Long-distance pipeline network data security acquisition system, method and electronic equipment

Abstract

This application discloses a data security acquisition system, method, and electronic device for long-distance pipeline networks, relating to the field of pipeline data acquisition technology. It aims to improve the security of data acquisition in long-distance pipeline networks and meet the high reliability and high security requirements of such acquisition. The system includes: a data sensing module, a security management module, and a data acquisition module. The data sensing module is used to: acquire raw data packets from the long-distance pipeline network based on one or more sensors, each sensor's built-in chip corresponding to a universally unique identifier (UUID). The security management module is used to: verify the validity of the UUID of each sensor and instruct the data sensing module to discard raw data packets acquired by sensors that fail the validity verification. The data acquisition module is used to: determine the valid raw data packets acquired by sensors that pass the validity verification, and process the valid raw data packets to generate valid data packets.

Description

Technical Field

[0001] This application relates to the field of pipeline data acquisition technology, and in particular to a long-distance pipeline network data security acquisition system, method and electronic equipment. Background Technology

[0002] Long-distance pipelines are crucial infrastructure for transporting energy sources such as oil and natural gas. These pipelines are long, span large distances, and operate in complex environments, with numerous data collection points distributed along their routes. Data collection is a core component of long-distance pipeline production and operation. The collected data encompasses key parameters and operational information such as pressure, temperature, flow rate, vibration, and stress. It serves as a vital basis for long-distance pipeline condition monitoring, dispatch control, and safe operation and maintenance, directly impacting the production safety and economic benefits of oil and gas pipeline networks.

[0003] However, the relevant technologies have insufficient security when collecting data from long-distance pipelines, making it difficult to guarantee the authenticity and validity of the collected data, and failing to meet the high reliability and high security requirements of long-distance pipelines. Summary of the Invention

[0004] The purpose of this application is to provide a data security acquisition system, method and electronic device for long-distance pipeline networks, which can improve the security of data acquisition in long-distance pipeline networks and meet the high reliability and high security acquisition requirements of long-distance pipeline networks.

[0005] In a first aspect, this application provides a long-distance pipeline network data security acquisition system, comprising: a data sensing module, a security management module, and a data acquisition module; The data sensing module is used to: collect raw data packets of the long-distance pipeline network based on one or more sensors. Each sensor's built-in chip corresponds to a universally unique identifier (UUID). The raw data packets include: external environmental parameters of the location of the long-distance pipeline network and internal operating data of the long-distance pipeline network. The security management module is used to: verify the validity of the UUID of each sensor and instruct the data sensing module to discard the raw data packets collected by sensors that fail the validity verification. The data acquisition module is used to: determine the legal raw data packets collected by sensors that have passed the legality verification, and generate valid data packets by processing the legal raw data packets.

[0006] The long-distance pipeline data security acquisition system provided in this application offers at least the following advantages: Compared to related technologies where long-distance pipeline data acquisition suffers from insufficient security, difficulty in effectively guaranteeing the authenticity and validity of data, and inability to meet the high reliability and high security acquisition requirements of long-distance pipelines, the long-distance pipeline data security acquisition system provided in this application, by setting up a data sensing module, a security management module, and a data acquisition module, and configuring a unique UUID for each sensor, can verify the validity of each sensor's UUID, discarding raw data packets collected by unqualified sensors, and only processing data collected by qualified sensors. This allows for sensor identification and screening at the source of data acquisition, preventing the collection of untrusted raw data packets, effectively improving the security of long-distance pipeline data acquisition, ensuring the authenticity and validity of the acquired data, and meeting the high reliability and high security acquisition requirements of long-distance pipelines.

[0007] In some embodiments, the system further includes: a data security processing module; The security management module is also used to: perform real-time digital signatures on valid data packets based on a preset signature algorithm to generate secure data packets. Each secure data packet includes a timestamp, a digital signature, and the UUID of the sensor corresponding to each secure data packet. The data security processing module is used to: obtain security data packets from the security management module, and encrypt the security data packets based on a preset encryption algorithm to obtain encrypted data packets.

[0008] In some embodiments, the system further includes: a network communication module and a data security transmission module; The network communication module is used to: detect the signal strength of the communication link and determine the target transmission link based on the signal strength; The data security transmission module is used to: obtain encrypted data packets from the data security processing module; perform secondary link encryption on the encrypted data packets based on the Virtual Private Network (VPN) encrypted tunnel and Hypertext Transfer Protocol Secure (HTTPS) to generate double-layer encrypted data packets; and send the double-layer encrypted data packets based on the target transmission link.

[0009] In some embodiments, the system further includes: an anti-tampering module and an edge storage module; The anti-tampering module is used to: detect the physical and firmware status of the system; if the detection fails, discard the double-encrypted data packet and send an alarm signal to the security management module through the network communication module; if the detection passes, send the detection result to the security management module. The security management module is also used to perform permission verification on the system's local data storage when the received detection result is that the detection has passed. The edge storage module is used to locally encrypt and cache double-encrypted data packets after the permission verification is passed.

[0010] Secondly, this application provides a method for secure data acquisition in long-distance pipeline networks, employing a secure data acquisition system for long-distance pipeline networks as described in the first aspect. The method includes: The raw data packets of the long-distance pipeline network are collected by one or more sensors, and each sensor's built-in chip corresponds to a UUID. The raw data packets include: external environmental parameters of the location of the long-distance pipeline network and internal operating data of the long-distance pipeline network. The validity of the UUID of each sensor is verified, and the data sensing module is instructed to discard the raw data packets collected by the sensors that fail the validity verification. The system identifies valid raw data packets collected by sensors that have passed legality verification. These valid raw data packets are then processed to generate effective data packets.

[0011] Thirdly, this application provides an electronic device, including: a processor and a memory configured to store processor-executable instructions; wherein the processor is configured to execute the instructions to implement the long-distance pipeline data security acquisition method provided in the second aspect and any possible implementation thereof.

