Encryption transmission method and system for full-life-cycle predictive maintenance parameters of equipment

Abstract

The invention discloses an equipment full life cycle predictive maintenance parameter encryption transmission method and system, and the method is cooperatively executed by an equipment monitoring terminal and a server: the terminal monitors equipment parameters, and determines a transmission path to the server; determining a first gateway number, a router path number and a second gateway number based on the path, and further generating an encryption parameter and masking the device parameter; then generating a data packet containing a path device identifier header and a masked payload, and sending the data packet; after receiving the data packet, the server analyzes the header to obtain the path equipment identifier, reversely determines the corresponding serial numbers, further generates decryption parameters and de-masks the payload to obtain original equipment parameters; the encryption and decryption key is generated through the dynamic path information, the rule is pre-stored and is not transmitted by a network, and the secrecy performance is remarkably improved while the existing encryption technology is compatible.

Description

Technical Field

[0001] This invention belongs to the field of industrial manufacturing and intelligent manufacturing technology, and in particular relates to a method and system for encrypted transmission of predictive maintenance parameters throughout the entire life cycle of equipment. Background Technology

[0002] In the fields of industrial manufacturing and intelligent manufacturing, predictive maintenance has become a key technology for improving equipment reliability, optimizing production efficiency, and reducing operation and maintenance costs. With the rapid development of industrial IoT and big data analytics, equipment lifecycle management is gradually shifting from traditional periodic maintenance and reactive repair to a data-driven intelligent maintenance model. The integration of multi-source heterogeneous data and the construction of semantic associations are increasingly being introduced into equipment management systems to achieve a deep understanding and reasoning of equipment status, fault mechanisms, and maintenance strategies, driving operation and maintenance management towards systematization, knowledge-based management, and automation.

[0003] In existing technologies, predictive maintenance systems for the entire equipment lifecycle typically employ a centralized data processing architecture. Monitoring terminals collect real-time sensor data from the equipment and transmit it to a remote server. The server integrates multi-source information, including real-time monitoring data, historical maintenance records, equipment knowledge bases, and expert experience, to build and maintain a core support system for equipment management. Based on this system, fault prediction, root cause analysis, and maintenance decision generation are performed. In the data transmission phase, existing solutions largely rely on common communication encryption protocols, such as TLS / SSL transport layer security mechanisms, or symmetric encryption and digital signatures to ensure the confidentiality and integrity of data during transmission.

[0004] However, the aforementioned existing technologies have significant shortcomings in terms of data confidentiality: since real-time sensor data typically reflects production process parameters and capacity information directly or indirectly, under a transmission mechanism using fixed encryption algorithms and static keys, once the encryption method is cracked or the key is leaked, attackers can still deduce key production processes and operational information by long-term monitoring and analysis of the data stream, leading to the leakage of core corporate secrets. Especially when facing competitors or malicious attackers with strong analytical capabilities, traditional encryption methods struggle to handle in-depth inferences and correlation analyses targeting the data content itself, failing to meet the confidentiality needs of manufacturing enterprises for highly sensitive operational data. Summary of the Invention

[0005] Purpose of the invention: The purpose of this invention is to provide a method and system for encrypted transmission of predictive maintenance parameters throughout the entire lifecycle of equipment. This method ensures the security of encryption and decryption rules without the receiving and sending devices being physically cracked, while also being compatible with existing encryption methods and offering higher confidentiality.

[0006] Technical Solution: The encrypted transmission method for predictive maintenance parameters throughout the equipment lifecycle described in this invention is executed collaboratively by the equipment monitoring terminal and the server, and includes the following steps:

[0007] The device monitoring terminal performs the following steps:

[0008] S1, Monitoring equipment parameters;

[0009] S2. Determine the transmission path from the device monitoring terminal to the server;

[0010] S3. Based on the transmission path, determine the number of the first gateway to be used in the wide area network where the device monitoring terminal is located, the router path number, and the number of the second gateway to be used in the wide area network where the server is located;

[0011] S4. Generate encryption parameters based on the number of the first gateway, the path number of the router, and the number of the second gateway;

[0012] S5. Use the encryption parameters to perform a masking operation on the device parameters;

[0013] S6. Generate a data packet and send it to the server. The data packet includes a header and a payload. The header contains the device identifier of the first gateway, the device identifiers of each router on the router path, and the device identifier of the second gateway. The payload contains masked device parameters.

[0014] The server performs the following steps:

[0015] S7. Receive the data packet;

[0016] S8. Parse the header of the data packet to obtain the device identifier of the first gateway, the device identifiers of each router on the router path, and the device identifier of the second gateway;

[0017] S9. Based on the device identifiers obtained from the parsing, determine the corresponding first gateway number, router path number, and second gateway number;

[0018] S10. Obtain decryption parameters based on the number of the first gateway, the router path number, and the number of the second gateway; use the decryption parameters to demask the payload of the data packet; and obtain device parameters based on the demasked payload.

