Data security protection method and device, equipment, medium and product

Abstract

The invention discloses a data security protection method and device, equipment, a medium and a product. The method comprises: in response to an access request of an industrial terminal device, obtaining coding information of the industrial terminal device, the coding information being generated based on device information of the industrial terminal device; performing identity authentication on the coded information by using a preset differential confusion mechanism to obtain an authentication result; under the condition that the authentication result is determined to pass the authentication, utilizing a preset dynamic game defense model to perform availability analysis on sending data sent by the industrial terminal equipment to obtain the availability of the sending data, the availability being used for representing the defense degree of the industrial network to the sending data; and encrypting the sent data to be stored in a database under the condition that the availability meets a defense strategy condition. According to the embodiment of the invention, identity authentication can be carried out on the data source, the reliability of the data source is ensured, attack of an industrial network can be resisted, and stable operation of the industrial network is ensured.

Description

Technical Field

[0001] This application belongs to the technical field of data security protection, and in particular relates to a data security protection method, device, equipment, medium and product. Background Technology

[0002] Currently, with the rapid development of science and the economy, industry, as the lifeline of the national economy, is one of the key technological fields representing the rise and fall of a nation. Along with the development of industrial technology, the focus on industrial network security has become increasingly intense. Because industrial product manufacturing involves multiple processes, this involves numerous industrial terminal devices. Ensuring the security of critical industrial data transmission within the industrial network when multiple industrial terminal devices are simultaneously connected to it presents a significant challenge in managing the diverse and numerous industrial terminal devices.

[0003] In related technologies, the large variety and quantity of industrial terminal equipment leads to uncertainty in data sources, which may result in the access of incorrect data. In addition, due to the large size of industrial networks, there may be malicious devices that launch network attacks on industrial networks, which will affect the operational efficiency of industrial networks and the operation of industrial terminal equipment. Summary of the Invention

[0004] This application provides a data security protection method, apparatus, device, medium, and product that can authenticate the data source, ensure the reliability of the data source, resist attacks on industrial networks, and ensure the stable operation of industrial networks.

[0005] On the one hand, embodiments of this application provide a data security protection method, the method including: In response to an access request from an industrial terminal device, the encoding information of the industrial terminal device is obtained, and the encoding information is generated based on the device information of the industrial terminal device. The encoded information is authenticated using a preset differential obfuscation mechanism to obtain the authentication result; If the authentication result is determined to be successful, the availability of the transmitted data sent by the industrial terminal device is analyzed using a preset dynamic game defense model to obtain the availability of the transmitted data. The availability is used to characterize the degree of defense of the industrial network against the transmitted data. If the availability meets the defense strategy conditions, the transmitted data is encrypted and stored in the database.

[0006] Optionally, the step of using a preset differential obfuscation mechanism to authenticate the encoded information and obtain an authentication result includes: The encoded information is processed to extract response fields, resulting in multiple response field information. The differential obfuscation mapping function is used to map each of the response field information to obtain the mapping value corresponding to each of the response field information; Based on the mapping value corresponding to each of the response field information, a differential confusion feature vector dataset is constructed. Calculate the first probability distribution of the multiple response field information and the second probability distribution of the differential confusion feature vector dataset, respectively; The differential confusion probability is obtained by weighted summation of the first probability distribution and the second probability distribution. Based on the differential confusion probability, each differential confusion feature vector in the differential confusion feature vector set is weighted to obtain a weighted differential confusion feature vector. The weighted differential obfuscation feature vector is matched with the preset authentication configuration dataset to obtain the matching result; Based on the matching results, the authentication result is determined.

[0007] Optionally, the preset authentication configuration dataset includes a real authentication configuration dataset and a fake authentication configuration dataset. The step of performing similarity matching between the weighted differential obfuscation feature vector and the preset authentication configuration dataset to obtain a matching result includes: Extract the real authentication configuration dataset and the fake authentication configuration dataset from the industrial network database; Based on a preset similarity algorithm, the first similarity between the weighted differential obfuscation feature vector and the real authentication configuration dataset, and the second similarity between the weighted differential obfuscation feature vector and the fake authentication configuration dataset are calculated respectively. The first similarity and the second similarity are compared to obtain the comparison result; If the comparison result determines that the first similarity is higher than the second similarity, the matching result is determined to be true for the encoded information.

[0008] Optionally, obtaining the encoding information of the industrial terminal device includes: Obtain the device information of the industrial terminal device, which includes device identity information, industrial type information, device connection network address information, device physical address information, and device configuration parameter information; The device identity information is serialized using a preset encoding model to obtain a layer of encoding. The industrial type information is type-encoded using a preset coding model to obtain a two-layer code; The device configuration parameter information is model-encoded using a preset coding model to obtain a three-layer code. The device's network address information and physical address information are location-encoded using a preset encoding model to obtain a four-layer encoding. The device configuration parameters are state-encoded using a preset coding model to obtain a five-layer code. The encoded information is generated based on the first-layer encoding, second-layer encoding, third-layer encoding, fourth-layer encoding, and fifth-layer encoding.

