Industrial Internet of Things equipment encryption communication method and system

Abstract

The invention provides an industrial Internet of Things equipment encryption communication method and system, and relates to the technical field of data transmission, and the method comprises the steps: obtaining to-be-transmitted industrial image data; performing block processing on the industrial image data to obtain a plurality of image blocks; extracting representative pixels in each image block, and sorting the representative pixels according to block numbers to form an important pixel set; performing compression processing on the important pixel set to form an important data stream; calculating difference values between other non-representative pixels and representative pixels in each image block, and merging the difference values according to block numbers to form a block-level non-representative pixel difference relation set; coding the block-level non-representative pixel difference relation set to form a non-important data stream; establishing session negotiation based on elliptic curve cryptography, and deriving hierarchical encryption parameters; performing differential encryption processing on the important data stream and the non-important data stream to obtain a layered encryption message; and packaging and sending the layered encrypted message through the industrial Internet of Things.

Description

Technical Field

[0001] This invention relates to the field of data transmission technology, and in particular to an encrypted communication method and system for industrial Internet of Things (IoT) devices. Background Technology

[0002] With the development of Industrial Internet of Things (IIoT) technology, visual sensing devices, edge acquisition terminals, industrial cameras, and intelligent control nodes in industrial settings are constantly generating large amounts of industrial image data, which is transmitted via industrial Ethernet, wireless industrial networks, or dedicated IIoT channels. Industrial image data is typically characterized by large data volume, high timeliness, complex transmission links, and high security requirements. Therefore, in IIoT scenarios, how to achieve efficient compression and secure transmission of image data has become a key issue in industrial intelligent communication.

[0003] In existing technologies, industrial image data transmission typically employs a serial processing approach of "compressing the entire image first, then encrypting it." This type of method usually involves first compressing the entire image using JPEG, JPEG2000, or other encoding methods, and then encrypting the compressed bitstream using AES, SM4, or other symmetric encryption algorithms.

[0004] The scheme is simple to implement, but it has a large computational overhead due to the uniform encryption of the entire bitstream, and it is difficult to implement hierarchical protection based on the importance of different information in the image. Summary of the Invention

[0005] To address the technical problems of existing technologies that involve large computational overhead when uniformly encrypting the entire bitstream and make it difficult to implement hierarchical protection based on the importance of different information in the image, this invention provides an encrypted communication method and system for industrial Internet of Things (IoT) devices.

[0006] The technical solutions provided by the embodiments of the present invention are as follows: The first aspect of this invention provides an encrypted communication method for industrial Internet of Things (IoT) devices, comprising: S1: Acquire industrial image data to be transmitted; S2: The industrial image data is divided into blocks to obtain multiple image blocks; S3: Extract representative pixels from each of the image blocks, and sort the representative pixels according to the block number to form an important pixel set; S4: Compress the set of important pixels to form an important data stream; S5: Calculate the difference between other non-representative pixels in each image block and the representative pixel, and merge the difference values ​​according to the block number to form a block-level non-representative pixel difference relationship set; S6: Encode the block-level non-representative pixel difference relationship set to form a non-important data stream; S7: Establish a session negotiation based on elliptic curve cryptography and derive hierarchical encryption parameters; S8: Using the hierarchical encryption parameters, perform differentiated encryption processing on the important data stream and the non-important data stream to obtain hierarchical encrypted messages; S9: Encapsulate and send the layered encrypted message via the Industrial Internet of Things.

[0007] A second aspect of the present invention provides an encrypted communication system for industrial Internet of Things (IoT) devices, comprising: processor; A memory storing computer-readable instructions, which, when executed by the processor, implement the encrypted communication method for industrial IoT devices as described in the first aspect.

[0008] A third aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the encrypted communication method for industrial Internet of Things devices as described in the first aspect.

[0009] The beneficial effects of the technical solutions provided by the embodiments of the present invention include at least the following: (1) In this invention, industrial image data is divided into important data streams and non-important data streams, and high-strength encryption and lightweight encryption strategies are used for differentiated encryption processing to avoid redundant computational overhead caused by implementing equal strength protection for all data, thereby improving the overall transmission efficiency while ensuring the security of key image information.

[0010] (2) In this invention, by extracting representative pixels within an image block and describing the details within the block using the difference relationship between other pixels and the representative pixels, local image correlation is effectively utilized. In particular, for large flat areas, repetitive texture areas, and background areas present in industrial image data, the difference values ​​are usually small or even zero, thus helping to significantly reduce data redundancy. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 This is a flowchart illustrating an encrypted communication method for industrial IoT devices provided in an embodiment of the present invention.

