SCADA data cloud storage security protection method and device

Abstract

The invention discloses an SCADA (Supervisory Control And Data Acquisition) data cloud storage security protection method and device. The SCADA data cloud storage security protection method comprises the following steps: in a local server of an SCADA system, packaging various types of data into standardized data containing corresponding time series data; performing encryption operation in an encryption module of the local server, converting the standardized data into a standardized data ciphertext, extracting keywords from the standardized data to generate a corresponding keyword ciphertext, and then generating a public key and a private key; and the cryptographic trans-firewall module sends the randomized keyword ciphertext, the standardized data ciphertext and the public key to a cloud storage server, and associatively stores the randomized keyword ciphertext and the standardized data ciphertext. According to the SCADA data cloud storage security protection method and device, the retrieval efficiency and the security protection performance can be better balanced.

Description

Technical Field

[0001] This invention relates to the technical field of cloud data storage, and in particular to a method and device for security protection of SCADA cloud data storage. Background Technology

[0002] SCADA (Supervisory Control and Data Acquisition) systems are key technologies in industrial automation for real-time monitoring, data acquisition, and control. By connecting with sensors, PLCs (Programmable Logic Controllers), RTUs (Remote Terminal Units), and other devices, SCADA systems help operators monitor equipment operating status in real time, collect process parameter data, and perform control. SCADA is widely used in power, water treatment, petrochemical, and traffic management industries. The main functions of a SCADA system include: real-time data acquisition and monitoring, data storage and historical data analysis, alarm and event management, automated control and remote operation, optimization, and scheduling. Due to the importance of SCADA system data, current SCADA system data is primarily stored in formats other than local storage. However, for task scenarios such as the Industrial Internet of Things (IIoT) with strong demands for remote real-time collaboration among multiple user terminals and high sensitivity to data timeliness, cloud storage for SCADA systems becomes a necessary choice. Therefore, data security for SCADA systems in cloud storage is particularly important.

[0003] In existing technologies, the security protection of SCADA system data cloud storage all adopt mature encryption and decryption technologies. For example, Chinese patent CN107330056A, "Wind Farm SCADA System and its Operation Method Based on Big Data Cloud Computing Platform," describes in claim 4 that "after the data from the wind farm side is collected by the front-end server, it is encrypted by the firewall, and then uploaded to the cloud computing platform by the switch through the user access interface." In other words, in existing technologies, data security protection is simply achieved by encrypting the SCADA system data with a front-end firewall before it is uploaded to the cloud storage server. In the encryption and decryption process of data storage, the cloud server simply uses mature existing encryption and decryption algorithms that are no different from those used for other types of data.

[0004] However, existing technologies have several problems. On the one hand, when other users in the SCADA system retrieve data from the cloud server, they need to decrypt the encrypted data, resulting in a redundant decryption-retrieval-encryption process, which does not meet the data processing efficiency requirements of remote real-time collaboration and data time-sensitive task scenarios. On the other hand, front-end firewall encryption technology cannot be applied to cloud storage servers to defend against new network threats such as algorithm substitution attacks, and the protection measures have shortcomings in defending against new threats. At the same time, raising the protection level cannot balance decryption efficiency and security performance. Furthermore, existing encryption technologies are not adapted to the high continuity and strong correlation characteristics of SCADA system time-series data (such as equipment operation logs and real-time production parameters), resulting in three core defects: First, high retrieval latency during decryption. The index structure of general encryption and decryption algorithms does not consider the temporal correlation of industrial data, and the matching process requires traversing the entire index, which is difficult to meet the real-time requirements of SCADA systems. Second, high index conflict rate. The keyword extraction logic of general encryption and decryption algorithms is not adapted to the encoding format of industrial parameters, which easily leads to duplicate keyword indexes for different data, affecting retrieval accuracy. Third, poor compatibility between the keys of general encryption and decryption algorithms and industrial scenarios. The key usage mechanism is not designed in conjunction with the link characteristics of industrial data transmission, which poses a risk of key leakage. Summary of the Invention

[0005] To overcome one or more technical problems existing in the prior art, embodiments of the present invention provide a method and apparatus for SCADA data cloud storage security protection, so as to better balance retrieval efficiency and security protection performance.

[0006] In a first aspect, the present invention provides a method for security protection of SCADA data cloud storage, comprising the following steps: In the local server of the SCADA system, various types of data are packaged into standardized data containing corresponding time series data, and then sent to the encryption module; Encryption is performed in the encryption module on the local server. The standardized data is converted into standardized data ciphertext, and keywords are extracted from the standardized data to generate corresponding keyword ciphertext. Then, a public key and a private key are generated. During the encryption operation, the encryption module searches for encryption algorithms based on the public key. It associates the three data elements of the standardized data—time stamp, device number, and keyword ciphertext—to generate a composite index. The time interval is used as the highest or higher priority for retrieval and matching. The encryption strength of the public key and private key is adjusted according to changes in data transmission bandwidth. The encryption module is a cryptographic anti-firewall module that transmits standardized data ciphertext, keyword ciphertext, public key, and private key to the local server. The cryptographic anti-firewall module re-randomizes the keyword ciphertext to generate randomized keyword ciphertext. The cryptographic anti-firewall module sends the randomized key ciphertext, standardized data ciphertext, and public key to the cloud storage server, and stores the randomized key ciphertext and standardized data ciphertext together.

[0007] Preferably, after packaging into standardized data, invalid and redundant data are removed before sending the standardized data.

[0008] Preferably, the cryptographic anti-firewall module uses a randomization algorithm to generate randomized key ciphertext.

[0009] Preferably, when the cloud storage server receives randomized keyword ciphertext and standardized data ciphertext, it uses a unique identifier field to associate and store the randomized keyword ciphertext and standardized data ciphertext.

