Industrial control system data encryption and decryption system based on domestic commercial cryptographic algorithm

Abstract

The invention provides an industrial control system data encryption and decryption system based on a domestic commercial cryptographic algorithm, and relates to the technical field of industrial control and information security. The system comprises a domestic commercial password card module, a database adaptation module, an operator station terminal module, an integrity verification module and a redundancy deployment module, and adopts an SM4 symmetric encryption algorithm and an HMAC-SM3 integrity verification mechanism to realize automatic encryption and decryption and integrity protection of user passwords, control instructions and authority information sensitive data in the industrial control system. Through code-level embedded transformation, a national cryptographic algorithm is deeply integrated to a database SQL execution engine, so that the encryption efficiency is improved; and the service continuity and the data anti-leakage capability are ensured by combining a dual-computer hot standby architecture and a local encryption mechanism. The method meets the commercial password application safety evaluation standard, is successfully applied to a large hydraulic power plant monitoring system, and has remarkable technical innovation and engineering popularization value.

Description

Industrial Control System Data Encryption and Decryption System Based on Domestic Commercial Cryptographic Algorithms Technical Field

[0001] This invention relates to the field of industrial control and information security technology, and more specifically, to an industrial control system data encryption and decryption system based on domestically developed commercial cryptographic algorithms. Background Technology

[0002] Industrial control systems are widely used in critical sectors such as energy, power, chemicals, and transportation, and are a core component of national critical infrastructure. With the development of industrial informatization and intelligentization, the integration of industrial control systems with information networks is deepening, and more and more industrial equipment is interacting with data and being remotely controlled through networks. This exposes industrial control systems to increasingly severe cybersecurity threats, such as hacker attacks, data breaches, and malware intrusions. Once the data security of an industrial control system is compromised, it can lead to production interruptions, equipment damage, serious environmental pollution, and even jeopardize national economic security and social stability. Therefore, ensuring the confidentiality, integrity, and usability of industrial control system data is of paramount importance.

[0003] Currently, some industrial control systems employ traditional encryption algorithms, such as DES and AES, to encrypt and protect data. While these algorithms can improve data security to some extent, they also have limitations. For example, the DES algorithm has a short key length, making it vulnerable to brute-force attacks; and although the AES algorithm offers high security, it is a foreign algorithm. In critical areas with high data security requirements, using foreign algorithms poses certain security risks and fails to meet national compliance requirements for cryptographic applications in critical information infrastructure.

[0004] Domestically developed commercial cryptographic algorithms, such as SM2, SM3, and SM4, possess independent intellectual property rights, high security, and superior performance, making them crucial technical means for ensuring information security in my country. However, their application in industrial control systems is relatively limited. Most existing industrial control systems utilize foreign databases and equipment, resulting in poor compatibility with domestic cryptographic algorithms. This hinders deep integration of domestic algorithms with industrial control systems and prevents the full realization of their advantages in data security.

[0005] In industrial control systems, data integrity is equally important. Existing data encryption technologies primarily focus on protecting data confidentiality, with relatively few measures to protect data integrity. Some systems only use simple checksums or hash algorithms to verify data integrity, but these methods are vulnerable to tampering attacks and cannot provide sufficient security. When data is tampered with during transmission or storage, the system may not detect it in time, leading to incorrect decisions and operations, and affecting the normal operation of industrial production.

[0006] Industrial control systems have high requirements for data real-time performance and availability. However, existing data encryption and decryption systems often fail to fully consider the specific needs of industrial control systems during their design and implementation. Some encryption and decryption systems have slow processing speeds, unable to meet the real-time processing requirements of large amounts of data in industrial control systems, leading to data transmission and processing delays and affecting system real-time performance. Furthermore, some systems lack effective redundancy design and fault-to-connection mechanisms; when a component in the system fails, it can easily lead to system paralysis, affecting the normal operation of the industrial control system.