[0019] This invention provides a predictive maintenance method for the entire lifecycle of equipment. Through the collaborative execution of the equipment monitoring terminal and server, it fully leverages the inherent variability of routing paths. At the terminal side, encrypted parameters are generated based on the gateway number and router path number determined by the transmission path, and a masking operation is performed on the device parameters. Because the transmission path dynamically changes, the basis for calculating the encrypted parameters is always in flux, fundamentally increasing the difficulty of cracking the encryption logic and effectively avoiding the risk of targeted cracking of fixed encryption bases. Simultaneously, this method stores encryption and decryption rules equally at the sending end (equipment monitoring terminal) and the receiving end (server), respectively. These rules are not transmitted in any form during data transmission, ensuring that the devices at both ends are not compromised. Under the premise of hard cracking, the security of encryption and decryption rules is guaranteed from both storage and transmission dimensions, avoiding the problem of confidentiality failure caused by rule leakage. In addition, the method uses a data packet structure design with gateway and router device identifiers in the header and masked device parameters in the payload. This not only enables the receiving end to obtain decryption parameters by accurately matching the corresponding number based on the identifier and complete the demasking to restore the device parameters, but also makes it compatible with various existing encryption methods without requiring major modifications to existing equipment and systems. While ensuring the high confidentiality of device parameters during data transmission, the method also takes into account its practicality and adaptability, significantly improving the security level and reliability of data transmission in predictive maintenance throughout the device's life cycle.

[0020] Preferably, in step S2, the transmission path is determined by the traceroute command, the system's built-in traceroute function, or other known path detection methods; if the device monitoring terminal is connected to a local area network, the second hop in the path detection result corresponds to the first gateway; if the device monitoring terminal is directly connected to a wide area network, the first hop in the path detection result corresponds to the first gateway.

[0021] This invention employs the traceroute command, the system's built-in traceroute function, and other known path detection methods to determine the transmission path, ensuring the universality and feasibility of transmission path acquisition. It eliminates the need for developing dedicated detection tools and adapts to various terminal usage scenarios. Furthermore, it accurately matches the first gateway in the path detection results, addressing different scenarios where the device monitoring terminal is connected to a local area network (LAN) or directly to a wide area network (WAN). This enables rapid and accurate identification of the first gateway, laying a reliable foundation for subsequent generation of encryption parameters based on gateway numbers and router path numbers, and for completing device parameter masking operations. This ensures the smooth progress of the entire encrypted transmission process and further improves the method's adaptability and execution efficiency.

[0022] Preferably, in step S3, the number of the first gateway is determined by a first mapping table, the number of the second gateway is determined by a second mapping table with the same structure as the first mapping table, and the router path number is determined by a third mapping table; the first mapping table stores the correspondence between the device identifier and the number of the first gateway, the second mapping table stores the correspondence between the device identifier and the number of the second gateway, and the third mapping table stores the correspondence between the router path and the number; the first mapping table, the second mapping table, and the third mapping table are pre-synchronously stored in the device monitoring terminal and the server, and are not transmitted between the two.

[0023] This invention uses three pre-defined mapping tables to associate gateway device identifiers with their numbers and router paths with their numbers. These three mapping tables have a unified structure, are pre-stored synchronously on the device monitoring terminal and server, and are not transmitted across terminals. This ensures the accuracy and efficiency of obtaining the first gateway number, the second gateway number, and the router path number, eliminating the need for additional real-time negotiation or calculation of number correspondences. This provides reliable data support for subsequent encryption parameter generation and matching of numbers required for demasking. Furthermore, it avoids the risk of the mapping tables being stolen or tampered with during transmission, ensuring the security of the number association rules. The unified mapping table structure also reduces the storage and adaptation costs for the terminal and server, further improving the stability and security of the entire encrypted transmission process. This facilitates the smooth and reliable advancement of data encryption and transmission in predictive maintenance throughout the device's lifecycle.

[0024] Preferably, the device identifier of the first gateway and the device identifier of the second gateway are MAC addresses, and the router paths in the third mapping table are uniquely identified by the MAC addresses of each router.

[0025] This invention uses MAC addresses as device identifiers for the first and second gateways, and uniquely identifies router paths in the third mapping table using the MAC addresses of each router. Leveraging the inherent uniqueness and stability of MAC addresses, the accuracy and exclusivity of gateway and router path identification are ensured, effectively avoiding number matching errors caused by identifier confusion. Simultaneously, as MAC addresses are inherent identifiers for devices and paths, no additional custom identifier rules are required, reducing system configuration and maintenance costs. This provides a reliable basis for rapid querying and matching of the first gateway number, second gateway number, and router path number, further ensuring the accuracy and efficiency of subsequent encryption parameter generation and demasking operations, solidifying the security foundation for encrypted data transmission, and improving the stability and reliability of the entire method.