[0010] In a second aspect, the present invention provides a SCADA data cloud storage security protection device for performing the SCADA data cloud storage security protection method of the first aspect, including a local server and a cloud storage server; The local server is equipped with a data packaging module, an encryption module, and a cryptographic anti-firewall module; the cloud storage server is equipped with a storage module. The data packaging module is connected to the encryption module; the data packaging module is used to package various types of data from the SCADA system into standardized data containing corresponding time-series data, and then send it to the encryption module. The encryption module connects to the cryptographic anti-firewall module. The encryption module converts standardized data into standardized ciphertext, extracts keywords from the standardized data to generate corresponding keyword ciphertext, and then generates a public key and a private key. During encryption, the encryption module searches for encryption algorithms using the public key, correlates the timestamp, device number, and keyword ciphertext of the standardized data to generate a composite index, prioritizing time intervals for matching, and adjusting the encryption strength of the public and private keys based on changes in data transmission bandwidth. The encryption module also transmits the standardized data ciphertext, keyword ciphertext, public key, and private key to the cryptographic anti-firewall module on the local server. The cryptographic anti-firewall module is connected to the storage module; the cryptographic anti-firewall module is used to re-randomize the key ciphertext to generate randomized key ciphertext; the cryptographic anti-firewall module is used to send the randomized key ciphertext, the normalized data ciphertext, and the public key to the storage module; The storage module is used to store randomized key ciphertext, standardized data ciphertext, and public key, and to store the randomized key ciphertext and standardized data ciphertext together.

[0011] Thirdly, the present invention provides a method for security protection of SCADA data cloud storage, including the following steps: In the local server of the SCADA system, various types of data are packaged into standardized data containing corresponding time series data, and then sent to the encryption module; Encryption is performed in the encryption module of the local server, converting standardized data into standardized data ciphertext, extracting keywords from the standardized data to generate corresponding keyword ciphertext, and then generating public and private keys. During the encryption operation, the steps of the encryption algorithm can be searched based on the public key. The three data elements of the standardized data—time stamp, device number, and keyword ciphertext—are correlated to generate a composite index. The time interval is used as the highest or higher priority for retrieval and matching. The encryption strength of the public and private keys is adjusted according to the changes in data transmission bandwidth. The encryption module is a cryptographic anti-firewall module that transmits standardized data ciphertext, keyword ciphertext, public key, and private key to the local server. The cryptographic anti-firewall module re-randomizes the keyword ciphertext to generate randomized keyword ciphertext. The cryptographic reverse firewall module sends randomized keyword ciphertext, standardized data ciphertext, and public key to the cloud storage server, and stores the randomized keyword ciphertext and standardized data ciphertext together. When a user of the SCADA system sends a search request, the encryption module of the local server receives the search keywords. The encryption module uses a combination of a private key and a search keyword to generate a keyword trapdoor, and then sends the keyword trapdoor to the cryptographic anti-firewall module on the local server. The encryption module can search for encryption algorithms based on the public key and generate a keyword trapdoor by combining the private key and the search keywords. The cryptographic anti-firewall module re-randomizes the keyword trapdoor to generate a randomized keyword trapdoor; The cryptographic anti-firewall module sends a randomized keyword trapdoor to the cloud storage server for retrieval. It then matches the randomized keyword trapdoor with the randomized keyword ciphertext. If a match is found, the corresponding standardized data ciphertext is directly returned to the client that issued the retrieval request.

[0012] Preferably, after packaging into standardized data, invalid and redundant data are removed before sending the standardized data.

[0013] Preferably, the cryptographic anti-firewall module uses a randomization algorithm to generate randomized keyword ciphertext and keyword trapdoors respectively.

[0014] Preferably, when the cloud storage server receives randomized keyword ciphertext and standardized data ciphertext, it uses a unique identifier field to associate and store the randomized keyword ciphertext and standardized data ciphertext.

[0015] Fourthly, the present invention provides a SCADA data cloud storage security protection device for performing the SCADA data cloud storage security protection method of the third aspect, including a local server and a cloud storage server; The local server is equipped with a data packaging module, an encryption module, and a cryptographic anti-firewall module; the cloud storage server is equipped with a retrieval and matching module and a storage module. The data packaging module is connected to the encryption module; the data packaging module is used to package various types of data from the SCADA system into standardized data containing corresponding time-series data, and then send it to the encryption module. The encryption module connects to the cryptographic reverse firewall module. The encryption module converts standardized data into standardized data ciphertext, extracts keywords from the standardized data to generate corresponding keyword ciphertext, and then generates a public key and a private key. During encryption, the encryption module uses the steps of the public key searchable encryption algorithm to correlate the three data elements of the standardized data—time stamp, device number, and keyword ciphertext—to generate a composite index. It prioritizes time intervals for retrieval and matching, and adjusts the encryption strength of the public and private keys according to changes in data transmission bandwidth. The encryption module also transmits the standardized data ciphertext, keyword ciphertext, public key, and private key to the cryptographic reverse firewall module on the local server. Furthermore, the encryption module combines the private key and the search keywords sent by the user terminal from the SCADA system's search request using the public key searchable encryption algorithm to generate a keyword trapdoor. The cryptographic anti-firewall module is connected to the retrieval and matching module and the storage module. The cryptographic anti-firewall module is used to re-randomize the keyword ciphertext and keyword trapdoor, respectively, generating randomized keyword ciphertext and randomized keyword trapdoor. The cryptographic anti-firewall module is used to send the randomized keyword ciphertext, standardized data ciphertext, and public key to the storage module. The cryptographic anti-firewall module is also used to send the randomized keyword trapdoor to the retrieval and matching module. The storage module is used to store randomized key ciphertext, standardized data ciphertext, and public key, and to store the randomized key ciphertext and standardized data ciphertext together. The retrieval matching module is used to match randomized keyword trapdoors with randomized keyword ciphertext. If the match is successful, the storage module will directly return the corresponding standardized data ciphertext to the user client that issued the retrieval request.