[0009] Optionally, before performing availability analysis on the transmitted data sent by the industrial terminal device using a preset dynamic game defense model to obtain the availability of the transmitted data, the method further includes: Obtain each node of the industrial network and the edges connected to the nodes, wherein the nodes include communication devices and storage devices of the industrial network, and the edges include communication channels between devices; Based on the nodes and edges, construct the network topology; By using a preset defense loss function and a preset defense cost function, a defense analysis is performed on the network topology to obtain a defense strategy; Based on the aforementioned defense strategy, a preset dynamic game defense model is constructed.

[0010] Optionally, before constructing the preset dynamic game defense model based on the defense strategy, the method further includes: Based on a preset defense loss function, the defense probability of each node is determined; The defense cost of each node is determined based on a preset defense cost function; For the given network topology, obtain the optimal defense strategy, which includes the defense strategy with the lowest defense probability and the lowest defense cost; The construction of a preset dynamic game defense model based on the defense strategy includes: Based on the optimal defense strategy, a preset dynamic game defense model is constructed.

[0011] Optionally, the step of using a preset dynamic game defense model to perform availability analysis on the transmitted data sent by the industrial terminal equipment to obtain the availability of the transmitted data includes: Using a preset dynamic game defense model, the defense loss and defense cost of the industrial network are calculated to obtain the real-time defense loss and real-time defense cost of the industrial network. The availability rate is obtained by weighted summation of the defense loss and the real-time defense cost.

[0012] Optionally, encrypting the transmitted data for storage in a database includes: The transmitted data is recursively processed to generate byte nodes for different transmitted data. The byte node is subjected to feedback encryption to generate a data sequence after feedback encryption; Each encrypted data sequence of the feedback is retrieved and labeled based on a hash algorithm to obtain the data to be stored, and the data to be stored is stored in the database.

[0013] Optionally, when the feedback encryption is forward encryption, the step of performing feedback encryption on the byte node to generate the encrypted data sequence includes: The data nodes that send different data are sequentially and recursively processed in a forward direction, and multi-source addition is performed with the corresponding byte nodes to generate a forward-feedback encrypted data sequence.

[0014] Optionally, when the feedback encryption is reverse encryption, the step of performing feedback encryption on the byte node to generate the encrypted data sequence includes: The data nodes that send different data are recursively processed in reverse order, and multi-source addition is performed with the corresponding byte nodes to generate a reverse-feedback encrypted data sequence.

[0015] On the other hand, embodiments of this application provide a data security protection device, the device comprising: The acquisition module is used to acquire the encoding information of the industrial terminal device in response to the access request of the industrial terminal device, wherein the encoding information is generated based on the device information of the industrial terminal device. The authentication module is used to perform identity authentication on the encoded information using a preset differential obfuscation mechanism to obtain an authentication result; The analysis module is used to perform availability analysis on the data sent by the industrial terminal device using a preset dynamic game defense model when the authentication result is determined to be successful, and to obtain the availability of the data sent. The availability is used to characterize the degree of defense of the industrial network against the data sent. An encryption module is used to encrypt the transmitted data and store it in a database when the availability meets the defense strategy conditions.

[0016] In another aspect, embodiments of this application provide an electronic device, the device comprising: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, it implements the data security protection method as described in the first aspect.

[0017] In another aspect, embodiments of this application provide a computer storage medium on which computer program instructions are stored, and when the computer program instructions are executed by a processor, the data security protection method as described in the first aspect is implemented.

[0018] In another aspect, embodiments of this application provide a computer program product in which instructions, when executed by a processor of an electronic device, cause the electronic device to perform the data security protection method as described in the first aspect.

[0019] The data security protection method, apparatus, device, medium, and product of this application can employ a differential obfuscation mechanism for identity authentication after receiving an access request from an industrial terminal device. This results in higher authentication efficiency and accuracy. Differential obfuscation technology can replace the original asymmetric cryptographic authentication technology, effectively protecting the data privacy information of industrial network users. Simultaneously, by utilizing a preset dynamic game theory defense model for data transmission screening, it effectively identifies and prevents the infectiousness and offensiveness of data transmitted by industrial terminal devices, improving protection efficiency. Attached Figure Description

[0020] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating a data security protection method provided in one embodiment of this application; Figure 2 This is a flowchart illustrating a data security protection method provided in another embodiment of this application; Figure 3 This is a flowchart illustrating a data security protection method provided in another embodiment of this application; Figure 4 This is a schematic diagram of the structure of a data security protection device provided in another embodiment of this application; Figure 5 This is a schematic diagram of the structure of an electronic device provided in another embodiment of this application. Detailed Implementation

[0022] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0023] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0024] To address the problems of existing technologies, embodiments of this application provide a data security protection method, apparatus, device, medium, and product. In these embodiments, upon receiving an access request from an industrial terminal device, a differential obfuscation mechanism can be used for authentication, resulting in higher authentication efficiency and accuracy. Differential obfuscation technology can replace the original asymmetric cryptographic authentication technology, effectively protecting the data privacy information of industrial network users. Simultaneously, a preset dynamic game theory defense model is used to screen transmitted data, effectively identifying and preventing the infectiousness and offensiveness of data sent by industrial terminal devices, thus improving protection efficiency.

