Data transmission system, method and device based on trusted hardware
By attaching a trusted hardware data transmission device to traditional industrial control equipment and using random keys to encrypt communication, the problem of insufficient security of traditional industrial control equipment in network interconnection is solved, achieving efficient and secure data transmission and avoiding equipment stability risks.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- XIONGAN ANSUAN TECHNOLOGY CO LTD
- Filing Date
- 2026-02-27
- Publication Date
- 2026-04-21
AI Technical Summary
Traditional industrial control equipment lacks network security protection mechanisms in network interconnection scenarios, making it vulnerable to network attacks and leading to serious consequences such as production process interruption and data leakage. Furthermore, upgrades and modifications may affect equipment stability.
A data pass-through device based on trusted hardware is used and installed on industrial control equipment as an external device. It uses randomly generated keys for encrypted communication to achieve authentication and data transmission, avoiding modifications to the original equipment hardware.
Without altering the hardware and software of industrial control equipment, it provides high-strength encrypted communication protection, effectively resisting the risks of eavesdropping and tampering, reducing modification costs and technical barriers, and ensuring equipment stability and security.
Smart Images
Figure CN121907459A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of data communication technology, and in particular to a data transmission system, method and apparatus based on trusted hardware. Background Technology
[0002] Industrial control systems, as the core support system for industrial production, are the foundation for ensuring the stable operation of key industries such as manufacturing, energy, and transportation. Industrial control equipment at the field control layer, as the core execution unit of industrial production, directly determines the real-time performance, continuity, and reliability of industrial production. For a long time, traditional industrial control systems have generally adopted physically isolated or restricted network deployment modes to ensure the stability of production processes. Under this mode, the design focus of industrial control equipment is highly concentrated on real-time control performance, long-term operational reliability, and the implementation of dedicated production functions. Their hardware architecture and software systems are not adapted to network interconnection scenarios, generally lacking standardized network communication interfaces and protocol support capabilities, and lacking built-in basic network security protection mechanisms such as identity authentication, communication encryption, and intrusion detection.
[0003] In recent years, with the widespread adoption of Industrial Internet technology and the accelerated advancement of industrial digital transformation, traditional industrial control systems are facing a fundamental transformation from a closed and isolated architecture to an open and interconnected one. To achieve end-to-end data flow in production, convenient remote operation and maintenance management, and optimized allocation of production resources, a large number of existing traditional industrial control devices are gradually breaking down their original physical isolation boundaries by adding communication modules and connecting to industrial Ethernet, thus achieving interconnection with enterprise management networks and even the public Internet. This transformation has greatly improved the flexibility of industrial production, operational management efficiency, and resource allocation optimization capabilities, becoming a core driving force for the digital and intelligent development of industry.
[0004] However, there is a serious mismatch between the cybersecurity protection capabilities of traditional industrial control equipment and the application scenarios of open interconnection. This has led to increasingly prominent cybersecurity risks, posing a severe challenge to the safe and stable operation of industrial production. On the one hand, most existing traditional industrial control equipment is designed based on early industrial control needs, with limited hardware resources and rigid software architectures. It lacks the hardware foundation and software interfaces to support security functions such as identity authentication, data encryption, and access control, making it impossible to supplement core security capabilities through simple software upgrades. On the other hand, once these devices are connected to open networks, they are completely exposed to diverse network threats such as network scanning, malicious intrusion, command tampering, and data theft. Due to the lack of effective security protection mechanisms, they are highly susceptible to becoming entry points for cyberattacks. Once attacked, this could lead to abnormal equipment shutdowns, production process interruptions, leakage of critical production data, and even more serious consequences such as equipment damage and safety accidents. This would not only cause huge economic losses to enterprises but also potentially affect the stable operation of critical infrastructure, posing a potential threat to national industrial security and public interests.
[0005] Against this backdrop, upgrading and transforming the massive stock of traditional industrial control equipment to ensure its security and controllability in open interconnected scenarios while maintaining its original real-time control performance and production functions has become a critical issue urgently needing to be addressed in the field of industrial internet security. This security upgrade requirement is both significantly urgent in the present context, directly addressing the security risks brought about by the networking of traditional industrial control equipment and ensuring the continuity and stability of industrial production; and of great strategic necessity, being of great significance for strengthening the cybersecurity protection capabilities of critical infrastructure, enhancing the overall resilience of the national industrial system, and promoting the sustainable development of industrial internet security and industrial integration. Therefore, developing a security upgrade solution that is adapted to the characteristics of traditional industrial control equipment, low-cost, easy to deploy, and does not affect the original production functions has become a research focus for those skilled in the art and an inevitable requirement for industry development. Summary of the Invention
[0006] This application provides a data transmission system, method, and apparatus based on trusted hardware, which can effectively resist the risks of eavesdropping and tampering and improve the security of data transmission without modifying the original industrial control equipment software and hardware.
[0007] The technical solution provided in this application includes: In a first aspect, embodiments of this application provide a data transmission system based on trusted hardware. This data transmission system includes at least one pair of data pass-through devices, each pair of data pass-through devices being interconnected, and each data pass-through device being externally mounted on its corresponding industrial control equipment. Any data pass-through device is used for: When it is determined that data communication is required, a first key and a second key are randomly generated, and the public key of the first key is sent to the data pass-through device connected to the data pass-through device so that the corresponding data pass-through device stores the public key; The first key is used to encrypt the second key to generate an encryption key, and the encryption key is sent to the data pass-through device connected to the data pass-through device. The corresponding data pass-through device uses the public key to authenticate the received encryption key. After successful authentication, a communication link is established with the data pass-through device so that each industrial control device can transmit data and store it accordingly through the established communication link.