[0016] Compared with existing technologies, the SCADA data cloud storage security protection method and device of the present invention have the following advantages: The new mechanism of public-key searchable encryption is combined with cryptographic anti-firewall. The key ciphertext generated by public-key searchable encryption is transmitted to cryptographic anti-firewall for re-randomization, ensuring that the key ciphertext is unknown before being uploaded to the cloud storage server, thus strengthening data security protection. The cryptographic reverse firewall receives the key ciphertext and key trapdoor and performs randomization processing to ensure that the key ciphertext is difficult to be leaked during encryption and the trapdoor is difficult to be broken when retrieved by the user, forming a closed loop of security protection for the entire SCADA data process. The cloud storage server associates and stores randomized keyword ciphertext and standardized data ciphertext to ensure that the corresponding standardized data ciphertext can be accurately located through keyword trapdoors during subsequent retrieval and matching, thereby improving retrieval efficiency. The public and private keys are processed directly into key ciphertext and key trapdoors within the local server to avoid the possibility of leakage during remote transmission and ensure the security and efficiency of the use of public and private keys. In public-key searchable encryption operations, a mechanism is used to address the shortcomings of traditional general algorithms in retrieving SCADA system data in time-sensitive scenarios, such as high latency, high index conflict rate, and poor adaptability. This is achieved by binding time-series features with indexes, prioritizing time-series intervals for retrieval and matching, and adjusting the encryption strength of public and private keys according to data transmission bandwidth fluctuations. It also forms a synergistic optimization with the randomization processing of cryptographic anti-firewalls, further improving the security and efficiency of encrypted retrieval. Cryptographic anti-firewalls use randomization algorithms to process key ciphertext and key trapdoors, avoiding interference with the public key searchable encryption process and ensuring the reliability of the randomization effect. This embodiment addresses the weak security protection of existing SCADA systems during cloud migration and data backhaul processes, avoiding the shortcomings of traditional security measures such as high deployment costs and difficulty in resisting new threats like algorithm substitution attacks. The integrated approach of public key searchable encryption and cryptographic reverse firewall reduces the maintenance costs of independent deployments and is suitable for SCADA systems that are sensitive to data timing. Attached Figure Description

[0017] Figure 1 This is a flowchart of one of the SCADA data cloud storage security protection methods of the present invention.

[0018] Figure 2 This is a flowchart of another SCADA data cloud storage security protection method according to the present invention.

[0019] Figure 3 For the corresponding Figure 1 A structural diagram of the SCADA data cloud storage security protection device.

[0020] Figure 4 For the corresponding Figure 2 A structural diagram of the SCADA data cloud storage security protection device. Detailed Implementation

[0021] Please refer to the diagrams, where the same component symbols represent the same components. The principles of the invention are illustrated by way of example implemented in a suitable operating environment. The following description is based on the illustrative specific embodiments of the invention and should not be construed as limiting the invention to other specific embodiments not detailed herein.

[0022] In the following description, specific embodiments of the invention will be illustrated with reference to the steps and symbols of operations performed by one or more computers, unless otherwise stated. Thus, it will be understood that these steps and operations, which are repeatedly mentioned as being performed by a computer, include manipulation by a computer processing unit representing electronic signals of data in a structured format. This manipulation transforms the data or maintains it at a location in the computer's memory system, which can be reconfigured or otherwise alter the operation of the computer in a manner well known to those skilled in the art. The data structure maintained by the data is the physical location of the memory, which has specific characteristics defined by the data format. However, the principles of the invention are described above and are not intended to be limiting; those skilled in the art will understand that many of the steps and operations described below can also be implemented in hardware.

[0023] As used herein, the terms “component,” “module,” “system,” “interface,” “process,” etc., generally refer to computer-related entities: hardware, a combination of hardware and software, software, or software in execution. For example, a component can be, but is not limited to, a process running on a processor, a processor, an object, an executable application, an executing thread, a program, and / or a computer. As illustrated, both an application running on a controller and the controller itself can be components. One or more components may reside within an executing process and / or thread, and components may be located on a single computer and / or distributed across two or more computers.

[0024] Furthermore, the claimed subject matter can be implemented as a method, apparatus, or article of manufacture that uses standard programming and / or engineering techniques to produce software, firmware, hardware, or any combination thereof to control a computer to implement the disclosed subject matter. As used herein, the term "article of manufacture" is intended to include computer programs accessible from any computer-readable device, carrier, or medium. Of course, those skilled in the art will recognize that many modifications can be made to this configuration without departing from the scope or spirit of the claimed subject matter.

[0025] Although not required, embodiments are described within the general context of "computer-readable instructions" being executed by one or more electronic devices. Computer-readable instructions can be distributed via computer-readable media. Computer-readable instructions can be implemented as program modules, such as functions, objects, application programming interfaces (APIs), data structures, etc., that perform specific tasks or implement specific abstract data types. Typically, the functionality of such computer-readable instructions can be freely combined or distributed in various environments.

[0026] This document provides various operations of the embodiments. In one and / or more embodiments, one or more of the operations may constitute computer-readable instructions stored on one or more computer-readable media, which, when executed by an electronic device, will cause a computing device to perform the operations. The order in which some or all of the operations are described should not be construed as implying that these operations must be sequentially related. Those skilled in the art will understand alternative orderings that have the benefits of this specification. Moreover, it should be understood that not all operations are required to be present in every embodiment provided herein.

[0027] Furthermore, the term "preferred" as used herein is intended to refer to an example, illustration, or illustration. Any aspect or design described herein as "preferred" need not be construed as being more advantageous than other aspects or designs. Rather, the use of the term "preferred" is intended to present the concept in a concrete manner. The term "or" as used in this application is intended to mean an inclusive "or" rather than an exclusionary "or." That is, unless otherwise specified or clear from the context, "X uses A or B" naturally includes either of the permutations. Specifically, if X uses A; X uses B; or X uses both A and B, then "X uses A or B" is satisfied in any of the foregoing examples.

[0028] Furthermore, although this disclosure has been shown and described with respect to one or more implementations, equivalent variations and modifications will occur to those skilled in the art based on a reading and understanding of this specification and drawings. This disclosure includes all such modifications and variations and is limited only by the scope of the appended claims. In particular, with respect to the various functions performed by the aforementioned components (e.g., elements, resources, etc.), the terminology used to describe such components is intended to correspond to any component (unless otherwise indicated) that performs the specified function of said component (e.g., is functionally equivalent to it), even if structurally not equivalent to the disclosed structure that performs the function in the exemplary implementation of this disclosure shown herein. Moreover, although a particular feature of this disclosure has been disclosed with respect to only one of several implementations, such feature may be combined with one or more other features of other implementations that may be desirable and advantageous for a given or particular application. Furthermore, with regard to the use of the terms “comprising,” “having,” “containing,” or variations thereof in the Detailed Description or claims, such terms are intended to be included in a manner similar to the term “including.”