[0025] The data security protection method provided in the embodiments of this application will be introduced first below.

[0026] Figure 1 A flowchart illustrating a data security protection method provided in one embodiment of this application is shown. Figure 1 As shown, data security protection methods may include S101-S104: S101, in response to the access request from the industrial terminal device, obtains the encoding information of the industrial terminal device.

[0027] In this embodiment of the application, when the electronic device receives an access request from the industrial terminal device, it indicates that the industrial terminal device may send data to the electronic device. In order to ensure data security, verification is required. This can be done by obtaining the encoding information of the industrial terminal device. The encoding information is generated based on the device information of the industrial terminal device, ensuring a unique correspondence between the encoding information and the industrial terminal device, so as to realize the identity authentication of the industrial terminal device. It is worth noting that the encoding information of each industrial terminal device is pre-stored in the electronic device.

[0028] S102, use a preset differential obfuscation mechanism to perform identity authentication on the encoded information and obtain the authentication result.

[0029] In this embodiment, the industrial terminal device is authenticated by a preset differential obfuscation mechanism. This enables efficient authentication of the same industrial terminal device using a pre-encrypted method, resulting in higher authentication efficiency and accuracy. The preset differential obfuscation mechanism can replace the crude asymmetric cryptographic authentication technology, effectively protecting the data privacy information of industrial network users. It can also achieve identity authentication of industrial terminal devices, ensuring the security of the source of the data to be received.

[0030] S103, if the authentication result is confirmed as successful, the availability of the transmitted data sent by the industrial terminal equipment is analyzed using a preset dynamic game defense model to obtain the availability of the transmitted data.

[0031] In this embodiment of the application, after the industrial terminal device is successfully authenticated, it may be subject to network attacks during data transmission. Network attacks such as viruses may be implanted into the data sent by the industrial terminal device. Therefore, a preset dynamic game defense model can be used to analyze the availability of the data sent by the industrial terminal device, reasonably allocate defense resources, generate the availability of the sent data, determine the threshold of infection and attack on the industrial network, and take corresponding defense measures to improve protection efficiency. The availability is used to characterize the degree of defense of the industrial network against the sent data.

[0032] S104, if the availability meets the defense strategy conditions, encrypt the transmitted data and store it in the database.

[0033] In this embodiment, after receiving an access request from an industrial terminal device, a differential obfuscation mechanism can be used for authentication, resulting in higher authentication efficiency and accuracy. Differential obfuscation technology can replace the original asymmetric cryptographic authentication technology, effectively protecting the data privacy of industrial network users. Simultaneously, a preset dynamic game theory defense model is used to screen transmitted data, effectively identifying and preventing the infectiousness and offensiveness of data sent by industrial terminal devices, thus improving protection efficiency.

[0034] In some other embodiments, S101 may include: Obtain equipment information for industrial terminal devices; The device identification information is serialized using a preset coding model to obtain a layer of coding. Industrial type information is type-encoded using a preset coding model to obtain a two-layer code; The equipment configuration parameter information is encoded using a preset encoding model to obtain a three-layer encoding. A four-layer encoding is obtained by using a preset encoding model to perform location encoding on the device's network connection address information and device physical address information; The device configuration parameters are status-encoded using a preset coding model to obtain a five-layer coding. Encoded information is generated based on one-layer, two-layer, three-layer, four-layer, and five-layer encoding.

[0035] In this embodiment of the application, since there are many industrial terminal devices connected to the industrial network and identity authentication is difficult, efficient identification is not possible. In order to efficiently identify industrial terminal devices, the device information of the industrial terminal devices can be extracted in advance. The device information includes device identity information, industrial type information, device connection network address information, device physical address information and device configuration parameter information. Then, based on the preset encoding model, encoding operation is performed to generate unique encoding information for the industrial terminal device.

[0036] Specifically, taking the Rveit coding model as an example, the coding structure of this model is a five-level coding system: Level 1 + Level 2 + Level 3 + Level 4 + Level 5. Its coding rules can include: 1. A five-level code structure is adopted. The first level is the serial number, obtained from the device ID information; the second level is the type, obtained from the device's industrial type; the third level is the model, obtained from the device configuration parameters; the fourth level is the location, obtained from the device's network address and physical address information; and the fifth level is the status, obtained from the device configuration parameters. After obtaining these five levels of coding, the first, second, third, fourth, and fifth levels are concatenated to generate the coding information. This also lays the foundation for subsequent identity authentication through a preset differential obfuscation mechanism, facilitating identity verification and improving efficiency. Compared to related technologies, this approach first encodes the industrial terminal device and then performs identity authentication using the encoded information, eliminating the need for multiple authentication steps and requiring only verification of the coding information, thus improving authentication efficiency and accuracy.

