Data right system and method based on industrial internet, electronic device and medium

Abstract

This invention provides a data ownership confirmation system, method, electronic device, and medium based on the Industrial Internet, belonging to the field of active identification carriers in the Industrial Internet. The system includes: an active identification carrier for actively initiating connections to identification resolution service nodes or identification data application platforms; a trusted execution environment for executing sensitive code and processing sensitive data; a data template for defining the specific format for identification registration; a data encryption and transmission module for encrypting collected data and transmitting encrypted data through a data upload interface; and a blockchain service platform for receiving encrypted data and storing it on the blockchain. By constructing an immutable hardware module for the active identification carrier, the trustworthiness of the data is ensured. Encrypted transmission based on active identification ensures data transmission security and supports the trustworthiness of data ownership confirmation. The blockchain ensures data security at each stage, preventing data tampering and supporting the trustworthiness of data ownership confirmation.

Description

Technical Field

[0001] This invention relates to the field of active identification carrier technology in the industrial internet, specifically to a data ownership confirmation system, method, electronic device, and medium based on the industrial internet. Background Technology

[0002] Industrial data is a crucial asset in the digital economy era, and establishing a standardized data ownership system is a vital support for data transactions. Data resources generally have relatively complex ownership relationships, often involving privacy, ownership protection, and profit distribution during their use. Digital watermarking is a commonly used technology in data ownership confirmation. However, relying solely on digital watermarking for data ownership confirmation presents significant copyright trust issues.

[0003] Existing technologies, based on the characteristics of blockchain such as "unforgeable," "fully traceable," "traceable," "transparent," and "collectively maintained," verify the validity of information and propose using blockchain to achieve data notarization technology. Users can store their own data on the blockchain. When proof of data ownership is needed, it can serve as evidence for data ownership confirmation. The drawback is that it cannot verify the validity of data before it was uploaded to the blockchain and cannot trace the source of the data. Summary of the Invention

[0004] The purpose of this invention is to provide a data ownership confirmation system, method, electronic device, and medium based on the Industrial Internet, which can solve all or at least part of the technical problems existing in the prior art.

[0005] To achieve the above objectives, embodiments of the present invention provide a data ownership confirmation system based on the Industrial Internet, comprising: Active identification carrier: Embedded inside industrial equipment or industrial terminals, it carries identification codes, necessary security certificates, algorithms and keys, and has network communication capabilities, used to actively initiate connections to identification resolution service nodes or identification data application platforms; Trusted Execution Environment: Located inside industrial equipment or industrial terminals, it is used to execute sensitive code and process sensitive data to ensure the immutability of identifiers and keys; Data template: Created on the Industrial Internet Identifier Resolution Secondary Node Platform, used to define the specific format for identifier registration; Data encryption and transmission module: Encrypts the collected data in the trusted execution environment of the industrial terminal, and transmits the encrypted data through the data upload interface of the Industrial Internet Identifier Resolution Secondary Node Platform; Blockchain service platform: Receives encrypted data and stores it on the blockchain to ensure the data's tamper-proof nature and traceability.

[0006] Optionally, the active identification carrier is integrated with the circuit board of industrial equipment or industrial terminal and binds identification data items when collecting data. The active identification carrier may be in the form of a chip, module or board.

[0007] Optionally, when the industrial terminal starts up, the BootLoader performs hash processing on the active identifier and key stored in the trusted execution environment to generate a hash value, and compares the generated hash value with the pre-stored hash value. If they match, it indicates that the active identifier and key have not been tampered with.

[0008] Optionally, the data template may include at least the industry classification of the industrial terminal, the identifier prefix, and key information of the data items.

[0009] Optionally, the data encryption and transmission module uses a symmetric encryption algorithm to encrypt the data collected by the industrial terminal, and transmits the encrypted data over the network through the data upload interface of the Industrial Internet Identifier Resolution Secondary Node Platform.

[0010] Optionally, when creating a data template on the Industrial Internet Identifier Resolution Secondary Node Platform, the blockchain notarization option can be selected, enabling the Industrial Internet Identifier Resolution Secondary Node Platform to store the data on the blockchain while receiving encrypted data, and to confirm the writer's ownership and control of the data through the digital signature of the blockchain transaction.

