parts. Encryption preprocessing: Perform a complete CBC-MAC encryption calculation on the template content, and cache the result of the encryption calculation and the encrypted final block state, where the encrypted final block state is mainly used for chain concatenation; Real-time data transmission: When dynamic data arrives, the dynamic data is filled to the standard block size. CBC-MAC encryption calculation is only performed on the dynamic data, but the initial vector is linked to the last block state of the preprocessed data to generate the MAC value of the complete message. The template, dynamic data and the MAC value of the complete message are concatenated and sent. The receiving end also splits the template and dynamic data, and uses the pre-stored template state to verify the MAC value of the complete message.

[0036] CTR layered encryption is suitable for high-speed streaming data transmission scenarios, enabling the protection of data confidentiality. CBC-MAC, on the other hand, possesses tamper-resistant characteristics, making it suitable for lightweight MAC scenarios where critical instructions are optimized with CBC-MAC templates. Thus, for low-end devices, CTR pre-allocates memory to cache the key stream; for high-end gateways, it maintains a CBC-MAC template library for multiple devices.

[0037] This embodiment optimizes low latency through pre-connection encryption. In view of the computing power limitations of the edge side of the nuclear power industrial Internet of Things, it introduces encryption preprocessing and template-based fast verification technology to reduce encryption latency and integrity verification delay during transmission. Traditional encryption will produce significant delays on low-end devices, meeting the millisecond-level response requirements of industrial scenarios, such as the need for emergency stop.

[0038] Specifically, the encryption process in step S2 employs a hybrid encryption method: Generate the public and private keys used for asymmetric encryption; The sending end uses a symmetric encryption key to encrypt the plaintext data using AES, thus forming ciphertext data; The public key is sent to the sending end, and the symmetric encryption key is encrypted using the public key to form an encryption key; The encrypted data and the encryption key are sent to the receiving end.

[0039] Current data encryption methods mainly include symmetric and asymmetric encryption. Symmetric encryption refers to the use of the same key for encryption and decryption at both the sending and receiving ends. It is fast and efficient, but its security is insufficient and it is easily cracked. Asymmetric encryption uses a pair of public and private keys. The sending end uses the public key to encrypt the data, and the receiving end uses the private key to decrypt the data. It is highly secure, but it requires more computation and has higher transmission costs.

[0040] To reduce the computational load of data encryption during data transmission, thereby reducing data transmission latency and cost, while ensuring data transmission security, this embodiment employs a hybrid encryption method. For example...Figure 3 As shown, the specific process is as follows: Key generation: Generate a public key and a private key for asymmetric encryption; Data encryption: The data sender uses the symmetric encryption key to encrypt the plaintext data using AES to form ciphertext data; Key encryption: The generated public key is sent to the data sender, which then uses this public key to encrypt the symmetric encryption key using RSA or SHA-2 to form the encryption key; Data transmission: The data sender sends the ciphertext data and the encryption key to the data receiver; Key decryption: The data receiver uses the private key to decrypt the encryption key to obtain the key; Data decryption: The data receiver uses the key to decrypt the ciphertext data.

[0041] Therefore, each data transmission only requires encrypting the symmetric encryption key, thereby reducing computation and lowering data transmission costs. Configurable encryption methods include: RSA encryption, one of the most commonly used asymmetric encryption algorithms, is characterized by relatively simple public and private key generation and good compatibility; SHA-2 encryption is a hash encryption algorithm with high security and wide application, used for data integrity verification.

[0042] This embodiment introduces a lightweight design with hybrid encryption, optimizes the key management process, separates symmetric keys from data encryption, and reduces the amount of asymmetric computation during transmission through key pre-encryption.

[0043] Specifically, step S3 is as follows: The sending end sends encrypted ciphertext, distributes the ciphertext to different transmission paths using a pseudo-random table, and sends it to the receiving end through different propagation paths. The receiving end then aggregates the data, and the different propagation paths include different root master stations.

[0044] Specifically, in step S4, the received data is restored, which involves: Perform data restoration based on configuration information and tools: Decrypt the encryption key using the private key to obtain the decrypted key, and use the key to decrypt and restore the ciphertext data; decompress the data according to the data compression method; open the group signature on the root node, and reassemble the data according to the signatures of each data packet to restore the original data.

[0045] The data restoration operation is automatically performed based on the configuration information of the data processing module. Specifically, this includes: data decryption (decrypting and restoring the data according to the encryption method); data decompression (decompressing the data according to the compression method); and data reconstruction (reconstructing the data based on the signatures of each data packet to restore the original data).

[0046] Specifically, in step S4, constructing a layered integrity verification architecture to verify the integrity of received data involves: A hierarchical integrity verification architecture is constructed, which performs integrity verification in two stages: data segmentation and data reassembly. In the data segmentation stage, the reliability of the block source is verified based on the group signature. In the data reassembly stage, the integrity of the overall data is verified based on the hash value comparison.

[0047] This embodiment constructs a layered integrity verification architecture, which performs verification in the two stages of data segmentation and reassembly. During segmentation, group signatures ensure the credibility of the segment source, and hash verification after reassembly verifies the overall integrity. This architecture is more suitable for segmented transmission scenarios and prevents segmented tampering.

[0048] Example 2 This embodiment provides a low-latency data security transmission device for nuclear power industrial IoT, including a memory and a processor. The memory stores a computer program, and when the computer program is executed by the processor, it implements the low-latency data security transmission method for nuclear power industrial IoT described in Embodiment 1.