[0029] The hardware infrastructure of this invention consists of a local server and a cloud server. Data from the SCADA system is uploaded to the cloud after passing through the local server. When multiple user terminals in the SCADA system need to obtain data from the cloud server, they must first pass through the local server before uploading the request to the cloud server. The working environment of the electronic devices used in the encryption, decryption, and cloud storage processes is preferably a server. Data is transmitted through local networks and / or remote networks. The server may include multiple databases and information processing programs. However, the electronic devices are not limited to personal computers, multiprocessor systems, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc.

[0030] The first embodiment of the present invention is described below.

[0031] Please refer to Figure 1 The SCADA data cloud storage security protection method of this embodiment includes the following steps: S1. On the local server of the SCADA system, all types of data that need to be uploaded to the cloud storage server are packaged into standardized data in a unified format. In this embodiment, preferably after packaging the data into standardized data in a unified format, a data filtering mechanism is also set to remove invalid and redundant data that meet the filtering conditions, and then send the filtered standardized data. In this embodiment, the standardized data packaged in a unified format includes time-series data corresponding to various types of data in the SCADA system; S2. Perform encryption operations in the encryption module of the local server to convert the standardized data into standardized data ciphertext, extract keywords from the standardized data to generate corresponding keyword ciphertext, and then generate public and private keys. In this embodiment, the local server is located in the data network on one side of the SCADA system, specifically a server within the local area network, and can be regarded as part of the SCADA system. Data upload and download requests between the SCADA system and the cloud storage server must be securely verified through the local server. When the SCADA system uploads standardized data to the cloud storage server, the standardized data must first be sent to the local server for encryption. In step S2, during the encryption operation, a new encryption mechanism is introduced based on the public-key searchable encryption (PEKS algorithm) method. This new encryption mechanism includes: (1) In terms of index structure, the time-series characteristics of standardized data are bound to the index, specifically: the three data elements of standardized data, namely timestamp, device number, and keyword ciphertext, are correlated to generate a composite index; In this embodiment, the time sequence feature refers to the time point and order of the standardized data, specifically the timestamp when the data is collected, and the device number can be compiled according to the device characteristics of the specific SCADA system. (2) In terms of retrieval matching logic, the time series interval is used as the highest or higher priority for retrieval matching, and keyword matching is performed first within the time series interval to be retrieved; (3) In terms of key generation, the encryption strength of the public and private keys is adjusted according to the changes in the data transmission bandwidth when the SCADA system sends standardized data to the local server, so as to balance the security of data transmission and the efficiency of transmission processing. For example, when the bandwidth is large, a larger amount of data can be transmitted, so the encryption strength can be enhanced without affecting the transmission efficiency. When the bandwidth is small, the amount of data transmitted is low, so the encryption strength is weakened to avoid even worse transmission efficiency. S3, the encryption module of the local server, transmits the standardized data ciphertext, keyword ciphertext, public key, and private key to the cryptographic anti-firewall module of the local server through the internal data link of the local server. S4. The cryptographic anti-firewall module re-randomizes the keyword ciphertext to generate randomized keyword ciphertext. In this embodiment, a randomization algorithm is used to re-randomize the ciphertext containing the keywords; S5, the cryptographic reverse firewall module sends the randomized keyword ciphertext, standardized data ciphertext, and public key to the cloud storage server, which then stores the SCADA system's data into the database. In this embodiment, when the cloud storage server receives the randomized keyword ciphertext and the standardized data ciphertext, it uses a unique identifier field to associate and store the randomized keyword ciphertext and the standardized data ciphertext.

[0032] Compared to existing technologies, the SCADA data cloud storage security protection method in this embodiment has the following advantages: The new mechanism of public-key searchable encryption is combined with cryptographic anti-firewall. The key ciphertext generated by public-key searchable encryption is transmitted to cryptographic anti-firewall for re-randomization, ensuring that the key ciphertext is unknown before being uploaded to the cloud storage server, thus strengthening data security protection. The cryptographic reverse firewall receives the ciphertext of the keyword and performs randomization processing to ensure that the trapdoor is difficult to break when it is retrieved by the user end, thus forming a closed loop of security protection for the SCADA data retrieval process. The cloud storage server associates and stores randomized keyword ciphertext and standardized data ciphertext to ensure that the corresponding standardized data ciphertext can be accurately located during subsequent retrieval and matching, thereby improving retrieval efficiency. The public key is processed directly into key ciphertext within the local server, avoiding the possibility of leakage during remote transmission and ensuring the security and efficiency of public key usage; In public-key searchable encryption operations, a mechanism is used to address the shortcomings of traditional general algorithms in retrieving SCADA system data in time-sensitive scenarios, such as high latency, high index conflict rate, and poor adaptability. This is achieved by binding time-series features with indexes, prioritizing time-series intervals for retrieval and matching, and adjusting the encryption strength of public and private keys according to data transmission bandwidth fluctuations. It also forms a synergistic optimization with the randomization processing of cryptographic anti-firewalls, further improving the security and efficiency of encrypted retrieval. Cryptographic anti-firewalls use randomization algorithms to process key-based ciphertext, avoiding interference with the public-key searchable encryption process and ensuring the reliability of the randomization effect. This embodiment addresses the weakness in security protection of existing SCADA systems during cloud migration, avoiding the shortcomings of traditional security measures such as high deployment costs and difficulty in resisting new threats like algorithm substitution attacks. The integrated approach of public key searchable encryption and cryptographic reverse firewall reduces the maintenance costs of independent deployments and is suitable for SCADA systems that are sensitive to data time sequence.

[0033] The second embodiment of the present invention is described below.