[0008] In one embodiment of this application, each data transmission device is further provided with a random number generator, which is triggered to randomly generate a first key and a second key when it is determined that data communication is required.
[0009] In one embodiment of this application, each data transmission device is further provided with a reset button indicating that data transmission needs to be started. When the reset button is pressed, the random number generator is triggered to randomly generate a first key and a second key.
[0010] In one embodiment of this application, when the first industrial control device needs to interact with the second industrial control device, the data pass-through device connected to the first industrial control device is used to receive the transmission data sent by the first industrial control device, perform packetization and data alignment processing on the transmission data, encrypt the processed transmission data with a second key to form ciphertext, and transmit the ciphertext to the data pass-through device connected to the second industrial control device through the established communication link; The data transmission device connected to the second industrial control device is used to decrypt the ciphertext after receiving it, using the encryption key received during authentication to restore it to plaintext, and to perform inverse operations of packet segmentation and data alignment on the plaintext to obtain the restored original data. The original data is then transmitted to the second industrial control device through a physical communication link, thus completing a data transmission from the first industrial control device to the second industrial control device.
[0011] In one embodiment of this application, the first key is an SM2 key and the second key is an SM4 key; The step of encrypting the second key using the first key to generate an encryption key includes: The SM4 key is encrypted using the SM2 algorithm to generate an encryption key; The corresponding data pass-through device uses the public key to authenticate the received encryption key, including: The corresponding data pass-through device uses the public key of SM2 to decrypt the SM4 key, which is encrypted by SM2 algorithm, in order to achieve identity verification.
[0012] In one embodiment of this application, encrypting the processed transmitted data using a second key to form ciphertext includes: The processed transmitted data is encrypted using the SM4 encryption algorithm to form ciphertext; The step of decrypting the ciphertext using the encryption key received during authentication to restore it to plaintext includes: Use the SM4 key received during authentication to decrypt the ciphertext and restore it to plaintext.
[0013] In one embodiment of this application, each data transmission device is further provided with a power management unit, which includes an AC220V to 12V power adapter and multiple high-voltage to low-voltage conversion modules.
[0014] Secondly, embodiments of this application also provide a data transmission method based on trusted hardware. This data transmission method is applied to any data transparent transmission device in the data transmission system described in any embodiment of the first aspect. The data transparent transmission method includes: When it is determined that data communication is required, a first key and a second key are randomly generated, and the public key of the first key is sent to the data pass-through device connected to the data pass-through device so that the corresponding data pass-through device stores the public key; The first key is used to encrypt the second key to generate an encryption key, and the encryption key is sent to the data pass-through device connected to the data pass-through device. The corresponding data pass-through device uses the public key to authenticate the received encryption key. After successful authentication, a communication link is established with the data pass-through device so that each industrial control device can transmit data and store it accordingly through the established communication link.
[0015] Thirdly, embodiments of this application also provide a data transmission method based on trusted hardware, which further includes, before the random generation of the first key and the second key: Receive connection requests sent by data pass-through devices connected to the data pass-through device; Based on the connection request, determine whether to agree to the connection request. If agreed, execute the step of randomly generating the first key and the second key. Otherwise, send a rejection request to the corresponding data pass-through device, so that the corresponding data pass-through device stops sending connection requests after the number of rejection requests received and / or the number of times no response is received to the connection request reaches a threshold.
[0016] Fourthly, embodiments of this application also provide a data transmission device based on trusted hardware, characterized in that the data transmission device is applied to any data pass-through device in the data transmission system described in any embodiment of the first aspect, the data pass-through device comprising: A public key sending unit is used to randomly generate a first key and a second key when it is determined that data communication is required, and send the public key of the first key to the data pass-through device connected to the data pass-through device, so that the corresponding data pass-through device stores the public key; The key encryption unit is used to encrypt the second key using the first key to generate an encryption key, and send the encryption key to the data pass-through device connected to the data pass-through device, so that the corresponding data pass-through device uses the public key to authenticate the received encryption key. After successful authentication, a communication link is established with the data pass-through device so that each industrial control device can transmit data and store it accordingly through the established communication link.
[0017] As can be seen from the above technical solutions, this application provides a data transmission system, method, and apparatus based on trusted hardware. The data transmission system includes at least one pair of data pass-through devices, each pair being interconnected. Each data pass-through device is externally mounted on its corresponding industrial control equipment. Each data pass-through device is used to: randomly generate a first key and a second key when data communication is required, and send the public key of the first key to the data pass-through device connected to it, so that the corresponding data pass-through device stores the public key; encrypt the second key using the first key to generate an encryption key, and send the encryption key to the data pass-through device connected to it, so that the corresponding data pass-through device uses the public key to authenticate the received encryption key; after successful authentication, establish a communication link with the data pass-through device, so that each industrial control equipment can transmit and store data through the established communication link. As can be seen, the technical solution provided in this application does not require any modification to the existing industrial control equipment's hardware or software. Each data transmission device can be installed in its corresponding industrial control equipment in a non-intrusive "plug-in" manner, providing high-strength, encrypted communication protection for older equipment that previously lacked security capabilities. This completely avoids the risks to equipment stability and reliability that may arise from upgrades and modifications, making it the safest and most feasible path for upgrading existing equipment. Based on this, applying the embodiments provided in this application can effectively resist the risks of eavesdropping and tampering, and improve the security of data transmission without modifying the existing industrial control equipment's hardware or software. Attached Figure Description
[0018] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure.