[0013] Figure 2This is a schematic diagram of the structure of an encrypted communication system for industrial Internet of Things (IoT) devices provided in an embodiment of the present invention. Detailed Implementation

[0014] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0015] In embodiments of the present invention, words such as "exemplarily," "for example," etc., are used to indicate that something is an example, illustration, or description. Any embodiment or design described as "exemplary" in the present invention should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of the word "exemplary" is intended to present the concept in a concrete manner. Furthermore, in embodiments of the present invention, the meaning expressed by "and / or" can be both, or either one.

[0016] In the embodiments of this invention, the terms "image" and "picture" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, they convey the same meaning. Similarly, the terms "of," "corresponding (relevant)," and "corresponding" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, they convey the same meaning.

[0017] In this embodiment of the invention, sometimes a subscript such as W1 may be written in a non-subscript form such as W1. When the difference is not emphasized, the meaning they express is the same.

[0018] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0019] Reference manual attached Figure 1 The diagram illustrates a flowchart of an encrypted communication method for industrial IoT devices provided by an embodiment of the present invention.

[0020] This invention provides an encrypted communication method for industrial IoT devices. This method can be implemented by an encrypted communication device for industrial IoT devices, which can be a terminal or a server. The processing flow of the encrypted communication method for industrial IoT devices may include the following steps: S1: Acquire industrial image data to be transmitted.

[0021] S2: The industrial image data is divided into blocks to obtain multiple image blocks.

[0022] Optionally, the industrial image data can be divided into regular blocks according to a preset size. Those skilled in the art can set the size of the preset size according to the actual situation, and this invention does not limit it.

[0023] Alternatively, the K-means algorithm can be used for region segmentation based on color. The K-means algorithm is a very mature existing technology, and will not be described in detail here.

[0024] Those skilled in the art can choose appropriate segmentation techniques based on the actual situation; this invention does not impose any limitations.

[0025] S3: Extract representative pixels from each image block and sort the representative pixels according to the block number to form an important pixel set.

[0026] Optionally, the representative pixel is the pixel corresponding to the minimum pixel value, maximum pixel value, or average pixel value within the block.

[0027] By selecting the representative pixel as the pixel corresponding to the minimum, maximum, or average pixel value within the block, the overall grayscale distribution or extreme value features of the image block can be effectively characterized while ensuring low computational complexity. The minimum or maximum value helps to constrain the differential range and reduce the differential coding bit width, while the average value can better reflect the overall brightness level within the block. This balances compression efficiency and reconstruction accuracy in different scenarios, improves the stability and adaptability of important pixel extraction, and provides more compact and representative basic data for subsequent differential modeling and hierarchical encryption.

[0028] S4: Compress the set of important pixels to form an important data stream.

[0029] In one possible implementation, S4 specifically includes sub-steps S401 to S406: S401: Rearrange the important pixel set to obtain the important image base.

[0030] Specifically, based on the position index of each image block in the original image, the representative pixels corresponding to each image block can be filled into a two-dimensional matrix consistent with the grid structure of the image blocks in a row-first or column-first manner, thereby constructing an important image base with low resolution but retaining the overall structural outline.

[0031] S402: Perform JPEG2000 preprocessing on important image substrates.

[0032] JPEG2000 preprocessing refers to the standardization process performed on the original image before it enters the wavelet compression process. This mainly includes image component separation (e.g., RGB to YCbCr), pixel value shifting (usually subtracting the bias to achieve zero mean), and necessary image size alignment. The purpose of this process is to reduce the correlation between different color components and provide more stable input data for subsequent wavelet transforms, thereby improving compression efficiency and coding performance. JPEG2000 preprocessing is a very mature existing technology and will not be elaborated upon further in this invention.

[0033] S403: Perform a two-dimensional discrete wavelet transform on the preprocessed important image basis.

[0034] Two-dimensional discrete wavelet transform is a multi-resolution analysis method that maps images from the spatial domain to the frequency domain. By filtering and downsampling the image in both the horizontal and vertical directions, it decomposes the image into low-frequency sub-bands (approximate information) and multiple high-frequency sub-bands (detail information), thereby achieving a hierarchical representation of the image's structural information. Two-dimensional discrete wavelet transform is a very mature existing technology, and will not be elaborated upon in this invention.

[0035] S404: Obtain the subband coefficients containing detail information in the two-dimensional discrete wavelet transform result.

[0036] It should be noted that the subband coefficients containing detailed information generally refer to the subband coefficients of high-frequency subbands.

[0037] S405: Perform Tier-1 encoding on subband coefficients containing detailed information.

[0038] Tier-1 coding is the core entropy coding stage in JPEG2000. It employs an algorithm based on Embedded Block Coding Optimized Truncation (EBCOT) to perform bit-by-bit planar coding on the quantized wavelet coefficients, and combines context modeling and arithmetic coding to achieve efficient compression. Tier-1 coding is a very mature existing technology, and will not be elaborated upon in this invention.

