Industrial internet of things big data security protection software

Abstract

The application discloses an industrial Internet of Things big data security protection software and belongs to the technical field of industrial Internet of Things network security and cryptography, aiming at the problems of existing cloud disk static encryption scheme, such as memory plaintext exposure, low homomorphic encryption efficiency, searchable encryption storage expansion and edge key vulnerable to physical side channel attacks, the application proposes a hybrid ciphertext processing method combining the cuckoo filter optimized searchable symmetric encryption and the Chinese remainder theorem packaged semi-homomorphic encryption, realizes label data ciphertext retrieval and telemetry data ciphertext state aggregation, combines the edge key dynamic derivation based on a physically unclonable function and the white box confusion technology, makes the key not reside in the memory in plaintext, and adopts a ciphertext state time series data adaptive dimension reduction storage method to reduce storage overhead, and can be used for ciphertext state security protection of industrial Internet of Things big data.

Description

Technical Field

[0001] This invention relates to the field of industrial IoT network security and cryptography technology, specifically industrial IoT big data security protection software. Background Technology

[0002] As the Industrial Internet of Things (IIoT) develops in depth, sensor data such as temperature, vibration, and pressure, equipment status data, and production control data from industrial sites are being massively aggregated to cloud-based big data platforms for mining, analysis, and centralized storage. To ensure the security of this data throughout the entire process of collection, transmission, storage, and computation, the industry's well-known data security protection measures mainly include: using transport layer encryption tunneling protocols to protect data during network transmission, and using symmetric keys for static encryption when storing data on disk, but restoring it to plaintext in memory when read and used by business systems. In addition, the academic community has proposed fully homomorphic encryption for implementing pure ciphertext computation in the cloud, and searchable symmetric encryption to support ciphertext keyword retrieval without decryption. Both are considered to be fundamental cryptographic tools for building systems where data is usable but not visible.

[0003] Currently, the most similar solution for big data security protection in the Industrial Internet of Things (IIoT) is a technical architecture that combines transport layer encryption with cloud-based static encryption, and performs analysis after decryption on demand. The process is as follows: edge devices transmit the raw sensor data they collect to the cloud via an encrypted channel. After receiving the data, the cloud uses a symmetric key to statically encrypt the data and stores it on disk. When the business system needs to retrieve alarm records of a device or calculate statistical indicators for a certain period, the cloud backend service first decrypts the corresponding encrypted data in memory to restore it to plaintext, and then performs retrieval or aggregation operations. After the operation is completed, the results are returned. Based on this, some research attempts to use fully homomorphic encryption to replace the decryption and calculation step to achieve pure encrypted calculation, or to use searchable encryption to build encrypted indexes for structured tag fields to support decryption-free retrieval. However, none of the above attempts have formed a complete technical solution that balances computational efficiency and storage costs in the context of industrial time-series big data.

[0004] The aforementioned existing technical solutions have the following drawbacks. First, since the business analysis process requires the ciphertext data to be restored to plaintext before retrieval and statistical operations can be performed, there is inevitably a window of exposure for plaintext data in the cloud server's memory. This allows internal system administrators with high privileges to steal the plaintext data, and also allows attackers who have penetrated the cloud host to directly obtain the plaintext from memory. In other words, this solution is difficult to defend against threats from insiders and memory-resident attacks. Second, fully homomorphic encryption requires underlying mechanisms such as bootstrapping to continuously suppress noise expansion during ciphertext operations. The time consumption of its addition and multiplication operations is orders of magnitude greater than that of plaintext operations, making this solution unsuitable for the massive data throughput and low-latency computing requirements of industrial time-series big data scenarios, and lacking engineering usability. Third, the indexing structure of traditional searchable encryption solutions... The design of the encryption and ciphertext expansion coefficients is not optimized for continuous time-series numerical data, resulting in a significant increase in ciphertext storage space compared to plaintext, leading to a substantial increase in storage costs. Furthermore, the solution itself only supports keyword matching retrieval, making it difficult to directly perform aggregation and statistical operations such as summation and averaging on sensor ciphertext values. This fails to meet the numerous numerical aggregation requirements in industrial big data analysis. In addition, in existing solutions, the encryption and decryption keys of edge gateways are usually stored in a fixed form in chip storage media or memory space. Due to the relatively open environment of industrial workshops and the possibility of physical contact with equipment, these keys are easily extracted by physical means such as power consumption analysis and electromagnetic side-channel analysis. This allows attackers to bypass the cryptographic algorithm itself and directly obtain the key, causing the overall security protection of edge nodes to fail. To address these issues, we propose industrial IoT big data security protection software. Summary of the Invention

[0005] The purpose of this invention is to provide industrial IoT big data security protection software.