[0026] Preferably, the specific process of generating encryption parameters in step S4 includes:

[0027] S41. Generate the first segment of the encryption parameters based on the number of the first gateway and the first generation rule;

[0028] S42. Generate the second segment of the encryption parameter based on the router path number and the second generation rule;

[0029] S43. Generate the third segment of the encryption parameters based on the number of the second gateway and the third generation rule;

[0030] S44. Concatenate the first segment, the second segment, and the third segment to obtain the encryption parameters.

[0031] By generating encrypted parameters in stages, the system uses dedicated generation rules based on the first gateway number, router path number, and second gateway number to generate three segments of encrypted parameters. These segments are then concatenated to form the complete encrypted parameters. This approach fully leverages the differentiated characteristics of each core number, making the encrypted parameters more complex and unique, thus increasing the difficulty of cracking the encryption logic. Furthermore, the clear segmented generation rules and concatenation process ensure the standardization and repeatability of encrypted parameter generation, enabling the receiving end to accurately reverse engineer the data according to the corresponding rules. Simultaneously, the generation processes of each segment are independent yet closely interconnected, enhancing the randomness and security of the encrypted parameters while ensuring the efficient and controllable generation process. This provides strong encryption support for reliable masking operations of device parameters, further solidifying the confidentiality foundation of data transmission.

[0032] Preferably, the first generation rule, the second generation rule, and the third generation rule are all preset complex functions. The independent variables of the functions are the number of the first gateway, the router path number, and the number of the second gateway, respectively. The function value is converted into a binary number after being rounded down, and used as the corresponding segment.

[0033] By setting the first, second, and third generation rules as preset complex functions, with the corresponding numbers as independent variables, and converting them into binary numbers after rounding down to serve as segments of the encryption parameters, the non-linear characteristics of the complex functions are used to significantly enhance the randomness and unpredictability of each segment, making the composition of the encryption parameters more concealed and further increasing the difficulty of cracking. Furthermore, the unified rounding and binary conversion process ensures the consistency of the format of each segment, providing standardized support for the subsequent cascading generation of complete encryption parameters. Simultaneously, the preset rules do not require real-time negotiation, ensuring the efficiency and stability of encryption parameter generation. The combination of function complexity and standardized conversion processing strengthens the security of data encryption and ensures the feasibility of reverse decryption at the receiving end based on the corresponding rules, providing a solid guarantee for the reliable execution of device parameter masking and demasking, and further improving the confidentiality and smoothness of the entire data transmission process.

[0034] Preferably, the masking operation in step S5 is an XOR operation; if the bit length of the encryption parameter is less than the bit length of the device parameter, the encryption parameter is repeated a preset number of times so that the bit length of the extended encryption parameter is consistent with the bit length of the device parameter.

[0035] By employing XOR operation as the masking method, the efficiency and reversibility of XOR ensure the rapid execution of device parameter masking and subsequent demasking processes, eliminating the need for complex computational resource consumption and improving data processing efficiency. Simultaneously, to address the mismatch between the bit lengths of encrypted parameters and device parameters, a preset number of encryption parameter repetitions and expansions are used to achieve precise bit length matching, avoiding masking operation failures or data distortion caused by length differences. This ensures both the standardization and reliability of masking operations without requiring additional modifications to the core encryption parameter generation logic, balancing ease of operation and security. It provides efficient and stable technical support for encrypted transmission of device parameters, further enhancing the confidentiality and smoothness of data transmission.

[0036] Preferably, the specific process of obtaining the decryption parameters in step S10 includes:

[0037] S101. Generate the first segment of the decryption parameters based on the number of the first gateway and the first generation rule;

[0038] S102. Generate the second segment of the decryption parameter based on the router path number and the second generation rule;

[0039] S103. Generate the third segment of the decryption parameters based on the number of the second gateway and the third generation rule;

[0040] S104. Concatenate the first segment, the second segment, and the third segment to obtain the decryption parameters;

[0041] The first generation rule, the second generation rule, and the third generation rule are consistent with the rules used in step S4.

[0042] By adopting the same segmented generation logic and corresponding generation rules as the encryption parameter generation when acquiring decryption parameters, and generating each segment of the decryption parameters in stages based on the parsed relevant numbers before concatenation, the precise correspondence between the decryption and encryption parameters is ensured. This provides a core guarantee for the reversibility of the XOR mask operation, enabling accurate restoration of device parameters and avoiding decryption failures or data corruption due to rule differences. Furthermore, it eliminates the need for designing separate decryption rules, reducing the complexity of system design and maintenance. The fact that the generation rules are only stored on the terminal and server and not transmitted further enhances the security of the encryption and decryption logic, ensuring the confidentiality and continuity of data transmission throughout the process. This makes the entire encryption and decryption process efficient, reliable, and secure, providing solid support for accurate data acquisition and secure transmission in predictive maintenance throughout the device's lifecycle.