[0012] Fourthly, this application provides a computer-readable storage medium storing instructions that, when executed by a device, enable the device to perform the long-distance pipeline data security acquisition method provided in the second aspect and any possible implementation thereof.

[0013] Fifthly, this application provides a computer program product including computer instructions that, when executed on a device's processor, enable the device to perform the long-distance pipeline data security acquisition method provided in the second aspect above and any possible implementation thereof.

[0014] It should be noted that the beneficial effects of the technical solutions and corresponding possible implementations of the second to fifth aspects of this application can be found in the above description of the technical effects of the first aspect and its corresponding possible implementations, and will not be repeated here. Attached Figure Description

[0015] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 A schematic diagram of the structure of a long-distance pipeline network data security acquisition system provided in this application embodiment; Figure 2 A flowchart illustrating a method for secure data acquisition in long-distance pipeline networks, provided in this application embodiment; Figure 3 A flowchart illustrating another method for secure data acquisition in long-distance pipeline networks provided in this application embodiment; Figure 4 A flowchart illustrating another method for secure data acquisition in long-distance pipeline networks provided in this application embodiment; Figure 5 A flowchart illustrating another method for secure data acquisition in long-distance pipeline networks provided in this application embodiment; Figure 6 A flowchart illustrating another method for secure data acquisition in long-distance pipeline networks provided in this application embodiment; Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0017] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0018] In the description of this application, it should be understood that the terms "upper," "lower," "left," "right," "front," "rear," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or relative positional relationship shown in the accompanying drawings. They are used only for the convenience of describing this application and for simplification, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application. Unless otherwise specified, the above-mentioned orientational descriptions can be flexibly set in practical applications, provided that the relative positional relationships shown in the accompanying drawings are satisfied.

[0019] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0020] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the terms "installation," "connection," "linking," and "communication" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection. They can refer to a direct connection or an indirect connection through an intermediate medium, or a connection within two components. Those skilled in the art can understand the specific meaning of the above terms in this application according to the specific circumstances.

[0021] In embodiments of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, article, or apparatus that includes that element.

[0022] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0023] In the description of this specification, specific features, structures, materials, or characteristics may be combined in any suitable manner in one or more embodiments or examples.

[0024] As mentioned in the background technology, data acquisition is a core component of long-distance pipeline production and operation. The acquired data typically includes parameters such as pressure, temperature, flow rate, vibration, and stress. The security and accuracy of this data directly affect the safety and economic benefits of oil and gas pipeline network production. However, related technologies suffer from insufficient security when acquiring data for long-distance pipelines. For example, data acquisition equipment is susceptible to physical tampering (e.g., sensor replacement, malware implantation in firmware), and there is a lack of effective authentication mechanisms. This results in unreliable data at the source, making it difficult to guarantee the authenticity and validity of the data, and failing to meet the high reliability and high security requirements of long-distance pipeline networks.

[0025] Based on this, this application provides a long-distance pipeline network data security acquisition system, which can improve the security of long-distance pipeline network data acquisition and meet the high reliability and high security acquisition requirements of long-distance pipeline networks.

[0026] The embodiments provided in this application will now be described in detail with reference to the accompanying drawings.

[0027] like Figure 1 As shown in the diagram, this application provides a structural schematic of a long-distance pipeline network data security acquisition system. The system 100 includes: a data sensing module, a security management module, a data acquisition module, a data security processing module, a network communication module, a data security transmission module, an anti-tampering module, and an edge storage module. The data security processing module includes a data encryption processing submodule and a data anti-tampering detection submodule. All modules in the system 100 are communicatively connected.

[0028] Among them, such as Figure 1 As shown, system 100 can be divided into hardware units, a data acquisition layer, a data processing layer, a data transmission layer, and a security management layer. The hardware units include a data sensing module, a network communication module, an anti-tampering module, and an edge storage module. The data acquisition module is located in the data acquisition layer, the data security processing module (including a data encryption processing submodule and a data anti-tampering detection submodule) is located in the data processing layer, the data security transmission module is located in the data transmission layer, and the data security management module is located in the security management layer. The modules included within each hardware unit are hardware modules, while the other modules in system 100 besides those within the hardware units are software modules.

[0029] The data sensing module is used to collect raw data packets from the long-distance pipeline network based on one or more sensors.

[0030] In some embodiments, the data sensing module is a hardware module, which consists of multiple sensors, an 8-channel universal signal interface module, and a sensor universal unique identifier (UUID) chip. The sensors include at least one of the following: a pressure sensor, a temperature sensor, and a flow sensor.

[0031] In some embodiments, each sensor's built-in chip corresponds to a universally unique identifier (UUID), providing a hardware basis for system 100 to perform legitimacy verification. For example, the sensor can be an industrial-grade sensor.

[0032] In some embodiments, the raw data packet includes: external environmental parameters of the location of the long-distance pipeline network and internal operating data of the long-distance pipeline network. Exemplarily, the external environmental parameters include at least one of the following: wind speed, external temperature, and external humidity. The internal operating data includes: pressure, temperature, flow rate, and other data within the long-distance pipeline network.

[0033] In some embodiments, each raw data packet further includes the UUID of the sensor that acquired the raw data packet, the acquisition channel number, the acquisition timestamp, the data sequence number, the raw measurement value, and the data summary corresponding to the raw data packet.

[0034] In some embodiments, the data sensing module can use industrial-grade sensors to sense the external environmental parameters and internal operating data of long-distance pipelines (such as oil and gas long-distance pipelines) in real time. The general signal interface module of the data sensing module integrates a general communication interface that is compatible with various types of sensors, such as analog (4-20mA) and digital (RS485 communication interface / Modbus protocol), to achieve unified sensing of multiple types of data.

[0035] In some embodiments, the data sensing module can also output raw data packets with UUIDs to the data acquisition module through the network communication module, and at the same time, accept the UUID validity verification by the security management module. For unqualified (or illegal) sensors after validity verification, the data output is directly rejected.