[0006] The technical problem this invention aims to solve is: how to achieve encrypted protection of massive time-series big data in the Industrial Internet of Things (IIoT) throughout the entire process of data collection, transmission, storage, and computation, while ensuring that the data has conditional retrieval capabilities and encrypted statistical aggregation capabilities in the cloud. Simultaneously, it aims to overcome the technical problems of low computational efficiency of existing fully homomorphic encryption schemes, severe ciphertext storage expansion in traditional searchable encryption schemes, and the vulnerability of industrial field edge gateway keys to physical side-channel attacks. Therefore, this invention provides an IIoT big data security protection method that combines computational efficiency, low storage overhead, and resistance to physical attacks.

[0007] To address the aforementioned technical problems, this invention provides an industrial IoT big data security protection method, comprising: edge computing nodes classifying raw data collected from industrial field equipment into structured tagged data and telemetry flow numerical data; for the structured tagged data, generating a trapdoor based on a searchable symmetric encryption algorithm; calculating the candidate bucket position corresponding to the trapdoor using a cuckoo filter; writing the fingerprint value of the trapdoor and the corresponding ciphertext data block address into an empty slot at the candidate bucket position to obtain a ciphertext index; and uploading the ciphertext index and the ciphertext data block to a cloud-based ciphertext analysis platform. For the telemetry flow numerical data, multiple pairwise coprime submoduloes are selected. Based on the Chinese Remainder Theorem, plaintext data from multiple time points within a packaging period are merged and encoded into a single packaged plaintext. A semi-homomorphic encryption algorithm is used to encrypt the packaged plaintext to obtain packaged ciphertext, which is then uploaded to the cloud. When the cloud-based ciphertext analysis platform receives a retrieval request, it performs fingerprint matching in the ciphertext index based on the corresponding trapdoor and returns the corresponding ciphertext data block. When it receives an aggregation request, it directly performs homomorphic operations on multiple packaged ciphertexts within the corresponding time range to obtain aggregated ciphertext, which is then returned to the party with decryption authority for decryption to obtain the aggregation result.

[0008] Based on the above methods, this invention also provides a dynamic edge key derivation method for industrial IoT. By combining four steps—challenge response mechanism, fuzzy extractor error correction, session time sequence identifier mixed into hash derivation, and white-box obfuscation transformation—this ensures that the session key used by the edge node to complete encryption and decryption operations does not reside in registers and memory in plaintext form throughout its entire lifecycle. This achieves one-time dynamic updates of the key bound to hardware. In addition, this invention also provides an adaptive dimensionality reduction storage method for ciphertext-state time-series data. Based on the volatility of the data within the sliding window, this method dynamically selects whether to perform differential encoding and adjusts the slot density of the Chinese Remainder Theorem packing in conjunction with the data. This reduces the expansion ratio of the ciphertext storage space relative to the original data while ensuring that the data can be restored without loss.

[0009] Compared with the prior art, the beneficial effects of the present invention by adopting the above technical solution are as follows:

[0010] 1. This invention fundamentally eliminates the exposure window of plaintext data in cloud memory by processing structured tagged data and telemetry stream numerical data separately, and by using the Chinese Remainder Theorem to package and amortize the overhead of a single semi-homomorphic encryption. In existing technologies, searchable encryption schemes and homomorphic encryption schemes are usually deployed independently and a single ciphertext processing mode is uniformly used for the same dataset. This invention breaks through the conventional practice of using the same ciphertext processing mechanism for the same batch of industrial data. Instead, it dynamically matches different ciphertext processing paths according to the data structure characteristics (structured tags / continuous time-series numerical data), so that the two complement each other. This split architecture is not a simple superposition of existing technologies, but a targeted technical solution for the heterogeneous characteristics of industrial time-series big data. The ciphertext computing efficiency is significantly improved compared with the traditional fully homomorphic encryption scheme, and it also has the ability to directly aggregate and statistically analyze ciphertext values, thus making up for the deficiency of traditional searchable encryption schemes in not supporting numerical aggregation operations.