[0007] Existing industrial control system data encryption and decryption systems have shortcomings in security management and auditing. Some systems lack a robust key management mechanism, and the processes of key generation, storage, distribution, and updating are vulnerable to security breaches, easily leading to key leaks and compromising data security. Furthermore, the systems' security auditing functions are weak, failing to comprehensively and accurately record and analyze security events, making it difficult to detect potential security threats and violations, and hindering timely preventative and remedial measures. Therefore, we propose an industrial control system data encryption and decryption system based on domestically developed commercial cryptographic algorithms to address these shortcomings. Summary of the Invention

[0008] The purpose of this invention is to address the problems identified in the existing background technology. To achieve the above-mentioned objective, this invention provides the following technical solution: an industrial control system data encryption and decryption system based on domestically developed commercial cryptographic algorithms, including a domestically developed commercial cryptographic card module; a database adaptation module for establishing a connection with a domestic database and calling the cryptographic card for encryption and decryption operations; an operator station terminal module for encrypted storage and integrity verification of local sensitive data; an encryption service management module for controlling the data encryption and decryption process; a data integrity verification module for generating and verifying HMAC-SM3 digest values; a security policy configuration module for setting encryption strength, integrity protection level, and access control rules; and a redundancy deployment and fault switching module for ensuring high availability of the encryption service.

[0009] As a preferred technical solution of the present invention, the domestic commercial cryptographic card module uses the cryptographic card HMAC algorithm to complete data integrity protection. Specifically, the database calls the cryptographic card SM4 algorithm at a frequency of no less than 1000 times per second to encrypt and store the structured data in the DM database. The SM4 algorithm key length is 128 bits. The encrypted data calls the HMAC-SM3 algorithm at a frequency of no less than 1000 times per second for integrity verification. The digest length generated by the HMAC-SM3 algorithm is 256 bits, thereby meeting the confidentiality and integrity protection requirements of important data storage.

[0010] As a preferred technical solution of the present invention, for system data that is distributed and stored in various operator stations and has high real-time requirements, the data response time is no more than 0.5 seconds. The confidentiality and integrity of important data storage are protected by cryptographic cards. The cryptographic cards are redundantly deployed in a number of no less than two to achieve high-availability deployment of encryption devices, and the availability of encryption devices is no less than 99.9%.

[0011] As a preferred technical solution of the present invention, a storage confidentiality protection system is provided. This system mainly targets user login passwords and user information data. Before the data is stored in the database, the SM2 encryption algorithm of the national cryptographic standard is called with a processing time of no more than 0.3 seconds. The key length is 256 bits. The encrypted data is stored in the database or server. When the data is used, the decryption method is called with a processing time of no more than 0.3 seconds to decrypt it.

[0012] As a preferred technical solution of the present invention, it also includes a storage integrity protection system, which involves user login password, user login log information, system scheduling decision data, and access control information data; before the data is generated and stored, the national cryptographic HMAC-SM3 algorithm of the cryptographic card is called with a processing time of no more than 0.2 seconds to implement HMAC integrity protection technology, generate a 256-bit digest value, and store the data and digest value together.

[0013] As a preferred technical solution of the present invention, when data needs to be accessed and used, HMAC technology is first invoked to generate a summary of the current storage status of the relevant data within a time of no more than 0.2 seconds, and then compared with the previously stored summary; if the two calculated summary values ​​are the same, the data is determined to be complete; if they are different, the data integrity is determined to be compromised, and the system will pop up a prompt within 0.1 seconds and notify the developers via email and SMS for detailed analysis.

[0014] As a preferred technical solution of the present invention, the system is compatible with domestic software and hardware platforms, including the Kylin operating system, Phytium Loongson processor, and DM database.

[0015] As a preferred technical solution of the present invention, the security policy configuration module supports flexible setting of encryption strength, integrity protection level, and key update cycle parameters, and realizes unified policy distribution and audit tracking through a centralized management platform.

[0016] As a preferred technical solution of the present invention, the system supports the Commercial Cryptography Application Security Assessment (GM / T0054) standard and provides a complete assessment interface, detection mechanism and compliance report template.

[0017] As a preferred technical solution of the present invention, its application in energy-related industrial control systems such as hydropower plants, thermal power plants, and wind farms is particularly suitable for data security protection scenarios of the HNICS-H316 domestically produced computer monitoring system.

[0018] Compared with existing technologies, the beneficial effects of this invention are as follows: This system provides strong confidentiality protection for industrial control system data by using domestically developed commercial cryptographic algorithms, including SM4 and SM2 algorithms. For critical data, such as user login passwords, user information, real-time monitoring data during production, and equipment operating parameters, encryption is performed during storage and transmission. Taking the SM4 symmetric encryption algorithm as an example, its 128-bit key length and complex permutation and substitution operations make it difficult for attackers to crack the encrypted ciphertext. The SM2 asymmetric encryption algorithm provides an even higher level of security for sensitive user information; even if the data is illegally obtained during storage, it cannot be decrypted without the corresponding private key. This effectively prevents data leakage and protects the company's core secrets and users' privacy information.