[0039] S406: Perform Tier-2 packing and rate control on the Tier-1 encoded results to form an important data stream.

[0040] Tier-2 packing is the process of organizing and encapsulating the bitstream of code blocks output by Tier-1 encoding. It reorders the code blocks according to resolution layer, quality layer, and spatial location to generate the final compressed bitstream structure. Tier-2 packing is a very mature existing technology, and will not be described in detail here.

[0041] In this embodiment of the invention, by rearranging the important pixel set into an image basis with spatial structural consistency, and combining JPEG2000 preprocessing, two-dimensional discrete wavelet transform, and Tier-1 / Tier-2 hierarchical coding and rate control, the most informative part of the original image can be energy-concentrated and multi-resolution expressed. This allows important information to be efficiently compressed and preferentially encoded in low-frequency and key detail subbands, thereby significantly reducing the amount of data while preserving the main structural features and detailed information of the image. This not only improves transmission efficiency and bandwidth adaptability, but also provides a more compact and information-density data carrier for subsequent high-strength encryption, achieving an effective balance between security and computational complexity.

[0042] S5: Calculate the difference between other non-representative pixels and representative pixels in each image block, and merge the difference values ​​according to the block number to form a block-level non-representative pixel difference relationship set.

[0043] In this invention, by calculating the difference between non-representative pixels and representative pixels within each image block and merging them according to block number, the original pixel data can be transformed into relative change information based on the representative pixels. This significantly reduces the dynamic range of the data, makes the distribution of difference values ​​more concentrated, which is beneficial for subsequent use of variable-length coding or bit-width compression strategies to reduce data redundancy. At the same time, it keeps the structural relationship within the block unchanged, making it easy to achieve high-precision reconstruction at the receiving end through simple superposition. Thus, while ensuring reconstruction quality, it effectively improves compression efficiency and reduces the computational complexity of encryption processing.

[0044] S6: Encode the block-level non-representative pixel difference relationship set to form a non-important data stream.

[0045] In one possible implementation, S6 specifically includes sub-steps S601 to S603: S601: Determine the difference sparsity coefficients in each image block based on the difference values ​​in the block-level non-representative pixel difference relationship set. Among them, DS i Represents the difference sparsity coefficients in the i-th image patch. denoted by , represents the number of non-zero difference values ​​in the block-level non-representative pixel difference relation set of the i-th image block, and n represents the total number of non-representative pixels of the i-th image block.

[0046] The differential sparsity coefficient characterizes the sparsity of the difference values ​​between non-representative pixels and representative pixels in each image block. Essentially, it reflects the similarity level between pixels within a block and the representative pixel. A small number of non-zero difference values ​​indicates that most pixels are similar to the representative pixel, the difference data is highly concentrated, and the sparsity is high. Conversely, a large number of non-zero difference values ​​indicates that the pixel variations within the block are significant, the difference distribution is relatively dispersed, and the sparsity is low. Therefore, this coefficient can intuitively measure the information redundancy of an image block and provides an important basis for subsequent adaptive coding and compression strategies.

[0047] S602: Determine whether the differential sparsity coefficient in the image block is greater than a preset coefficient. If yes, it indicates that a large number of pixels within the block are close to the representative pixels. A high compression ratio coding technique is used to encode the differential values ​​in the block-level non-representative pixel differential relationship set using a high compression ratio. Otherwise, it indicates that the differentials within the block are scattered. A high-fidelity coding technique is used to encode the differential values ​​in the block-level non-representative pixel differential relationship set using a high compression ratio.

[0048] Those skilled in the art can set the value of the preset coefficient according to the actual situation, and the present invention does not limit it.

[0049] High compression ratio coding techniques can employ variable-length coding (such as Huffman coding), arithmetic coding, run-length encoding (RLE), and sparsity-based zero-value compression coding. These methods effectively reduce data redundancy and significantly lower the bit rate by utilizing the large number of repetitive or zero values ​​in the differential data, making them suitable for image blocks with high differential sparsity. High-fidelity coding techniques can employ fixed-length coding, predictive coding (such as DPCM), lossless compression coding (such as LZ77 / LZ78), or lightweight quantization control coding. These methods encode while maintaining data accuracy and detail information, avoiding distortion caused by over-compression. They are suitable for image blocks with relatively discrete differential distributions and high requirements for reconstruction accuracy, thus achieving a balance between compression efficiency and reconstruction quality under different data characteristics. Those skilled in the art can select different high compression ratio coding techniques and high-fidelity coding techniques according to actual conditions; this invention does not limit such selection.