[0011] 2. This invention, through an adaptive dimensionality reduction storage structure for encrypted temporal data, can dynamically compress redundant information and increase the effective data slot carrying density of a single encrypted message based on data fluctuation characteristics, thereby reducing cloud storage overhead and alleviating the problem of encrypted space expansion in traditional encrypted systems.

[0012] 3. This invention uses edge key dynamic derivation based on physically unclonable functions and white-box obfuscation technology to ensure that the key does not exist in plaintext form in memory throughout its entire lifecycle. This can block physical layer feature extraction attacks targeting edge nodes and key reverse analysis attacks in white-box environments, achieving a ciphertext isolation effect where data is usable but not visible. Attached Figure Description

[0013] Figure 1 This is a schematic diagram of the overall business process of the software in this embodiment of the invention;

[0014] Figure 2 This is a schematic diagram of the edge PUF dynamic session key derivation process in an embodiment of the present invention;

[0015] Figure 3 This is a schematic diagram of the adaptive dimensionality reduction, packaging, and encryption process for time-series data in an embodiment of the present invention. Detailed Implementation

[0016] The following is in conjunction with the appendix Figure 1-3 The specific embodiments of the present invention will be further described below. It should be noted that the description of these embodiments is for the purpose of helping to understand the present invention, but does not constitute a limitation of the present invention.

[0017] Furthermore, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0018] I. System Overall Architecture:

[0019] The industrial IoT big data security protection software described in this invention runs within a layered system consisting of an industrial field layer, an edge computing node layer, a network transmission layer, and a cloud-based encrypted analysis platform layer. The industrial field layer includes field devices such as temperature sensors, vibration sensors, pressure sensors, and programmable logic controllers (PLCs). These devices transmit the collected raw data to the edge computing nodes via fieldbus or industrial Ethernet. The edge computing node layer includes a data preprocessing and classification module, a dynamic key derivation module, a searchable symmetric encryption index construction module, and a Chinese Remainder Theorem-based semi-homomorphic encryption module. The data preprocessing and classification module distinguishes between structured tagged data and telemetry stream numerical data, and the dynamic key derivation module is used to communicate with the security chip. The system interacts with physically unclonable function circuits to generate session keys. A searchable symmetric encryption index building module with a built-in cuckoo filter constructs a ciphertext index for tagged data. A Chinese Remainder Theorem-packed semi-homomorphic encryption module with a built-in adaptive dimensionality reduction unit generates packaged ciphertext for telemetry stream data. Edge nodes upload the generated ciphertext data packets and ciphertext indexes to the cloud via existing encrypted transmission channels. The cloud-based ciphertext analysis platform layer includes a ciphertext retrieval engine, a ciphertext homomorphic aggregation engine, and a result return interface. The ciphertext retrieval engine performs trapdoor matching on the cuckoo filter index, and the ciphertext homomorphic aggregation engine performs homomorphic operations on the packaged ciphertext. Business systems or authorized users can obtain decryption permissions through the key management service to locally decrypt the resulting ciphertext.

[0020] II. Searchable symmetric encryption processing of structured tagged data:

[0021] For structured tag fields such as device number and alarm code, the edge software first derives a first subkey and a second subkey with separate uses from the data owner's master key. Using the first subkey, a pseudo-random function value is calculated for each keyword in the tag field set to obtain the trapdoor corresponding to that keyword. The calculation formula is as follows:

[0022] ;

[0023] in, Indicates the keyword to be processed. This represents the first subkey derived from the master key, used to generate the trapdoor. Represents a pseudo-random function. This represents the calculated trapdoor.

[0024] After obtaining the trapdoor, a fingerprint value is calculated for it. The fingerprint value is a short identifier obtained by cryptographically hashing and compressing the trapdoor. Then, the positions of the fingerprint value in the two candidate buckets of the cuckoo filter are calculated using a double hashing mechanism. The position of the first candidate bucket is calculated using the first hash function, and the formula for calculating the position of the second candidate bucket is as follows:

[0025] ;

[0026] in, This represents the first hash function used to calculate the initial bucket index corresponding to the trapdoor. Represents a cryptographic hash function. Indicates a trapdoor fingerprint value, This represents the bitwise XOR operator, which allows the mapping relationship between the positions of two candidate buckets to be calculated backward from the fingerprint value itself, without the need to store the original key.