[0043] Preferably, the masking operation on the device monitoring terminal side is performed by the MAC layer, and the demasking operation on the server side is performed by the MAC layer; the MAC layer of the device monitoring terminal encapsulates the RLC PDU encrypted by the RLC layer into a transport block, performs a masking operation on the transport block, and generates the data packet; the MAC layer of the server performs a demasking operation on the received data packet and submits the transport block to the RLC layer for decryption.

[0044] By deploying masking and demasking operations at the MAC layers of the device monitoring terminal and server respectively, and with the terminal MAC layer first encapsulating the RLC-encrypted PDU before performing the masking operation, and the server MAC layer first demasking before submitting it to the RLC layer for decryption, this approach leverages the underlying transmission characteristics of the MAC layer to ensure the efficiency and real-time nature of the operation, avoiding delays caused by additional layers of intervention. It also forms a dual security protection mechanism of "RLC layer encryption + MAC layer masking," significantly improving the confidentiality of device parameter transmission and effectively resisting the risk of data theft and tampering during transmission. Furthermore, this deployment method aligns with the existing communication protocol's layered architecture, requiring no protocol reconstruction and being compatible with existing RLC layer encryption logic, reducing system modification and adaptation costs. While ensuring high data transmission security, it also considers the practicality and execution efficiency of the method, providing more comprehensive and reliable support for secure data transmission in predictive maintenance throughout the device's lifecycle.

[0045] The device lifecycle predictive maintenance parameter encryption transmission system of the present invention includes a device monitoring terminal and a server; the device monitoring terminal is configured to execute steps S1-S6 of the method according to any one of claims 1-9; the server is configured to execute steps S7-S10 of the method according to any one of claims 1-9; the device monitoring terminal and the server establish a communication connection through a first gateway, a router path and a second gateway, and the device monitoring terminal and the server pre-synchronously store a first mapping table, a second mapping table and a third mapping table.

[0046] Beneficial effects: Compared with existing technologies, this invention has the following significant advantages: 1. This invention fully utilizes the dynamic nature of data transmission paths, causing the basic values ​​used to generate encryption parameters (i.e., gateway number and routing path number) to change with the path, increasing the difficulty of cracking the encryption method. Simultaneously, the encryption and decryption rules are pre-stored equally in the device monitoring terminal and server, eliminating the need for transmission over the network. This ensures the security of the rules themselves, provided the terminal and server are not physically cracked. This method is compatible with existing encryption technologies, thus achieving higher overall confidentiality performance; 2. By establishing and synchronously maintaining a mapping table of gateways and routing paths, both communicating parties can dynamically and accurately generate encryption and decryption parameters based on the actual network topology, ensuring that the encryption and decryption process is closely bound to the specific network path used in each communication; 3. By applying complex function generation rules to gateway numbers and path numbers, and concatenating multiple generated segments, highly complex encryption parameters are constructed, thereby significantly enhancing the security of masking operations and effectively resisting cracking attempts; 4. This invention designs masking and demasking operations to be executed at the MAC layer, and can work in conjunction with the upper-layer RLC layer encryption technology. This layered encryption mechanism provides additional, physical path-based security for data transmission without changing the upper-layer structure of the existing communication protocol. Attached Figure Description

[0047] Figure 1 This is a schematic diagram of the system architecture of the present invention;

[0048] Figure 2 This is a flowchart of the method of the present invention;

[0049] Figure 3 This is a logical functional block diagram of the present invention;

[0050] Figure 4 This is a schematic diagram of the data structure of the present invention. Detailed Implementation

[0051] The technical solution of the present invention will be further described below with reference to the accompanying drawings.

[0052] Existing communication protocols provide confidentiality services for user data. For example, in existing 5G communication protocols, the Restricted Frame Locking (RLC) layer provides confidentiality for PDUs. At the sending end, the RLC entity uses the superframe number and frame sequence number as keys to encrypt the original data. At the receiving end, the RLC entity uses the synchronized superframe number and frame sequence number as keys to decrypt the encrypted data, thereby obtaining the original data. However, some technologies have been developed that can crack the encryption services provided by existing technologies. Therefore, how to improve the confidentiality strength of the communication process without changing the existing logical architecture of the communication system is an important issue. The method of this invention aims to improve the confidentiality strength of the communication process.

[0053] Figure 1 This is a schematic diagram of a system architecture according to an embodiment of the present invention. As shown, the system of the present invention includes a device monitoring terminal, a first gateway, multiple routers (i.e., router 1 to router N), a second gateway, and a server. The device monitoring terminal can receive device parameters from sensors. The device monitoring terminal can be a smartphone, tablet computer, laptop computer, desktop computer, etc. The device monitoring terminal communicates with network entities in other wide area networks (WANs) through the first gateway. It should be understood that there are multiple gateways in the WAN where the device monitoring terminal is located, and the device monitoring terminal can communicate with other WANs through any one of these gateways. The destination of the device parameters is the server, and the server receives data packets from other WANs through the second gateway. Between the first gateway and the second gateway, there are multiple routers, and data needs to be routed through multiple routers to reach the second gateway from the first gateway.