[0034] Please refer to Figure 2 The SCADA data cloud storage security protection method of this embodiment includes the following steps: S1. On the local server of the SCADA system, all types of data that need to be uploaded to the cloud storage server are packaged into standardized data in a unified format. Then, invalid and redundant data are filtered out, and the filtered standardized data is sent to the encryption module of the local server. In this embodiment, the standardized data packaged in a unified format includes time-series data corresponding to various types of data in the SCADA system; invalid data includes data that does not conform to the preset format (such as incorrect date format), data type mismatch (such as inputting numbers in text fields), data that exceeds the allowed range (such as temperature values ​​exceeding the sensor's range), and logical contradictions between data (such as mismatch between wind speed and power data); redundant data is mainly backup data, including real-time synchronized data, historical synchronized data, alarm information synchronized data, network protocol redundant data, etc. S2. The encryption module of the local server encrypts the standardized data, converts the standardized data into standardized data ciphertext, extracts keywords from the standardized data to generate corresponding keyword ciphertext, and then generates a public key and a private key. In this embodiment, the local server is located in the data network on one side of the SCADA system, specifically a server within the local area network, and is part of the SCADA system. Data upload and download requests between the SCADA system and the cloud storage server must be securely verified through the local server. When the SCADA system uploads standardized data to the cloud storage server, the standardized data must first be sent to the local server for encryption. In step S2, the specific process of performing the encryption operation involves introducing a new encryption mechanism based on the public-key searchable encryption (PEKS algorithm) method. The new encryption mechanism includes: (1) In terms of index structure, the time-series characteristics of standardized data are bound to the index, specifically: the three data elements of standardized data, namely timestamp, device number, and keyword ciphertext, are correlated to generate a composite index; In this embodiment, the time sequence feature refers to the time point and order of the standardized data, specifically the timestamp when the data is collected, and the device number can be compiled according to the device characteristics of the specific SCADA system. (2) In terms of retrieval matching logic, the time series interval is used as the highest or higher priority for retrieval matching, and keyword matching is performed first within the time series interval to be retrieved; (3) In terms of key generation, the encryption strength of the key is adjusted according to the change in data transmission bandwidth when the SCADA system sends standardized data to the local server, so as to balance the security and efficiency of data transmission. S3, the encryption module of the local server, transmits the standardized data ciphertext, keyword ciphertext, public key, and private key to the cryptographic anti-firewall module of the local server through the internal data link of the local server. S4. The cryptographic anti-firewall module re-randomizes the keyword ciphertext to generate randomized keyword ciphertext. In this embodiment, a randomization algorithm is used to re-randomize the ciphertext containing the keywords; S5, the cryptographic reverse firewall module sends the randomized keyword ciphertext, standardized data ciphertext, and public key to the cloud storage server, which then stores the SCADA system's data into the database. In this embodiment, when the cloud storage server receives the randomized keyword ciphertext and the standardized data ciphertext, it uses a unique identifier field to associate and store the randomized keyword ciphertext and the standardized data ciphertext. S6. When the user sends a search request to retrieve standardized encrypted data, the search keywords are sent to the encryption module of the local server. S7. The local server's encryption module uses the private key and the search keyword to generate a keyword trapdoor, and then sends the keyword trapdoor to the local server's cryptographic anti-firewall module. In this embodiment, the encryption module combines the private key and the search keyword to generate a keyword trapdoor based on the Public Key Searchable Encryption Algorithm (PEKS); S8, the cryptographic anti-firewall module re-randomizes the keyword trapdoor to generate a randomized keyword trapdoor; In this embodiment, a randomization algorithm is used to re-randomize the keyword trapdoor. The randomization algorithm in step S8 is the same as that in step S4. S9. The cryptographic reverse firewall module sends the randomized keyword trapdoor to the cloud storage server for retrieval. During the retrieval, the randomized keyword trapdoor is matched with the randomized keyword ciphertext. If the match is successful, the corresponding standardized data ciphertext is directly returned to the user client that issued the retrieval request. In this embodiment, the cloud storage server has a preset matching algorithm, which is called when the cloud storage server performs a search.

[0035] Compared to existing technologies, the SCADA data cloud storage security protection method in this embodiment has the following advantages: The new mechanism of public-key searchable encryption is combined with cryptographic anti-firewall. The key ciphertext generated by public-key searchable encryption is transmitted to cryptographic anti-firewall for re-randomization, ensuring that the key ciphertext is unknown before being uploaded to the cloud storage server, thus strengthening data security protection. The cryptographic reverse firewall receives the key ciphertext and key trapdoor and performs randomization processing to ensure that the key ciphertext is difficult to be leaked during encryption and the trapdoor is difficult to be broken when retrieved by the user, forming a closed loop of security protection for the entire SCADA data process. The cloud storage server associates and stores randomized keyword ciphertext and standardized data ciphertext to ensure that the corresponding standardized data ciphertext can be accurately located through keyword trapdoors during subsequent retrieval and matching, thereby improving retrieval efficiency. The public and private keys are processed directly into key ciphertext and key trapdoors within the local server to avoid the possibility of leakage during remote transmission and ensure the security and efficiency of the use of public and private keys. In public-key searchable encryption operations, a mechanism is used to address the shortcomings of traditional general algorithms in retrieving SCADA system data in time-sensitive scenarios, such as high latency, high index conflict rate, and poor adaptability. This is achieved by binding time-series features with indexes, prioritizing time-series intervals for retrieval and matching, and adjusting the encryption strength of public and private keys according to data transmission bandwidth fluctuations. It also forms a synergistic optimization with the randomization processing of cryptographic anti-firewalls, further improving the security and efficiency of encrypted retrieval. Cryptographic anti-firewalls use randomization algorithms to process key ciphertext and key trapdoors, avoiding interference with the public key searchable encryption process and ensuring the reliability of the randomization effect. This embodiment addresses the weak security protection of existing SCADA systems during cloud migration and data backhaul processes, avoiding the shortcomings of traditional security measures such as high deployment costs and difficulty in resisting new threats like algorithm substitution attacks. The integrated approach of public key searchable encryption and cryptographic reverse firewall reduces the maintenance costs of independent deployments and is suitable for SCADA systems that are sensitive to data timing.

[0036] The third embodiment of the present invention is described below.

[0037] Please refer to Figure 3 The SCADA data cloud storage security protection device in this embodiment is used to run the SCADA data cloud storage security protection method of the first embodiment of the present invention.

[0038] The SCADA data cloud storage security protection device in this embodiment includes a local server and a cloud storage server. The local server and the cloud storage server are connected through a data network to transmit SCADA data and requests.