[0027] After determining the candidate bucket positions, it is checked whether there are empty slots in the first and second candidate bucket positions. If there are empty slots, the fingerprint value corresponding to the keyword and the address of the ciphertext data block encrypted with the second subkey are written into the empty slot to complete the index insertion. If both the first and second candidate bucket positions are full, one of the slots is randomly selected, the original fingerprint value is migrated out of the slot, and the other candidate bucket position is recalculated for migration and insertion. If this migration process is repeated a preset number of times and still unsuccessful, the filter expansion and reconstruction are triggered. When an authorized user needs to initiate a search request for a certain keyword, the client recalculates the trapdoor corresponding to the keyword locally and sends it to the cloud. The cloud calculates the two candidate bucket positions according to the aforementioned method and compares the fingerprint values ​​in the filter. If a match is found, the encrypted address associated with the slot is extracted, and the corresponding ciphertext data block is decrypted and located, and returned to the client. Throughout the entire process, the cloud does not obtain the plaintext information of the keyword.

[0028] III. Chinese Remainder Theorem Packaging and Semi-Homomorphic Aggregation of Telemetry Flow Numerical Data:

[0029] For telemetry stream data consisting of continuous time-series values ​​such as temperature and vibration frequency, the edge software collects plaintext telemetry data from multiple consecutive time points within a packaging cycle. A coprime small modulus is selected for each data slot, with all moduli being pairwise coprime. Furthermore, the value of each sub-modulus is greater than the value of every data point appearing in the corresponding slot within the packaging cycle to avoid cross-slot carry contamination during computation. Based on this, and using the Chinese Remainder Theorem, multiple plaintext slot data are merged and encoded into a single large integer packaged plaintext. The calculation formula is as follows:

[0030] ;

[0031] in, Indicates the first Plaintext telemetry data corresponding to each slot This represents the product of all submodulo numbers, i.e. , Indicates removing the first The product of the remaining moduli after the first moduli, i.e. , express In the model Multiplicative inverse in the sense of, satisfies , This represents the packaged plaintext obtained by merging the encoding. The above calculation method merges multiple independent plaintext slots into a single large integer, achieving the effect of encrypting multiple data points at once.

[0032] After obtaining the packaged plaintext, the edge software uses a semi-homomorphic public-key encryption algorithm to encrypt the packaged plaintext. The formula for generating the ciphertext is expressed as:

[0033] ;

[0034] in, The modulus of the public key is obtained by multiplying two large prime numbers. Represents the public key generator. This represents a random number selected during each encryption process to ensure the semantic security of the encryption. This represents the obtained packaged ciphertext, which, along with the sub-modulus set corresponding to each slot and a timestamp, is uploaded to the cloud. After receiving packaged ciphertexts from multiple time periods, if the business needs to perform summation and aggregation on data within a certain time period, it directly performs modular multiplication on the corresponding ciphertext without decryption. The aggregation relationship is represented as follows:

[0035] ;

[0036] in, This represents the decryption function. and These represent the encrypted packets corresponding to the two packaging cycles. and These represent the merged plaintext corresponding to the packaging period. Since the modulus of each slot is independently selected and does not interfere with each other during packaging using the Chinese Remainder Theorem, the plaintext field addition result is decrypted and restored, and then the remainder is taken according to each sub-modulus to obtain the cumulative result of the original slot data. Thus, the parallel aggregation operation of data at multiple time points is completed at once in the ciphertext state, avoiding the overhead of point-by-point encryption and point-by-point operation brought by traditional homomorphic encryption. When the authorized party has the private key and needs to obtain the final aggregation result, the decryption algorithm is executed on the aggregated ciphertext to obtain the merged plaintext, and then the aggregated value corresponding to each slot is restored by taking the remainder according to each sub-modulus.