[0037] In some other embodiments, S102 may include: S1021, Extract response fields from the encoded information to obtain multiple response field information; S1022, use the differential obfuscation mapping function to map each response field information to obtain the mapping value corresponding to each response field information; S1023, Construct a differential confusion feature vector dataset based on the mapping value corresponding to each response field information; S1024, calculate the first probability distribution of multiple response field information and the second probability distribution of the differentially confused feature vector dataset respectively; S1025, the weighted sum of the first probability distribution and the second probability distribution is used to obtain the differential confusion probability; S1026, Based on the differential confusion probability, each differential confusion feature vector in the differential confusion feature vector set is weighted to obtain the weighted differential confusion feature vector; S1027, perform similarity matching between the weighted differential obfuscation feature vector and the preset authentication configuration dataset to obtain the matching result; S1028, Based on the matching results, determine the authentication result.

[0038] In this embodiment, a pre-defined differential obfuscation mechanism is used to construct a differential obfuscation strategy for industrial network environments. This strategy analyzes the unique encoding information of industrial terminal devices, extracts several differential obfuscation feature information, optimizes the unique encoding information into multiple differential obfuscation feature vectors, and obtains the corresponding differential obfuscation probabilities. This forms the differential obfuscation feature components of the industrial terminal device, and obtains the corresponding differential obfuscation probabilities to form a dataset of the differential obfuscation feature components of the industrial terminal device. This dataset is then matched with a pre-defined authentication configuration dataset in the industrial network to determine similarity. Based on the similarity matching results, the authentication result is obtained.

[0039] Specifically, response fields can be extracted from the encoded information based on a preset extraction model. Response fields with strong responsiveness are extracted and compiled into a preset dataset. The preset extraction model can be the Pythia model. Then, a differential obfuscation mapping function is used to map each response field, obtaining a mapping value for each response field. This forms a differential obfuscation feature vector corresponding to the unique encoded information of the industrial terminal device, resulting in a differential obfuscation feature vector dataset. In this embodiment, the differential confusion mapping function can be

[0040] Where C is the differential confusion feature vector mapping value, P is the response field information, δ is the differential confusion coefficient, m is the differential confusion feature extraction value, μ is the permutation function, k is the coefficient to be permuted, β is the nonlinear permutation parameter, l is the differential confusion permutation vector, and f is the permutation controlled parameter. X is the mapping parameter.

[0041] In this embodiment, the probability density calculation function can be used to calculate the first probability of each response field information in the preset dataset and the second probability distribution of the differentially confused feature vector dataset. The difference probability is obtained by weighted summation based on the changes in the probability distribution of the preset dataset to the second probability distribution of the differentially confused feature vector dataset and by multivariate addition.

[0042] Then, a weighted value is calculated based on the Hadamard product and the differential confusion probability, and the differential confusion feature vector is weighted. The weighted differential confusion feature vector is then matched with a preset authentication configuration dataset to obtain the matching result. Specifically, the preset authentication configuration dataset includes a real authentication configuration dataset and a fake authentication configuration dataset. S1027 may include: Extract the real authentication configuration dataset and the fake authentication configuration dataset from the industrial network database; Based on a preset similarity algorithm, the first similarity between the weighted differential obfuscation feature vector and the real authentication configuration dataset, and the second similarity between the weighted differential obfuscation feature vector and the fake authentication configuration dataset are calculated respectively. The first similarity and the second similarity are compared to obtain the comparison results; If the comparison result determines that the first similarity is higher than the second similarity, the matching result is determined to be the authenticity of the encoded information.

[0043] In this embodiment, a genuine authentication configuration dataset and a fake authentication configuration dataset can be extracted from an industrial network database beforehand. Then, based on similarity calculation methods in related technologies, a first similarity with the genuine authentication configuration dataset and a second similarity with the fake authentication configuration dataset are calculated respectively. The first similarity and the second similarity are compared. If the first similarity is greater than the second similarity, it indicates that the weighted differential obfuscation feature vector is similar to the genuine authentication configuration dataset, and the corresponding industrial terminal device is successfully authenticated. If the first similarity is less than the second similarity, it indicates that the encoded information is genuine, but the weighted differential obfuscation feature vector is similar to the fake authentication configuration dataset, indicating that the encoded information is fake, and the corresponding industrial terminal device fails to authenticate.

[0044] In this embodiment of the application, the data privacy information of industrial network users is effectively protected by using a differential obfuscation mechanism instead of the asymmetric cryptographic authentication technology for crude oil.