[0011] Optionally, when the industrial terminal calls the data upload interface, the Industrial Internet Identifier Resolution Secondary Node Platform will store parameters including business ID, business type, encryption type and evidence storage data on the blockchain. After receiving the parameter information, the blockchain service platform will write the parameters completely into the blockchain in the form of a JSON string. After the evidence storage is completed, the Industrial Internet Identifier Resolution Secondary Node Platform will return the request result information, status code and hash value of the data.

[0012] On the other hand, the present invention also provides a data ownership confirmation method based on the Industrial Internet applied to an Industrial Internet-based data ownership confirmation system, comprising: Embed active identification carriers in industrial equipment or industrial terminals and integrate them with trusted execution environments; Create a data template on the Industrial Internet Identifier Resolution Secondary Node Platform; Data collected by industrial terminals is encrypted in a trusted execution environment, and the encrypted data is transmitted through the data upload interface of the Industrial Internet Identifier Resolution Secondary Node Platform. Encrypted data is stored on the blockchain through a blockchain service platform to achieve data tamper-proofing and traceability.

[0013] On the other hand, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the data rights confirmation method based on the Industrial Internet described above.

[0014] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the data ownership confirmation method based on the Industrial Internet described above.

[0015] The above technical solution constructs an immutable hardware module for active identification carriers, sets an enterprise prefix at the factory, and binds all enterprises to the data through this prefix, ensuring data trustworthiness. Encrypted transmission based on active identification in the Industrial Internet ensures data transmission security and supports the trustworthiness of data ownership confirmation. A blockchain data traceability system guarantees data security during storage and retrieval, ensuring data is not tampered with and supporting the trustworthiness of data ownership confirmation.

[0016] Other features and advantages of the embodiments of the present invention will be described in detail in the following detailed description section. Attached Figure Description

[0017] The accompanying drawings are provided to further illustrate embodiments of the present invention and form part of the specification. They are used together with the following detailed description to explain the embodiments of the present invention, but do not constitute a limitation thereof. In the drawings: Figure 1 This is a schematic diagram of the structure of a data ownership confirmation system based on the Industrial Internet provided in an embodiment of the present invention; Figure 2 This is a VAA encoding format provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of an ARM platform with TrustZone enabled according to an embodiment of the present invention; Figure 4 This is an implementation flowchart of a data ownership confirmation method based on the Industrial Internet, provided by an embodiment of the present invention and applied to an Industrial Internet-based data ownership confirmation system. Detailed Implementation

[0018] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit the scope of the present invention.

[0019] See Figure 1The diagram shown is a structural schematic of a data ownership confirmation system based on the Industrial Internet provided in an embodiment of the present invention, comprising: Active identification carrier: Embedded inside industrial equipment or industrial terminals, it carries a unique identification code, necessary security certificates, algorithms and keys, and has network communication capabilities, used to actively initiate connections to identification resolution service nodes or identification data application platforms; Trusted Execution Environment: Located inside industrial equipment or industrial terminals, it is used to execute sensitive code and process sensitive data to ensure the immutability of identifiers and keys; Data template: Created on the Industrial Internet Identifier Resolution Secondary Node Platform, used to define the specific format for identifier registration; Data encryption and transmission module: Encrypts the collected data in the trusted execution environment of the industrial terminal, and transmits the encrypted data through the data upload interface of the Industrial Internet Identifier Resolution Secondary Node Platform; Blockchain service platform: Receives encrypted data and stores it on the blockchain to ensure the data's tamper-proof nature and traceability.

[0020] In one specific implementation, 1) the relationship between the identifier-bound data and the active identifier carrier is identified: (1) The uniqueness of the identifier is the foundation of data traceability: an identifier is a unique code for a physical object in the digital world, serving as the physical object's "identity card" in the data. Currently, the world's mainstream encoding standards include VAA, OID, HANDLE, Ecode, GS1, etc. For example... Figure 2 The VAA encoding format shown is: Issuing Organization Code (VAA) + Service Organization Code (08810012345678) + Separator ( / ) + Internal Enterprise Code (abc123). See Table 1 for a description of its structure. Table 1: VAA Encoding Structure Description

[0021] (2) The integration of active identification carriers with industrial equipment or industrial terminals ensures the reliability of the source of industrial data.