[0039] The local server is equipped with a data packaging module, an encryption module, and a cryptographic anti-firewall module; the cloud storage server is equipped with a storage module. The data packaging module connects to the corresponding data devices in the SCADA system for data transmission.

[0040] The data packaging module is connected to the encryption module. The data packaging module is used to package various types of data that need to be uploaded to the cloud storage service server into standardized data in a unified format, filter invalid and redundant data, and send the filtered standardized data to the encryption module.

[0041] The encryption module connects to the cryptographic anti-firewall module. The encryption module is used to encrypt standardized data, converting it into standardized ciphertext, extracting keywords from the standardized data to generate corresponding keyword ciphertext, and generating public and private keys.

[0042] When the encryption module performs encryption operations, it introduces a new encryption mechanism based on the public-key searchable encryption method with keyword search (PEKS algorithm). The new encryption mechanism includes: (1) In terms of index structure, the time-series characteristics of standardized data are bound to the index, specifically: the three data elements of standardized data, namely timestamp, device number, and keyword ciphertext, are correlated to generate a composite index; In this embodiment, the time sequence feature refers to the time point and order of the standardized data, specifically the timestamp when the data is collected, and the device number can be compiled according to the device characteristics of the specific SCADA system. (2) In terms of retrieval matching logic, the time series interval is used as the highest or higher priority for retrieval matching, and keyword matching is performed first within the time series interval to be retrieved; (3) In terms of key generation, the encryption strength of the key is adjusted according to the change in data transmission bandwidth when the SCADA system sends standardized data to the local server, so as to balance the security and efficiency of data transmission.

[0043] The cryptographic anti-firewall module connects to the storage module for data transmission. The cryptographic anti-firewall module is used to re-randomize the key ciphertext, generating randomized key ciphertext.

[0044] In this embodiment, the cryptographic anti-firewall module uses a randomization algorithm to re-randomize the keyword ciphertext.

[0045] In this embodiment, the cryptographic reverse firewall module is used to send the randomized key ciphertext, standardized data ciphertext, and public key to the storage module of the cloud storage service server.

[0046] The storage module of the cloud storage server is used to store randomized key ciphertext, standardized data ciphertext, and public key.

[0047] In this embodiment, the storage module uses a unique identifier field to associate and store the randomized keyword ciphertext and the standardized data ciphertext.

[0048] Compared with existing technologies, the SCADA data cloud storage security protection device in this embodiment has the following advantages: The new mechanism of public-key searchable encryption is combined with cryptographic anti-firewall. The key ciphertext generated by public-key searchable encryption is transmitted to cryptographic anti-firewall for re-randomization, ensuring that the key ciphertext is unknown before being uploaded to the cloud storage server, thus strengthening data security protection. The cryptographic reverse firewall receives the ciphertext of the keyword and performs randomization processing to ensure that the trapdoor is difficult to break when it is retrieved by the user end, thus forming a closed loop of security protection for the SCADA data retrieval process. The cloud storage server associates and stores randomized keyword ciphertext and standardized data ciphertext to ensure that the corresponding standardized data ciphertext can be accurately located during subsequent retrieval and matching, thereby improving retrieval efficiency. The public key is processed directly into key ciphertext within the local server, avoiding the possibility of leakage during remote transmission and ensuring the security and efficiency of public key usage; In public-key searchable encryption operations, a mechanism is used to address the shortcomings of traditional general algorithms in retrieving SCADA system data in time-sensitive scenarios, such as high latency, high index conflict rate, and poor adaptability. This is achieved by binding time-series features with indexes, prioritizing time-series intervals for retrieval and matching, and adjusting the encryption strength of public and private keys according to data transmission bandwidth fluctuations. It also forms a synergistic optimization with the randomization processing of cryptographic anti-firewalls, further improving the security and efficiency of encrypted retrieval. Cryptographic anti-firewalls use randomization algorithms to process key-based ciphertext, avoiding interference with the public-key searchable encryption process and ensuring the reliability of the randomization effect. This embodiment addresses the weakness in security protection of existing SCADA systems during cloud migration, avoiding the shortcomings of traditional security measures such as high deployment costs and difficulty in resisting new threats like algorithm substitution attacks. The integrated approach of public key searchable encryption and cryptographic reverse firewall reduces the maintenance costs of independent deployments and is suitable for SCADA systems that are sensitive to data time sequence.

[0049] The fourth embodiment of the present invention is described below.

[0050] Please refer to Figure 4 The SCADA data cloud storage security protection device in this embodiment is used to run the SCADA data cloud storage security protection method of the second embodiment of the present invention.

[0051] The SCADA data cloud storage security protection device in this embodiment includes a local server and a cloud storage server. The local server and the cloud storage server are connected through a data network to transmit SCADA data and requests.

[0052] The local server is equipped with a data packaging module, an encryption module, and a cryptographic anti-firewall module; the cloud storage server is equipped with a retrieval and matching module and a storage module. The data packaging module connects to the corresponding data devices in the SCADA system for data transmission, the encryption module connects to multiple user terminals of the SCADA system for data transmission, and the cloud storage server connects to multiple user terminals of the SCADA system for data transmission.

[0053] The data packaging module is connected to the encryption module. The data packaging module is used to package various types of data that need to be uploaded to the cloud storage service server into standardized data in a unified format, filter invalid and redundant data, and send the filtered standardized data to the encryption module.

[0054] The encryption module connects to the cryptographic anti-firewall module. The encryption module encrypts standardized data, converting it into ciphertext, extracting keywords to generate corresponding keyword ciphertext, and generating public and private keys. The encryption module also uses the private key and retrieved keywords to generate a keyword trapdoor, which is then sent to the cryptographic anti-firewall module on the local server.