[0045] In other embodiments, after successful authentication, the sent data needs to be screened to determine if a specific attack targeting the industrial network is occurring. The attacked node has two identities: an attack agent and an attack target. Typically, network attacks infect multiple attack agents to penetrate more targets one-to-one or one-to-many. The attack process mainly includes two stages: infection and attack. Generally, in specific attacks targeting industrial networks, industrial terminal devices are often used as infection sources, infecting data nodes on the industrial network before launching the attack, rather than directly using the data nodes uploaded by the industrial terminal devices as the attack starting point. Therefore, using industrial terminal devices as infection sources in the attack process is dynamic, and it is not possible to simply obtain the specific attacked data node based on the upload node where the terminal device is located. Therefore, it is necessary to construct a preset dynamic game theory defense model for non-fixed attack locations to screen the data sent by industrial terminal devices and determine whether there is a risk of infection.

[0046] Specifically, refer to Figure 3 Prior to S103, the method may also include: S301, Obtain each node of the industrial network and the edges connected to the nodes; S302, based on nodes and edges, constructs network topology; S303 uses a preset defense loss function and a preset defense cost function to perform defense analysis on the network topology and obtain defense strategies; S304, based on defense strategies, constructs a preset dynamic game defense model.

[0047] In this embodiment of the application, in order to defend the entire industrial network, a network topology can be constructed first. Each node of the industrial network and the edges connecting the nodes can be obtained first. The nodes include the communication devices and storage devices of the industrial network, and the edges include the communication channels between the devices. Assuming that each node is a vulnerable node, a defense strategy to deal with the attack can be formed by analyzing the robustness and stability of each node, and a preset dynamic game defense model can be formed based on the defense strategy.

[0048] Specifically, the preset defense loss function is shown in the following formula (2):

[0049] in, Let be the probability that the i-th node is infected at time t. Let be the probability that the i-th node is attacked.

[0050] The preset defense cost function is shown in the following formula (3):

[0051] in, The cost coefficient for deploying infection defense resources on the i-th node. The cost coefficient for deploying defense resources on the i-th node. Let be the defense strength coefficient deployed at node i.

[0052] By using the aforementioned preset defense loss function and preset defense cost function, the defense strategy for each node can be obtained, thus yielding the defense strategy for the network topology. Based on this defense strategy, a preset winter game defense model can be constructed to protect the industrial network.

[0053] In some other embodiments, before constructing a preset dynamic game defense model based on a defense strategy, the method may further include: Based on a preset defense loss function, the defense probability of each node is determined; The defense cost of each node is determined based on a preset defense cost function; For the network topology, obtain the optimal defense strategy, which includes the defense strategy with the lowest probability of defense and the lowest defense cost. Based on the defense strategy, a pre-defined dynamic game defense model is constructed, including: Based on the optimal defense strategy, a pre-defined dynamic game defense model is constructed.

[0054] To save defense resources, an optimal defense strategy can be obtained based on minimizing defense losses and defense costs. A preset dynamic game defense model can then be constructed based on this optimal defense strategy. The optimal defense strategy is to rationally allocate defense resources to achieve the objective function of minimizing defense losses and defense costs.

[0055] The dynamic game defense model is used to identify data sent from industrial terminal devices, determine the probability of them infecting and attacking the industrial network, calculate defense losses and costs, assign reliability indicators, and generate availability based on the reliability indicator values.

[0056] In some other embodiments, S103 may include: Using a pre-defined dynamic game defense model, the defense loss and defense cost of the industrial network are calculated to obtain the real-time defense loss and real-time defense cost of the industrial network. The availability rate is obtained by weighted summation of defense losses and real-time defense costs.

[0057] In this embodiment, the preset dynamic game defense model constructed in the above manner can optimally arrange defense resources and identify the data sent by industrial terminal devices to determine the availability of the data. If the availability is greater than a preset threshold, it means that the data sent at this time has not been infected or attacked and can be safely received and used; otherwise, it cannot be used or received.

[0058] In other embodiments, when the availability meets the defense strategy conditions, i.e., when a preset threshold is met, data can be received and transmitted, encrypted, and stored in a database. Specifically, S104 may include: The data to be sent is processed recursively to generate byte nodes for different data to be sent. Perform feedback encryption on the byte nodes to generate a data sequence with feedback encryption; Each encrypted data sequence is retrieved and labeled using a hash algorithm to obtain the data to be stored, which is then stored in the database.

[0059] In this embodiment, the data sent by the industrial terminal device has a very obvious characteristic that is suitable for industrial networks: it needs to have a certain degree of redundancy. Here, positive feedback encryption and negative feedback encryption are used to make full use of the data redundancy to encrypt the industrial data.

[0060] Specifically, forward and reverse encryption can be performed on the transmitted data to generate a feedback encrypted data sequence. Each feedback encrypted data sequence can then be retrieval and labeled based on a hash algorithm to facilitate subsequent retrieval of the transmitted data in the database.

[0061] In some embodiments, when the feedback encryption is forward encryption, performing feedback encryption on byte nodes to generate an encrypted data sequence may include: The data nodes that send different data are sequentially and recursively processed in a forward direction, and multi-source addition is performed with the corresponding byte nodes to generate a forward-feedback encrypted data sequence.