[0019] This invention employs the HMAC-SM3 algorithm to verify data integrity, ensuring that data is not tampered with during storage and transmission. When data is encrypted and stored, a 256-bit digest value is generated and stored along with the ciphertext. When the data is used, the digest value is recalculated and compared with the stored digest value. If the digest values ​​match, the data is intact; if they differ, the data has been tampered with. This mechanism promptly detects abnormal changes in data, ensuring data authenticity and reliability, and providing an accurate data foundation for decision-making and operation in industrial control systems.

[0020] This invention's system ensures high data availability through redundant deployment and rapid switching mechanisms of cryptographic cards. When one cryptographic card fails, the system can automatically switch to a backup card within 0.1 seconds, ensuring uninterrupted processing of production data. For some system data with high real-time requirements, the response time is no more than 0.5 seconds. The efficient encryption and decryption processing of the cryptographic cards ensures timely and accurate data transmission and use. Simultaneously, the system's regular data backup and off-site storage mechanisms provide assurance for data recovery. Even in the event of database failure or disaster, data can be quickly recovered, guaranteeing the normal operation of the industrial control system.

[0021] This invention features a highly efficient data encryption and decryption process. The database calls the encryption algorithm of the cryptographic card at a frequency of no less than 1000 times per second, which can meet the real-time processing needs of large amounts of data in industrial control systems. The hardware acceleration function and optimized algorithm implementation of the cryptographic card enable fast and efficient data encryption and decryption without significantly impacting the normal operation of the system. Simultaneously, the system's parallel processing capabilities and distributed architecture design further improve the overall processing performance, ensuring stable operation of the industrial control system under high concurrency and large data volumes.

[0022] The redundant deployment of cryptographic cards and the real-time monitoring mechanism in this invention ensure stable system operation. The redundant design of the cryptographic cards allows the system to automatically switch over in the event of hardware failure, avoiding system paralysis caused by a single point of failure. The system's real-time monitoring function can promptly detect and warn of system anomalies, such as cryptographic card performance degradation or network connection interruptions, and automatically take corresponding measures to handle them. Furthermore, the system's fault-tolerant design and fault recovery mechanism enable the system to quickly resume normal operation after a failure, reducing downtime and improving the reliability and stability of the industrial control system.

[0023] This invention's system strictly adheres to relevant national cryptographic regulations and standards, employing domestically developed commercial cryptographic algorithms for data encryption and decryption, ensuring system compliance. Through cryptographic application security assessments, the pass rate for each assessment indicator is no less than 95%, meeting national requirements for the construction of cryptographic applications in critical information infrastructure. This enables enterprises to avoid legal risks arising from non-compliant cryptographic applications when using this system, safeguarding their legitimate rights and interests.

[0024] This invention's regular security assessments and simulated attack tests enable the system to promptly identify and patch potential security vulnerabilities. Continuous optimization of the system's security strategies and encryption algorithms enhances its resistance to attacks. The system can withstand various common network attacks, such as hacking, data tampering, and denial-of-service attacks, providing comprehensive security protection for industrial control systems. Simultaneously, the system's security auditing function and logging mechanism can record and analyze security events in detail, providing strong support for tracing and investigating security incidents.

[0025] The successful application of this invention and system provides practical experience for the promotion and application of domestically produced commercial cryptographic algorithms in industrial control systems. By using domestically produced cryptographic cards and algorithms, the development of the domestic cryptographic industry has been promoted, and the market competitiveness of domestically produced cryptographic products has been enhanced. The application needs of the system have also driven innovation and development in cryptographic technology, prompting cryptographic companies to continuously develop more efficient and secure cryptographic products and solutions, injecting new impetus into the development of my country's cryptographic industry.

[0026] This invention provides a model for the iterative innovation of cryptographic security technology products for industrial control systems and offers exemplary experience for the construction of cryptographic application security for national critical infrastructure. Its advanced design concept, efficient encryption and decryption scheme, and comprehensive security management mechanism provide a reference model for the construction of cryptographic applications in other industrial enterprises and critical infrastructure fields. Other enterprises can quickly build cryptographic security systems that meet their own needs based on the successful experience of this system, improve the cryptographic security level of the entire industry, and promote the enhancement of the security assurance capabilities of national critical infrastructure.

[0027] In today's digital age, data security has become a crucial component of a company's core competitiveness. This invention provides reliable data security for industrial control systems, enabling companies to confidently undertake digital transformation and intelligent upgrades. By ensuring data security and stability, it improves production efficiency and management levels, enhancing the company's competitiveness in the market. Simultaneously, a company's strong performance in cryptographic security also helps improve its brand image and reputation, attracting more customers and partners.

