A data processing method, device, medium, and product

Abstract

This invention discloses a data processing method, device, medium, and product. The method includes: reading a target quantum key index from a first quantum cryptography server; generating a request protocol message based on a post-quantum cryptography PQC private key, the target quantum key index, a first transaction identifier, and request protocol data, wherein the request protocol message includes ciphertext request protocol data; sending the request protocol message to a Modbus server, so that the Modbus server verifies the request protocol message based on the PQC public key and the target quantum key index read from a second quantum cryptography server; after successful verification, decrypting the ciphertext request protocol data using the target quantum key to obtain plaintext request protocol data, and executing the plaintext request protocol data to obtain response protocol data. This invention improves the security of data interaction.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of computer technology, and in particular to a data processing method, device, medium and product. Background Technology

[0002] In existing cross-LAN industrial control environments, communication between the host computer and the slave computer typically uses the Modbus Transmission Control Protocol (Modbus-TCP). Traditional Modbus-TCP generally uses plaintext transmission. When confidentiality is required, the following two solutions are generally adopted:

[0003] (a) Fixed-key encryption scheme: A fixed symmetric key needs to be used on both the Modbus client and server, and the Modbus protocol needs to be extended, including adding a Hash-Based Message Authentication Code (HMAC) for integrity verification and adding a sequence number to resist replay attacks. Before the client initiates a request, the Protocol Data Unit (PDU) is encrypted with the fixed key, the HMAC is calculated, and the result is appended to the end of the frame; after receiving the request, the server decrypts the PDU with the fixed key and verifies its HMAC. If the verification passes, a response is sent.

[0004] (ii) Secure Sockets Layer (SSL) / Transport Layer Security (TLS) security encapsulation scheme: Using the SSL / TLS protocol requires the server to prepare a digital certificate. When the client and server establish a connection, they exchange a series of messages to establish a secure connection. This connection establishment process is the standard handshake process of the SSL / TLS protocol. Once the handshake is successful, a secure channel for communication between the two parties is created. This channel protects the Modbus-TCP protocol data between the client and server, thereby enabling server authentication and communication encryption.

[0005] Fixed-key encryption schemes use the same key for PDU encryption and verification throughout the communication process. This scheme offers high communication efficiency as it eliminates the need for key negotiation and interactive authentication between the client and server. However, since the same key is always used, there is a risk of information leakage if the key is cracked or leaked.

[0006] SSL / TLS security encapsulation schemes rely on asymmetric keys for key negotiation. However, quantum computing and quantum algorithms pose significant challenges to the security of asymmetric cryptosystems based on mathematically difficult problems, such as RSA encryption. Even the Elgamma algorithm based on discrete logarithms on elliptic curves can be cracked by quantum computers in a short time. Furthermore, the handshake at the SSL layer requires a delay of 2 round-trip time (RTT) (Elliptic Curve Diffie-Hellman Ephemeral (ECDHE)), which can impact real-time industrial control environments. Additionally, older industrial control equipment may experience issues with updating the TLS protocol stack, posing a potential vulnerability to this solution. Summary of the Invention

[0007] This invention provides a data processing method, device, medium, and product to improve the security of data interaction.

[0008] According to one aspect of the present invention, a data processing method is provided, applied to a data processing system, the data processing system comprising: a Modbus client, a Modbus server, a first quantum cryptography server, and a second quantum cryptography server, wherein the first quantum cryptography server is connected to the Modbus client, and the second quantum cryptography server is connected to the Modbus server, the data processing method being executed by the Modbus client, the data processing method comprising:

[0009] Read the target quantum key index from the first quantum cryptography server;

[0010] Based on the post-quantum cryptography PQC private key, the target quantum key index, the first transaction identifier, and the request protocol data, a request protocol message is generated, wherein the request protocol message includes: ciphertext request protocol data;

[0011] The request protocol message is sent to the Modbus server, so that the Modbus server verifies the request protocol message based on the PQC public key and the target quantum key index read from the second quantum cryptography server. After successful verification, the ciphertext request protocol data is decrypted using the target quantum key to obtain the plaintext request protocol data, and the plaintext request protocol data is executed to obtain the response protocol data.

[0012] According to another aspect of the present invention, a data processing method is provided, applied to a data processing system, the data processing system comprising: a Modbus client, a Modbus server, a first quantum cryptography server, and a second quantum cryptography server, wherein the first quantum cryptography server is connected to the Modbus client, and the second quantum cryptography server is connected to the Modbus server, the data processing method being executed by the Modbus server, the data processing method comprising:

[0013] The Modbus client receives a request protocol message, wherein the request protocol message is a message generated by the Modbus client based on the post-quantum cryptography PQC private key, the target quantum key index read from the first quantum cryptography server, the first transaction identifier, and request protocol data, and the request protocol message includes: ciphertext request protocol data;

[0014] The request protocol message is verified based on the PQC public key and the target quantum key index read from the second quantum cryptography server;

[0015] After successful verification, the ciphertext request protocol data is decrypted using the target quantum key to obtain the plaintext request protocol data.