[0062] In this embodiment, the data sent from the industrial network terminal device is recursively serialized to generate byte nodes of different data; positive feedback encryption is performed. The encryption process of positive feedback encryption is to recursively process the data nodes of different data in the corresponding number of nodes in the forward direction and perform multivariate addition with the corresponding byte nodes to generate the data sequence after positive feedback encryption.

[0063] In other embodiments, when the feedback encryption is reverse encryption, performing feedback encryption on byte nodes to generate an encrypted data sequence may include: The data nodes that send different data are recursively processed in reverse order, and multi-source addition is performed with the corresponding byte nodes to generate a reverse-feedback encrypted data sequence.

[0064] In this embodiment, the data sent from the industrial network terminal device is recursively serialized to generate byte nodes of different data; reverse encryption is then performed. The reverse feedback encryption process involves recursively counting the data nodes of different data in reverse order and performing multivariate addition with the corresponding byte nodes to generate the reverse feedback encrypted data sequence.

[0065] It is worth noting that the corresponding number of nodes can be dynamically adjusted according to the redundancy, which will not be elaborated further here.

[0066] Based on the data security protection method provided in the above embodiments, this application also provides specific implementation methods of the data security protection device. Please refer to the following embodiments.

[0067] First see Figure 4 The data security protection device 400 provided in this application embodiment may include: The acquisition module 401 is used to respond to the access request of the industrial terminal device and acquire the encoding information of the industrial terminal device. The encoding information is generated based on the device information of the industrial terminal device. Authentication module 402 is used to perform identity authentication on encoded information using a preset differential obfuscation mechanism to obtain authentication results; Analysis module 403 is used to perform availability analysis on the data sent by industrial terminal equipment using a preset dynamic game defense model when the authentication result is determined to be successful, and obtain the availability of the data sent. The availability is used to characterize the degree of defense of the industrial network against the data sent. Encryption module 404 is used to encrypt the transmitted data for storage in the database, provided that the availability meets the defense strategy conditions.

[0068] As an alternative implementation, the authentication module 402 can also be used for: The encoded information is processed to extract response fields, resulting in multiple response field information. The differential obfuscation mapping function is used to map each response field information to obtain the mapping value corresponding to each response field information; Based on the mapping value corresponding to each response field information, construct a differential confusion feature vector dataset; Calculate the first probability distribution of multiple response field information and the second probability distribution of the differentially confused feature vector dataset, respectively; The differential confusion probability is obtained by weighted summation of the first and second probability distributions. Based on the differential confusion probability, each differential confusion feature vector in the differential confusion feature vector set is weighted to obtain the weighted differential confusion feature vector. The weighted differential obfuscation feature vector is matched with the preset authentication configuration dataset to obtain the matching result; The authentication result is determined based on the matching results.

[0069] As an optional implementation, the preset authentication configuration dataset includes a real authentication configuration dataset and a fake authentication configuration dataset, and the authentication module 402 can also be used for: Extract the real authentication configuration dataset and the fake authentication configuration dataset from the industrial network database; Based on a preset similarity algorithm, the first similarity between the weighted differential obfuscation feature vector and the real authentication configuration dataset, and the second similarity between the weighted differential obfuscation feature vector and the fake authentication configuration dataset are calculated respectively. The first similarity and the second similarity are compared to obtain the comparison results; If the comparison result determines that the first similarity is higher than the second similarity, the matching result is determined to be the authenticity of the encoded information.

[0070] As an alternative implementation, the acquisition module 401 can also be used for: Obtain device information for industrial terminal equipment, including device identity information, industry type information, device network address information, device physical address information, and device configuration parameter information; The device identification information is serialized using a preset coding model to obtain a layer of coding. Industrial type information is type-encoded using a preset coding model to obtain a two-layer code; The equipment configuration parameter information is encoded using a preset encoding model to obtain a three-layer encoding. A four-layer encoding is obtained by using a preset encoding model to perform location encoding on the device's network connection address information and device physical address information; The device configuration parameters are status-encoded using a preset coding model to obtain a five-layer coding. Encoded information is generated based on one-layer, two-layer, three-layer, four-layer, and five-layer encoding.

[0071] As an alternative implementation, the analysis module 403 can also be used for: Obtain each node of the industrial network and the edges connected to the nodes. Nodes include communication devices and storage devices in the industrial network, and edges include communication channels between devices. Based on nodes and edges, construct the network topology; By using preset defense loss function and preset defense cost function, defense analysis is performed on the network topology to obtain defense strategies; Based on the defense strategy, a pre-defined dynamic game defense model is constructed.

[0072] As an alternative implementation, the analysis module 403 can also be used for: Based on a preset defense loss function, the defense probability of each node is determined; The defense cost of each node is determined based on a preset defense cost function; For the network topology, obtain the optimal defense strategy, which includes the defense strategy with the lowest probability of defense and the lowest defense cost. Analysis module 403 can also be used for: Based on the optimal defense strategy, a pre-defined dynamic game defense model is constructed.