[0050] In this invention, threshold judgment is based on the differential sparsity coefficient, and high compression ratio coding or high-fidelity coding is selected under different conditions. This enables differentiated processing of different image blocks. For image blocks with high differential sparsity, high compression coding can significantly reduce the amount of data, while for image blocks with dispersed differential sparsity, high-fidelity coding can avoid information loss. This achieves a dynamic balance between compression efficiency and reconstruction quality, improving the overall performance and adaptability of the system.

[0051] Optionally, the present invention provides a novel high compression ratio coding technique, which specifically may include: S6021: Determine the maximum value of the difference value in each image block in the block-level non-representative pixel difference relation set.

[0052] S6022: Determine the bit width range parameter of the image block based on the maximum difference value.

[0053] Optionally, when the maximum difference value is 0, the bit width range parameter is 1. This is to ensure consistency between encoding and decoding; at least one bit must be used to represent the data, even if all the data is 0. When the maximum difference value is greater than 0, the bit width range parameter is: Among them, BR i The parameter represents the bit width range of the i-th image block, log2() represents the logarithmic operation to the base 2, and dm i This represents the maximum difference value in the i-th image patch. This indicates the rounding up operation.

[0054] The bit width range parameter determines the difference between each pixel and the selected representative pixel. Essentially, it represents the minimum number of bits required to fully represent the maximum difference within the image block; that is, a "bit-level measure" of the maximum variation of non-representative pixels relative to the representative pixel. When the difference is small, a lower bit width is required, indicating that pixels within the block are highly similar to the representative pixel. When the difference is large, a higher bit width is required, indicating more drastic pixel variations within the block. Therefore, this parameter not only characterizes the degree of local difference in the image block but also provides a basis for subsequent adaptive variable-length coding, enabling each image block to be represented with the minimum necessary number of bits, thus achieving efficient compression while ensuring data recoverability.

[0055] S6023: Based on the bit width range parameter, variable-length bit encoding is performed on the difference values ​​in the non-representative pixel difference relationship set, so that different image blocks are compressed and stored with different bit widths.

[0056] In this invention, variable-length bit encoding is applied to the difference values ​​based on a bit-width range parameter. This allows different image blocks to be stored using the minimum necessary bit width that matches their difference range, effectively eliminating redundant high-order bits caused by uniform bit-width encoding. This significantly reduces the overall data volume and improves compression efficiency. Furthermore, since the bit width is adaptively determined based on the maximum difference value, it ensures that all difference information is completely preserved, achieving lossless compression. In addition, this method can also achieve differentiated encoding based on the local characteristics of different image blocks, making the data representation more refined and compact, providing a more efficient data foundation for subsequent transmission and lightweight encryption.

[0057] S603: The encoding results of each image block are concatenated in block order to form a non-critical data stream.

[0058] S7: Establish session negotiation based on elliptic curve cryptography and derive hierarchical encryption parameters.

[0059] Elliptic curve cryptography (ECC) is a public-key cryptosystem based on the elliptic curve discrete logarithm problem. It achieves key generation, encryption, and decryption through elliptic curve dot product operations over finite fields.

[0060] In one possible implementation, S7 specifically includes sub-steps S701 to S706: S701: Generate private and public keys based on elliptic curve cryptography: Where T represents the public key, d represents the private key held by the sender or receiver, and G represents the base point on the elliptic curve. x0 represents the x-coordinate of the base point, and y0 represents the y-coordinate of the base point.

[0061] S702: The sending end constructs a session random number and calculates a temporary point: in, This represents the temporary elliptic curve point calculated by the sending end based on the random number k and the base point G. x1 represents the x-coordinate of the temporary elliptic curve point, y1 represents the y-coordinate of the temporary elliptic curve point, and k represents the random number.

[0062] In this invention, by introducing a session random number k and calculating temporary elliptic curve points, one-time random parameters can be generated for each communication, making each round of the session independent and unpredictable, thereby effectively preventing replay attacks and key reuse risks. At the same time, this temporary point serves as an important input for the subsequent generation of shared secrets, improving the dynamism and security strength of the key negotiation process.

[0063] S703: The sending end generates a shared point and constructs a session secret: in, The shared elliptic curve point is calculated by the sender based on the random number k and the public key T. x1 represents the x-coordinate of the shared elliptic curve point and y2 represents the y-coordinate of the shared elliptic curve point.

[0064] In this invention, the sending end calculates the shared point using a random number k and the receiving end's public key T, enabling secure generation of a shared secret between the two parties without transmitting a private key. This process is based on the elliptic curve discrete logarithm problem, which has high security. At the same time, it ensures that only the legitimate receiver can restore the same shared point using its own private key, thereby achieving a secure key negotiation mechanism.

[0065] S704: Concatenate and hash the coordinates, timestamp, and device identifier of the shared point to derive the session master key.