[0036] The security management module provides core security control for all modules in System 100. For example, the security management module can perform UUID validity verification, digital signature of collected data, key management, user permission management, and alarm management.

[0037] In some embodiments, the security management module can perform validity verification on the UUID of each sensor and instruct the data sensing module to discard raw data packets collected by sensors that fail the validity verification. For example, the security management module can maintain a sensor identity binding table, wherein the sensor identity binding table includes at least one of the following: sensor UUID, acquisition channel number, process tag number, sensor type, measurement range, key digest, sampling frequency, key digest, and certificate status. Based on the sensor identity binding table, the security management module can perform validity verification (or consistency verification) on the sensor UUID, acquisition channel number, and data type in the raw data packets. In some embodiments, when the sensor's UUID exists but the acquisition channel number, process tag number, or sensor type is inconsistent, the security management module determines that the original data packet acquired by the sensor has not passed the legality verification.

[0038] In some embodiments, the security management module can send a random number challenge message to the sensor. The sensor signs the random number challenge message or generates a message authentication code based on a built-in key and returns an authentication response to the security management module. The security management module verifies the authentication response based on a pre-stored digest key or integer information. If the verification is successful, the security management module receives the original data packet uploaded by the sensor within a preset session validity period; if the verification fails, the data packet uploaded by the sensor is rejected from proceeding to subsequent processing. In some embodiments, the security management module can determine whether the original data packet is a replay data packet based on the acquisition timestamp and data sequence number. For example, the security management module can maintain a data sequence window corresponding to the UUID of each sensor pair, and determine whether the original data packet exceeds a preset time limit or has already been received based on the acquisition timestamp and data sequence number. When the acquisition timestamp of the original data packet is earlier than a preset time threshold, or the data sequence number falls within the received data sequence window, the security management module determines that the original data packet is a replay data packet.

[0039] In some embodiments, the security management module is also used to refuse access to the system 100 to unqualified (or illegal) sensors that have undergone legality verification.

[0040] In some embodiments, the security management module is also used to instruct the data awareness module to discard original data packets that fail the legality check or are determined to be replay data packets.

[0041] It is understood that by verifying the validity of the sensor's UUID during the data acquisition stage and rejecting unqualified or illegal sensors from accessing the system, the embodiments of this application can prevent data forgery or tampering from the source of data acquisition, ensuring the authenticity and reliability of the acquired raw data packets and safeguarding data security.

[0042] In some embodiments, the security management module can uniformly store and manage the device's identity certificate and the keys for all encryption algorithms (such as Commercial Cryptography (SM) 2 (Elliptic Curve Public Key Cryptography) / SM3 (Cryptographic Hash Algorithm) / SM4 (Block Cipher Algorithm)). This provides key support for the data encryption processing submodule in the data security processing module and the link encryption function of the data security transmission module, thereby achieving centralized and secure key management.

[0043] In some embodiments, the security management module can also receive abnormal alarm signals from modules at various levels, such as physical tampering alarm signals from the anti-tampering module and link interruption alarm signals from the data security transmission module during link encryption. The security management module can then perform alarm management based on these alarm signals.

[0044] In some embodiments, the security management module can also implement access control for data access and system management. For example, a role-based access control (RBAC) model can be used to implement a hierarchical control mechanism with three levels of permissions: administrator, operator, and auditor. Administrators have permissions for system configuration, data collection object configuration, and collection policy configuration, as well as data export permissions and management and permission allocation permissions for other users. Operators have permissions for system page operation, data collection object configuration, collection policy configuration, data viewing, and data analysis and processing. Auditors have permissions for system log auditing and user operation behavior auditing.

[0045] In some embodiments, when a user needs to access data stored locally by the system 100 or data transmitted in the background, the security management module can verify the user's identity and permission level, and only authorize the user to decrypt or view data of the corresponding level according to their own permissions. All access operations are synchronously recorded to the log and are fully audited by auditor-level users.

[0046] Understandably, compared to the lack of hierarchical control over data access and the vulnerability to sensitive data leakage due to human error in related technologies, this application adopts a role-based access control model to implement a hierarchical control mechanism with three levels of permissions: administrator, operator, and auditor. This achieves refined permission control for data access and system management. The administrator, operator, and auditor are independent of each other and mutually constrain each other, preventing any single role from exceeding its authority and effectively preventing the risk of data leakage due to human error. At the same time, the complete operation log recording and auditing mechanism provides a basis for post-event traceability and security review.

[0047] The data acquisition module is used to identify valid raw data packets collected by sensors that have passed validity verification, and to process these valid raw data packets to generate effective data packets. For example, the data acquisition module acquires valid raw data packets from the data sensing module that have passed validity verification, performs cleaning and verification processes on these valid raw data packets, and then generates effective data packets.

[0048] In some embodiments, the data acquisition module is used to determine legitimate original data packets that have passed the legality check and have not been identified as replay data packets, and to perform cleaning, verification and other processing on the legitimate original data packets, and then generate valid data packets.

[0049] Understandably, compared to related technologies where data acquisition for long-distance pipelines suffers from insufficient security, difficulty in ensuring the authenticity and validity of data, and inability to meet the high reliability and security requirements of long-distance pipelines, this application's embodiment addresses these issues by setting up a data sensing module, a security management module, and a data acquisition module. Each sensor is configured with a unique UUID, allowing for the verification of each sensor's UUID's validity. Raw data packets from unqualified sensors are discarded, and only data from qualified sensors undergoes further processing. This approach enables sensor identification and screening at the source of data acquisition, preventing the collection of untrusted raw data packets. This effectively improves the security of data acquisition for long-distance pipelines, ensures the authenticity and validity of the acquired data, and meets the high reliability and security requirements of long-distance pipelines.