[0073] As an alternative implementation, the analysis module 403 can also be used for: Using a pre-defined dynamic game defense model, the defense loss and defense cost of the industrial network are calculated to obtain the real-time defense loss and real-time defense cost of the industrial network. The availability rate is obtained by weighted summation of defense losses and real-time defense costs.

[0074] As an alternative implementation, the encryption module 404 can also be used for: The data to be sent is processed recursively to generate byte nodes for different data to be sent. Perform feedback encryption on the byte nodes to generate a data sequence with feedback encryption; Each encrypted data sequence is retrieved and labeled using a hash algorithm to obtain the data to be stored, which is then stored in the database.

[0075] As an alternative implementation, when the feedback encryption is forward encryption, the encryption module 404 can also be used for: The data nodes that send different data are sequentially and recursively processed in a forward direction, and multi-source addition is performed with the corresponding byte nodes to generate a forward-feedback encrypted data sequence.

[0076] As an alternative implementation, when the feedback encryption is reverse encryption, the encryption module 404 can also be used for: The data nodes that send different data are recursively processed in reverse order, and multi-source addition is performed with the corresponding byte nodes to generate a reverse-feedback encrypted data sequence.

[0077] Figure 5 A schematic diagram of the hardware structure of the electronic device provided in an embodiment of this application is shown.

[0078] An electronic device may include a processor 501 and a memory 502 storing computer program instructions.

[0079] Specifically, the processor 501 may include a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0080] Memory 502 may include mass storage for data or instructions. For example, and not limitingly, memory 502 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. In one instance, memory 502 may include removable or non-removable (or fixed) media, or memory 502 may be non-volatile solid-state storage. Memory 502 may be internal or external to the integrated gateway disaster recovery device.

[0081] In one instance, memory 502 may be read-only memory (ROM). In one instance, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically rewritable ROM (EAROM), or flash memory, or a combination of two or more of these.

[0082] Memory 502 may include read-only memory (ROM), random access memory (RAM), disk storage media device, optical storage media device, flash memory device, electrical, optical, or other physical / tangible memory storage device. Therefore, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the data security protection method according to the first aspect of this disclosure.

[0083] The processor 501 reads and executes computer program instructions stored in the memory 502 to achieve... Figure 1 A data security protection method is shown in the embodiment.

[0084] In one example, the electronic device may also include a communication interface 503 and a bus 504. For example, Figure 5 As shown, the processor 501, memory 502, and communication interface 503 are connected through bus 504 and complete communication with each other.

[0085] The communication interface 503 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0086] Bus 504 includes hardware, software, or both, that couples components of an electronic device together. For example, and not as a limitation, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 504 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, this application contemplates any suitable bus or interconnect.

[0087] The electronic device can execute the data security protection method described in the embodiments of this application, thereby achieving a combination Figures 1-4 The data security protection methods and devices described herein.

[0088] Furthermore, in conjunction with the data security protection methods in the above embodiments, this application embodiment can provide a computer storage medium for implementation. This computer storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the data security protection methods in the above embodiments.

[0089] In an optional embodiment, in conjunction with the data security protection methods in the above embodiments, this application embodiment can provide a computer program product to implement the data security protection methods described above. The instructions in the computer program product are executed by the processor of the electronic device, enabling the electronic device to implement any of the data security protection methods described above.

[0090] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0091] The functional blocks shown in the above block diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0092] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0093] The aspects of this disclosure have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by special-purpose hardware performing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0094] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A data security protection method, characterized in that, include: In response to an access request from an industrial terminal device, the encoding information of the industrial terminal device is obtained, and the encoding information is generated based on the device information of the industrial terminal device. The encoded information is authenticated using a preset differential obfuscation mechanism to obtain the authentication result; If the authentication result is determined to be successful, the availability of the transmitted data sent by the industrial terminal device is analyzed using a preset dynamic game defense model to obtain the availability of the transmitted data. The availability is used to characterize the degree of defense of the industrial network against the transmitted data. If the availability meets the defense strategy conditions, the transmitted data is encrypted and stored in the database.

2. The method according to claim 1, characterized in that, The step of using a preset differential obfuscation mechanism to authenticate the encoded information and obtain the authentication result includes: The encoded information is processed to extract response fields, resulting in multiple response field information. The differential obfuscation mapping function is used to map each of the response field information to obtain the mapping value corresponding to each of the response field information; Based on the mapping value corresponding to each of the response field information, a differential confusion feature vector dataset is constructed. Calculate the first probability distribution of the multiple response field information and the second probability distribution of the differential confusion feature vector dataset, respectively; The differential confusion probability is obtained by weighted summation of the first probability distribution and the second probability distribution. Based on the differential confusion probability, each differential confusion feature vector in the differential confusion feature vector set is weighted to obtain a weighted differential confusion feature vector. The weighted differential obfuscation feature vector is matched with the preset authentication configuration dataset to obtain the matching result; Based on the matching results, the authentication result is determined.