[0054] Example 1

[0055] Figure 2 This is a flowchart of a method according to an embodiment of the present invention. As shown in the figure, the device monitoring terminal performs the following steps:

[0056] Step 1: Monitor equipment parameters;

[0057] Step 2: Determine the transmission path from the device monitoring terminal to the server; in one example, the transmission path from the device monitoring terminal to the server can be determined using the following Python program:

[0058] import subprocess

[0059] import re

[0060] def trace_route(target_host):

[0061] try:

[0062] # Execute the traceroute command

[0063] result = subprocess.run(['traceroute', target_host],

[0064] capture_output=True, text=True, timeout=30)

[0065] if result.returncode == 0:

[0066] lines = result.stdout.split('\n')

[0067] print(f"Network path to {target_host}:")

[0068] for line in lines:

[0069] if line.strip():

[0070] print(line)

[0071] # Analyze the information of each hop

[0072] match = re.match(r'\s*(\d+)\s+([^\s]+)\s+', line)

[0073] if match:

[0074] hop_num = match.group(1)

[0075] host = match.group(2)

[0076] print(f"hop number {hop_num}: {host}")

[0077] else:

[0078] print("traceroute failed to execute")

[0079] except Exception as e:

[0080] print(f"Error: {e}")”

[0081] Furthermore, it is understood that traceroute is a basic function built into Windows systems, and the aforementioned transmission path can also be obtained using the traceroute function of Windows systems. It is also understood that any method for obtaining the transmission path other than the aforementioned code or the traceroute function of Windows systems can also be applied to the purposes of this invention. The transmission path can be obtained through various well-known methods, which will not be elaborated upon here. It should be noted that, regardless of the method used, if the device monitoring terminal is connected to a local area network (LAN), the second hop in the aforementioned code execution result represents the first gateway to be used in the wide area network (WAN) where the device monitoring terminal is located; if the device monitoring terminal is directly connected to a WAN, the first hop in the aforementioned code execution result represents the first gateway to be used in the WAN where the device monitoring terminal is located.

[0082] Step 3: Determine the number of the first gateway to be used in the WAN where the device monitoring terminal is located, the router path number, and the number of the second gateway to be used in the WAN where the server is located, based on the transmission path. In one example, after the method executes step 2, the device identifier of the first gateway can be obtained. For the purpose of executing subsequent steps and maintaining confidentiality, the device identifier of the first gateway can be converted into the number of the first gateway. The conversion of the device identifier of the first gateway into the number of the first gateway can be based on the following correspondence table:

[0083] Table 1

[0084] Device identifier (MAC address) of the first gateway The number of the first gateway 00:1B:44:11:3A:B7 100 00:1E:10:AB:CD:EF 200 00:1D:0F:12:34:56 300 00:1B:44:AB:CD:EF 400 00:1E:10:12:34:56 500 00:1D:0F:11:3A:B7 600

[0085] It is understood that Table 1 is merely an example, and other mapping methods for device identifiers and numbers can also be applied to this invention. It is understood that Table 1 or similar mapping tables should be pre-stored in the device monitoring terminal and similarly stored in the server. In other words, in the method of this invention, the mapping table is not transmitted between the device monitoring terminal and the server. Furthermore, the actual mapping table can have more entries. After step 2 is executed, the device identifiers of each router can be obtained. For the purpose of executing subsequent steps and maintaining confidentiality, the router path can be converted into a router path number. This conversion can be based on the following correspondence table:

[0086] Table 2

[0087] Router path Router path number Router 1 - Router 3 - Router 7 (meaning data packets reach the second gateway via routers 1, 3, and 7). 100 Router 2 - Router 5 - Router 6 200 Router 3-Router 4-Router 7 300 Router 1 - Router 3 - Router 6 400 Router 2 - Router 3 - Router 8 500 Router 2 - Router 3 - Router 9 600

[0088] It is understood that Table 2 is merely an example, and other mapping methods for router paths and router path numbers can also be applied to this invention. It is understood that Table 2 or similar mapping tables should be pre-stored in the device monitoring terminal and similarly stored in the server. In other words, in the method of this invention, the mapping table is not transmitted between the device monitoring terminal and the server. For ease of illustration, Table 2 represents the router's device identifier as "Router 1," but in the actual mapping table, "Router 1" can be replaced by the router's MAC address. Furthermore, the actual mapping table can have more entries and should cover all possible router paths. To reduce the number of table entries, the hop count of data packets between the first and second gateways can be limited. The method for converting the device identifier of the second gateway into the second gateway number can refer to the method described in Table 1 and will not be repeated here.