[0066] In this invention, by concatenating and hashing the shared point coordinates, timestamps, and device identifiers, the original shared information can be mapped into a fixed-length, uniformly distributed session master key. This not only improves the randomness and collision resistance of the key, but also enhances the uniqueness and timeliness of the key by introducing timestamps and device identifiers, thereby effectively preventing man-in-the-middle attacks and session reuse problems.

[0067] S705: Derive hierarchical encryption parameters based on the session master key.

[0068] The hierarchical encryption parameters include: important data stream subkeys, non-important data stream subkeys, and random matrix generation seed.

[0069] Specifically, by introducing a key derivation function, the session master key is concatenated with a preset purpose identifier and context information, and then input into a hash function to generate multiple independent subkeys and parameters. This process distinguishes different purposes through labels, cryptographically isolating various keys, while using hash mapping to enhance randomness and collision resistance. This achieves efficient generation and unified management of hierarchical encryption parameters while ensuring security. For example, the session master key, purpose identifier, and context information (such as device ID, timestamp, etc.) can be concatenated and then used to derive corresponding hierarchical encryption parameters using a hash function.

[0070] S706: Output a set of hierarchical encryption parameters.

[0071] S8: Using hierarchical encryption parameters, perform differentiated encryption processing on important data streams and unimportant data streams to obtain hierarchically encrypted messages.

[0072] In one possible implementation, S8 specifically includes sub-steps S801 to S804: S801: Generate a seed based on the random matrix and construct the first random matrix RM1, the second random matrix RM2 and the third random matrix RM3.

[0073] Specifically, the random matrix generation seed input random matrix generation module generates a first random matrix RM1, a second random matrix RM2, and a third random matrix RM3 for use in intra-block scan scrambling and differential bit obfuscation.

[0074] Specifically, the random matrix generation module can generate random matrices based on the KSA and PRGA algorithms. First, the initial state array is permuted using the input key or seed to form an initial random state related to the key. Then, the state is iteratively updated using PRGA, and a pseudo-random sequence is output. Finally, the generated pseudo-random sequence is mapped and reconstructed into multiple random matrices (such as RM1, RM2, RM3) according to a predetermined dimension for subsequent scanning scrambling, bit obfuscation, and encryption processes. This achieves a random matrix generation mechanism with low computational complexity, suitable for industrial IoT scenarios, while ensuring randomness and security. KSA permutation and PRGA algorithms are both mature existing technologies and will not be elaborated upon further in this invention.

[0075] S802: Based on the first random matrix RM1, the second random matrix RM2, and the important data stream subkey, perform high-strength encryption on the important data stream based on matrix permutation and confusion to obtain the important ciphertext stream.

[0076] Optionally, S802 specifically includes sub-steps S8021 to S8026: S8021: Use the important data stream subkey to derive the permutation table, the first permutation table, and the second permutation table.

[0077] Specifically, the important data stream subkey is divided into three parts by bit, and each part is used to derive the permutation table, the first permutation table, and the second permutation table, respectively.

[0078] Optionally, a permutation table is generated by sorting the mapping (e.g., shuffling the index based on the subkey), and a first and second permutation table are constructed by lookup table or S-box generation, thereby completing the key-driven parameter initialization.

[0079] S8022: Construct important data streams into multiple sub-matrices.

[0080] Optionally, the important linear data stream can be rearranged into multiple sub-matrices according to preset rules (such as fixed length or two-dimensional size). The data can be divided into two-dimensional block structures of the same size by filling by row or column. If the data length is insufficient, padding is performed to achieve the mapping of data structure from one-dimensional to two-dimensional.

[0081] S8023: Based on the permutation table, randomly select another submatrix to be encrypted for combination and pairing.

[0082] Optionally, a permutation table can be used as an index mapping relationship to map each submatrix number, thereby determining a corresponding paired submatrix for the current submatrix. That is, the corresponding submatrix is ​​found through the permutation function, realizing random pairing between submatrixes.

[0083] In this invention, a pair of submatrices is randomly selected for each submatrix based on a permutation table. This can break the spatial order and correlation of the original data, creating cross-coupling relationships between different submatrices, thereby enhancing the diffusion effect, preventing attackers from inferring the original information through single-block analysis, and improving the overall resistance to statistical analysis.

[0084] S8024: Input the submatrix to be encrypted and its corresponding paired submatrix into the first encryption function and the second encryption function respectively: Where cx represents the result of the first encryption function, f represents the first encryption function, x represents the current submatrix, y represents another paired submatrix selected through the permutation table, S1 represents the first replacement table, S2 represents the second replacement table, and RM1 represents the first random matrix. This indicates a bitwise XOR operation.

[0085] Specifically, the submatrix x is first replaced once using the first replacement table, then a bitwise XOR operation is performed with the first random matrix and the paired submatrix y, and finally a second replacement is performed using the second replacement table.