[0019] Figure 1 A schematic diagram of a data transmission system based on trusted hardware provided in this application; Figure 2 A schematic diagram of a data transmission method based on trusted hardware provided in this application; Figure 3 A flowchart illustrating a data transmission method based on trusted hardware provided in this application; Figure 4 This application provides a schematic diagram of the structure of a data pass-through device; Figure 5 A schematic diagram of a data transmission device based on trusted hardware provided in this application; Figure 6 This is a schematic diagram of the structure of an electronic device provided in this application. Detailed Implementation
[0020] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the invention as detailed in the appended claims.
[0021] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The singular forms “a,” “the,” and “the” used in this invention and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.
[0022] It should be understood that although the terms first, second, third, etc., may be used in this invention to describe various information, this information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first information may also be referred to as second information without departing from the scope of this invention, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to a determination."
[0023] Firstly, see [the following] Figure 1 , Figure 1The present application provides a schematic diagram of a data transmission system based on trusted hardware. The data transmission system includes at least one pair of data pass-through devices, each pair of data pass-through devices is interconnected, and each data pass-through device is installed on its corresponding industrial control equipment in an external manner.
[0024] In this embodiment, the data transmission system includes at least one pair of data pass-through devices. That is, the data transmission system may include one pair of data pass-through devices, or it may represent multiple pairs of data pass-through devices. The data pass-through devices appear in pairs. One data pass-through device can be paired with at least one data pass-through device. This embodiment is not limited in this respect. For example, data pass-through device A, data pass-through device B, and data pass-through device C. Data pass-through device A can be paired with both data pass-through device B and data pass-through device C. That is, data pass-through device A can be connected to data pass-through device B and data pass-through device C via Ethernet.
[0025] The industrial control equipment and data pass-through device in this application are also paired and connected. Each data pass-through device is physically installed on the corresponding industrial control equipment in a non-intrusive external manner. The installation of the data pass-through device does not change the original physical structure of the industrial control equipment. Specifically, for two traditional industrial control devices, there is no inherent security mechanism. Taking RS485 communication as an example, industrial control equipment A establishes a physical communication link with data pass-through device A through an RS485 communication module. Similarly, industrial control equipment B establishes a physical communication link with data pass-through device B through an RS485 communication module. Data pass-through devices A and B can uniformly use Ethernet communication. In this embodiment, the data pass-through device interfaces with the traditional industrial control equipment through an external physical connection in a "non-intrusive" security empowerment mode, without modifying its original hardware or software.
[0026] Based on the above embodiments, any data pass-through device is used to achieve the following functions: When it is determined that data communication is required, a first key and a second key are randomly generated, and the public key of the first key is sent to the data pass-through device connected to the data pass-through device so that the corresponding data pass-through device stores the public key; The first key is used to encrypt the second key to generate an encryption key, and the encryption key is sent to the data pass-through device connected to the data pass-through device. The corresponding data pass-through device uses the public key to authenticate the received encryption key. After successful authentication, a communication link is established with the data pass-through device so that each industrial control device can transmit data and store it accordingly through the established communication link.
[0027] In this embodiment, the first key and the second key are randomly generated. This means that before the keys are generated, they are kept secret and unknown to any user, including the programmer who manufactured the data pass-through device. Therefore, the public key of the first key sent by the data pass-through device to other data pass-through devices connected to it is kept secret. The first key includes a public key and a private key.
[0028] The first key is randomly generated, meaning that its public and private keys are unknown beforehand. The data pass-through device sends the public key of this first key to other data pass-through devices connected to it, which then save and manage it upon receipt. In practical applications, each data pass-through device can be equipped with a key management module for storing and managing keys.
[0029] As one embodiment, each data pass-through device is also equipped with a random number generator, which is triggered to randomly generate a first key and a second key when data communication is required. In this embodiment, the data pass-through device can be triggered by an external physical means to determine that data communication is required with a connected and specified data pass-through device. After the button is pressed, the random number generator is immediately triggered to generate the first key and the second key. Alternatively, it can communicate with an external control center to trigger the random number generator to generate the first key and the second key by receiving communication commands sent by the control center; this embodiment is not limited to this. Triggering the random number generator can improve the response speed of the data pass-through device and complete a rapid connection with the data pass-through device. Based on this, as another embodiment, each data pass-through device is also equipped with a reset button indicating that data transmission needs to be started. When the reset button is pressed, the random number generator is triggered to randomly generate the first key and the second key. This embodiment uses the pressing of the reset button to trigger the random number generator to generate the first key and the second key, realizing the issuance and response of data communication commands in a simple and fast manner.