[0028] The application of this invention effectively reduces the potential losses and risks to enterprises caused by data security issues. By preventing data leaks and tampering incidents, it avoids legal proceedings, financial compensation, and business interruption losses faced by enterprises due to data security incidents. Simultaneously, the system's automated monitoring and management functions reduce the human and material resources that enterprises need for security operations and maintenance, lowering their security management costs. The application of this system brings significant economic and social benefits to enterprises. Attached Figure Description

[0029] Figure 1 is a system logic block diagram provided by the present invention; Figure 2 is a schematic diagram of system parameters provided by the present invention; Figure 3 is a block diagram of evaluation data provided by the present invention; Figure 4 is a block diagram of algorithm logic provided by the present invention; Figure 5 is a schematic diagram of index data parameters provided by the present invention. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention.

[0031] Therefore, the following detailed description of the embodiments of the present invention is not intended to limit the scope of the claimed invention, but merely illustrates some embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention. It should be noted that, unless otherwise specified, the embodiments and features and technical solutions in the embodiments of the present invention can be combined with each other. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0032] Example 1: An industrial control system data encryption and decryption system based on domestically developed commercial cryptographic algorithms, including a domestically developed commercial cryptographic card module; a database adaptation module for establishing a connection with a domestic database and calling the cryptographic card for encryption and decryption operations; an operator station terminal module for encrypted storage and integrity verification of local sensitive data; an encryption service management module for controlling the data encryption and decryption process; a data integrity verification module for generating and verifying HMAC-SM3 digest values; a security policy configuration module for setting encryption strength, integrity protection level, and access control rules; and a redundancy deployment and fault switching module for ensuring high availability of the encryption service.

[0033] The domestically produced commercial cryptographic card module uses the HMAC algorithm to protect data integrity. Specifically, the database calls the SM4 algorithm of the cryptographic card at a frequency of no less than 1,000 times per second to encrypt and store the structured data in the DM database. The SM4 algorithm key length is 128 bits. The encrypted data is then called the HMAC-SM3 algorithm at a frequency of no less than 1,000 times per second for integrity verification. The digest length generated by the HMAC-SM3 algorithm is 256 bits, thus meeting the confidentiality and integrity protection requirements of important data storage.

[0034] For system data that is distributed across various operator stations and has high real-time requirements, the data response time should not exceed 0.5 seconds. The confidentiality and integrity of important data storage should be protected by cryptographic cards. Cryptographic cards should be redundantly deployed in a quantity of no less than two to achieve high availability of encryption devices, with an availability of no less than 99.9%.

[0035] A storage confidentiality protection system is provided, which mainly targets user login passwords and user information data. Before the data is stored in the database, the SM2 national cryptographic encryption algorithm with a key length of 256 bits is called in a processing time of no more than 0.3 seconds to encrypt the data. The encrypted data is then stored in the database or server. When the data is used, the decryption method is called in a processing time of no more than 0.3 seconds to decrypt it.

[0036] It also includes a storage integrity protection system, which involves user login passwords, user login log information, system scheduling decision data, and access control information data. Before the data is generated and stored, the national cryptographic HMAC-SM3 algorithm of the cryptographic card is called in a processing time of no more than 0.2 seconds to implement HMAC integrity protection technology, generate a 256-bit digest value, and store the data and digest value together.

[0037] When data needs to be accessed, HMAC technology is first invoked within 0.2 seconds to generate a summary of the current storage status of the relevant data and compared with the previously stored summary. If the two calculated summary values ​​are the same, the data is considered complete. If they are different, the data integrity is considered to have been compromised. The system will pop up a prompt within 0.1 seconds and notify the developers via email and SMS for detailed analysis.

[0038] The system is compatible with domestic software and hardware platforms, including the Kylin operating system, Phytium Loongson processor, and DM database.

[0039] The security policy configuration module supports flexible settings for encryption strength, integrity protection level, and key update cycle parameters, and enables unified policy distribution and audit tracking through a centralized management platform.

[0040] The system supports the Commercial Cryptography Application Security Assessment (GM / T 0054) standard, providing complete assessment interfaces, detection mechanisms, and compliance report templates.

[0041] Its application in energy-related industrial control systems such as hydropower plants, thermal power plants, and wind farms is particularly suitable for data security protection scenarios of the HNICS-H316 fully domestically produced computer monitoring system.