[0022] The active identifier is embedded within the device, carrying the identifier code, necessary security certificates, algorithms, and keys. It has network communication capabilities and actively initiates connections to identifier resolution service nodes or identifier data application platforms without requiring an identifier reader / writer device to trigger the connection. The active identifier carriers involved in this patent come in several forms, including chips, modules, and boards.

[0023] When designing the circuit board of industrial equipment or industrial terminals, select an MCU with active identification, and add identification data items when the industrial equipment or terminal collects data, thereby binding the correspondence between the data and the industrial equipment or industrial terminal.

[0024] For example, in industrial terminals without active identification, the collected data is as follows: { Temperature: '20' Humidity: '38' After the industrial terminal adds an identifier, the data collected will be in the following format: { VAA: '88.178.125 / abc123' Temperature: '20' Humidity: '38' This way, when tracing the source of this data, we can know which industrial terminal it came from.

[0025] It should be understood that a TEE (Trusted Execution Environment) is a separate, secure area used for executing sensitive code and processing sensitive data. It achieves isolation and protection through a combination of hardware and software, ensuring that sensitive information remains secure even if the device is attacked or compromised. Examples of TEEs include, but are not limited to: Intel Software Guard eXtensions (SGX), AMD Memory Encryption Technologies, ARM TrustZone Technology, x86 system management mode, AMD platform security processors, and Intel Management Engine (ME).

[0026] ARM TrustZone technology is a hardware feature that, since around 2002 with ARMv6, has created an isolated execution environment. Similar to other hardware isolation technologies, it provides two environments, or worlds. The Trusted Execution Environment (TEE) is called the secure world, and the Rich Execution Environment (REE) is called the normal world. To ensure complete isolation between the secure and normal worlds, TrustZone provides security extensions for hardware components including the CPU, memory, and peripherals.

[0027] On ARM platforms with TrustZone enabled, CPUs have two security modes: security mode and normal mode. Figure 3 This displays the processor modes in an ARM platform with TrustZone enabled. Each processor mode has its own memory access regions and permissions. Code running in normal mode cannot access memory in safe mode, while programs executing in safe mode can access memory in normal mode. Safe mode and normal mode can be identified by reading the NS bit in the Security Configuration Register (SCR), which can only be modified in safe mode.

[0028] (4) When designing industrial terminals, select MCUs with TEE capabilities and store industrial terminal identifiers and communication encryption keys in a TEE secure environment to ensure that the identity of industrial terminals and keys are tamper-proof, thereby ensuring the reliability of data ownership confirmation.

[0029] In some implementations, the active identification carrier is integrated with the circuit board of industrial equipment or industrial terminal and binds identification data items when collecting data. The active identification carrier may be in the form of a chip, module or board.

[0030] In some implementations, when the industrial terminal starts up, the BootLoader performs hash processing on the active identifier and key stored in the trusted execution environment to generate a hash value, and compares the generated hash value with the pre-stored hash value. If they match, it indicates that the active identifier and key have not been tampered with.

[0031] Specifically, when the industrial terminal starts up, the BootLoader performs hashing on the active identifier and key stored in the secure area to generate a hash value. This hash value is then compared with the hash value stored in the secure storage area. If the generated hash value matches the expected hash value or the hash value stored in the secure storage area, it indicates that the active identifier and key have not been tampered with. After the verification result is correct, the industrial terminal application (APP) in the REE area is verified to ensure that the APP program has not been modified. Only after the detection passes can the APP enter the normal working program.

[0032] In some implementations, the data template includes at least the industry classification of the industrial terminal, the identifier prefix, and key information of the data items.

[0033] Specifically, a template is a format specification used to define the specific format for identifier registration. It covers key information about the identifier, such as the industry classification of the industrial terminal, the identifier prefix, and data items. When registering an identifier, the information entered must strictly adhere to the template requirements. These templates are typically developed by the enterprise itself according to its needs to ensure standardization of the registration process and accuracy of the information. After the data template is created, a key is first written into the TEE environment of the industrial terminal. Then, the data collected by the industrial terminal (such as temperature and humidity) is encrypted using the selected encryption algorithm. Finally, the data upload interface is called to transmit the encrypted data. Taking a symmetric encryption algorithm as an example, the industrial terminal encrypts the original data using a symmetric encryption algorithm to obtain ciphertext; the industrial terminal then transmits the ciphertext over the network.