[0030] The first key is used to encrypt the second key to generate an encryption key. Because the first and second keys are randomly generated, this encryption key also possesses extremely high confidentiality and security. This encryption key is then sent to the data pass-through device connected to the data pass-through device. Upon receiving the encryption key, the data pass-through device decrypts it using the public key of the existing first key to complete identity verification. If authentication is successful, the data pass-through device transmitting the encryption key is considered trustworthy, and a communication link is established with the data pass-through device, enabling data transmission. If authentication fails, a rejection request is sent to the data pass-through device.
[0031] Once the data transmission devices complete identity verification, bidirectional data transmission can be achieved. The technical solution provided in this application is a universal and modular security transformation solution. It greatly reduces the technical threshold and cost of industrial internet transformation, enabling massive amounts of existing equipment to quickly and smoothly transition to a secure and controllable networked state, and accelerating the large-scale secure deployment of the industrial internet.
[0032] As can be seen, this embodiment is based on proactive security protection using trusted hardware: the data pass-through device can uniquely authenticate the identity of the requesting data pass-through device and encrypt the transmitted data after successful authentication, thus establishing the foundation for device identity uniqueness and secure key storage from the source. This not only changes the situation where traditional industrial control equipment passively relies on network protection, but also enables proactive encryption and identity verification at the starting point of data generation and transmission, significantly improving the level of protection and anti-attack capabilities.
[0033] In some embodiments, when the first industrial control device needs to interact with the second industrial control device, the data pass-through device connected to the first industrial control device is used to receive the transmission data sent by the first industrial control device, perform packetization and data alignment processing on the transmission data, encrypt the processed transmission data with a second key to form ciphertext, and transmit the ciphertext to the data pass-through device connected to the second industrial control device through the established communication link. The data transmission device connected to the second industrial control device is used to decrypt the ciphertext after receiving it, using the encryption key received during authentication to restore it to plaintext, and to perform inverse operations of packet segmentation and data alignment on the plaintext to obtain the restored original data. The original data is then transmitted to the second industrial control device through a physical communication link, thus completing a data transmission from the first industrial control device to the second industrial control device.
[0034] In this embodiment, the first industrial control device and the second industrial control device are each equipped with their respective data pass-through devices via external connection. When the data pass-through devices need to perform RS485 communication to complete data exchange, the first industrial control device sends transmission data to the externally connected data pass-through device. The data pass-through device performs packetization and data alignment processing on the received transmission data, then encrypts the processed transmission data into ciphertext using a second key, and transmits the ciphertext to the other data pass-through device with which communication has been established via Ethernet. Upon receiving the ciphertext, the other data pass-through device decrypts it using the encryption key received during authentication, restoring it to plaintext. It then performs the inverse operation of packetization and data alignment to further restore the plaintext to the original data, and transmits the data to the second industrial control device through the physical communication link between the other data pass-through device and the externally connected second industrial control device. This completes one data pass-through operation between the first and second industrial control devices.
[0035] In other embodiments, the first key is an SM2 key and the second key is an SM4 key; the implementation of encrypting the second key with the first key to generate an encryption key may include: encrypting the SM4 key with the SM2 algorithm to generate an encryption key; The implementation method of the above-mentioned data pass-through device using the public key to authenticate the received encryption key may include: the corresponding data pass-through device using the public key of SM2 to decrypt the SM4 key encrypted by SM2 algorithm to achieve authentication.
[0036] The data pass-through device also includes an SM4 encryption module and an SM4 decryption module. The SM4 encryption module is used to encrypt the transmitted data, and the SM4 decryption module is used to decrypt the encrypted transmitted data. In this embodiment, an SM2 key and an SM4 key can be randomly generated using a random number generator, and the generated keys are stored and managed by the key management module built into the data pass-through device. The public key and encryption key of the received SM2 key can also be stored and managed. During the authentication process, the SM2 national cryptographic algorithm can be used to decrypt the encrypted SM4 key to achieve identity verification between the two data pass-through devices.
[0037] In other embodiments, the above-described method of encrypting the processed transmitted data with the second key to form ciphertext may include: encrypting the processed transmitted data with the SM4 encryption algorithm to form ciphertext; Based on the above embodiments, the implementation method of decrypting the ciphertext and restoring it to plaintext using the encryption key received during authentication may include: decrypting the ciphertext and restoring it to plaintext using the SM4 key received during authentication.
[0038] In this embodiment, the data pass-through device uses the SM4 encryption algorithm to encrypt transmitted data to form ciphertext. Since the SM4 key is randomly generated, the ciphertext encrypted using the SM4 algorithm also possesses high randomness and security. The data pass-through device, connected to the data pass-through device via Ethernet, uses the stored encryption key to decrypt the ciphertext and restore it to plaintext. Therefore, this design decouples security functions from production operations. While providing high-strength national standard (SM4) encrypted communication protection for old equipment with zero security capabilities, it completely avoids the risks to equipment stability and reliability that may arise from upgrades and modifications, making it the safest and most feasible path for upgrading existing equipment.
[0039] In some embodiments, each data transmission device further includes a power management unit, which includes an AC220V to 12V power adapter and multiple high-voltage to low-voltage conversion modules. In this embodiment, the multiple high-voltage to low-voltage conversion modules may be 12V to 5V and 5V to 3.3V DC-DC modules.