[0050] In some embodiments, the data acquisition module employs two modes: a timed acquisition mode and an event-triggered mode, to collect legitimate raw data packets. For example, under normal conditions, the data acquisition module can use the timed acquisition mode to obtain legitimate raw data packets from the data sensing module at preset time intervals (e.g., once per second). When the size of the collected legitimate raw data packets exceeds a preset threshold (indicating a significant change in the pipeline network's operating status or an abnormal situation), the data acquisition module automatically switches to a timed acquisition mode with a smaller time granularity, for example, adjusting the acquisition interval from once per second to once every 100 milliseconds to improve the density and real-time performance of data acquisition.

[0051] In some embodiments, the event-triggered mode is automatically triggered based on the occurrence of a specific event. These specific events include, but are not limited to: specific parameters in the received raw data packet exceeding a preset threshold, receiving a trigger command from an external system, or detecting a system malfunction (such as communication interruption or hardware failure). When any of these specific events occurs, the data acquisition module automatically triggers a data acquisition to obtain the currently valid raw data packet.

[0052] Understandably, the event-triggered mode can add additional data collection points for specific situations on the basis of timed collection, ensuring that important data is not missed at critical moments, and further improving the flexibility and reliability of data collection.

[0053] In some embodiments, the security management module is further configured to: perform real-time digital signature on valid data packets based on a preset signature algorithm to generate secure data packets, each secure data packet including a timestamp, a digital signature, and the UUID of the sensor corresponding to each secure data packet. Exemplarily, the preset signature algorithm can be the SM2 digital signature algorithm. Exemplarily, the security management module can concatenate the valid data packet, the sensor's UUID, the acquisition timestamp, the data sequence number, and the data digest to generate data to be signed, and then use the SM2 digital signature algorithm to digitally sign the data to be signed, generating a secure data packet.

[0054] It is understood that the embodiments of this application generate secure data packets containing timestamps, digital signatures, and sensor UUIDs by performing real-time digital signatures on valid data packets. When it is necessary to trace the data in the secure data packets, the collection time and source sensor of the secure data packets can be accurately located by parsing the timestamps and UUIDs in the secure data packets. By verifying the digital signature, it can be determined whether the data has been tampered with during transmission or storage, thus realizing the authenticity, integrity, and traceability of the data.

[0055] The data security processing module is used to obtain security data packets from the security management module and encrypt the security data packets based on a preset encryption algorithm to obtain encrypted data packets.

[0056] For example, the data encryption processing submodule in the data security processing module is used to encrypt and store data stored locally. Specifically, the data encryption processing submodule can generate a checksum based on the SM3 algorithm (or hash algorithm) before data transmission, and then encrypt and store the data body (e.g., secure data packet) of the data stored locally based on the checksum and a preset encryption algorithm to obtain an encrypted data packet.

[0057] For example, the preset encryption algorithm can be the SM4 encryption algorithm (or a symmetric encryption algorithm).

[0058] It is understood that this application embodiment encrypts secure data packets using an encryption algorithm different from digital signatures. This provides further encryption protection for the data itself on top of digital signatures, ensuring that even if the encrypted data packet is intercepted during transmission, it cannot be decrypted to obtain the original data content. Moreover, after decrypting the encrypted data packet, the data receiver can verify whether the data has been tampered with based on the checksum. If any changes are made to the data during transmission, the checksum will not match, effectively ensuring the security and immutability of data transmission.

[0059] In some embodiments, the data anti-tampering detection submodule can detect the integrity of the running firmware in the system 100 in real time using SecureHash Algorithm 256 (SHA-256). If the running firmware is found to have been tampered with (e.g., malicious code has been injected), the data anti-tampering detection submodule can send an instruction to the data acquisition module to terminate data acquisition and start the backup firmware from the backup firmware hardware storage area to ensure the continuous operation of the system 100.

[0060] In some embodiments, the data tamper-proof detection submodule can also work together with the anti-tamper module to achieve dual tamper-proofing of the system 100 at both the physical and firmware levels. For example, at the physical level, the anti-tamper module can use hardware such as vibration sensors and temperature anomaly detectors to monitor in real time whether the device has been subjected to violent disassembly or environmental anomalies. At the firmware level, the data tamper-proof detection submodule can use a hash algorithm to detect the integrity of the system's running firmware in real time. The two complement each other; even if an attacker bypasses physical protection, they cannot bypass firmware verification; conversely, even if firmware verification is bypassed, physical detection can still detect anomalies.

[0061] It is understood that the embodiments of this application work together through the data anti-tampering detection submodule and the anti-tampering module. This dual anti-tampering mechanism, which combines hardware and software, can jointly protect the security of the system 100 from both hardware and software dimensions.

[0062] The network communication module is used to detect the signal strength of the communication link and determine the target transmission link based on the signal strength.

[0063] In some embodiments, the network communication module includes hardware units such as 4th Generation (4G) communication / 5th Generation (5G) communication, fiber optic communication, and Long Range Radio (LoRa) communication, which can provide data transmission channels for data collected by various modules in system 100 (e.g., raw data packets, encrypted data packets, secure data packets, and double-encrypted data packets). Each hardware communication unit in the network communication module can detect the signal strength of its respective communication link and dynamically select the link with the best signal for data transmission based on the signal status of the communication link.

[0064] In some embodiments, the network communication module can generate a link quality score based on the signal strength, latency, packet loss rate, jitter value, and link security status of the communication link, and determine the communication link with the highest link quality score and that meets the preset security conditions as the target transmission link.

[0065] In some embodiments, when the link quality score of the target transmission link is lower than a preset threshold, the edge storage module performs local encryption caching of the service layer encrypted data packets; when the link quality score recovers to above the preset threshold, the system 100 performs breakpoint resumption of the cached encrypted data packets based on the data sequence number, and deletes the retransmitted cached data after confirmation at the receiving end.

[0066] The data security transmission module is used to obtain encrypted data packets from the data security processing module; based on the VPN encrypted tunnel and HTTPS end-to-end encryption method, it performs secondary link encryption on the encrypted data packets (encrypted data packets output by the data security processing module) to generate double-layer encrypted data packets; and sends the double-layer encrypted data packets based on the target transmission link.