[0086] Where cy represents the result of the second encryption function, g represents the second encryption function, and RM2 represents the second random matrix.

[0087] Specifically, the paired submatrix y is first replaced once using the second replacement table, then bitwise XORed with the first random matrix and the second random matrix, and finally replaced a second time using the first replacement table.

[0088] In this invention, by constructing dual encryption functions f and g, and introducing substitution operations and random matrix XOR confusion, a multi-layer nonlinear transformation structure of "substitution-confusion-resubstitution" is realized, which makes the data undergo complex changes at both the numerical and structural levels, thereby significantly enhancing the encryption strength. At the same time, the use of random matrices in the operation further improves the diffusion and key sensitivity.

[0089] S8025: Update the submatrix using the result of the first encryption function, and update the paired submatrix using the result of the second encryption function.

[0090] S8026: Convert the updated submatrix into a data stream to form an important ciphertext stream.

[0091] In this invention, the updated submatrix is ​​converted back into a data stream and formed into an important ciphertext stream. This can restore the linear structure of the data while maintaining the integrity of the encryption result, which is convenient for subsequent transmission and storage. At the same time, it ensures that the receiving end can perform reverse reconstruction and decryption according to the same rules, thus achieving effective connection between encryption processing and communication process.

[0092] S803: Based on the third random matrix RM3 and the non-critical data stream subkey, perform low-complexity lightweight encryption on the non-critical data stream based on scan scrambling to obtain the non-critical ciphertext stream.

[0093] Optionally, S803 specifically includes sub-steps S8031 to S8034: S8031: Determine the scanning category and scanning status of each image block based on the third random matrix RM3.

[0094] Specifically, the 5-bit control field corresponding to each image block is read sequentially from the third random matrix RM3. The first 2 bits are used to determine the scan category between B-shaped, Z-shaped and X-shaped scans, and the last 3 bits are used to determine the specific scan state, thereby generating an independent scan strategy for each image block.

[0095] In this invention, the selection of scanning mode is driven by a random matrix, which makes the data access path within the block highly random, effectively disrupting the original spatial structure, improving the unpredictability of the data, and achieving initial confusion with low computational complexity.

[0096] S8032: Perform intra-block scan scrambling on the set of non-representative pixel difference relationships in non-critical data streams according to the scan category and scan status.

[0097] In this invention, by changing the order of data arrangement without changing the numerical values ​​themselves, the spatial correlation of differential data is effectively destroyed, enhancing the resistance to statistical analysis. At the same time, since it only involves index rearrangement, the computational overhead is low.

[0098] S8033: Perform bitwise obfuscation on the scrambled block-level non-representative pixel difference relation set.

[0099] Specifically, the scrambled difference sequence is represented as a bit string and XORed bitwise with a third random matrix RM3 to obtain a lightly obfuscated difference relation sequence. By introducing random bit perturbation, the difference data, which originally had a certain distribution pattern, is further randomized at the bit level, effectively improving diffusion and security, while maintaining the characteristics of simple implementation and high computational efficiency.

[0100] S8034: Use the non-critical data stream subkey to perform a bitwise XOR operation on the bitwise obfuscated block-level non-representative pixel differential relationship set to perform lightweight encryption and obtain a non-critical ciphertext stream.

[0101] Specifically, based on the obfuscation result, a key stream is generated using a non-critical data stream subkey, and a bit-by-bit XOR operation is performed on the differential bit string to complete lightweight encryption and generate a non-critical ciphertext stream. This method, through a final obfuscation step involving the key, strongly binds the encryption result to the key, ensuring security while avoiding the computational burden of complex encryption algorithms. It achieves lightweight yet effective security protection, suitable for large-scale data transmission scenarios in the Industrial Internet of Things (IIoT).

[0102] In this invention, industrial image data is divided into important data streams and non-important data streams, and high-strength encryption and lightweight encryption strategies are used for differentiated encryption processing, avoiding the redundant computational overhead caused by implementing equal-strength protection for all data, thereby improving the overall transmission efficiency while ensuring the security of key image information.

[0103] S804: Outputs a differentiated encryption result containing both important and unimportant ciphertext streams.

[0104] S9: Encapsulates and sends layered encrypted messages via the Industrial Internet of Things (IIoT).

[0105] In one possible implementation, the encrypted communication method for industrial IoT devices further includes: S10: The receiving end performs layered decryption, inverse transformation and image reconstruction to recover industrial image data.