[0016] Execute the plaintext request protocol data to obtain the response protocol data.

[0017] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0018] At least one processor; and

[0019] A memory communicatively connected to the at least one processor; wherein,

[0020] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the data processing method according to any embodiment of the present invention.

[0021] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the data processing method described in any embodiment of the present invention.

[0022] According to another aspect of the present invention, a computer program product is provided, which, when executed by a processor, implements the data processing method as described in any of the embodiments of the present invention.

[0023] This invention, in its embodiments, reads the target quantum key index from a first quantum cryptography server; generates a request protocol message based on the post-quantum cryptography PQC private key, the target quantum key index, a first transaction identifier, and request protocol data. The request protocol message includes ciphertext request protocol data. This message is then sent to a Modbus server, which verifies the message using the PQC public key and the target quantum key index read from a second quantum cryptography server. Upon successful verification, the server decrypts the ciphertext request protocol data using the target quantum key to obtain plaintext request protocol data, and executes the plaintext request protocol data to obtain response protocol data. This allows for dynamic key generation and rotation, effectively addressing the security vulnerabilities inherent in traditional industrial control systems that rely on fixed keys. By deeply integrating quantum keys with the Modbus-TCP protocol, it ensures real-time communication while possessing the ability to resist current and future security threats.

[0024] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0025] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is a flowchart of a data processing method according to an embodiment of the present invention;

[0027] Figure 2 This is a schematic diagram of the structure of a data processing system according to an embodiment of the present invention;

[0028] Figure 3 This is a timing diagram of a data processing method using a Modbus-TCP protocol read coil instruction as an example in an embodiment of the present invention;

[0029] Figure 4 This is a timing diagram of a data processing method according to an embodiment of the present invention;

[0030] Figure 5 This is a flowchart of another data processing method in an embodiment of the present invention;

[0031] Figure 6 This is a schematic diagram of the structure of a data processing device according to an embodiment of the present invention;

[0032] Figure 7 This is a schematic diagram of the structure of another data processing device in an embodiment of the present invention;

[0033] Figure 8 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0034] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0035] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0036] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0037] Example 1

[0038] Figure 1 This is a flowchart illustrating a data processing method provided in an embodiment of the present invention. This embodiment is applicable to data processing situations. The method can be executed by a data processing device in this embodiment of the present invention. This device can be configured in a Modbus client and can be implemented in software and / or hardware, such as... Figure 1 As shown, the method specifically includes the following steps:

[0039] S110, Read the target quantum key index from the first quantum cryptography server.

[0040] The data processing method provided in this embodiment is applied to a data processing system, which includes a Modbus client, a Modbus server, a first quantum cryptography server, and a second quantum cryptography server. The first quantum cryptography server is connected to the Modbus client, and the second quantum cryptography server is connected to the Modbus server. The data processing method is executed by the Modbus client.

[0041] Optionally, the data processing system further includes: a first quantum key distribution (QKD) device and a second QKD device. The first QKD device is connected to a first quantum cryptography server, and the second QKD device is connected to a second quantum cryptography server. The first QKD device and the second QKD device are connected through a QKD network. After receiving a key distribution request sent by the first quantum cryptography server, the first QKD device is used to perform quantum key negotiation with the second QKD device to determine a target quantum key, send the target quantum key to the first quantum cryptography server, and record the target quantum key index corresponding to the target quantum key. After performing quantum key negotiation with the first QKD device to determine the target quantum key, the second QKD device is used to send the target quantum key to the second quantum cryptography server and record the target quantum key index corresponding to the target quantum key.

[0042] In this embodiment, the quantum key distribution (QKD) key is generated and distributed based on the principles of quantum mechanics. It can utilize the property that eavesdropping will change the quantum state to realize the security verification of the key distribution process, and is a core security element in quantum communication.

[0043] In this embodiment, the method for obtaining the target quantum key index in the first quantum cryptography server can be as follows: the first quantum cryptography server sends a quantum key distribution request to the first QKD device; the first QKD device receives the quantum key distribution request; the first QKD device negotiates quantum key with the second QKD device through the QKD network to determine the target quantum key; the first QKD device sends the target quantum key to the first quantum cryptography server and records the target quantum key index corresponding to the target quantum key; the second QKD device sends the target quantum key to the second quantum cryptography server and records the target quantum key index corresponding to the target quantum key. In this embodiment, the method for obtaining the target quantum key index in the first quantum cryptography server can also be as follows: the second quantum cryptography server sends a quantum key distribution request to the second QKD device; the second QKD device receives the quantum key distribution request; the second QKD device negotiates quantum key with the first QKD device through the QKD network to determine the target quantum key; the second QKD device sends the target quantum key to the second quantum cryptography server and records the target quantum key index corresponding to the target quantum key; the first QKD device sends the target quantum key to the first quantum cryptography server and records the target quantum key index corresponding to the target quantum key.