[0037] IV. Dynamic derivation of physically unclonable functions of edge keys and white-box obfuscation:

[0038] To address the vulnerability of edge gateway keys to physical side-channel attacks, this invention provides a dynamic edge key derivation method based on a physically unclonable function. During power-on initialization or each time a new encryption / decryption session needs to be established, the edge gateway security chip generates a random challenge value through its main control logic. This value is then input into the chip's built-in physically unclonable function circuit. This circuit generates an excitation response based on random differences in its manufacturing process. The calculation relationship is expressed as follows:

[0039] ;

[0040] in, Indicates the random challenge value. The response function of a physically non-clonable function circuit. The generated stimulus response is affected by environmental noise such as temperature and voltage, resulting in a certain bit error. This invention uses pre-generated auxiliary data in conjunction with a fuzzy extractor to perform error correction on the original response, extracting stable and high-entropy key material, so that the same key material can be stably restored under different environmental conditions for the same challenge value.

[0041] After obtaining the stable key material, this key material is concatenated with the session sequence identifier, which reflects the temporal order of this session, and the random number of this session. This concatenation is then input into a cryptographic hash function to derive the session key. The calculation relationship is expressed as follows:

[0042] ;

[0043] in, Represents a cryptographic hash function. This refers to the stable key material obtained after error correction processing. This represents the session sequence identifier, which can be a timestamp or the count value of a monotonically increasing counter. It is used to ensure that even if the challenge value is reused, the derived session key will still be different each time. This represents a random number for this session. This represents the string concatenation operator. This indicates the derived key for this session;

[0044] After obtaining the session key, it is input into the white-box obfuscation transformation module and converted into a set of lookup tables. The trapdoor generation operation described in Part 2 and the semi-homomorphic encryption operation described in Part 3 are both completed by directly calling this white-box lookup table, instead of temporarily storing the session key itself in plaintext in registers or memory. This ensures that even if an attacker can fully observe the memory and runtime state of the edge node, they cannot directly reverse engineer the plaintext key from the white-box representation. After the session operation is completed, the main control logic immediately triggers the erasure operation of the stable key material, session key, and related intermediate register data. The next session will generate a completely new white-box lookup table, achieving a dual protection effect of dynamic key refresh and physical layer anti-cloning.

[0045] V. Adaptive Dimensionality Reduction Storage of Ciphertext Time-Series Data:

[0046] To reduce the inflation rate of encrypted storage relative to the original data, the edge software continuously collects raw telemetry sampling values ​​at multiple time points using a fixed-length sliding window. The standard deviation of the sampling values ​​within the window is calculated to assess the strength of data fluctuations during that period. This standard deviation is compared to a preset fluctuation threshold. If the standard deviation is less than the preset threshold, the data for that period is determined to be low-frequency, redundant data. In this case, differential encoding is performed on the original sequence. The point-by-point calculation method is expressed as follows:

[0047] ;

[0048] in, Indicates the first The original sampled values ​​at each time point This represents the sampled value at the previous time point. This indicates the difference result between the two. Since the numerical range of adjacent difference values ​​in low-fluctuation data is much smaller than that of the original data itself, the required sub-modulus bit width can be greatly reduced. If the standard deviation is not less than the preset fluctuation threshold, it is determined that the data changes drastically during this period. In order to ensure accuracy, differential compression is not performed, and the original sampling sequence is directly retained for subsequent packaging.

[0049] Based on the numerical range of the data obtained after the aforementioned processing, the edge software dynamically calculates the sub-modulus bit width that satisfies the non-overflow condition, and adaptively adjusts the number of slots for the Chinese Remainder Theorem packing described in Part Three accordingly. The higher the number of slots, the greater the information density carried by each unit of ciphertext, and the lower the expansion ratio of the ciphertext storage space relative to the original data. The encoded data after the above processing is packed and semi-homomorphically encrypted according to the algorithm described in Part Three, generating a ciphertext package which is then uploaded to cloud storage. When the authorized party needs to restore the original data sequence, the ciphertext is first decrypted to obtain the difference sequence and the first value. Then, an accumulation operation is performed on the difference sequence based on the first value. The accumulation relationship is expressed as:

[0050] ;

[0051] The complete original telemetry sequence is restored point by point in reverse, completing the closed loop of encrypted state dimensionality reduction storage and lossless restoration.