[0089] Step 4: Generate encryption parameters based on the first gateway number, the router path number, and the second gateway number; for details on the implementation of step 4, please refer to the following embodiments.

[0090] Step 5: Mask the device parameters using the encryption parameters. In one example, the masking operation can be an XOR operation; see subsequent embodiments for details. In another example, the operation in Step 5 can be performed by a lower-level logical entity of the existing encryption entity; see the logic diagram below. Figure 3 .like Figure 3 As shown, taking 4G or 5G communication protocols as an example, the encryption entity (encryption entity at the sending end, and correspondingly, decryption entity at the receiving end) specified in the relevant communication standards is the RLC layer. The lower logical entity of the encryption entity can be the MAC layer. Similarly, the reverse operation can be performed at the receiving end. At the receiving end, the decryption entity is the server's RLC layer, and the lower logical entity of the decryption entity is the MAC layer. A specific operation flow could be as follows: the RLC layer sends the encrypted RLC PDU to the MAC layer. The MAC layer first encapsulates multiple RLC PDUs into a transport block. Then, the MAC layer can use encryption parameters to mask the transport block composed of these RLC PDUs. Next, it adds some control information, the device identifier of the first gateway, the device identifiers of each router on the router path, and the device identifier of the second gateway to the header of the transport block. Finally, it appends necessary cyclic redundancy check (CRC) or any other suitable check bits to the end of the transport block, thus forming a data packet that is secondarily encrypted by the MAC layer. A schematic data structure of the data packet can be found in [reference needed]. Figure 4 .like Figure 4 As shown, Figure 4The data structure shown in the first row is actually the basic structure of the transport block in the existing technology. The existing technology only has RLC layer encryption operation. Therefore, the transport block includes multiple encrypted RLC PDUs as well as the transport block header and check bits. However, as mentioned earlier, the RLC layer encryption of the existing technology is at risk of being cracked. Figure 4 The second line shows that this invention uses encryption parameters to perform secondary encryption on the data. Figure 4 The third line shows the result of the invention after the data is encrypted a second time.

[0091] Step 6: Generate a data packet, which includes a header and a payload. The header includes the device identifier of the first gateway, the device identifiers of each router on the router path, and the device identifier of the second gateway. The payload includes masked device parameters. (Still referring to...) Figure 4 For example, a data packet can be a transport block, which has a header. The header includes information that should be included in the header of a transport block as specified in the prior art. In addition, the header of the present invention also includes the device identifier of the first gateway, the device identifiers of each router on the router path, and the device identifier of the second gateway.

[0092] Send the data packet to the server.

[0093] The server performs the following steps:

[0094] Step 7: Receive data packets; in one example, the format of the data packets received by the server can be found in [link to example]. Figure 4 The example data packet in the third line shows that after the server receives the data packet, the lower-level logical entity of the server-side decryption entity (such as the MAC entity) can determine whether the data packet has been received correctly based on the check bits. If it is determined that the data packet has been received correctly, the server-side MAC entity continues to parse the header of the data packet.

[0095] Step 8: Parse the packet header, which includes the device identifier of the first gateway, the device identifiers of each router on the router path, and the device identifier of the second gateway. In one example, after the MAC entity on the server side parses the packet header, it can obtain the device identifiers of the first gateway, the device identifiers of each router on the router path, and the device identifier of the second gateway.

[0096] Step 9: Based on the device identifier of the first gateway, the device identifiers of each router on the router path, and the device identifier of the second gateway, determine the number of the first gateway, the router path number, and the number of the second gateway. In one example, since the server side stores mapping tables such as Table 1 and Table 2, the server can determine the number of the first gateway, the router path number, and the second gateway number based on these mapping tables and the parsed device identifiers of the first gateway, the router path numbers, and the second gateway.

[0097] Step 10: Demask the payload of the data packet based on the first gateway number, the router path number, and the second gateway number;

[0098] Device parameters are obtained based on the demasked payload.

[0099] Demasking the data packet payload based on the first gateway number, router path number, and second gateway number includes:

[0100] Based on the first gateway number, the router path number, and the second gateway number, obtain the decryption parameters;

[0101] The payload of the data packet is demasked using decryption parameters.

[0102] Based on the first gateway number, the router path number, and the second gateway number, the decryption parameters are obtained as follows:

[0103] The first segment of the decryption parameter is generated based on the first gateway number and the first generation rule. In one example, the first generation rule should be consistent with the first generation rule stored on the device monitoring terminal side. Therefore, on the server side, the first generation rule is also Formula 1. Since the mapping table stored on the device monitoring terminal side is consistent with that stored on the server side, the server can also calculate F(x) as 338583. Then, the decimal number is converted into a binary number to obtain the first segment of the decryption parameter. Therefore, in this example, the first segment of the decryption parameter is "1010010101100010111".