[0044] It should be noted that when the Modbus client and Modbus server are on the same local area network (LAN), the Modbus client can perform data acquisition and other operations on the server based on the traditional Modbus-TCP protocol. However, when the Modbus client and server are in a cross-LAN network environment (an insecure network), the Modbus-TCP protocol, extended with quantum communication, is required to perform these operations. In this case, the Modbus server and client negotiate to retrieve the corresponding quantum key index from their respective quantum cryptography service platforms, and use the quantum key corresponding to the quantum key index QKID to encrypt or decrypt the Modbus protocol data.

[0045] In this embodiment, as Figure 2As shown, the Modbus client is located in LAN A, and the Modbus server is located in LAN B. The Modbus client and Modbus server are in a cross-LAN network environment. The data processing system includes: a first QKD device, a first quantum cryptography server, a Modbus client, two Modbus servers, a second quantum cryptography server, and a second QKD device. The first quantum cryptography server is connected to the Modbus client, and the second quantum cryptography server is connected to the Modbus server. There is a first quantum key distribution QKD device and a second QKD device. The first QKD device is connected to the first quantum cryptography server, and the second QKD device is connected to the second quantum cryptography server. The first QKD device and the second QKD device are connected through a QKD network. The Modbus client and the Modbus server are connected through a Modbus protocol bus.

[0046] S120 generates a request protocol message based on the post-quantum cryptography PQC private key, the target quantum key index, the first transaction identifier, and the request protocol data.

[0047] The request protocol message includes: encrypted request protocol data. The request protocol message also includes: an MBAP header and a quantum-safe hybrid header.

[0048] In this embodiment, the method for generating a request protocol message based on the post-quantum cryptography PQC private key, the target quantum key index, the first transaction identifier, and the request protocol data can be as follows: The target quantum key index and the first transaction identifier are signed based on the post-quantum cryptography PQC private key and the PQC signature value length to obtain a target signature field; the request protocol data is encrypted based on the target quantum key to obtain ciphertext request protocol data; a first message authentication code is determined based on the target quantum key and the request protocol data; and a request protocol message is generated based on the target signature field, the ciphertext request protocol data, the first message authentication code, the target quantum key index, the PQC signature value length, and the first transaction identifier.

[0049] Optionally, a request protocol message is generated based on the post-quantum cryptography PQC private key, the target quantum key index, the first transaction identifier, and the request protocol data, including:

[0050] The target quantum key index and the first transaction identifier are signed based on the post-quantum cryptography PQC private key and the PQC signature value length to obtain the target signature field.

[0051] In this embodiment, the target quantum key index is signed based on the post-quantum cryptography PQC private key and the PQC signature value length to obtain a first signature field, and the first transaction identifier (TID) is signed based on the post-quantum cryptography PQC private key and the PQC signature value length to obtain a second signature field. The target signature field is determined based on the first signature field and the second signature field.

[0052] In this embodiment, the post-quantum cryptography PQC private key is a post-quantum cryptography agreed upon in advance by the Modbus client and the Modbus server. The Modbus client stores the PQC private key, and the Modbus server stores the PQC public key.

[0053] The request protocol data is encrypted using the target quantum key to obtain the ciphertext request protocol data.

[0054] In this embodiment, the Protocol Data Unit (PDU) data is a complete data unit that contains protocol control information and user data and is transmitted between different protocol layers in network communication.

[0055] Determine the first message authentication code based on the target quantum key and request protocol data.

[0056] In this embodiment, the method for determining the first message authentication code based on the target quantum key and the request protocol data can be as follows: using the symmetric key generated by the target quantum key as the key of the MAC algorithm, and using the request protocol data as the input message, the first message authentication code is calculated by "quantum key + request protocol data + HMAC algorithm".

[0057] Generate a request protocol message based on the target signature field, ciphertext request protocol data, first message authentication code, target quantum key index, PQC signature value length, and first transaction identifier.

[0058] In this embodiment, the method for generating a request protocol message based on the target signature field, ciphertext request protocol data, first message authentication code, target quantum key index, PQC signature value length, and first transaction identifier can be as follows: A Management Basic Application Protocol (MBAP) header is generated based on the first transaction identifier, protocol identifier, request protocol data length, and device address; a quantum-safe hybrid header is generated based on the target quantum key index, PQC signature value length, first message authentication code, and target signature field; and a request protocol message is generated based on the MBAP header, the quantum-safe hybrid header, and the ciphertext request protocol data.