[0040] In some embodiments, any data transmission device may also be configured with multiple communication interfaces for different transmissions, including at least one of RS485, CAN, and Ethernet. This allows for adaptation to traditional industrial control equipment with different interfaces through configurable communication modules, forming a "universal" security upgrade solution. This modular design enables flexible and rapid deployment in diverse industrial sites, significantly reducing the technical complexity and large-scale application costs of networking old equipment, and powerfully promoting the implementation and popularization of industrial internet security.
[0041] Therefore, in the technical solution provided in this application embodiment, the data transmission system includes at least one pair of data pass-through devices. Each pair of data pass-through devices is interconnected, and each data pass-through device is installed externally on its corresponding industrial control equipment. Each data pass-through device is used to: randomly generate a first key and a second key when it is determined that data communication is required, and send the public key of the first key to the data pass-through device connected to it, so that the corresponding data pass-through device stores the public key; encrypt the second key using the first key to generate an encryption key, and send the encryption key to the data pass-through device connected to it, so that the corresponding data pass-through device uses the public key to authenticate the received encryption key; after successful authentication, establish a communication link with the data pass-through device, so that each industrial control equipment can transmit data and store it accordingly through the established communication link. As can be seen, the technical solution provided in this application embodiment does not require any modification to the original industrial control equipment's hardware or software. It allows for non-intrusive "plug-in" installation of various data transmission devices into their respective industrial control equipment, providing high-strength, encrypted communication protection for older equipment that previously lacked security capabilities. This completely avoids the risks to equipment stability and reliability that may arise from upgrades and modifications, making it the safest and most feasible path for upgrading existing equipment. Based on this, applying the embodiments provided in this application can effectively resist the risks of eavesdropping and tampering, and improve the security of data transmission without modifying the original industrial control equipment's hardware or software.
[0042] To more clearly illustrate the working principle of a data transmission system based on trusted hardware, an example is given below: Figure 2 As shown, this example involves two traditional industrial control devices, denoted as Industrial Control Device A and Industrial Control Device B. These devices lack built-in security mechanisms. Using RS485 communication as an example, Industrial Control Device A establishes a physical communication link with Data Transmission Device A via an external RS485 communication module. Similarly, Industrial Control Device B establishes a physical communication link with Data Transmission Device B via an external RS485 communication module. Data Transmission Devices A and B communicate using Ethernet. In this example, Data Transmission Devices A and B establish physical communication links by selecting the appropriate communication mode for the traditional industrial control devices, thus enabling data transmission between them. The specific implementation is as follows: Data pass-through device A and data pass-through device B establish a physical communication link via an Ethernet cable. Both are connected to an AC220V power adapter. After power-on, authentication can be performed via a reset button. Specifically, when data pass-through device A presses the reset button, it immediately generates a connection request and sends it to data pass-through device B. If no response is received within a set time period (i.e., no response), the device continues to send the connection request to data pass-through device B. If no response is received three times within each set time period, a connection failure message is sent to industrial control device A. If a response is received, a random number generator randomly generates an SM2 key and an SM4 key. The SM2 key includes a public key and a private key. Data pass-through device A sends the SM2 public key to data pass-through device B. Data pass-through device B receives the key and stores and manages it in its key management module. Data pass-through device A sends an SM4 key, which is encrypted using the SM2 algorithm based on the SM2 key, to data pass-through device B. After receiving the SM4 key encrypted using the SM2 algorithm, data pass-through device B decrypts the SM4 key using the public key sent by data pass-through device A that has been saved, and stores the SM4 key in the key management module. Thus, data pass-through device A and data pass-through device B complete identity authentication and establish a communication connection between data pass-through device A and data pass-through device B.
[0043] Once data pass-through devices A and B have completed mutual authentication, they can achieve bidirectional data transmission. When industrial control devices A and B need to perform RS485 communication to exchange data, data pass-through device A first receives the data transmitted from industrial control device B. Data pass-through device A performs packet segmentation and data alignment processing on the received data, then encrypts the processed data using the SM4 encryption algorithm to form ciphertext, and transmits the ciphertext to data pass-through device B via Ethernet. Upon receiving the ciphertext, data pass-through device B uses the SM4 key received during authentication to decrypt the ciphertext back to plaintext. It then performs the inverse operation of packet segmentation and data alignment to further restore the plaintext to the original data, and transmits the data to industrial control device B through the physical communication link between data pass-through device B and industrial control device B. This completes one data pass-through operation between industrial control devices A and B. The corresponding principle is as follows: Data pass-through device B first receives data transmitted from industrial control device B. Data pass-through device B performs packet segmentation and data alignment processing on the received data, then encrypts the processed data using the SM4 encryption algorithm to form ciphertext, which is then transmitted to data pass-through device A via Ethernet. Upon receiving the ciphertext, data pass-through device A decrypts it using the SM4 key received during authentication, restoring it to plaintext. It then performs the inverse operation of packet segmentation and data alignment to further restore the plaintext to the original data, and transmits the data to industrial control device A through the physical communication link between data pass-through device A and industrial control device A. This completes one data pass-through operation between industrial control devices B and A. This solution is a universal and modular security transformation solution. It significantly reduces the technical threshold and cost of industrial internet transformation, enabling a massive number of existing devices to quickly and smoothly transition to a secure and controllable networked state, accelerating the large-scale secure deployment of the industrial internet.