[0042] The working principle of an industrial control system data encryption and decryption system based on domestically developed commercial cryptographic algorithms: This system aims to provide comprehensive encryption and decryption protection for data in industrial control systems (such as computer monitoring systems in hydropower plants) using domestically developed commercial cryptographic algorithms, ensuring the confidentiality, integrity, and usability of the data. The system core is integrated with the domestic DM database and local operator stations through an "embedded modification and fusion" approach, adapted to domestic database cryptographic cards, and redundantly deployed to ensure high stability and real-time performance of production data in complex industrial environments.

[0043] The system employs a code-level "embedded modification and integration" approach, deeply studying the interface protocols and functional characteristics of the national cryptographic card and integrating it thoroughly with the code of the domestic DM database and local operator station. By embedding specific calling interfaces in the database and operator station code, data interaction and command transmission between the system and the cryptographic card are achieved. This adaptive development ensures that the cryptographic card can be seamlessly integrated into the industrial control system, providing support for data encryption and decryption.

[0044] To ensure the high stability and real-time availability of production data, the system employs a redundant deployment approach, deploying multiple cryptographic cards. During normal operation, these cryptographic cards work in parallel, jointly undertaking data encryption and decryption tasks. When one cryptographic card fails, the system can automatically detect the fault and switch the workload to the backup cryptographic card within a very short time of 0.1 seconds, ensuring that the continuity of data processing is not affected, thereby guaranteeing that the availability of production data is no less than 99.99%.

[0045] Data integrity protection principle: SM4 encryption: The database calls the SM4 algorithm on the cryptographic card at a frequency of no less than 1000 times per second to encrypt the structured data in the DM database. The SM4 algorithm is a symmetric encryption algorithm with a key length of 128 bits. During the encryption process, the cryptographic card performs complex permutation and substitution operations on the data according to the preset key, converting the original data into ciphertext, thereby ensuring the confidentiality of the data during storage.

[0046] HMAC-SM3 Verification: The encrypted data undergoes integrity verification by calling the HMAC-SM3 algorithm on the cryptographic card at a frequency of no less than 1000 times per second. The HMAC-SM3 algorithm is a hash-based message authentication code algorithm that combines the SM3 hash algorithm and the key to generate a 256-bit digest value. This digest value serves as the data's "fingerprint," uniquely identifying its content. During data storage, the system saves the digest value along with the encrypted data. When the data is needed, the system recalculates the digest value and compares it with the previously saved digest value. If the two digest values ​​match, it indicates that the data has not been tampered with during storage, ensuring data integrity.

[0047] For system data that is distributed across various operator stations and has high real-time requirements, the system requires a data response time of no more than 0.5 seconds. This data is also encrypted and stored using cryptographic cards to ensure its confidentiality and integrity. Redundant deployment of cryptographic cards ensures that if a single card fails, others can quickly take over, achieving high-availability deployment of the encryption device and maintaining an availability of no less than 99.9%.

[0048] The storage confidentiality protection system primarily targets user login passwords and sensitive user information data. Before this data is stored in the database, the system encrypts it using the national cryptographic algorithm (such as the SM2 algorithm with a 256-bit key length) within a processing time of no more than 0.3 seconds. The SM2 algorithm is an asymmetric encryption algorithm that uses a public key to encrypt data, and only the corresponding private key can decrypt it. In this way, even if the data is illegally obtained during storage, attackers cannot easily crack the data content, thus ensuring data confidentiality.

[0049] When this encrypted data is needed, the system invokes the decryption method of the cryptographic card within a processing time of no more than 0.3 seconds, using the corresponding private key to decrypt the data. The decrypted original data can then be used normally, ensuring data security during use.

[0050] For user login passwords, user login log information, system scheduling decision data, and access control information that require integrity protection, the system invokes the national cryptographic algorithm (such as HMAC-SM3 algorithm) of the cryptographic card to implement HMAC integrity protection technology within a processing time of no more than 0.2 seconds before the data is generated and stored. This algorithm generates a 256-bit digest value based on the data content and a preset key, and stores the data and digest value together. This digest value records the original state of the data at the time of storage.

[0051] When data needs to be accessed, the system first uses HMAC technology to generate a digest of the current storage status of the relevant data within a time limit of 0.2 seconds. Then, the generated digest is compared with a previously stored digest. If the two digest values ​​are the same, it means the data has not been tampered with during storage and is intact; if the digest values ​​are different, it means the data integrity has been compromised. The system will display a notification within 0.1 seconds and notify developers via email and SMS for detailed analysis to promptly identify and address data security issues.