[0034] In some implementations, the data encryption and transmission module uses a symmetric encryption algorithm to encrypt the data collected by the industrial terminal, and transmits the encrypted data over the network through the data upload interface of the Industrial Internet Identifier Resolution Secondary Node Platform.

[0035] It should be understood that data collected by industrial terminals refers to various information and data generated in the process of industrial production, operation, management, and technology development, including production data, quality data, sales data, and R&D data.

[0036] Specifically, the data encryption and transmission module uses a symmetric encryption algorithm to encrypt data collected by the industrial terminal. This process includes selecting a secure key, typically 128, 192, or 256 bits in length. In AES128, the key length is 128 bits. The data collected by the industrial terminal to be encrypted is divided into blocks according to a preset block length. If the data length is not a multiple of 128 bits, padding is required to ensure each data block meets the block length requirement. The generated key is XORed with the first data block as the starting step of the encryption process. A series of round operations are performed on each data block, including byte substitution, row shifting, column obfuscation, and round key addition. Byte substitution: Bytes are substituted using an S-box (substitution table). Row shifting: Bytes in each row are cyclically shifted. Column obfuscation: Bytes in each column are linearly transformed. Round key addition: In each round, the round key for the current round is XORed with the data block. The above round operations are repeated according to the key length (e.g., 128 bits) and the number of encryption rounds until the last round. After the final round of computation, the round key and the data blocks from the final round are XORed again to obtain the final ciphertext.

[0037] In summary, the data encryption and transmission module employs a symmetric encryption algorithm to encrypt data collected by industrial terminals. This process involves multiple steps, including key generation, data segmentation, initial round key addition, round operations, repeated round operations, final round key addition, and data transmission. These steps collectively ensure the confidentiality and integrity of the data during transmission.

[0038] In some implementations, when creating a data template on the Industrial Internet Identifier Resolution Secondary Node Platform, the blockchain notarization option can be selected, enabling the Industrial Internet Identifier Resolution Secondary Node Platform to store the data on the blockchain while receiving encrypted data, and to confirm the writer's ownership and control of the data through the digital signature of the blockchain transaction.

[0039] In some implementations, when an industrial terminal calls the data upload interface, the Industrial Internet Identifier Resolution Secondary Node Platform stores parameters including business ID, business type, encryption type, and evidence storage data on the blockchain. After receiving the parameter information, the blockchain service platform writes the parameters completely into the blockchain in the form of a JSON string. After the evidence storage is completed, the Industrial Internet Identifier Resolution Secondary Node Platform returns the request result information, status code, and hash value of the data.

[0040] In some implementations, the issue of industrial data ownership mainly manifests in unclear data sources, difficulty in guaranteeing data authenticity, and insufficient data privacy protection. This application ensures the authenticity and reliability of data from its source to its storage through industrial internet active identification carriers, TEE, data encryption, and blockchain notarization.

[0041] See Figure 4 The diagram shown is an implementation flowchart of a data ownership confirmation method based on the Industrial Internet, applied to an Industrial Internet-based data ownership confirmation system, according to an embodiment of the present invention. The method includes the following execution steps: Step 400: Embed an active identification carrier in industrial equipment or industrial terminals and integrate a trusted execution environment.

[0042] Step 401: Create a data template on the Industrial Internet Identifier Resolution Secondary Node Platform.

[0043] Step 402: Encrypt the data collected by the industrial terminal in the trusted execution environment, and transmit the encrypted data through the data upload interface of the Industrial Internet Identifier Resolution Secondary Node Platform.

[0044] Step 403: Store the encrypted data on the blockchain service platform to achieve data tamper-proofing and traceability.

[0045] The technical effects achieved by this application are as follows: By constructing an immutable hardware module for active identification carriers and setting an enterprise prefix at the factory, the data is bound to all enterprises through this prefix, ensuring data trustworthiness. Encrypted transmission based on active identification in the Industrial Internet ensures data transmission security and supports the trustworthiness of data ownership confirmation. A blockchain data traceability system ensures data security during storage and retrieval, guaranteeing data integrity and supporting the trustworthiness of data ownership confirmation.