[0104] The second segment of the decryption parameter is generated based on the router path number and the second generation rule. In one example, the second generation rule should be consistent with the second generation rule stored on the device monitoring terminal side. Therefore, on the server side, the second generation rule is also Formula 2. Since the mapping table stored on the device monitoring terminal side is consistent with that stored on the server side, the server can also calculate F1(x) as 8752, and then convert this decimal number into a binary number to obtain the first segment of the decryption parameter. Therefore, in this example, the first segment of the decryption parameter is "10001000110000".

[0105] In a preferred embodiment, obtaining the decryption parameters based on the first gateway number, the router path number, and the second gateway number includes:

[0106] The third segment of the decryption parameter is generated based on the second gateway number and the third generation rule. In one example, the third generation rule should be consistent with the third generation rule stored on the device monitoring terminal side. Therefore, on the server side, the third generation rule is also Formula 3. Since the mapping table stored on the device monitoring terminal side is consistent with that stored on the server side, the server can also calculate F2(x) as 16650. Then, the decimal number is converted into a binary number to obtain the first segment of the decryption parameter. Therefore, in this example, the first segment of the decryption parameter is "100000100001010".

[0107] The decryption parameter is generated by concatenating the first, second, and third segments of the decryption parameter. After concatenating the first, second, and third segments of the decryption parameter, the resulting decryption parameter is "10100101011000101111000100011000010000100001010". The server can then calculate the number of bits in the payload portion. For example, continuing from the previous example, if the number of bits in the payload is calculated to be 4800, the decryption parameter is repeated 100 times, thereby expanding the 48-bit decryption parameter to 4800 bits. The decryption parameter can then be used to perform an XOR operation on the payload again to demask it.

[0108] Example 2

[0109] In Example 2, generating encryption parameters based on the first gateway number, the router path number, and the second gateway number includes:

[0110] The first segment of the encrypted parameters is generated based on the first gateway number and the first generation rule. In one example, the first generation rule can be a function with a certain complexity, where the independent variable is the first gateway number and the function value is the first segment of the encrypted parameters. As a specific example, the first generation rule can be represented by the following formula 1:

[0111]

[0112] Continuing with the previous example, assuming the first gateway number is 100, substituting it into the formula, we get F(x) as 338583.33. Rounding this value down, we get F(x) as 338583. Then, we convert this decimal number to a binary number to obtain the first segment of the encryption parameter; therefore, in this example, the first segment of the encryption parameter is "1010010101100010111".

[0113] The second segment of the encrypted parameters is generated based on the router path number and the second generation rule. In one example, the second generation rule can be a function with a certain complexity, where the router path number is the independent variable and the second segment of the encrypted parameters is the function value. As a specific example, the second generation rule can be represented by the following formula 2: Continuing with the previous example, assuming the router path number is 100, substituting it into the formula, we get F1(x) as 8752.14. Rounding this value down, we get F1(x) as 8752. Then, we convert this decimal number to a binary number to obtain the second segment of the encryption parameter. Therefore, in this example, the second segment of the encryption parameter is "10001000110000".

[0114] Generating encryption parameters based on the first gateway number, router path number, and second gateway number also includes:

[0115] The third segment of the encrypted parameters is generated based on the second gateway's ID and the third generation rule. In one example, the third generation rule can be a function with a certain complexity, where the independent variable is the second gateway's ID and the function value is the third segment of the encrypted parameters. As a specific example, the third generation rule can be represented by the following formula 3:

[0116] Continuing with the previous example, assuming the number of the second gateway is 100, substituting it into the formula, we get F2(x) as 16650. Then, we convert this decimal number into a binary number to obtain the third segment of the encryption parameter. Therefore, in this example, the third segment of the encryption parameter is "100000100001010".

[0117] The first, second, and third segments of the encrypted parameters are concatenated to generate the encrypted parameters. Continuing the previous example, concatenating the first, second, and third segments of the encrypted parameters yields the encrypted parameter "101001010110001011110001000110000100000100001010". In this example, the encrypted parameter is 48 bits long. If the number of bits of the RLC PDU to be masked is, for example, 4800 bits, the encrypted parameter can be repeated 100 times, thereby expanding the 48-bit encrypted parameter to 4800 bits, so that the encrypted parameter can be used to mask the RLC PDU.

[0118] Example 3

[0119] This invention provides an encrypted transmission system for predictive maintenance parameters throughout the entire lifecycle of equipment. The system includes an equipment monitoring terminal and a server. The equipment monitoring terminal is configured to execute the method described above, and the server is configured to execute the method described above.