[0059] Optionally, a request protocol message is generated based on the target signature field, the encrypted request protocol data, the first message authentication code, the target quantum key index, the PQC signature value length, and the first transaction identifier, including:

[0060] Based on the first transaction identifier, protocol identifier, request protocol data length, and device address, generate the Management Basic Application Protocol (MBAP) header;

[0061] Generate a quantum-secure hybrid header based on the target quantum key index, PQC signature value length, first message authentication code, and target signature field;

[0062] A request protocol message is generated based on the MBAP header, the quantum-safe hybrid header, and the ciphertext request protocol data.

[0063] In this embodiment, the request protocol message format is shown in Table 1:

[0064] Table 1

[0065]

[0066] Table 1 shows the optimized Modbus-TCP protocol messages. Compared to the traditional Modbus-TCP protocol, the optimized protocol inserts a quantum-safe hybrid QSH header message after the Modbus-TCP MBAP header. The QSH mainly includes the quantum key index QKID, message authentication code (PDU MAC value), PQC signature length, and target signature field (obtained by signing the QKID and transaction identifier using the PQC private key). The target signature field performs request authentication to ensure that the client's request is trustworthy; the message authentication code is used for message integrity verification to ensure the integrity of the Modbus-TCP message; and the PDU data is encrypted using the quantum key corresponding to the quantum key index to ensure message confidentiality.

[0067] Meanwhile, to ensure compatibility with the traditional Modbus-TCP protocol, the protocol identifier has been extended. When the protocol identifier is 0x01, it indicates that the corresponding Modbus device supports QKD devices and can be parsed using the optimized protocol (the protocol provided in this embodiment). When the protocol identifier is 0x00, it indicates that the corresponding Modbus device does not support QKD devices and the QSH header in the protocol can be ignored to achieve protocol compatibility.

[0068] S130, the request protocol message is sent to the Modbus server so that the Modbus server verifies the request protocol message based on the PQC public key and the target quantum key index read from the second quantum cryptography server. After the verification is successful, the ciphertext request protocol data is decrypted using the target quantum key to obtain the plaintext request protocol data, and the plaintext request protocol data is executed to obtain the response protocol data.

[0069] In this embodiment, the Modbus client sends the request protocol message to the Modbus server. The Modbus server verifies the request protocol message based on the PQC public key and the target quantum key index read from the second quantum cryptography server. After successful verification, the server decrypts the ciphertext request protocol data using the target quantum key to obtain the plaintext request protocol data, and executes the plaintext request protocol data to obtain the response protocol data.

[0070] This embodiment employs an information-theoretically secure key distribution mechanism, achieving unconditional security based on quantum key distribution (QKD) technology. QKD utilizes quantum mechanical principles (such as Heisenberg's uncertainty principle) to ensure that any eavesdropping will introduce detectable quantum errors, and its security has rigorous mathematical proof. Compared to traditional PKI systems that rely on the computational complexity of RSA / ECC algorithms and are vulnerable to quantum computing (such as Shor's algorithm), the keys generated by QKD cannot be cracked even with the advent of future quantum computers.

[0071] In a specific example, such as Figure 3 As shown, taking the Modbus-TCP protocol coil read command as an example, the Modbus client calculates the target signature field for authentication and the MAC value of the requested PDU data, and finally assembles them into a complete coil read request command message, which is then sent to the Modbus server. Upon receiving the message, the Modbus server performs authentication, verification, and decryption steps to obtain the plaintext requested PDU data; it then performs coil read processing based on the plaintext requested PDU data; after processing, the Modbus server calculates the MAC value of the response PDU data (the PQC signature field can be ignored), and finally assembles it into a complete coil read response message and returns it. Upon receiving the response message, the Modbus client decrypts and verifies the MAC value of the response PDU data and completes the processing.

[0072] This embodiment aims to optimize the security issues of the Modbus-TCP protocol in the current industrial control field. By introducing quantum key distribution (QKD) networks into the industrial control environment, a data processing method based on the optimized Modbus-TCP protocol with fused quantum keys is proposed. This method introduces quantum key-related extensions, which, while maintaining the compatibility of the original protocol, provides devices in cross-LAN industrial control environments with quantum computing resistance.

[0073] Optional, also includes:

[0074] Receive response protocol messages sent by the Modbus server.

[0075] In this embodiment, the response protocol message is a message generated by the Modbus server based on the second message authentication code, the encrypted response protocol data, the target quantum key index, and the second transaction identifier. The encrypted response protocol data and the second message authentication code are obtained based on the target quantum key and the response protocol data.

[0076] In this embodiment, the Modbus server obtains encrypted response protocol data and a second message authentication code based on the target quantum key and response protocol data; according to the second message authentication code, encrypted response protocol data, target quantum key index, and second transaction identifier, it generates a response protocol message, and the Modbus server sends the response protocol message to the Modbus client.