[0046] On the other hand, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the data rights confirmation method based on the Industrial Internet described above.

[0047] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the data ownership confirmation method based on the Industrial Internet described above.

[0048] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0049] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0050] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0051] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0052] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0053] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, like read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0054] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0055] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0056] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A data ownership confirmation system based on the Industrial Internet, characterized in that, include: Active identification carrier: Embedded inside industrial equipment or industrial terminals, it carries identification codes, necessary security certificates, algorithms and keys, and has network communication capabilities, used to actively initiate connections to identification resolution service nodes or identification data application platforms; Trusted Execution Environment: Located inside industrial equipment or industrial terminals, it is used to execute sensitive code and process sensitive data to ensure the immutability of identifiers and keys; Data template: Created on the Industrial Internet Identifier Resolution Secondary Node Platform, used to define the specific format for identifier registration; Data encryption and transmission module: Encrypts the collected data in the trusted execution environment of the industrial terminal, and transmits the encrypted data through the data upload interface of the Industrial Internet Identifier Resolution Secondary Node Platform; Blockchain service platform: Receives encrypted data and stores it on the blockchain to ensure the data's tamper-proof nature and traceability.

2. The data ownership confirmation system based on the Industrial Internet according to claim 1, characterized in that, The active identification carrier is integrated with the circuit board of industrial equipment or industrial terminal and binds identification data items when collecting data. The active identification carrier may be in the form of a chip, module or board.

3. The data ownership confirmation system based on the Industrial Internet according to claim 1, characterized in that, When the industrial terminal starts up, the BootLoader performs hash processing on the active identifier and key stored in the trusted execution environment to generate a hash value, and compares the generated hash value with the pre-stored hash value. If they match, it indicates that the active identifier and key have not been tampered with.

4. The data ownership confirmation system based on the Industrial Internet according to claim 1, characterized in that, The data template includes at least the industry classification of the industrial terminal, the identifier prefix, and key information of the data items.

5. The data ownership confirmation system based on the Industrial Internet according to claim 1, characterized in that, The data encryption and transmission module uses a symmetric encryption algorithm to encrypt the data collected by the industrial terminal, and transmits the encrypted data over the network through the data upload interface of the Industrial Internet Identifier Resolution Secondary Node Platform.

6. The data ownership confirmation system based on the Industrial Internet according to claim 1, characterized in that, When creating a data template on the Industrial Internet Identifier Resolution Secondary Node Platform, the blockchain notarization option can be selected. This allows the Industrial Internet Identifier Resolution Secondary Node Platform to store the data on the blockchain while receiving encrypted data, and to confirm the writer's ownership and control of the data through the digital signature of the blockchain transaction.

7. The data ownership confirmation system based on the Industrial Internet according to claim 1, characterized in that, When an industrial terminal calls the data upload interface, the Industrial Internet Identifier Resolution Secondary Node Platform stores parameters including business ID, business type, encryption type, and evidence storage data on the blockchain. After receiving the parameter information, the blockchain service platform writes the parameters completely into the blockchain in the form of a JSON string. After the evidence storage is completed, the Industrial Internet Identifier Resolution Secondary Node Platform returns the request result information, status code, and hash value of the data.

8. A data ownership confirmation method based on the Industrial Internet, applied to the data ownership confirmation system based on the Industrial Internet as described in any one of claims 1-7, characterized in that, include: Embed active identification carriers in industrial equipment or industrial terminals and integrate them with trusted execution environments; Create a data template on the Industrial Internet Identifier Resolution Secondary Node Platform; Data collected by industrial terminals is encrypted in a trusted execution environment, and the encrypted data is transmitted through the data upload interface of the Industrial Internet Identifier Resolution Secondary Node Platform. Encrypted data is stored on the blockchain through a blockchain service platform to achieve data tamper-proofing and traceability.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the data ownership confirmation method based on the Industrial Internet as described in claim 8.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the data ownership confirmation method based on the Industrial Internet as described in claim 8.

Images