[0044] Secondly, Figure 3 This application also provides a flowchart illustrating a data transmission method based on trusted hardware. This data transmission method is applied to any data pass-through device in the data transmission system described in any embodiment of the first aspect. The data pass-through method includes the following steps: Step 201: When it is determined that data communication is required, a first key and a second key are randomly generated; Step 202: Send the public key of the first key to the data pass-through device connected to the data pass-through device, so that the corresponding data pass-through device stores the public key; Step 203: Encrypt the second key using the first key to generate an encryption key; Step 204: Send the encryption key to the data pass-through device connected to the data pass-through device, so that the corresponding data pass-through device uses the public key to authenticate the received encryption key. After successful authentication, establish a communication link with the data pass-through device so that each industrial control device can transmit data and store it accordingly through the established communication link.
[0045] As one embodiment, before the random generation of the first key and the second key, the method further includes: Receive connection requests sent by data pass-through devices connected to the data pass-through device; Based on the connection request, determine whether to agree to the connection request. If agreed, execute the step of randomly generating the first key and the second key. Otherwise, send a rejection request to the corresponding data pass-through device, so that the corresponding data pass-through device stops sending connection requests after the number of rejection requests received and / or the number of times no response is received to the connection request reaches a threshold.
[0046] As an example, each data pass-through device is also equipped with a random number generator, which is triggered to randomly generate a first key and a second key when it is determined that data communication is required.
[0047] As an example, each data pass-through device is also equipped with a reset button indicating that data transmission needs to be started. When the reset button is pressed, the random number generator is triggered to randomly generate a first key and a second key.
[0048] As an example, when the first industrial control device needs to interact with the second industrial control device, the data pass-through device connected to the first industrial control device is used to receive the transmission data sent by the first industrial control device, perform packetization and data alignment processing on the transmission data, encrypt the processed transmission data with a second key to form ciphertext, and transmit the ciphertext to the data pass-through device connected to the second industrial control device through the established communication link. The data transmission device connected to the second industrial control device is used to decrypt the ciphertext after receiving it, using the encryption key received during authentication to restore it to plaintext, and to perform inverse operations of packet segmentation and data alignment on the plaintext to obtain the restored original data. The original data is then transmitted to the second industrial control device through a physical communication link, thus completing a data transmission from the first industrial control device to the second industrial control device.
[0049] As an example, the first key is an SM2 key, and the second key is an SM4 key; The step of encrypting the second key using the first key to generate an encryption key includes: The SM4 key is encrypted using the SM2 algorithm to generate an encryption key; The corresponding data pass-through device uses the public key to authenticate the received encryption key, including: The corresponding data pass-through device uses the public key of SM2 to decrypt the SM4 key, which is encrypted by SM2 algorithm, in order to achieve identity verification.
[0050] As one embodiment, the step of encrypting the processed transmitted data using a second key to form ciphertext includes: The processed transmitted data is encrypted using the SM4 encryption algorithm to form ciphertext; The step of decrypting the ciphertext using the encryption key received during authentication to restore it to plaintext includes: Use the SM4 key received during authentication to decrypt the ciphertext and restore it to plaintext.
[0051] As an example, each data transmission device is also equipped with a power management unit, which includes an AC220V to 12V power adapter and multiple high-voltage to low-voltage conversion modules.
[0052] Therefore, in the technical solution provided by this application embodiment, when data communication is required, the data transmission method randomly generates a first key and a second key, and sends the public key of the first key to the data pass-through device connected to it, so that the corresponding data pass-through device stores the public key; the second key is encrypted using the first key to generate an encryption key, and the encryption key is sent to the data pass-through device connected to it, so that the corresponding data pass-through device uses the public key to authenticate the received encryption key. After successful authentication, a communication link is established with the data pass-through device, so that each industrial control device can transmit and store data through the established communication link. Thus, in the technical solution provided by this application embodiment, no modifications to the original industrial control equipment's hardware or software are required. Each data pass-through device can be installed in its corresponding industrial control equipment in a non-intrusive "plug-in" manner, providing high-strength, encrypted communication protection for old equipment that originally lacked security capabilities. This completely avoids the risks to equipment stability and reliability that may arise from upgrades and modifications, making it the safest and most feasible path for upgrading existing equipment. Based on this, the embodiments provided in this application can effectively resist the risks of eavesdropping and tampering and improve the security of data transmission without modifying the original industrial control equipment software and hardware.
[0053] Thirdly, Figure 4This application also provides a schematic diagram of a data pass-through device, which further includes a controller, an identity authentication unit, a secure data unit, a communication unit, and a power management unit.