[0067] In some embodiments, the system 100 can be configured with a link signal strength detection program that combines a network communication module (hardware module) and a data security transmission module (software module) to monitor the signal status of each link (4G / 5G, fiber optic, LoRa) in real time and dynamically select the optimal link; at the same time, it performs end-to-end secondary link encryption on encrypted data packets through VPN tunnel + HTTPS to form double-layer encrypted data packets.

[0068] Understandably, by using a hardware-software combined link signal strength detection program to monitor the signal status of multiple communication links in real time and dynamically select the optimal link, this application can switch target transmission links according to the actual network environment, ensuring the stability of the data transmission link. Simultaneously, by using a VPN encrypted tunnel and HTTPS to perform secondary link encryption on encrypted data packets, forming a double-layer encrypted data packet, it effectively prevents data from being intercepted and eavesdropped on during transmission, ensuring the security and stability of the data transmission link.

[0069] The anti-tampering module is used to detect the physical and firmware status of the system. If the detection fails, it discards the double-encrypted data packet and sends an alarm signal to the security management module through the network communication module. If the detection passes, it sends the detection result to the security management module.

[0070] In some embodiments, the anti-tampering module employs a tamper-proof housing (e.g., a housing made of stainless steel and sealed with epoxy resin), and incorporates a vibration sensor and a temperature anomaly detector. The physical state detection includes: monitoring whether the physical modules in system 100 have been subjected to violent disassembly or severe vibration using the vibration sensor, and monitoring whether the ambient temperature of system 100 exceeds the normal range using the temperature anomaly detector. Firmware state detection includes: calculating the hash value of the running firmware of system 100 in real time using a hash algorithm (such as SHA-256), and comparing it with a preset standard hash value to determine whether the firmware has been tampered with or injected with malicious code.

[0071] In some embodiments, when a hardware module in system 100 is forcibly disassembled or environmental parameters exceed a threshold, local data self-destruction (deletion of sensitive keys) is triggered, and an alarm signal is sent to the security management module via the network communication module. This prevents data leakage or forgery caused by tampering with system 100 during data collection.

[0072] In some embodiments, the anti-tampering module, together with the data anti-tampering detection submodule, can monitor the physical and firmware status of system 100 in real time. If the detection fails (e.g., physical dismantling or firmware tampering), the double-encrypted data packet can be immediately discarded, triggering data self-destruction and sending an alarm signal to the security management module. Alternatively, in the event of a failed detection, the anti-tampering module can also determine the response level based on the detection result. At the first response level, the current data packet is marked as a data packet to be reviewed; at the second response level, data transmission is suspended and written to the isolation cache; at the third response level, the relevant key is deleted and system 100 is locked.

[0073] In some embodiments, the anti-tampering module can simultaneously detect the physical state and firmware state of the system. For low-level anomalies such as abnormal temperature or slight vibration, the system 100 can mark the relevant data packets as data packets to be reviewed and retain audit records; for medium-level anomalies such as shell disassembly or inconsistent firmware hash values, the system suspends data transmission and writes it to the isolation cache; for high-level anomalies such as key area access anomalies or firmware boot chain verification failure, the system deletes the session key, locks access permissions for local sensitive data, and sends alarm information containing the anomaly type, occurrence time, and device identification to the security management module.

[0074] In some embodiments, the security management module is further configured to perform permission verification on the system's local data storage if the received detection result is a successful detection.

[0075] It is understood that this application embodiment uses an anti-tampering module to monitor the physical and firmware states of system 100 in real time, enabling timely detection and handling of situations where system 100 is physically disassembled, subjected to environmental anomalies, or has its firmware tampered with. If the detection fails, system 100 immediately discards the current double-encrypted data packet and triggers local data self-destruction (e.g., deleting sensitive keys), while simultaneously issuing an alarm signal to prevent data leakage or forgery in an insecure state. If the detection passes, system 100 continues to perform permission verification, ensuring that only data that has undergone dual verification of both physical and firmware states can enter the storage stage. Furthermore, the anti-tampering module works in conjunction with the data anti-tampering detection submodule to form dual monitoring at both the physical and firmware layers, resisting the risk of physical tampering under harsh environments, further enhancing the end-to-end security protection capabilities and resilience to harsh environments of system 100, and avoiding the risk of data leakage or forgery caused by damage or tampering of the physical module or firmware.

[0076] The edge storage module is used to locally encrypt and cache double-encrypted data packets after the permission verification is passed.

[0077] In some embodiments, the edge storage module consists of hardware units such as a solid-state storage chip, a Redundant Array of Independent Disks (RAID) 5 data redundancy check hardware array, and a hardware encrypted storage interface.

[0078] In some embodiments, the edge storage module can locally encrypt and cache the valid data output by the data acquisition module. The solid-state storage chip in the edge storage module has anti-electromagnetic interference characteristics and is suitable for complex industrial field environments of oil and gas pipelines. The RAID5 data redundancy check hardware array can ensure the integrity of the stored data and prevent data loss caused by hardware failure.

[0079] In some embodiments, the data stored in system 100 is linked to the security management module through a hardware encrypted storage interface. The edge storage module can only read the stored data after passing the permission verification of the security management module. The edge storage module 106 receives preprocessed data (e.g., valid data packets) from the data acquisition module, provides the data to be encrypted to the data security processing module, and integrates the permission verification interface of the security management module to accept data anti-tampering monitoring from the data security processing module.

[0080] In some embodiments, the edge storage module is also used to locally encrypt and cache encrypted data packets when the target transmission link is unavailable or the link quality score is lower than a preset threshold, and to resume the interrupted transmission of the cached encrypted data packets based on the data sequence number after the target transmission link is restored.