[0052] The system has real-time monitoring capabilities, enabling it to monitor key indicators such as the working status of the cryptographic card, the processing speed of data encryption and decryption, and the error rate of data transmission in real time. Upon detecting any anomalies, such as cryptographic card malfunction, data processing delays, or excessive error rates, the system will immediately issue an alarm and automatically take corresponding measures, such as switching to a backup cryptographic card and adjusting data processing strategies, to ensure the normal operation of the system.

[0053] The system regularly conducts security assessments of cryptographic applications, including the compliance of cryptographic algorithms, the correctness of data encryption and decryption, and overall system security. Various attack scenarios are simulated to test the system's resistance to attacks and the effectiveness of data protection. The pass rate for assessment indicators is no less than 95% to ensure the compliance, correctness, and effectiveness of cryptographic applications in the domestically developed computer monitoring system's cryptographic transformation project, meeting national requirements for the construction of cryptographic applications in critical information infrastructure.

[0054] The system employs an advanced fault detection mechanism to monitor the operational status of key components such as password cards, databases, and operator stations in real time. When a component malfunctions, the system can quickly identify the fault type and location, and, according to a preset switching strategy, switch the workload to a backup component in the shortest possible time. For example, when a password card malfunctions, the system automatically transfers encryption and decryption tasks to a backup password card, ensuring the continuity of data processing.

[0055] In the event of a major security incident or system failure, the system initiates an emergency response procedure. First, the system immediately halts all related data operations to prevent further data loss. Then, the system automatically backs up critical data and sends fault information and relevant logs to the system administrator and developers. Based on this information, the administrators and developers diagnose and repair the fault, restoring the system to normal operation as quickly as possible. Simultaneously, the system records and analyzes the incident in detail, summarizing lessons learned to improve system security and reliability.

[0056] The working process of an industrial control system data encryption and decryption system based on domestically developed commercial cryptographic algorithms: System initialization phase: Upon system startup, a self-test is first performed on the redundantly deployed domestically developed database cryptographic cards. This checks whether the hardware connections of the cryptographic cards are normal and whether the internal domestically developed commercial cryptographic algorithm modules (such as SM4, HMAC-SM3, SM2) are functioning correctly. Simultaneously, the connection status of the local operator station and the domestic DM database is checked to ensure stable data exchange between the various components.

[0057] The keys used for data encryption and decryption are loaded into the cryptographic card from a secure key storage area (such as a key management server). For the symmetric encryption algorithm SM4, a 128-bit encryption key is loaded; for the asymmetric encryption algorithm SM2, a 256-bit public-private key pair is loaded. The loading process involves strict authentication and authorization to ensure that only authorized system components can access and use these keys.

[0058] Based on the actual needs of the industrial control system, configure and initialize various system parameters. For example, set the redundancy switching threshold for the password card, the fault response time to 0.1 seconds, the data encryption and decryption processing frequency, the database to call the SM4 algorithm no less than 1000 times per second, and relevant data storage parameters, storage path, and backup cycle.

[0059] Data encryption stage: Structured data encryption: DM Database extracts the structured data that needs to be encrypted from the database according to preset rules and frequency (no less than 1,000 times per second), such as real-time monitoring data and equipment operating parameters in the production process.

[0060] SM4 Encryption: The database sends the extracted data to the cipher card for encryption by calling the SM4 algorithm interface. The cipher card, based on the loaded 128-bit SM4 key, performs a series of permutations and substitutions on the data, converting the original data into ciphertext.

[0061] HMAC-SM3 Integrity Verification: The encrypted ciphertext data is sent back to the cryptographic card, and the HMAC-SM3 algorithm is invoked to generate a 256-bit digest value. This digest value, along with the ciphertext data, is stored in the Dream Database for subsequent data integrity verification.

[0062] Data identification and collection: The local operator station monitors real-time system data that is distributed across various nodes and has high real-time requirements, with a response time of no more than 0.5 seconds, such as real-time control commands from equipment and emergency alarm information. Once data requiring encryption is detected, it is immediately collected and prepared for encryption processing.

[0063] Password card encryption: The operator station sends the collected data to the password card for encryption. The SM4 algorithm is also used to encrypt the data, ensuring confidentiality during storage and transmission.

[0064] Redundancy processing and storage: Encrypted data is processed using redundantly deployed cryptographic cards, ensuring that even if one cryptographic card fails, the data can still be encrypted and stored normally. The encrypted data is stored on the local operator station's storage device or in the DM database.