Claims

1. A method for encrypted transmission of predictive maintenance parameters throughout the entire lifecycle of equipment, characterized in that, This process is executed collaboratively by the device monitoring terminal and the server, and includes the following steps: The device monitoring terminal performs the following steps: S1, Monitoring equipment parameters; S2. Determine the transmission path from the device monitoring terminal to the server; S3. Based on the transmission path, determine the number of the first gateway to be used in the wide area network where the device monitoring terminal is located, the router path number, and the number of the second gateway to be used in the wide area network where the server is located; S4. Generate encryption parameters based on the number of the first gateway, the path number of the router, and the number of the second gateway; S5. Use the encryption parameters to perform a masking operation on the device parameters; S6. Generate a data packet and send it to the server. The data packet includes a header and a payload. The header contains the device identifier of the first gateway, the device identifiers of each router on the router path, and the device identifier of the second gateway. The payload contains masked device parameters. The server performs the following steps: S7. Receive the data packet; S8. Parse the header of the data packet to obtain the device identifier of the first gateway, the device identifiers of each router on the router path, and the device identifier of the second gateway; S9. Based on the device identifiers obtained from the parsing, determine the corresponding first gateway number, router path number, and second gateway number; S10. Obtain decryption parameters based on the number of the first gateway, the router path number, and the number of the second gateway; use the decryption parameters to demask the payload of the data packet; and obtain device parameters based on the demasked payload.

2. The method according to claim 1, characterized in that, In step S2, the transmission path is determined by the traceroute command, the system's built-in traceroute function, or other known path detection methods; if the device monitoring terminal is connected to a local area network, the second hop in the path detection result corresponds to the first gateway; If the device monitoring terminal is directly connected to the wide area network, the first hop in the path detection result corresponds to the first gateway.

3. The method according to claim 1, characterized in that, In step S3, the number of the first gateway is determined by a first mapping table, the number of the second gateway is determined by a second mapping table with the same structure as the first mapping table, and the router path number is determined by a third mapping table. The first mapping table stores the correspondence between the device identifier and the number of the first gateway, the second mapping table stores the correspondence between the device identifier and the number of the second gateway, and the third mapping table stores the correspondence between the router path and the number. The first mapping table, the second mapping table, and the third mapping table are pre-synchronized and stored in the device monitoring terminal and the server, and are not transmitted between the two.

4. The method according to claim 3, characterized in that, The device identifiers of the first gateway and the second gateway are MAC addresses, and the router paths in the third mapping table are uniquely identified by the MAC addresses of each router.

5. The method according to claim 1, characterized in that, The specific process of generating encryption parameters in step S4 includes: S41. Generate the first segment of the encryption parameters based on the number of the first gateway and the first generation rule; S42. Generate the second segment of the encryption parameter based on the router path number and the second generation rule; S43. Generate the third segment of the encryption parameters based on the number of the second gateway and the third generation rule; S44. Concatenate the first segment, the second segment, and the third segment to obtain the encryption parameters.

6. The method according to claim 5, characterized in that, The first generation rule, the second generation rule, and the third generation rule are all preset complex functions. The independent variables of the functions are the number of the first gateway, the router path number, and the number of the second gateway, respectively. The function value is converted into a binary number after being rounded down, and used as the corresponding segment.

7. The method according to claim 1, characterized in that, The masking operation in step S5 is an XOR operation; if the bit length of the encryption parameter is less than the bit length of the device parameter, the encryption parameter is repeated a preset number of times so that the bit length of the extended encryption parameter is consistent with the bit length of the device parameter.

8. The method according to claim 1, characterized in that, The specific process of obtaining the decryption parameters in step S10 includes: S101. Generate the first segment of the decryption parameters based on the number of the first gateway and the first generation rule; S102. Generate the second segment of the decryption parameter based on the router path number and the second generation rule; S103. Generate the third segment of the decryption parameters based on the number of the second gateway and the third generation rule; S104. Concatenate the first segment, the second segment, and the third segment to obtain the decryption parameters; The first generation rule, the second generation rule, and the third generation rule are consistent with the rules used in step S4.

9. The method according to claim 1, characterized in that, The masking operation on the device monitoring terminal side is performed by the MAC layer, and the demasking operation on the server side is performed by the MAC layer. The MAC layer of the device monitoring terminal encapsulates the RLC PDU encrypted by the RLC layer into a transport block, performs a masking operation on the transport block, and generates the data packet. The MAC layer of the server performs a demasking operation on the received data packet and submits the transport block to the RLC layer for decryption.

10. A system for encrypted transmission of predictive maintenance parameters throughout the entire lifecycle of equipment, characterized in that, The system includes a device monitoring terminal and a server; the device monitoring terminal is configured to perform steps S1-S6 of the method according to any one of claims 1-9; the server is configured to perform steps S7-S10 of the method according to any one of claims 1-9; the device monitoring terminal and the server establish a communication connection through a first gateway, a router path and a second gateway, and the device monitoring terminal and the server pre-synchronize and store a first mapping table, a second mapping table and a third mapping table.

Images