[0077] Verify the response protocol message based on the target quantum key.

[0078] In this embodiment, the method for verifying the response protocol message based on the target quantum key can be as follows: the target quantum key is used as a shared key, and together with the response protocol data, it is used as input and calculated using a specific MAC algorithm.

[0079] After successful verification, the ciphertext response protocol data is decrypted using the target quantum key to obtain the plaintext response protocol data.

[0080] Execute the plaintext response protocol data.

[0081] In this embodiment, as Figure 4 As shown, the optimized Modbus-TCP communication process can be roughly divided into two processes: key distribution and Modbus protocol communication. The specific steps are as follows:

[0082] 1. The first quantum cryptography server triggers quantum key distribution to the first QKD device, and the first QKD device negotiates and distributes QKD keys to the second QKD device through the QKD distribution protocol.

[0083] 2. After the QKD two-end quantum key negotiation is completed, the quantum key is distributed to the quantum cryptography server at each end. The quantum cryptography server updates the quantum key in various quantum key resource pools and records the index QKID corresponding to the quantum key. At this point, the QKD key distribution is completed.

[0084] 3. The Modbus client reads a quantum key index (QKID) from the first quantum cryptography server and signs the QKID and transaction identifier (TID) with the preset Modbus client PQC (post-quantum cryptography) private key to obtain the target signature field.

[0085] 4. The Modbus client requests the first quantum cryptography server to use the QKD key pair to request PDU data and uses the SM4-GCM algorithm to calculate the MAC of the requested PDU data.

[0086] 5. The Modbus client requests the first quantum cryptography server to encrypt the request PDU data using QKID, and then sends a request to the Modbus server.

[0087] 6. After receiving the message, the Modbus server uses its own PQC public key to verify the target signature field in the QSH of the message. If the verification is successful, the authentication is successful.

[0088] 7. The Modbus server uses the SM4-GCM algorithm to verify the QKID. After the verification is successful, it sends a decryption request to the second quantum cryptography server, requesting to decrypt the request PDU data using the quantum key.

[0089] 8. The Modbus server responds to the Modbus protocol message and performs business processing, such as reading coils. After completion, it requests the second quantum cryptography server to encrypt the PDU data using the QKID quantum key.

[0090] 9. The Modbus client requests the first quantum cryptography server to decrypt using QKID, and then processes the received PDU data.

[0091] 10. After the Modbus client finishes processing, it uses the QKID to calculate the HMAC (Hash-based Message Authentication Code) information of the log information, and then writes the log and QKID together to disk. At this point, the Modbus two-way interaction is complete.

[0092] This invention proposes a quantum-enhanced Modbus-TCP protocol stack, achieving security upgrades by embedding a quantum-safe header (QSH) into the traditional Modbus-TCP frame structure. The QSH contains four core fields: a 16-bit quantum session ID (dynamically generated by the QKD network), a 32-bit quantum message checksum (MAC) constructed based on quantum random numbers, a 16-bit PQC algorithm signature length, and a corresponding PQC signature value. This invention achieves seamless integration of the Modbus protocol layer and quantum key distribution (QKD) for the first time. Compared to traditional TLS-based encapsulation schemes, the technical solution provided in this embodiment integrates quantum security features at the protocol's native layer, avoiding the complex handshake process and high latency issues of TLS.

[0093] To ensure compatibility, the optimized protocol supports dual-mode parsing: The optimized protocol distinguishes between the presence and absence of a QSH header extension by using the protocol identifier field in the MBAP header (0x00 for the traditional Modbus-TCP protocol, 0x01 for the optimized protocol). Traditional devices read the protocol identifier as 0x00, thus ignoring the QSH header and parsing the original Modbus data normally; while devices supporting quantum encryption read the protocol identifier as 0x01, automatically enabling QKD keys to decrypt and verify the data unit (PDU). This design not only allows for a smooth transition to existing industrial equipment but also provides critical infrastructure (such as power grids and petrochemical plants) with resistance to quantum computing attacks.

[0094] The technical solution of this embodiment reads the target quantum key index from the first quantum cryptography server; generates a request protocol message based on the post-quantum cryptography PQC private key, the target quantum key index, the first transaction identifier, and request protocol data. The request protocol message includes ciphertext request protocol data. The request protocol message is sent to the Modbus server, which verifies the request protocol message using the PQC public key and the target quantum key index read from the second quantum cryptography server. Upon successful verification, the ciphertext request protocol data is decrypted using the target quantum key to obtain plaintext request protocol data, and then executed to obtain response protocol data. This allows for dynamic generation and rotation of keys, effectively solving the security risks associated with the long-term use of fixed keys in traditional industrial control systems. By deeply integrating quantum keys with the Modbus-TCP protocol, real-time communication is ensured while possessing the ability to resist current and future security threats.