[0054] The identity authentication unit, security data unit, communication unit, and power management unit are all electrically connected to the controller. In this embodiment, the controller is the core unit of the entire device, responsible for data processing, process management, and data transmission. The controller includes a clock module, a reset module, and a communication mode selection. Communication units include, but are not limited to, RS485 communication modules, CAN communication modules, and Ethernet communication modules. Power management units include, but are not limited to, AC220V to 12V modules (corresponding power adapters), 12V to 5V modules, and 12V to 3.3V modules. The authentication unit includes a random number generator, an authentication module, and a key management module. The secure data unit includes a data processing module, an SM4 encryption module, and an SM4 decryption module. In practical applications, the controller displays various communication modules to the user for selection. After the user selects a corresponding communication module, the selected module is used for connection. This allows the user to establish a physical communication link with traditional industrial control equipment by selecting different communication modules. For example, when connecting to industrial control equipment, the communication mode selection allows choosing the same communication method as the traditional industrial control equipment to establish a physical communication link. The controller also controls the power management unit to provide users with various power supply options for selection or matching. The controller's clock module provides a communication clock reference, the reset module establishes authentication between a pair of data pass-through devices, and the random generator randomly generates first and second keys, such as SM2 and SM4 keys. The data processing module handles data packetization after transmission to the data pass-through device. The SM4 encryption module encrypts transmitted data using the SM4 encryption algorithm to form ciphertext, and the SM4 decryption module decrypts the ciphertext to form plaintext. In practical applications, the authentication unit randomly generates SM2 and SM4 keys using a random number generator and stores and manages these keys through the key management module. The authentication unit uses the SM2 national cryptographic algorithm to achieve authentication between the two data pass-through devices. The secure data unit handles packetization and data alignment of data transmitted from traditional industrial control equipment or repackages encrypted data. The communication unit establishes a physical communication link with traditional industrial control equipment or enables communication between the two data pass-through devices via Ethernet. In practical applications, after data is transmitted to the data pass-through device, it is packetized, encrypted with SM4, and then transmitted securely via Ethernet. The receiving end receives the encrypted data, and the SM4 decryption module restores the data to its original form before transmitting it to the corresponding industrial control equipment or server via the appropriate physical communication link. Thus, this pass-through device, in a non-intrusive "add-on" manner, provides high-strength, SM4-encrypted communication security for older, previously insecure devices. Without altering the existing industrial control equipment's hardware and software, it significantly improves the confidentiality and integrity of data during network communication, effectively resisting the risks of eavesdropping and tampering.
[0055] As can be seen, this data transmission device adapts to traditional devices with different interfaces through configurable communication modules (such as RS485, CAN, Ethernet, etc.), forming a "universal" security upgrade solution. This modular design enables flexible and rapid deployment in diverse industrial sites, significantly reducing the technical complexity and large-scale application cost of networking old equipment, and powerfully promoting the implementation and popularization of industrial internet security.
[0056] Fourthly, Figure 5 This application provides a schematic diagram of a trusted hardware-based data transmission device 300, which is applied to any data pass-through device in the data transmission system described in any embodiment of the first aspect. The data transmission device 300 includes: The public key sending unit 301 is used to randomly generate a first key and a second key when it is determined that data communication is required, and send the public key of the first key to the data pass-through device connected to the data pass-through device so that the corresponding data pass-through device stores the public key; The key encryption unit 302 is used to encrypt the second key using the first key to generate an encryption key, and send the encryption key to the data pass-through device connected to the data pass-through device, so that the corresponding data pass-through device uses the public key to authenticate the received encryption key. After successful authentication, a communication link is established with the data pass-through device so that each industrial control device can transmit data and store it accordingly through the established communication link.
[0057] Therefore, in the technical solution provided by this application embodiment, when the data transmission device determines that data communication is required, it randomly generates a first key and a second key, and sends the public key of the first key to the data pass-through device connected to it, so that the corresponding data pass-through device stores the public key; it uses the first key to encrypt the second key to generate an encryption key, and sends the encryption key to the data pass-through device connected to it, so that the corresponding data pass-through device uses the public key to authenticate the received encryption key. After successful authentication, a communication link is established with the data pass-through device, so that each industrial control device can transmit data and store it accordingly through the established communication link. It is evident that in the technical solution provided by this application embodiment, no modifications to the original industrial control equipment's hardware or software are required. Each data pass-through device can be installed in its corresponding industrial control equipment in a non-intrusive "plug-in" manner, providing high-strength, encrypted communication protection for old equipment that originally lacked security capabilities. This completely avoids the equipment stability and reliability risks that may arise from upgrades and modifications, making it the safest and most feasible path for upgrading existing equipment. Based on this, the embodiments provided in this application can effectively resist the risks of eavesdropping and tampering and improve the security of data transmission without modifying the original industrial control equipment software and hardware.
[0058] The specific implementation process of the functions and roles of each unit in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.
[0059] This application also provides an electronic device. From a hardware perspective, a hardware architecture diagram can be found in [reference needed]. Figure 6 As shown, it includes: a machine-readable storage medium and a processor, wherein: the machine-readable storage medium stores machine-executable instructions that can be executed by the processor; the processor is used to execute the machine-executable instructions to implement the trusted hardware-based data transmission operation disclosed in the above example.
[0060] The machine-readable storage medium provided in this application embodiment stores machine-executable instructions. When the machine-executable instructions are invoked and executed by a processor, the machine-executable instructions cause the processor to implement the trusted hardware-based data transmission operation disclosed in the above examples.
[0061] Here, a machine-readable storage medium can be any electronic, magnetic, optical, or other physical storage device that can contain or store information, such as executable instructions, data, etc. For example, a machine-readable storage medium can be: RAM (Random Access Memory), volatile memory, non-volatile memory, flash memory, storage drives (such as hard disk drives), solid-state drives, any type of storage disk (such as optical discs, DVDs, etc.), or similar storage media, or combinations thereof.