[0081] It is understood that the system 100 in this embodiment is an integrated hardware and software system (or device). The hardware module mainly consists of a data sensing module, an edge storage module, an anti-tampering module, and a network communication module. The software module includes core modules such as a data acquisition module, a data security processing module, a data security transmission module, and a security management module. The hardware module serves as the physical carrier of the system 100, and the software modules run on top of it to implement their respective core functions. The collaboration between the software and hardware modules in the entire data acquisition process—from sensing, acquisition, storage, encryption, transmission, and control—enables end-to-end security protection from the data source to data use. This ensures the authenticity, integrity, and confidentiality of data throughout its entire lifecycle, addressing issues such as insufficient accuracy in data acquisition, inability to guarantee data storage integrity, and susceptibility to illegal tampering and access in related technologies. It also ensures the security of data transmission and prevents data leakage and illegal tampering.

[0082] It should be understood that the above Figure 1 This is an exemplary structural diagram. Figure 1 The system 100 shown includes an unlimited number of modules; for example, the number of data sensing modules is unlimited. Furthermore, except... Figure 1 In addition to the modules shown, Figure 1 The system 100 shown may also include other modules, which are not limited thereto.

[0083] The application scenarios of the embodiments in this application are not limited. The system architecture and business scenarios described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of the architecture of the long-distance pipeline network data security acquisition system and the emergence of new business scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0084] It should be noted that the system 100 provided in the above embodiments is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the system 100 can be divided into different functional modules according to the actual situation to complete all or part of the functions described above. In addition, the system 100 provided in the above embodiments and the method embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0085] The following is a detailed description of a method for secure data acquisition in long-distance pipeline networks provided by an embodiment of this application.

[0086] Figure 2 A flowchart of a method for secure data acquisition in a long-distance pipeline network using a secure data acquisition system, provided as an embodiment of this application, is shown below. Figure 2 As shown, the method includes the following steps: S101. Collect raw data packets from the long-distance pipeline network based on one or more sensors.

[0087] In some embodiments, the long-distance pipeline network can be an oil and gas long-distance pipeline network. The sensor can be an industrial-grade sensor, and each sensor's built-in chip corresponds to a UUID.

[0088] In some embodiments, the raw data packets include: external environmental parameters of the location of the long-distance pipeline network and internal operational data of the long-distance pipeline network. Each raw data packet includes the UUID of the sensor that acquired the raw data packet and a timestamp of the acquisition time.

[0089] S102. Perform a validity check on the UUID of each sensor and instruct the data sensing module to discard the raw data packets collected by the sensors that fail the validity check.

[0090] For example, after validating the UUID of each sensor, if the UUID of sensor A is invalid (or illegal), the original data packet collected by sensor A is discarded directly, and the original data packet collected by sensor A is rejected from entering the subsequent process.

[0091] S103. Determine the valid raw data packets collected by the sensors that have passed the validity verification, and generate valid data packets by processing the valid raw data packets.

[0092] For example, after validating the UUID of each sensor, if the UUIDs of sensor B and sensor C are qualified (or valid), the raw data packets collected by sensor B and sensor C are allowed to proceed to the next step of data processing to generate valid data packets.

[0093] In some embodiments, data processing includes preprocessing such as cleaning and verification of the raw data packets.

[0094] It should be noted that the specific content of the above data processing is only some examples given in this application. In actual implementation, data processing may also include other processing methods, which are not limited here.

[0095] It is understood that, by verifying the validity of the UUID of each sensor, the original data packets collected by the sensors that fail the verification are directly discarded, and only the data collected by the qualified sensors are processed. This effectively filters out illegal sensors at the source of data collection and ensures the authenticity and reliability of the collected data.

[0096] In some embodiments, such as Figure 3 As shown, the above method also includes steps S201-S202.

[0097] S201. Perform real-time digital signature on valid data packets based on a preset signature algorithm to generate secure data packets.

[0098] In some embodiments, each security data packet includes a timestamp, a digital signature, and a UUID of the sensor corresponding to each security data packet.

[0099] For example, the preset signature algorithm can be the SM2 digital signature algorithm, that is, the valid data packets can be digitally signed in real time based on the SM2 digital signature algorithm to generate secure data packets with timestamps, digital signatures and UUIDs.

[0100] It is understood that the embodiments of this application generate secure data packets containing timestamps, digital signatures, and sensor UUIDs by performing real-time digital signatures on valid data packets. This allows each secure data packet to be attached with a unique identity and tamper-proof credential, thus achieving data traceability and tamper-proofing.

[0101] S202. The encrypted data packet is obtained by encrypting the security data packet based on the preset encryption algorithm.

[0102] In some embodiments, the preset signature algorithm and the preset encryption algorithm are different. For example, the preset signature algorithm can be the SM2 digital signature algorithm, and the preset encryption algorithm can be the SM4 encryption algorithm. That is, after obtaining the secure data packet, a data checksum can be generated first using the SM3 algorithm, and then the secure data packet and the data checksum can be encrypted using the SM4 encryption algorithm to generate an encrypted data packet. The keys for the SM2 digital signature algorithm, the SM3 algorithm, and the SM4 encryption algorithm can all be pre-stored.

[0103] Understandably, compared to related technologies where data collection lacks effective signature and encryption protection, data is easily tampered with and difficult to trace, and oil and gas pipelines are long, span large distances, and have complex environments, data in remote areas relying on wireless transmission is easily intercepted or tampered with, and traditional single encryption methods have limited resistance to attacks, this application uses a preset signature algorithm to perform real-time digital signatures on valid data packets, generating secure data packets containing timestamps, digital signatures, and sensor UUIDs, so that each piece of data has a traceable identity and tamper-proof credentials; then, a preset encryption algorithm different from the preset signature algorithm is used to encrypt the secure data packets, generating encrypted data packets, thus providing double protection and improving the security of long-distance pipeline data collection in complex transmission environments.

[0104] In some embodiments, such as Figure 4 As shown, the above method also includes steps S301-S303.

[0105] S301. Detect the signal strength of the communication link and determine the target transmission link based on the signal strength.