[0095] Example 2

[0096] Figure 5This is a flowchart illustrating a data processing method provided in an embodiment of the present invention. This embodiment is applicable to data processing situations. The method can be executed by a data processing device in this embodiment of the present invention. This device can be configured in a Modbus server and can be implemented in software and / or hardware, such as... Figure 5 As shown, the method specifically includes the following steps:

[0097] S510, receive the request protocol message sent by the Modbus client.

[0098] The request protocol message is generated by the Modbus client based on the post-quantum cryptography PQC private key, the target quantum key index read from the first quantum cryptography server, the first transaction identifier, and the request protocol data. The request protocol message includes: ciphertext request protocol data.

[0099] In this embodiment, the request protocol message further includes an MBAP header and a quantum-safe hybrid header. The MBAP header includes a first transaction identifier, and the quantum-safe hybrid header includes a target signature field, a first message authentication code, a target quantum key index, and a PQC signature value length.

[0100] It should be noted that the method by which the Modbus client generates request protocol messages has been described in the above embodiments and will not be repeated here.

[0101] S520, verify the request protocol message based on the PQC public key and the target quantum key index read from the second quantum cryptography server.

[0102] In this embodiment, verifying the request protocol message includes: verifying the signature of the request protocol message and verifying the integrity of the request protocol data in the request protocol message.

[0103] In this embodiment, the method for verifying the signature of the request protocol message based on the PQC public key and the target quantum key index read from the second quantum cryptography server can be as follows: decrypt the target signature field in the request protocol message based on the PQC public key to obtain the decryption result, compare the first transaction identifier and the target quantum key index with the decryption result, and then obtain the signature verification result. If they match, the signature verification is successful (data has not been tampered with and the signature is valid); if they do not match, the signature verification fails.

[0104] In this embodiment, the integrity verification method for the request protocol data in the request protocol message can be as follows: The integrity of the request protocol data in the request protocol message can be verified using the SM4-GCM algorithm and a first message authentication code. For example, the message authentication code corresponding to the request protocol data can be determined using the SM4-GCM algorithm and the encrypted request protocol data in the request protocol message. The integrity verification result is obtained by comparing the message authentication code corresponding to the request protocol data with the first message authentication code. If the message authentication code corresponding to the request protocol data matches the first message authentication code, the request protocol data is complete; otherwise, the request protocol data is missing.

[0105] After successful verification, the S530 decrypts the ciphertext request protocol data using the target quantum key to obtain the plaintext request protocol data.

[0106] In this embodiment, the target quantum key is the quantum key corresponding to the target quantum key index read from the second quantum cryptography server.

[0107] S540 executes the plaintext request protocol data and obtains the response protocol data.

[0108] Optional, also includes:

[0109] Based on the target quantum key and response protocol data, the ciphertext response protocol data and the second message authentication code are obtained.

[0110] In this embodiment, the response protocol data is encrypted based on the target quantum key to obtain ciphertext response protocol data; the target quantum key is used as a shared key and together with the response protocol data as input, and a specific MAC algorithm is used to calculate and generate a second message authentication code.

[0111] A response protocol message is generated based on the second message authentication code, the encrypted response protocol data, the target quantum key index, and the second transaction identifier.

[0112] In this embodiment, the method for generating a response protocol message based on the second message authentication code, the encrypted response protocol data, the target quantum key index, and the second transaction identifier can be as follows: generate an MBAP header based on the second transaction identifier, the protocol identifier, the response PDU data length, and the device address; generate a quantum-safe hybrid header based on the target quantum key index and the second message authentication code; and generate a response protocol message based on the MBAP header, the quantum-safe hybrid header, and the encrypted response protocol data.

[0113] It should be noted that the target quantum key index for generating the response protocol message can be the same as or different from the target quantum key index for generating the request protocol message. This embodiment of the invention does not impose any restrictions on this.

[0114] The response protocol message is sent to the Modbus client so that the Modbus client can verify the response protocol message based on the target quantum key. After successful verification, the ciphertext response protocol data is decrypted using the target quantum key to obtain the plaintext response protocol data, and the plaintext response protocol data is executed.

[0115] In this embodiment, the Modbus server sends the response protocol message to the Modbus client. The Modbus client receives the response protocol message sent by the Modbus server. The Modbus client verifies the response protocol message based on the target quantum key. After successful verification, the Modbus client decrypts the ciphertext response protocol data using the target quantum key to obtain the plaintext response protocol data. The Modbus client then executes the plaintext response protocol data.

[0116] After processing the response protocol data, the Modbus client uses the QKID to calculate the HMAC (Hash-based Message Authentication Code) information in the log, and then writes the log and QKID together to disk. At this point, the Modbus two-way interaction is complete.