[0065] Data interception: The system intercepts data involving user login passwords or user information that requires confidentiality protection before it is transmitted to the database. This data typically originates from the user login interface or the user information management module.

[0066] SM2 Encryption: The SM2 algorithm of the cryptographic card is invoked, and the data is encrypted using a pre-loaded public key. The encryption process involves complex mathematical operations to convert the original data into ciphertext, ensuring the confidentiality of the data during storage.

[0067] Encrypted data storage: The encrypted data is stored in a designated storage area of ​​the Dream Database or server, awaiting subsequent use and decryption operations.

[0068] Data storage and management phase: Encrypted data (including ciphertext and corresponding digest values) is stored in the Dream Database according to the system's preset storage rules. The database allocates specific storage areas for different types of data and performs index management to facilitate fast querying and access.

[0069] Regularly back up the encrypted data stored in the database, with backup data stored on a secure off-site storage device. The backup process employs rigorous encryption to ensure data security. Simultaneously, the backup time and data content information are recorded for data recovery when needed.

[0070] The system monitors the status of stored data in real time, including data integrity and the health of storage devices. It periodically checks digest values ​​to verify data integrity and monitors disk usage and read / write speed parameters to ensure data storage stability. If any anomalies are detected, appropriate measures are taken promptly, such as data repair or device replacement.

[0071] Data Decryption Phase: Data Request: When the industrial control system needs to use stored structured data, it sends a data request to the DM database. Data Extraction: The database extracts the corresponding encrypted data and digest value from the storage area according to the request. Integrity Verification: The encrypted data is sent to the cryptographic card, the HMAC-SM3 algorithm is called to regenerate the digest value, and it is compared with the stored digest value. If the two digest values ​​are the same, it means that the data has not been tampered with during storage and the data is intact; otherwise, the system issues an alarm and conducts further investigation.

[0072] SM4 Decryption: If the data integrity verification passes, the cipher card uses the pre-loaded SM4 key to decrypt the ciphertext data, restoring it to the original structured data, and returns it to the requester.

[0073] System Data Decryption: Data Request and Transmission: When the local operator station needs to use a portion of the previously encrypted system data, it sends a data request to the storage device. The storage device transmits the encrypted data to the cryptographic card. SM4 Decryption: The cryptographic card uses the SM4 algorithm to decrypt the encrypted data, restoring it to its original form. The decrypted data is returned to the operator station within 0.5 seconds to meet real-time requirements.

[0074] Confidential Data Decryption: Data Usage Request: When user login passwords or other confidential user information are needed, the system sends a decryption request to the database. Data Extraction and Decryption: The database extracts the corresponding ciphertext data and sends it to the password card. The password card uses a pre-loaded SM2 private key to decrypt the ciphertext. The decrypted data is used only internally within the system, and access permissions are strictly controlled to ensure data confidentiality.

[0075] System monitoring and troubleshooting phase: Real-time monitoring: The system continuously monitors the operational status of each component, including the password card, local operator station, and DM database. Monitoring includes component performance metrics, processing speed, resource utilization, communication status, network connectivity, and security status.

[0076] Data recording and analysis: The monitored data is recorded and analyzed to generate system operation logs and performance reports. Analysis of this data helps identify potential system problems and risks in a timely manner, providing a basis for system optimization and improvement.

[0077] Fault Handling: Fault Detection and Alarms: When the system detects a fault in a component, such as a password card malfunction or database connection interruption, an alarm is immediately issued. Alarm information is communicated to system administrators and relevant technical personnel through various means, including SMS, email, and system pop-ups.

[0078] Fault Switching and Recovery: For redundantly deployed component password cards, the system automatically performs fault switching, transferring the workload to the backup component to ensure normal system operation. Simultaneously, technicians diagnose and repair faults based on the fault information, restoring the faulty component to normal operation as quickly as possible.

[0079] Security Assessment and Optimization Phase: The system undergoes security assessments monthly or quarterly according to a predetermined schedule. The assessment includes the compliance of cryptographic algorithms, the correctness of data encryption and decryption, and the system's resistance to attacks. Various attack scenarios are simulated to test the system's security and reliability.

[0080] Based on the security assessment results, the system's existing problems were rectified and optimized. This included updating the cryptographic algorithm version, adjusting the system's security policies, and optimizing system performance parameters. Simultaneously, lessons learned from the security assessment were summarized to continuously improve the system's security protection mechanisms and enhance its overall security and stability.