[0106] It should be noted that the decryption process is the reverse of the encryption process. To avoid excessive repetition, this invention only provides a general description of the decryption process. The process involves receiving layered encrypted messages and parsing out important and non-important ciphertext streams, achieving initial separation of data at different security levels and establishing a data foundation for subsequent hierarchical decryption. Elliptic curve operations are performed based on the receiver's private key and the sender's temporary point to recover the shared point. A session master key is then generated by combining the timestamp and device identifier, enabling secure session recovery without transmitting sensitive keys. Using the session master key, important data stream subkeys, non-important data stream subkeys, and a random matrix seed are generated through a key derivation mechanism. This allows for the independent generation of decryption parameters for different data streams, ensuring the security and isolation of the hierarchical decryption process. The first, second, and third random matrices are reconstructed based on the random matrix seed, ensuring that the decryption end maintains a consistent random perturbation structure with the encryption end, providing a foundation for subsequent de-obfuscation and descrambling operations. For non-critical ciphertext streams, key XOR decryption, random matrix inverse obfuscation, and scan-mode-based inverse scrambling are performed sequentially to gradually recover the block-level non-representative pixel difference relationship set, achieving efficient restoration of lightweight data. For critical ciphertext streams, submatrix reconstruction, inverse substitution, and inverse obfuscation are performed, and the original content of the submatrix is ​​restored by combining the permutation relationship, thus completing the inverse operation of the high-strength encryption structure and restoring the critical data stream. For critical data streams, Tier-2 unpacking, Tier-1 decoding, inverse wavelet transform, and JPEG2000 inverse preprocessing are performed to gradually restore the important image base and the important pixel set, achieving complete decoding of compressed data. Based on the restored representative pixels and difference relationships, non-representative pixels in each image block are reconstructed through differential superposition, achieving pixel restoration at the image block level and ensuring the accuracy of data reconstruction. All reconstructed image blocks are stitched together according to their original spatial positions to restore complete industrial image data, achieving a closed loop from encrypted transmission to original image reconstruction.

[0107] Reference manual attached Figure 2 The diagram shows a structural schematic of an encrypted communication system for industrial Internet of Things (IoT) devices provided by the present invention.

[0108] The present invention also provides an encrypted communication system 20 for industrial IoT devices, applied to the above-mentioned encrypted communication method for industrial IoT devices, comprising: Processor 201.

[0109] The memory 202 stores computer-readable instructions, which, when executed by the processor 201, implement the encrypted communication method for industrial IoT devices as described in the method embodiment.

[0110] The industrial IoT device encrypted communication system 20 provided by the present invention can execute the above-mentioned industrial IoT device encrypted communication method and achieve the same or similar technical effects. To avoid duplication, the present invention will not elaborate further.

[0111] It should be understood that the processor in the embodiments of the present invention can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0112] It should also be understood that the memory in the embodiments of the present invention can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDR SDRAM), enhanced synchronous DRAM (ESDRAM), synchronous linked DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0113] The above embodiments can be implemented, in whole or in part, by software, hardware (such as circuits), firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0114] It should be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. A and B can be singular or plural. Additionally, the character " / " in this article generally indicates an "or" relationship between the preceding and following related objects, but it can also represent an "and / or" relationship. Please refer to the context for a more accurate understanding.

[0115] In this invention, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of a single item or a plurality of items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be a single item or multiple items.

[0116] It should be understood that, in various embodiments of the present invention, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0117] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0118] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the devices, apparatuses, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0119] In the several embodiments provided by this invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0120] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0121] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0122] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0123] This invention provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the encrypted communication method for industrial IoT devices as described in the method embodiments.

[0124] The present invention provides a computer-readable storage medium that can implement the steps and effects of the encrypted communication method for industrial IoT devices described in the above method embodiments. To avoid repetition, the present invention will not repeat them.

[0125] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

[0126] The following points need to be explained: (1) The accompanying drawings of the embodiments of the present invention only involve the structures involved in the embodiments of the present invention. Other structures can refer to the general design.

[0127] (2) For clarity, the thickness of layers or regions is enlarged or reduced in the drawings used to describe embodiments of the invention, i.e., these drawings are not drawn to scale. It is understood that when an element such as a layer, film, region or substrate is referred to as being “above” or “below” another element, the element may be “directly” located “above” or “below” the other element or there may be intermediate elements.

[0128] (3) Where there is no conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other to obtain new embodiments.

[0129] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. The scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for encrypted communication of industrial Internet of Things (IoT) devices, characterized in that, include: S1: Acquire industrial image data to be transmitted; S2: The industrial image data is divided into blocks to obtain multiple image blocks; S3: Extract representative pixels from each of the image blocks, and sort the representative pixels according to the block number to form an important pixel set; S4: Compress the set of important pixels to form an important data stream; S5: Calculate the difference between other non-representative pixels in each image block and the representative pixel, and merge the difference values ​​according to the block number to form a block-level non-representative pixel difference relationship set; S6: Encode the block-level non-representative pixel difference relationship set to form a non-important data stream; S7: Establish a session negotiation based on elliptic curve cryptography and derive hierarchical encryption parameters; S8: Using the hierarchical encryption parameters, perform differentiated encryption processing on the important data stream and the non-important data stream to obtain hierarchical encrypted messages; S9: Encapsulate and send the layered encrypted message via the Industrial Internet of Things.