[0117] The technical solution provided in this embodiment constructs a communication architecture resistant to quantum computing attacks, achieving end-to-end protection through quantum security technology. At the data transmission layer, a dynamic key generated by QKD is combined with the SM4-GCM algorithm to encrypt protocol data, ensuring the confidentiality and integrity of communication content. At the authentication layer, a post-quantum cryptographic signature algorithm is introduced to verify device identity and is bound to a Modbus transaction identifier, forming a dual protection mechanism of device authentication and data transmission. The technical solution provided in this embodiment organically combines quantum key distribution technology with quantum-resistant cryptographic algorithms, constructing a secure communication chain from key distribution and authentication to data encryption. This effectively resists current and future quantum computing attack threats while meeting the stringent real-time and reliability requirements of industrial control systems.

[0118] In this embodiment, the Modbus server receives a request protocol message from the Modbus client; verifies the request protocol message using the PQC public key and the target quantum key index read from the second quantum cryptography server; after successful verification, decrypts the ciphertext request protocol data using the target quantum key to obtain plaintext request protocol data; and executes the plaintext request protocol data to obtain response protocol data. This allows for dynamic generation and rotation of keys, effectively solving the security risks associated with the long-term use of fixed keys in traditional industrial control systems. By deeply integrating quantum keys with the Modbus-TCP protocol, it ensures real-time communication while possessing the ability to resist current and future security threats.

[0119] Example 3

[0120] Figure 6 This is a schematic diagram of a data processing device provided in an embodiment of the present invention. This embodiment is applicable to data processing applications. The device can be implemented using software and / or hardware, and can be integrated into any device that provides data processing functionality, such as a Modbus client. Figure 2 As shown, the data processing device specifically includes: a reading module 610, a request protocol message generation module 620, and a request protocol message sending module 630.

[0121] Among them, the target quantum key index is read from the first quantum cryptography server;

[0122] Based on the post-quantum cryptography PQC private key, the target quantum key index, the first transaction identifier, and the request protocol data, a request protocol message is generated, wherein the request protocol message includes: ciphertext request protocol data;

[0123] The request protocol message is sent to the Modbus server, so that the Modbus server verifies the request protocol message based on the PQC public key and the target quantum key index read from the second quantum cryptography server. After successful verification, the ciphertext request protocol data is decrypted using the target quantum key to obtain the plaintext request protocol data, and the plaintext request protocol data is executed to obtain the response protocol data.

[0124] The above-described products can perform the methods provided in any embodiment of the present invention, and have the corresponding functional modules and beneficial effects for performing the methods.

[0125] Example 4

[0126] Figure 7This is a schematic diagram of a data processing device provided in an embodiment of the present invention. This embodiment is applicable to data processing applications. The device can be implemented using software and / or hardware, and can be integrated into any device that provides data processing functionality, such as a Modbus server. Figure 7 As shown, the data processing device specifically includes: a request protocol message receiving module 710, a verification module 720, a decryption module 730, and an execution module 740.

[0127] The method includes receiving a request protocol message sent by the Modbus client. The request protocol message is a message generated by the Modbus client based on the post-quantum cryptography PQC private key, the target quantum key index read from the first quantum cryptography server, the first transaction identifier, and request protocol data. The request protocol message includes: ciphertext request protocol data.

[0128] The request protocol message is verified based on the PQC public key and the target quantum key index read from the second quantum cryptography server;

[0129] After successful verification, the ciphertext request protocol data is decrypted using the target quantum key to obtain the plaintext request protocol data.

[0130] Execute the plaintext request protocol data to obtain the response protocol data.

[0131] The above-described products can perform the methods provided in any embodiment of the present invention, and have the corresponding functional modules and beneficial effects for performing the methods.

[0132] Example 5

[0133] Figure 8 A schematic diagram of an electronic device 10 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0134] like Figure 8As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0135] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0136] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as data processing methods.

[0137] In some embodiments, the data processing method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or mounted on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the data processing method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the data processing method by any other suitable means (e.g., by means of firmware).

[0138] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0139] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0140] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0141] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0142] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0143] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0144] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0145] This invention also provides a computer program product, including a computer program that, when executed by a processor, implements the data processing method according to any embodiment of the invention.