[0106] In some embodiments, the link signal strength of different types of communication units (e.g., 4G / 5G communication units, fiber optic communication units, and LoRa communication units) can be monitored in real time. For example, the signal strength of 4G / 5G base stations, the optical power of fiber optic links, and the signal quality of LoRa gateways can be detected. Based on the detected signal strength, the communication quality of each link is evaluated, and the link with the best signal strength and the most stable communication quality is selected as the target transmission link.

[0107] In some embodiments, if the signal strength of the target transmission link currently in use drops below a preset threshold, this application may also automatically switch to another link with better signal strength to ensure the continuity and stability of data transmission.

[0108] S302. Based on VPN encrypted tunnel and HTTPS, perform secondary link encryption on encrypted data packets to generate double-layer encrypted data packets.

[0109] In some embodiments, a VPN-based encrypted tunnel can be established first, which performs Layer 1 link encryption on encrypted data packets to prevent them from being intercepted or eavesdropped on during transmission. Then, HTTPS is used for Layer 2 encryption, resulting in a double-layer encrypted data packet.

[0110] S303. Send double-layer encrypted data packets based on the target transmission link.

[0111] In some embodiments, the double-layer encrypted data packet can be sent out through the target transmission link. For example, the double-layer encrypted data packet can be encapsulated into a data frame conforming to the transmission protocol of the target transmission link by calling the communication interface corresponding to the target transmission link, and then sent out.

[0112] It is understood that in this embodiment, HTTPS encrypts data at the transport layer, forming a double protection with VPN tunnel encryption. Through this two-layer encryption mechanism, even if one layer of encryption is cracked, the other layer can still ensure data security, improving the data transmission's resistance to attacks.

[0113] In some embodiments, such as Figure 5 As shown, the above method also includes steps S401-S404.

[0114] S401, Detect the physical and firmware status of the system.

[0115] In some embodiments, physical state detection includes: monitoring whether the device has been subjected to violent disassembly or severe vibration using a vibration sensor, and monitoring whether the ambient temperature of the device exceeds the normal range using a temperature anomaly detector. Firmware state detection includes: calculating the hash value of the system's running firmware in real time using a hash algorithm (such as SHA-256), and comparing it with a preset standard hash value to determine whether the firmware has been tampered with or injected with malicious code.

[0116] S402. If the detection fails, discard the double-encrypted data packet and send an alarm signal.

[0117] In some embodiments, if the detection fails (e.g., a vibration sensor trigger is detected, an abnormal temperature is detected, or the firmware hash value is inconsistent), the system is determined to be in an insecure state. In this case, the currently pending double-encrypted data packet can be discarded and an alarm signal can be sent.

[0118] In some embodiments, the alarm signal may include information such as the reason for the failure (e.g., "physical disassembly damage" or "firmware verification failure") and the time of occurrence. Upon receiving the alarm signal, the system may further trigger preset security response operations, such as locking the system, logging security information, or notifying a remote maintenance platform.

[0119] S403. If the test passes, perform permission verification on the system's local data storage.

[0120] In some embodiments, if the detection passes, permission verification can be performed on the local data storage. This permission verification is used to verify whether the current operation has access to the local storage, such as checking whether the current user or process is authorized to perform a data write operation.

[0121] S404. If the permission verification is successful, encrypt the double-layer encrypted data packet locally and cache it.

[0122] In some embodiments, if the permission verification passes, the double-layer data packet can be encrypted based on an encryption algorithm (such as the SM4 encryption algorithm), and then the encrypted data can be cached.

[0123] Understandably, compared to related technologies where acquisition devices are susceptible to physical tampering, firmware is difficult to detect after malicious code is injected, and there is a lack of effective data storage security mechanisms, this application detects the physical and firmware status of the system. When the detection fails, the double-encrypted data packet is discarded and an alarm signal is sent. Only after the detection and permission verification are passed is the double-encrypted data packet locally encrypted and cached. This achieves multiple security protections from the physical layer, firmware layer to the storage layer, effectively preventing data from being incorrectly stored or leaked in an insecure state, and improving the overall security of long-distance pipeline network data acquisition.

[0124] To facilitate understanding, the following example further illustrates the data security acquisition method for long-distance pipelines provided in this application.

[0125] For example, Figure 6 A flowchart illustrating another method for secure data acquisition in long-distance pipeline networks provided in this application embodiment. (See attached flowchart.) Figure 6 As shown, the method includes steps S1-S9.

[0126] S1. Collect data through sensors.

[0127] S2. Verify the sensor's UUID.

[0128] S3. Determine if the sensor's UUID is invalid; if yes, discard the collected data; otherwise, proceed to step S4.

[0129] S4. Perform data preprocessing and real-time signature on the collected data.

[0130] S5. Encrypt the data.

[0131] S6. Determine the target transmission link for data transmission and encrypt the link.

[0132] S7. Perform storage permission verification and anti-tampering detection on the data.

[0133] S8. Determine whether the detection passes; if yes, proceed to step S9; if no, discard the collected data.

[0134] S9, Store data.

[0135] It should be noted that the specific implementation of the above-mentioned long-distance pipeline network data security acquisition method can refer to the functions, execution logic and specific descriptions of each module in the above-mentioned system 100, and will not be repeated here in the embodiments of this application.

[0136] As can be seen, the above mainly describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, the embodiments of this application provide corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, in conjunction with the modules and algorithm steps of the various examples described in the embodiments disclosed herein, the embodiments of this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed by hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention.

[0137] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 7 As shown, the electronic device 200 includes, but is not limited to, a processor 201 and a memory 202.

[0138] The aforementioned memory 202 is used to store the executable instructions of the aforementioned processor 201. It is understood that the aforementioned processor 201 is configured to execute instructions to implement the long-distance pipeline data security acquisition method in the above embodiments.

[0139] It should be noted that those skilled in the art will understand that Figure 7The electronic device structure shown does not constitute a limitation on the electronic device; the electronic device may include, but is not limited to, other electronic devices. Figure 7 This may indicate more or fewer components, or combinations of certain components, or different component arrangements.