2. The encrypted communication method for industrial IoT devices according to claim 1, characterized in that, The representative pixel is the pixel corresponding to the minimum pixel value, maximum pixel value, or average pixel value within the block.

3. The encrypted communication method for industrial IoT devices according to claim 1, characterized in that, S4 specifically includes: S401: Rearrange the set of important pixels to obtain an important image base; S402: Perform JPEG2000 preprocessing on the important image substrate; S403: Perform a two-dimensional discrete wavelet transform on the preprocessed important image basis; S404: Obtain subband coefficients containing detail information from the two-dimensional discrete wavelet transform result; S405: Perform Tier-1 encoding on the subband coefficients containing detailed information; S406: Perform Tier-2 packing and rate control on the Tier-1 encoding results to form the important data stream.

4. The encrypted communication method for industrial IoT devices according to claim 1, characterized in that, S6 specifically includes: S601: Determine the difference sparsity coefficient in each image block based on the difference values ​​in the block-level non-representative pixel difference relationship set; S602: Determine whether the differential sparsity coefficient in the image block is greater than a preset coefficient; if so, it indicates that a large number of pixels in the block are close to the representative pixel, and a high compression ratio coding technique is used to encode the differential values ​​in the block-level non-representative pixel differential relationship set with a high compression ratio; otherwise, it indicates that the differentials in the block are scattered, and a high fidelity coding technique is used to encode the differential values ​​in the block-level non-representative pixel differential relationship set with a high compression ratio. S603: The encoding results of each image block are concatenated in block order to form the non-critical data stream.

5. The encrypted communication method for industrial IoT devices according to claim 1, characterized in that, Specifically, S7 includes: S701: Generate private and public keys based on elliptic curve cryptography; S702: The sending end constructs a session random number and calculates a temporary point; S703: The sending end generates a shared point and constructs a session secret; S704: Concatenate and hash the coordinates, timestamp, and device identifier of the shared point to derive the session master key; S705: Based on the session master key, derive hierarchical encryption parameters, which include: important data stream subkeys, non-important data stream keys, and a random matrix generation seed; S706: Output a set of hierarchical encryption parameters.

6. The encrypted communication method for industrial IoT devices according to claim 5, characterized in that, S8 specifically includes: S801: Generate a seed based on the random matrix, and construct a first random matrix, a second random matrix, and a third random matrix; S802: Based on the first random matrix, the second random matrix, and the important data stream subkey, perform high-strength encryption on the important data stream based on matrix permutation and confusion to obtain the important ciphertext stream; S803: Based on the third random matrix and the non-critical data stream subkey, perform low-complexity lightweight encryption on the non-critical data stream based on scan scrambling to obtain the non-critical ciphertext stream; S804: Output a differentiated encryption result containing the important ciphertext stream and the non-important ciphertext stream.

7. The encrypted communication method for industrial IoT devices according to claim 6, characterized in that, Specifically, S802 includes: S8021: Use the important data stream subkey to derive a permutation table, a first replacement table, and a second replacement table; S8022: Construct the important data stream into multiple sub-matrices; S8023: Based on the permutation table, randomly select another submatrix to be encrypted for combination and pairing; S8024: Input the submatrix to be encrypted and the corresponding paired submatrix into the first encryption function and the second encryption function respectively; S8025: Update the submatrix using the result of the first encryption function, and update the paired submatrix using the result of the second encryption function; S8026: Convert the updated submatrix into a data stream to form the important ciphertext stream.

8. The encrypted communication method for industrial IoT devices according to claim 6, characterized in that, Specifically, S803 includes: S8031: Determine the scanning category and scanning status of each image block according to the third random matrix; S8032: Based on the scan category and the scan state, perform intra-block scan scrambling on the block-level non-representative pixel difference relationship set in the non-critical data stream; S8033: Perform bitwise obfuscation on the scrambled block-level non-representative pixel difference relation set; S8034: Use the non-critical data stream subkey to perform a bitwise XOR operation on the bitwise obfuscated block-level non-representative pixel differential relationship set to perform lightweight encryption, thereby obtaining the non-critical ciphertext stream.

9. The encrypted communication method for industrial IoT devices according to claim 1, characterized in that, Also includes: S10: The receiving end performs layered decryption, inverse transformation and image reconstruction to recover the industrial image data.

10. An encrypted communication system for industrial Internet of Things (IoT) devices, characterized in that, include: processor; A memory storing computer-readable instructions, which, when executed by the processor, implement the encrypted communication method for industrial IoT devices as described in any one of claims 1 to 9.

Images