[0146] In implementing the computer program product, computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0147] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A data processing method, characterized in that, This is applied to a data processing system, which includes a Modbus client, a Modbus server, a first quantum cryptography server, and a second quantum cryptography server. The first quantum cryptography server is connected to the Modbus client, and the second quantum cryptography server is connected to the Modbus server. The data processing method is executed by the Modbus client and includes: Read the target quantum key index from the first quantum cryptography server; Based on the post-quantum cryptography PQC private key, the target quantum key index, the first transaction identifier, and the request protocol data, a request protocol message is generated, wherein the request protocol message includes: ciphertext request protocol data; The request protocol message is sent to the Modbus server so that the Modbus server can verify the request protocol message based on the PQC public key and the target quantum key index read from the second quantum cryptography server. After the verification is successful, the ciphertext request protocol data is decrypted using the target quantum key to obtain the plaintext request protocol data, and the plaintext request protocol data is executed to obtain the response protocol data. Based on the post-quantum cryptography PQC private key, the target quantum key index, the first transaction identifier, and the request protocol data, a request protocol message is generated, including: The target quantum key index and the first transaction identifier are signed based on the post-quantum cryptography PQC private key and the PQC signature value length to obtain the target signature field; The request protocol data is encrypted using the target quantum key to obtain the ciphertext request protocol data; Determine the first message authentication code based on the target quantum key and the request protocol data; Generate a request protocol message based on the target signature field, ciphertext request protocol data, first message authentication code, target quantum key index, PQC signature value length, and first transaction identifier.

2. The method according to claim 1, characterized in that, The data processing system further includes: a first QKD device and a second QKD device. The first QKD device is connected to a first quantum cryptography server, and the second QKD device is connected to a second quantum cryptography server. The first QKD device and the second QKD device are connected through a QKD network. After receiving a key distribution request sent by the first quantum cryptography server, the first QKD device is used to perform quantum key negotiation with the second QKD device to determine a target quantum key, send the target quantum key to the first quantum cryptography server, and record the target quantum key index corresponding to the target quantum key. After performing quantum key negotiation with the first QKD device to determine the target quantum key, the second QKD device is used to send the target quantum key to the second quantum cryptography server and record the target quantum key index corresponding to the target quantum key.

3. The method according to claim 1, characterized in that, Based on the target signature field, ciphertext request protocol data, first message authentication code, target quantum key index, PQC signature value length, and first transaction identifier, generate a request protocol message, including: Based on the first transaction identifier, protocol identifier, request protocol data length, and device address, generate the Management Basic Application Protocol (MBAP) header; Generate a quantum-secure hybrid header based on the target quantum key index, PQC signature value length, first message authentication code, and target signature field; A request protocol message is generated based on the MBAP header, the quantum-safe hybrid header, and the ciphertext request protocol data.

4. The method according to claim 1, characterized in that, Also includes: Receive response protocol messages sent by the Modbus server; Verification of response protocol messages is based on the target quantum key; After successful verification, the ciphertext response protocol data is decrypted using the target quantum key to obtain the plaintext response protocol data. Execute the plaintext response protocol data.

5. A data processing method, characterized in that, This is applied to a data processing system, which includes a Modbus client, a Modbus server, a first quantum cryptography server, and a second quantum cryptography server. The first quantum cryptography server is connected to the Modbus client, and the second quantum cryptography server is connected to the Modbus server. The data processing method is executed by the Modbus server and includes: The system receives a request protocol message sent by the Modbus client. The request protocol message is generated by the Modbus client based on the post-quantum cryptography PQC private key, the target quantum key index read from the first quantum cryptography server, the first transaction identifier, and request protocol data. The request protocol message includes: ciphertext request protocol data. Generating the request protocol message based on the post-quantum cryptography PQC private key, the target quantum key index, the first transaction identifier, and the request protocol data includes: signing the target quantum key index and the first transaction identifier based on the post-quantum cryptography PQC private key and the PQC signature value length to obtain a target signature field; encrypting the request protocol data based on the target quantum key to obtain ciphertext request protocol data; determining a first message authentication code based on the target quantum key and the request protocol data; and generating the request protocol message based on the target signature field, the ciphertext request protocol data, the first message authentication code, the target quantum key index, the PQC signature value length, and the first transaction identifier. The request protocol message is verified based on the PQC public key and the target quantum key index read from the second quantum cryptography server; After successful verification, the ciphertext request protocol data is decrypted using the target quantum key to obtain the plaintext request protocol data. Execute the plaintext request protocol data to obtain the response protocol data.

6. The method according to claim 5, characterized in that, Also includes: Based on the target quantum key and response protocol data, the ciphertext response protocol data and the second message authentication code are obtained. Generate a response protocol message based on the second message authentication code, the encrypted response protocol data, the target quantum key index, and the second transaction identifier; The response protocol message is sent to the Modbus client so that the Modbus client can verify the response protocol message based on the target quantum key. After successful verification, the ciphertext response protocol data is decrypted using the target quantum key to obtain the plaintext response protocol data, and the plaintext response protocol data is executed.

7. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the data processing method according to any one of claims 1-6.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the data processing method according to any one of claims 1-6.

9. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the data processing method according to any one of claims 1-6.

Images