[0062] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which can take the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email sending and receiving device, game console, tablet computer, wearable device, or any combination of these devices.
[0063] For ease of description, the above devices are described separately by function as various units. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware.
[0064] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, embodiments of this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0065] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0066] Furthermore, these computer program instructions can also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in the process. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0067] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0068] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this application according to actual needs. Those skilled in the art can understand and implement this without creative effort.
[0069] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.
Claims
1. A data transmission system based on trusted hardware, characterized in that, The data transmission system includes at least one pair of data pass-through devices, each pair of data pass-through devices is interconnected, and each data pass-through device is externally mounted on its corresponding industrial control equipment. Each data pass-through device is used for: When it is determined that data communication is required, a first key and a second key are randomly generated, and the public key of the first key is sent to the data pass-through device connected to the data pass-through device so that the corresponding data pass-through device stores the public key; The first key is used to encrypt the second key to generate an encryption key, and the encryption key is sent to the data pass-through device connected to the data pass-through device. The corresponding data pass-through device uses the public key to authenticate the received encryption key. After successful authentication, a communication link is established with the data pass-through device so that each industrial control device can transmit data and store it accordingly through the established communication link.
2. The data transmission system according to claim 1, characterized in that, Each data transmission device is also equipped with a random number generator, which is triggered to randomly generate a first key and a second key when it is determined that data communication is required.
3. The data transmission system according to claim 2, characterized in that, Each data transmission device is also equipped with a reset button to indicate that data transmission needs to be started. When the reset button is pressed, the random number generator is triggered to randomly generate a first key and a second key.
4. The data transmission system according to claim 3, characterized in that, When the first industrial control device needs to interact with the second industrial control device, the data pass-through device connected to the first industrial control device is used to receive the transmission data sent by the first industrial control device, perform packetization and data alignment processing on the transmission data, and encrypt the processed transmission data to form ciphertext through the second key, and transmit the ciphertext to the data pass-through device connected to the second industrial control device through the established communication link. The data transmission device connected to the second industrial control device is used to decrypt the ciphertext after receiving it, using the encryption key received during authentication to restore it to plaintext, and to perform inverse operations of packet segmentation and data alignment on the plaintext to obtain the restored original data. The original data is then transmitted to the second industrial control device through a physical communication link, thus completing a data transmission from the first industrial control device to the second industrial control device.
5. The data transmission system according to claim 1, characterized in that, The first key is the SM2 key, and the second key is the SM4 key; The step of encrypting the second key using the first key to generate an encryption key includes: The SM4 key is encrypted using the SM2 algorithm to generate an encryption key; The corresponding data pass-through device uses the public key to authenticate the received encryption key, including: The corresponding data pass-through device uses the public key of SM2 to decrypt the SM4 key, which is encrypted by SM2 algorithm, in order to achieve identity verification.
6. The data transmission system according to claim 5, characterized in that, The step of encrypting the processed transmitted data using a second key to form ciphertext includes: The processed transmitted data is encrypted using the SM4 encryption algorithm to form ciphertext; The step of decrypting the ciphertext using the encryption key received during authentication to restore it to plaintext includes: Use the SM4 key received during authentication to decrypt the ciphertext and restore it to plaintext.
7. The data transmission system according to claim 6, characterized in that, Each data transmission device is also equipped with a power management unit, which includes an AC220V to 12V power adapter and multiple high-voltage to low-voltage conversion modules.
8. A data transmission method based on trusted hardware, characterized in that, The data transmission method is applied to any data pass-through device in the data transmission system described in any one of claims 1 to 7, and the data pass-through method includes: When it is determined that data communication is required, a first key and a second key are randomly generated, and the public key of the first key is sent to the data pass-through device connected to the data pass-through device so that the corresponding data pass-through device stores the public key; The first key is used to encrypt the second key to generate an encryption key, and the encryption key is sent to the data pass-through device connected to the data pass-through device. The corresponding data pass-through device uses the public key to authenticate the received encryption key. After successful authentication, a communication link is established with the data pass-through device so that each industrial control device can transmit data and store it accordingly through the established communication link.
9. A data transmission method based on trusted hardware, characterized in that, Before the random generation of the first and second keys, the following is also included: Receive connection requests sent by data pass-through devices connected to the data pass-through device; Based on the connection request, determine whether to agree to the connection request. If agreed, execute the step of randomly generating the first key and the second key. Otherwise, send a rejection request to the corresponding data pass-through device, so that the corresponding data pass-through device stops sending connection requests after the number of rejection requests received and / or the number of times no response is received to the connection request reaches a threshold.
10. A data transmission device based on trusted hardware, characterized in that, The data transmission device is applied to any data pass-through device in the data transmission system described in any one of claims 1 to 7, and the data pass-through device comprises: A public key sending unit is used to randomly generate a first key and a second key when data communication is required, and send the public key of the first key to the data pass-through device connected to the data pass-through device so that the corresponding data pass-through device stores the public key; a key encryption unit is used to encrypt the second key using the first key to generate an encryption key, and send the encryption key to the data pass-through device connected to the data pass-through device so that the corresponding data pass-through device uses the public key to authenticate the received encryption key. After successful authentication, a communication link is established with the data pass-through device so that each industrial control device can transmit data and store it accordingly through the established communication link.