3. The method according to claim 2, characterized in that, The preset authentication configuration dataset includes a real authentication configuration dataset and a fake authentication configuration dataset. The step of performing similarity matching between the weighted differential obfuscation feature vector and the preset authentication configuration dataset to obtain the matching result includes: Extract the real authentication configuration dataset and the fake authentication configuration dataset from the industrial network database; Based on a preset similarity algorithm, the first similarity between the weighted differential obfuscation feature vector and the real authentication configuration dataset, and the second similarity between the weighted differential obfuscation feature vector and the fake authentication configuration dataset are calculated respectively. The first similarity and the second similarity are compared to obtain the comparison result; If the comparison result determines that the first similarity is higher than the second similarity, the matching result is determined to be true for the encoded information.

4. The method according to any one of claims 1-3, characterized in that, The step of obtaining the encoding information of the industrial terminal device includes: Obtain the device information of the industrial terminal device, which includes device identity information, industrial type information, device connection network address information, device physical address information, and device configuration parameter information; The device identity information is serialized using a preset encoding model to obtain a layer of encoding. The industrial type information is type-encoded using a preset coding model to obtain a two-layer code; The device configuration parameter information is model-encoded using a preset coding model to obtain a three-layer code. The device's network address information and physical address information are location-encoded using a preset encoding model to obtain a four-layer encoding. The device configuration parameters are state-encoded using a preset coding model to obtain a five-layer code. The encoded information is generated based on the first-layer encoding, second-layer encoding, third-layer encoding, fourth-layer encoding, and fifth-layer encoding.

5. The method according to claim 1, characterized in that, Before performing availability analysis on the transmitted data sent by the industrial terminal equipment using a preset dynamic game defense model to obtain the availability of the transmitted data, the method further includes: Obtain each node of the industrial network and the edges connected to the nodes, wherein the nodes include communication devices and storage devices of the industrial network, and the edges include communication channels between devices; Based on the nodes and edges, construct the network topology; By using a preset defense loss function and a preset defense cost function, a defense analysis is performed on the network topology to obtain a defense strategy; Based on the aforementioned defense strategy, a preset dynamic game defense model is constructed.

6. The method according to claim 5, characterized in that, Before constructing the preset dynamic game defense model based on the defense strategy, the method further includes: Based on a preset defense loss function, the defense probability of each node is determined; The defense cost of each node is determined based on a preset defense cost function; For the given network topology, obtain the optimal defense strategy, which includes the defense strategy with the lowest defense probability and the lowest defense cost; The construction of a preset dynamic game defense model based on the defense strategy includes: Based on the optimal defense strategy, a preset dynamic game defense model is constructed.

7. The method according to claim 6, characterized in that, The step of using a preset dynamic game defense model to analyze the availability of the transmitted data sent by the industrial terminal equipment to obtain the availability of the transmitted data includes: Using a preset dynamic game defense model, the defense loss and defense cost of the industrial network are calculated to obtain the real-time defense loss and real-time defense cost of the industrial network. The availability rate is obtained by weighted summation of the defense loss and the real-time defense cost.

8. The method according to claim 1, characterized in that, The step of encrypting the transmitted data for storage in the database includes: The transmitted data is recursively processed to generate byte nodes for different transmitted data. The byte node is subjected to feedback encryption to generate a data sequence after feedback encryption; Each encrypted data sequence of the feedback is retrieved and labeled based on a hash algorithm to obtain the data to be stored, and the data to be stored is stored in the database.

9. The method according to claim 8, characterized in that, When the feedback encryption is forward encryption, the step of performing feedback encryption on the byte node to generate the encrypted data sequence includes: The data nodes that send different data are sequentially and recursively processed in a forward direction, and multi-source addition is performed with the corresponding byte nodes to generate a forward-feedback encrypted data sequence.

10. The method according to claim 8 or 9, characterized in that, In the case where the feedback encryption is reverse encryption, the step of performing feedback encryption on the byte node to generate the encrypted data sequence includes: The data nodes that send different data are recursively processed in reverse order, and multi-source addition is performed with the corresponding byte nodes to generate a reverse-feedback encrypted data sequence.

11. A data security protection device, characterized in that, The device includes: The acquisition module is used to acquire the encoding information of the industrial terminal device in response to the access request of the industrial terminal device, wherein the encoding information is generated based on the device information of the industrial terminal device. The authentication module is used to perform identity authentication on the encoded information using a preset differential obfuscation mechanism to obtain an authentication result; The analysis module is used to perform availability analysis on the data sent by the industrial terminal device using a preset dynamic game defense model when the authentication result is determined to be successful, and to obtain the availability of the data sent. The availability is used to characterize the degree of defense of the industrial network against the data sent. An encryption module is used to encrypt the transmitted data and store it in a database when the availability meets the defense strategy conditions.

12. An electronic device, characterized in that, The device includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, it implements the data security protection method as described in any one of claims 1-10.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the data security protection method as described in any one of claims 1-10.

14. A computer program product, characterized in that, When the instructions in the computer program product are executed by the processor of the electronic device, the electronic device performs the data security protection method as described in any one of claims 1-10.

Images