[0140] Processor 201 is the control center of the electronic device. It connects various parts of the electronic device via various interfaces and lines. By running or executing software programs and / or modules stored in memory 202, and by calling data stored in memory 202, it performs various functions and processes data, thereby providing overall monitoring of the electronic device. Processor 201 may include one or more processing units. Optionally, processor 201 may integrate an application processor and a modem processor. The application processor mainly handles the operating system, user interface, and applications, while the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into processor 201.

[0141] The memory 202 can be used to store software programs and various data. The memory 202 may mainly include a program storage area and a data storage area, wherein the program storage area may store the operating system, application programs required by at least one functional module (such as determination units, processing units, etc.), etc. In addition, the memory 202 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0142] In an exemplary embodiment, a computer-readable storage medium including instructions is also provided, such as a memory 202 including instructions, which can be executed by a processor 201 of an electronic device 200 to implement the methods in the above embodiments.

[0143] Optionally, the computer-readable storage medium may be a non-transitory computer-readable storage medium, such as a read-only memory (ROM), random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device.

[0144] In an exemplary embodiment, this application also provides a computer program product including one or more instructions, which can be executed by a processor 201 of an electronic device to perform the methods described above.

[0145] It should be noted that when one or more instructions in the computer-readable storage medium or computer program product are executed by the processor of an electronic device, they implement the various processes of the above method embodiments and achieve the same technical effect as the above method. To avoid repetition, they will not be described again here.

[0146] In the embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative; for instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0147] The units described as separate components may or may not be physically separate. A component shown as a unit can be one or more physical units; that is, it can be located in one place or distributed in multiple different locations. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0148] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0149] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, essentially, or the part that contributes to the prior art, or a complete or partial classification of the technical solution, can be embodied in the form of a software product. This software product is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0150] In the description of the embodiments of this application, specific features, structures, materials or characteristics may be combined in any suitable manner in one or more embodiments or examples.

[0151] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A long-distance pipeline network data security acquisition system, characterized in that, The system includes: a data sensing module, a security management module, and a data acquisition module; The data sensing module is used to: collect raw data packets of the long-distance pipeline network based on one or more sensors, with each sensor's built-in chip corresponding to a universally unique identifier (UUID); the raw data packets include: external environmental parameters of the location of the long-distance pipeline network and internal operating data of the long-distance pipeline network; The security management module is used to: verify the validity of the UUID of each sensor, and instruct the data sensing module to discard the original data packets collected by the sensors that fail the validity verification. The data acquisition module is used to: determine the valid raw data packets collected by the sensors that have passed the validity verification, and generate valid data packets by processing the valid raw data packets.

2. The system according to claim 1, characterized in that, The system also includes: a data security processing module; The security management module is also used to: perform real-time digital signature on the valid data packet based on a preset signature algorithm to generate a secure data packet, each secure data packet including a timestamp, a digital signature and the UUID of the sensor corresponding to each secure data packet; The data security processing module is used to: obtain the security data packet from the security management module, and encrypt the security data packet based on a preset encryption algorithm to obtain an encrypted data packet.

3. The system according to claim 2, characterized in that, The system also includes: a network communication module and a data security transmission module; The network communication module is used to: detect the signal strength of the communication link, and determine the target transmission link based on the signal strength; The data security transmission module is used to: obtain the encrypted data packet from the data security processing module; perform secondary link encryption on the encrypted data packet based on the Virtual Private Network (VPN) encrypted tunnel and the Hypertext Transfer Security Protocol (HTTPS) to generate a double-layer encrypted data packet; and send the double-layer encrypted data packet based on the target transmission link.

4. The system according to claim 3, characterized in that, The system also includes: an anti-tampering module and an edge storage module; The anti-tampering module is used to: detect the physical state and firmware state of the system; if the detection fails, discard the double-encrypted data packet and send an alarm signal to the security management module through the network communication module; if the detection passes, send the detection result to the security management module. The security management module is also used to perform permission verification on the local data storage of the system when the received detection result is that the detection is passed. The edge storage module is used to: locally encrypt and cache the double-layer encrypted data packet when the permission verification is passed.

5. A method for securely acquiring data from a long-distance pipeline network using the system described in any one of claims 1-4, characterized in that, The method includes: The original data packets of the long-distance pipeline network are collected by one or more sensors, and each sensor's built-in chip corresponds to a UUID; the original data packets include: external environmental parameters of the location of the long-distance pipeline network and internal operating data of the long-distance pipeline network. The validity of the UUID of each sensor is verified, and the data sensing module is instructed to discard the raw data packets collected by the sensors that fail the validity verification. The valid raw data packets collected by the sensors that have passed the validity verification are identified, and the valid raw data packets are processed to generate valid data packets.

6. The method according to claim 5, characterized in that, The method further includes: The valid data packets are digitally signed in real time based on a preset signature algorithm to generate secure data packets. Each secure data packet includes a timestamp, a digital signature, and the UUID of the sensor corresponding to each secure data packet. The encrypted data packet is obtained by encrypting the secure data packet using a preset encryption algorithm.

7. The method according to claim 6, characterized in that, The method further includes: Detect the signal strength of the communication link, and determine the target transmission link based on the signal strength; Based on VPN encrypted tunnel and HTTPS, the encrypted data packets are subjected to secondary link encryption to generate double-layer encrypted data packets; The double-encrypted data packet is sent based on the target transmission link.

8. The method according to claim 7, characterized in that, The method further includes: Detect the physical state and firmware state of the system; If the detection fails, the double-encrypted data packet is discarded and an alarm signal is sent; If the detection passes, permission verification is performed on the local data storage of the system; If the permission verification passes, the double-encrypted data packet is locally encrypted and cached.

9. An electronic device, characterized in that, include: A processor and a memory for storing processor-executable instructions; The processor is configured to execute the instructions to implement the method as described in any one of claims 5-8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 5-8.

Images