[0055] When the encryption module performs encryption operations, it introduces a new encryption mechanism based on the public-key searchable encryption method with keyword search (PEKS algorithm). The new encryption mechanism includes: (1) In terms of index structure, the time-series characteristics of standardized data are bound to the index, specifically: the three data elements of standardized data, namely timestamp, device number, and keyword ciphertext, are correlated to generate a composite index; In this embodiment, the time sequence feature refers to the time point and order of the standardized data, specifically the timestamp when the data is collected, and the device number can be compiled according to the device characteristics of the specific SCADA system. (2) In terms of retrieval matching logic, the time series interval is used as the highest or higher priority for retrieval matching, and keyword matching is performed first within the time series interval to be retrieved; (3) In terms of key generation, the encryption strength of the key is adjusted according to the change in data transmission bandwidth when the SCADA system sends standardized data to the local server, so as to balance the security and efficiency of data transmission.

[0056] When generating a key trapdoor, the encryption module combines the private key and the search keyword according to the Public Key Searchable Encryption Algorithm (PEKS) to generate the key trapdoor. The search keyword used is transmitted from the user terminal.

[0057] The cryptographic anti-firewall module is connected to the retrieval and matching module and the storage module for data transmission. The cryptographic anti-firewall module is used to re-randomize the ciphertext of keywords, generating randomized keyword ciphertext. The cryptographic anti-firewall module is also used to re-randomize keyword trapdoors, generating randomized keyword trapdoors.

[0058] In this embodiment, the cryptographic anti-firewall module uses a randomization algorithm to re-randomize the key trapdoor; the cryptographic anti-firewall module uses the same randomization algorithm to re-randomize the key ciphertext.

[0059] In this embodiment, the cryptographic reverse firewall module is used to send randomized keyword ciphertext, standardized data ciphertext, and public key to the storage module of the cloud storage service server, and to send randomized keyword trapdoor to the retrieval and matching module of the cloud storage service server.

[0060] The storage module of the cloud storage server is used to store randomized key ciphertext, standardized data ciphertext, and public key.

[0061] In this embodiment, the storage module uses a unique identifier field to associate and store the randomized keyword ciphertext and the standardized data ciphertext.

[0062] The retrieval matching module is connected to the storage module. During retrieval, the retrieval matching module matches randomized keyword trapdoors with randomized keyword ciphertext; if a match is successful, it notifies the storage module to directly return the corresponding standardized data ciphertext to the user client that issued the retrieval request.

[0063] Compared with existing technologies, the SCADA data cloud storage security protection device in this embodiment has the following advantages: The new mechanism of public-key searchable encryption is combined with cryptographic anti-firewall. The key ciphertext generated by public-key searchable encryption is transmitted to cryptographic anti-firewall for re-randomization, ensuring that the key ciphertext is unknown before being uploaded to the cloud storage server, thus strengthening data security protection. The cryptographic reverse firewall receives the key ciphertext and key trapdoor and performs randomization processing to ensure that the key ciphertext is difficult to be leaked during encryption and the trapdoor is difficult to be broken when retrieved by the user, forming a closed loop of security protection for the entire SCADA data process. The cloud storage server associates and stores randomized keyword ciphertext and standardized data ciphertext to ensure that the corresponding standardized data ciphertext can be accurately located through keyword trapdoors during subsequent retrieval and matching, thereby improving retrieval efficiency. The public and private keys are processed directly into key ciphertext and key trapdoors within the local server to avoid the possibility of leakage during remote transmission and ensure the security and efficiency of the use of public and private keys. In public-key searchable encryption operations, a mechanism is used to address the shortcomings of traditional general algorithms in retrieving SCADA system data in time-sensitive scenarios, such as high latency, high index conflict rate, and poor adaptability. This is achieved by binding time-series features with indexes, prioritizing time-series intervals for retrieval and matching, and adjusting the encryption strength of public and private keys according to data transmission bandwidth fluctuations. It also forms a synergistic optimization with the randomization processing of cryptographic anti-firewalls, further improving the security and efficiency of encrypted retrieval. Cryptographic anti-firewalls use randomization algorithms to process key ciphertext and key trapdoors, avoiding interference with the public key searchable encryption process and ensuring the reliability of the randomization effect. This embodiment addresses the weak security protection of existing SCADA systems during cloud migration and data backhaul processes, avoiding the shortcomings of traditional security measures such as high deployment costs and difficulty in resisting new threats like algorithm substitution attacks. The integrated approach of public key searchable encryption and cryptographic reverse firewall reduces the maintenance costs of independent deployments and is suitable for SCADA systems that are sensitive to data timing.

[0064] Although the present invention has been disclosed above with reference to preferred embodiments, the above preferred embodiments are not intended to limit the present invention. Those skilled in the art can make various modifications and alterations without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention shall be determined by the scope defined in the claims.

Claims

1. A method for security protection of SCADA data cloud storage, characterized in that, Including the following steps: In the local server of the SCADA system, various types of data are packaged into standardized data containing corresponding time series data, and then sent to the encryption module; Encryption is performed in the encryption module of the local server to convert the standardized data into standardized data ciphertext, extract keywords from the standardized data to generate corresponding keyword ciphertext, and then generate a public key and a private key. During the encryption operation, the encryption module searches for encryption algorithms based on the public key, associates the three data elements of the standardized data (time stamp, device number, and keyword ciphertext) to generate a composite index, uses the time interval as the highest or higher retrieval matching priority, and adjusts the encryption strength of the public key and private key according to changes in data transmission bandwidth. The encryption module transmits the standardized data ciphertext, keyword ciphertext, public key, and private key to the local server's cryptographic anti-firewall module; The cryptographic anti-firewall module re-randomizes the keyword ciphertext to generate randomized keyword ciphertext. The cryptographic reverse firewall module sends the randomized keyword ciphertext, standardized data ciphertext, and public key to the cloud storage server, and stores the randomized keyword ciphertext and standardized data ciphertext together.

2. The SCADA data cloud storage security protection method according to claim 1, characterized in that, After packaging into standardized data, invalid and redundant data are removed before sending the standardized data.

3. The SCADA data cloud storage security protection method according to claim 1, characterized in that, The cryptographic anti-firewall module uses a randomization algorithm to generate randomized key ciphertext.

4. The SCADA data cloud storage security protection method according to claim 1, characterized in that, When the cloud storage server receives randomized keyword ciphertext and standardized data ciphertext, it uses a unique identifier field to associate and store the randomized keyword ciphertext and standardized data ciphertext.