[0081] The above embodiments are only used to illustrate the present invention and are not intended to limit the technical solutions described in the present invention. Although the present invention has been described in detail with reference to the above embodiments, the present invention is not limited to the specific embodiments described above. Therefore, any modifications or substitutions to the present invention, and all technical solutions and improvements that do not depart from the spirit and scope of the invention, are covered within the scope of the claims of the present invention.

Claims

1. An industrial control system data encryption and decryption system based on domestically developed commercial cryptographic algorithms, characterized in that, This includes a domestic commercial cryptographic card module; a database adaptation module for establishing connections with domestic databases and calling the cryptographic card for encryption and decryption operations; an operator station terminal module for encrypted storage and integrity verification of local sensitive data; an encryption service management module for controlling the data encryption and decryption process; and a data integrity verification module for generating and verifying HMAC-SM3 digest values. The security policy configuration module is used to set encryption strength, integrity protection level and access control rules; the redundancy deployment and failover module is used to ensure the high availability of encryption services.

2. The industrial control system data encryption and decryption system based on domestically developed commercial cryptographic algorithms according to claim 1, characterized in that, The domestically produced commercial cryptographic card module uses the HMAC algorithm to protect data integrity. Specifically, the database calls the SM4 algorithm of the cryptographic card at a frequency of no less than 1,000 times per second to encrypt and store the structured data in the DM database. The SM4 algorithm key length is 128 bits. The encrypted data is then called the HMAC-SM3 algorithm at a frequency of no less than 1,000 times per second for integrity verification. The digest length generated by the HMAC-SM3 algorithm is 256 bits, thus meeting the confidentiality and integrity protection requirements of important data storage.

3. The industrial control system data encryption and decryption system based on domestically developed commercial cryptographic algorithms according to claim 1, characterized in that, For system data that is distributed across various operator stations and has high real-time requirements, the data response time should not exceed 0.5 seconds. The confidentiality and integrity of important data storage should be protected by cryptographic cards. Cryptographic cards should be redundantly deployed in a quantity of no less than two to achieve high availability of encryption devices, with an availability of no less than 99.9%.

4. The industrial control system data encryption and decryption system based on domestically developed commercial cryptographic algorithms according to claim 1, characterized in that, A storage confidentiality protection system is provided, which mainly targets user login passwords and user information data. Before the data is stored in the database, the SM2 national cryptographic encryption algorithm with a key length of 256 bits is called in a processing time of no more than 0.3 seconds to encrypt the data. The encrypted data is then stored in the database or server. When the data is used, the decryption method is called in a processing time of no more than 0.3 seconds to decrypt it.

5. The industrial control system data encryption and decryption system based on domestically developed commercial cryptographic algorithms according to claim 1, characterized in that, It also includes a storage integrity protection system, which involves user login passwords, user login log information, system scheduling decision data, and access control information data. Before the data is generated and stored, the national cryptographic HMAC-SM3 algorithm of the cryptographic card is called with a processing time of no more than 0.2 seconds to implement HMAC integrity protection technology, generate a 256-bit digest value, and store the data and digest value together.

6. The industrial control system data encryption and decryption system based on domestically produced commercial cryptographic algorithms according to claim 5, characterized in that, When data needs to be accessed, HMAC technology is first invoked within 0.2 seconds to generate a summary of the current storage status of the relevant data and compared with the previously stored summary. If the two calculated summary values ​​are the same, the data is considered complete. If they are different, the data integrity is considered to have been compromised. The system will pop up a prompt within 0.1 seconds and notify the developers via email and SMS for detailed analysis.

7. The industrial control system data encryption and decryption system based on domestically produced commercial cryptographic algorithms according to claim 1, characterized in that, The system is compatible with domestic software and hardware platforms, including the Kylin operating system, Phytium Loongson processor, and DM database.

8. The industrial control system data encryption and decryption system based on domestically developed commercial cryptographic algorithms according to claim 1, characterized in that, The security policy configuration module supports flexible setting of encryption strength, integrity protection level, and key update cycle parameters, and realizes unified policy distribution and audit tracking through a centralized management platform.

9. The industrial control system data encryption and decryption system based on domestically developed commercial cryptographic algorithms according to claim 1, characterized in that, The system supports the Commercial Cryptography Application Security Assessment (GM / T 0054) standard, providing complete assessment interfaces, detection mechanisms, and compliance report templates.

10. The industrial control system data encryption and decryption system based on domestically produced commercial cryptographic algorithms according to claim 1, characterized in that, Applications in energy-related industrial control systems for hydropower plants, thermal power plants, and wind farms.

Images