[0049] The low-latency data security transmission device for nuclear power industrial IoT provided in this embodiment is used to realize the low-latency data security transmission method for nuclear power industrial IoT. Therefore, the low-latency data security transmission device for nuclear power industrial IoT also possesses the technical effects of the low-latency data security transmission method for nuclear power industrial IoT, and will not be described again here.

[0050] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of the present invention.

Claims

1. A low-latency data security transmission method for nuclear power industrial Internet of Things, characterized in that, Includes the following steps: Step S1: Divide the collected data into segments according to the data segmentation strategy, and perform group signature on each segmented data block. Step S2: Compress the block data, establish a transmission connection, perform encryption preprocessing, and perform the remaining encryption processing during data transmission; Step S3: The sending end sends the encrypted ciphertext to the receiving end through different paths according to the pseudo-random table; Step S4: Restore the received data and construct a hierarchical integrity verification architecture to verify the integrity of the received data.

2. The low-latency data security transmission method for the nuclear power industry Internet of Things according to claim 1, characterized in that, Step S1 specifically involves: Data segmentation strategies are selected based on the data characteristics of the collected data. The data segmentation strategies include segmenting data into a data packet with a set number of measurement points, segmenting data into a data packet with data within a set time period, segmenting data into a data packet with a set number of records, and segmenting data into a data packet with a set size of data file. After data segmentation, a group signature is performed on each segment to anonymize its identity and avoid exposing the data source.

3. The low-latency data security transmission method for the nuclear power industrial Internet of Things according to claim 1, characterized in that, In step S2, the segmented data is compressed, specifically as follows: Multiple data compression strategies are set up, and the appropriate data compression strategy is adaptively selected according to the characteristics of the block data to dynamically optimize the compression ratio.

4. The low-latency data security transmission method for nuclear power industrial Internet of Things according to claim 1, characterized in that, In step S2, after establishing the transmission connection, encryption preprocessing is performed. During data transmission, the remaining encryption processing is executed, specifically as follows: Multiple different encryption modes are used for encryption. After the transmission connection is established, the corresponding encryption preprocessing is performed. During data transmission, the remaining encryption processing of the corresponding mode is performed. The encryption modes include CTR layered encryption mode and CBC-MAC template optimization mode.

5. The low-latency data security transmission method for the nuclear power industry Internet of Things according to claim 4, characterized in that, The CTR layered encryption mode is as follows: a long connection is established before the plaintext data arrives; the edge device simultaneously completes authentication and key exchange, and negotiates a symmetric key and an initial calculator with the receiving end; encryption calculations are performed based on the symmetric key and the initial calculator, multiple calculator keystreams are pre-generated, and keystream blocks are cached in a memory queue; when the plaintext data arrives, the keystream is retrieved from the memory queue, an XOR calculation is performed, and the ciphertext obtained from the XOR calculation is sent directly; after the long connection is established, the receiving end synchronously pre-generates a decryption keystream, and restores the plaintext using the same symmetric key and the initial calculator; The CBC-MAC template optimization mode specifically involves: setting a pre-processing encryption template for fixed fields in the collected data; performing CBC-MAC encryption calculation on the fixed fields using the pre-processing encryption module after the transmission connection is established; and caching the encryption calculation result and the final block state; and performing real-time encryption on dynamic fields in the collected data during data transmission, filling the dynamic fields to the standard block size, performing CBC-MAC encryption calculation only on the dynamic fields, and generating a complete encryption result by combining the final block state.

6. The low-latency data security transmission method for the nuclear power industry Internet of Things according to claim 1, characterized in that, The encryption process in step S2 employs a hybrid encryption method: Generate the public and private keys used for asymmetric encryption; The sending end uses a symmetric encryption key to encrypt the plaintext data using AES, thus forming ciphertext data; The public key is sent to the sending end, and the symmetric encryption key is encrypted using the public key to form an encryption key; The encrypted data and the encryption key are sent to the receiving end.

7. The low-latency data security transmission method for the nuclear power industry Internet of Things according to claim 1, characterized in that, Step S3 specifically involves: The sending end sends encrypted ciphertext, distributes the ciphertext to different transmission paths using a pseudo-random table, and sends it to the receiving end through different propagation paths. The receiving end then aggregates the data, and the different propagation paths include different root master stations.

8. The low-latency data security transmission method for the nuclear power industry Internet of Things according to claim 1, characterized in that, In step S4, the received data is restored, specifically as follows: Perform data restoration based on configuration information and tools: Decrypt the encryption key using the private key to obtain the decrypted key, and use the key to decrypt and restore the ciphertext data; decompress the data according to the data compression method; open the group signature on the root node, and reassemble the data according to the signatures of each data packet to restore the original data.

9. The low-latency data security transmission method for the nuclear power industry Internet of Things according to claim 1, characterized in that, In step S4, the hierarchical integrity verification architecture is constructed to perform integrity verification on the received data, specifically as follows: A hierarchical integrity verification architecture is constructed, which performs integrity verification in two stages: data segmentation and data reassembly. In the data segmentation stage, the reliability of the block source is verified based on the group signature. In the data reassembly stage, the integrity of the overall data is verified based on the hash value comparison.

10. A low-latency data security transmission device for nuclear power industrial Internet of Things, characterized in that, It includes a memory and a processor, wherein the memory stores a computer program, which, when executed by the processor, implements the low-latency data security transmission method for the nuclear power industrial Internet of Things as described in any one of claims 1-9.

Images