5. A SCADA data cloud storage security protection device, used to execute the SCADA data cloud storage security protection method according to claim 1, characterized in that, This includes local servers and cloud storage servers; The local server is equipped with a data packaging module, an encryption module, and a cryptographic anti-firewall module; the cloud storage server is equipped with a storage module. The data packaging module is connected to the encryption module; the data packaging module is used to package various types of data from the SCADA system into standardized data containing corresponding time-series data, and then send it to the encryption module. The encryption module is connected to the cryptographic reverse firewall module. The encryption module converts the standardized data into standardized data ciphertext, extracts keywords from the standardized data to generate corresponding keyword ciphertext, and then generates a public key and a private key. During encryption, the encryption module searches for encryption algorithms using the public key, correlates the three data elements of the standardized data (time stamp, device number, and keyword ciphertext) to generate a composite index, using time intervals as the highest or higher priority for retrieval and matching, and adjusts the encryption strength of the public and private keys according to changes in data transmission bandwidth. The encryption module also transmits the standardized data ciphertext, keyword ciphertext, public key, and private key to the cryptographic reverse firewall module on the local server. The cryptographic anti-firewall module is connected to the storage module; the cryptographic anti-firewall module is used to re-randomize the keyword ciphertext to generate randomized keyword ciphertext; the cryptographic anti-firewall module is used to send the randomized keyword ciphertext, the standardized data ciphertext, and the public key to the storage module; The storage module is used to store randomized key ciphertext, standardized data ciphertext, and public key, and to store the randomized key ciphertext and standardized data ciphertext together.

6. A method for security protection of SCADA data cloud storage, characterized in that, Including the following steps: In the local server of the SCADA system, various types of data are packaged into standardized data containing corresponding time series data, and then sent to the encryption module; Encryption is performed in the encryption module of the local server, converting standardized data into standardized data ciphertext, extracting keywords from the standardized data to generate corresponding keyword ciphertext, and then generating public and private keys. During the encryption operation, the steps of the encryption algorithm can be searched based on the public key. The three data elements of the standardized data—time stamp, device number, and keyword ciphertext—are correlated to generate a composite index. The time interval is used as the highest or higher priority for retrieval and matching. The encryption strength of the public and private keys is adjusted according to the changes in data transmission bandwidth. The encryption module is a cryptographic anti-firewall module that transmits standardized data ciphertext, keyword ciphertext, public key, and private key to the local server. The cryptographic anti-firewall module re-randomizes the keyword ciphertext to generate randomized keyword ciphertext. The cryptographic reverse firewall module sends randomized keyword ciphertext, standardized data ciphertext, and public key to the cloud storage server, and stores the randomized keyword ciphertext and standardized data ciphertext together. When a user of the SCADA system sends a search request, the encryption module of the local server receives the search keywords. The encryption module uses a combination of a private key and a search keyword to generate a keyword trapdoor, and then sends the keyword trapdoor to the cryptographic anti-firewall module on the local server. The encryption module can search for encryption algorithms based on the public key and generate a keyword trapdoor by combining the private key and the search keywords. The cryptographic anti-firewall module re-randomizes the keyword trapdoor to generate a randomized keyword trapdoor; The cryptographic anti-firewall module sends the randomized keyword trapdoor to the cloud storage server for retrieval, matches the randomized keyword trapdoor with the randomized keyword ciphertext, and if the match is successful, directly returns the corresponding standardized data ciphertext to the user client that issued the retrieval request.

7. The SCADA data cloud storage security protection method according to claim 6, characterized in that, After packaging into standardized data, invalid and redundant data are removed before sending the standardized data.

8. The SCADA data cloud storage security protection method according to claim 6, characterized in that, The cryptographic anti-firewall module uses a randomization algorithm to generate randomized key ciphertext and key trapdoors, respectively.

9. The SCADA data cloud storage security protection method according to claim 6, characterized in that, When the cloud storage server receives randomized keyword ciphertext and standardized data ciphertext, it uses a unique identifier field to associate and store the randomized keyword ciphertext and standardized data ciphertext.

10. A SCADA data cloud storage security protection device, used to execute the SCADA data cloud storage security protection method according to claim 6, characterized in that, This includes local servers and cloud storage servers; The local server is equipped with a data packaging module, an encryption module, and a cryptographic anti-firewall module; the cloud storage server is equipped with a retrieval and matching module and a storage module. The data packaging module is connected to the encryption module; the data packaging module is used to package various types of data from the SCADA system into standardized data containing corresponding time-series data, and then send it to the encryption module. The encryption module is connected to the cryptographic reverse firewall module. The encryption module converts the standardized data into standardized data ciphertext, extracts keywords from the standardized data to generate corresponding keyword ciphertext, and then generates a public key and a private key. During encryption, the encryption module, based on the steps of the public key searchable encryption algorithm, correlates the three data elements of the standardized data—time stamp, device number, and keyword ciphertext—to generate a composite index, using the time sequence interval as the highest or higher priority for retrieval and matching, and adjusts the encryption strength of the public and private keys according to changes in data transmission bandwidth. The encryption module also transmits the standardized data ciphertext, keyword ciphertext, public key, and private key to the cryptographic reverse firewall module on the local server. Furthermore, the encryption module combines the private key and the search keywords sent by the user terminal from the SCADA system's search request using the public key searchable encryption algorithm to generate a keyword trapdoor. The cryptographic anti-firewall module is connected to the retrieval matching module and the storage module; the cryptographic anti-firewall module is used to re-randomize the keyword ciphertext and the keyword trapdoor respectively, generating randomized keyword ciphertext and randomized keyword trapdoor respectively; the cryptographic anti-firewall module is used to send the randomized keyword ciphertext, the standardized data ciphertext, and the public key to the storage module. The cryptographic anti-firewall module is used to send randomized keyword trapdoors to the retrieval matching module; The storage module is used to store randomized key ciphertext, standardized data ciphertext, and public key, and to store the randomized key ciphertext and standardized data ciphertext together. The retrieval matching module is used to match randomized keyword trapdoors with randomized keyword ciphertext. If the match is successful, the storage module will directly return the corresponding standardized data ciphertext to the user client that issued the retrieval request.

Images