[0052] VI. Alternative Implementation Methods:

[0053] In the semi-homomorphic encryption stage, a lattice-based homomorphic encryption scheme can be used instead of the aforementioned semi-homomorphic encryption scheme. By limiting the use of its additive homomorphic property to only the multiplicative homomorphic property and excluding the multiplicative homomorphic property to avoid noise expansion problems, the ciphertext state data aggregation function can still be achieved, and additional security attributes resistant to quantum computing attacks can be obtained. As an equivalent alternative to the Chinese Remainder Theorem-packed semi-homomorphic encryption mechanism of this invention, in the edge key protection stage, for edge gateway devices equipped with a trusted execution environment rather than an independent physical non-cloning function security chip, the generation, derivation, and white-box obfuscation operations of the key can all be performed in the secure isolation zone of the trusted execution environment. The key material is also not exposed in plaintext form to the memory space of the ordinary operating system. The hardware isolation characteristics of the trusted execution environment replace the physical characteristics of the physical non-cloning function, serving as an alternative to the edge key dynamic protection mechanism of this invention under different hardware conditions.

[0054] Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make possible changes and modifications without departing from the spirit and scope of the present invention. Therefore, any modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention shall fall within the protection scope defined by the claims of the present invention.

Claims

1. Industrial Internet of Things (IoT) big data security protection software, characterized in that: include: Edge computing nodes classify raw data collected from industrial field equipment into structured tagged data and telemetry stream numerical data. For the structured tagged data, a trapdoor is generated based on a searchable symmetric encryption algorithm. The positions of two candidate buckets corresponding to the trapdoor are calculated using a cuckoo filter. The fingerprint value of the trapdoor and the corresponding ciphertext data block address are written into empty slots in the candidate bucket positions to obtain a ciphertext index. The ciphertext index and the ciphertext data block are uploaded to a cloud-based ciphertext analysis platform. For the telemetry stream numerical data, multiple pairwise coprime submoduloes are selected. Based on the Chinese Remainder Theorem, plaintext data from multiple time points within a packaging cycle are merged and encoded into a single package. The plaintext is encrypted using a semi-homomorphic encryption algorithm to obtain packaged ciphertext. The packaged ciphertext is then uploaded to the cloud-based ciphertext analysis platform. When the cloud-based ciphertext analysis platform receives a retrieval request for the structured tag data, it performs fingerprint matching in the ciphertext index based on the trapdoor corresponding to the retrieval request to obtain the address of the matching ciphertext data block and returns the corresponding ciphertext data block. When the cloud-based ciphertext analysis platform receives an aggregation request for the telemetry stream numerical data, it directly performs homomorphic operations on multiple packaged ciphertexts within the time range corresponding to the aggregation request to obtain aggregated ciphertext. The aggregated ciphertext is then returned to the party with decryption authority for decryption to obtain the aggregation result.

2. The industrial IoT big data security protection software according to claim 1, characterized in that: The method for generating a trapdoor based on a searchable symmetric encryption algorithm includes: using a first subkey derived from the master key of the data owner, calculating a pseudo-random function value for the keywords in the structured tag data to obtain the trapdoor corresponding to the keywords; calculating a fingerprint value for the trapdoor; calculating the first candidate bucket position corresponding to the fingerprint value according to a first hash function; performing a bitwise XOR operation on the result of the cryptographic hash function operation between the first candidate bucket position and the fingerprint value to obtain the second candidate bucket position; when it is determined that both the first candidate bucket position and the second candidate bucket position have empty slots, writing the fingerprint value and the address of the ciphertext data block encrypted by the second subkey into one of the empty slots; when it is determined that neither the first candidate bucket position nor the second candidate bucket position has empty slots, randomly selecting one of the candidate bucket positions and migrating the fingerprint value stored in that candidate bucket position to its other candidate bucket position.

3. The industrial IoT big data security protection software according to claim 1, characterized in that: The method of merging and encoding plaintext data from multiple time points within a packaging period into a single packaged plaintext based on the Chinese Remainder Theorem includes: mapping the multiple plaintext data within the packaging period to different slots; calculating the modulus product and modulo inverse of each data point based on the sub-modulus corresponding to each slot; summing the products of the multiple plaintext data, the modulus product, and the modulo inverse, and then taking the modulus of the product of all sub-modulus numbers to obtain the packaged plaintext; encrypting the packaged plaintext to obtain packaged ciphertext includes: selecting a random number; calculating the packaged ciphertext based on the public key generator, the packaged plaintext, and the random number; the packaged ciphertext is accompanied by a set of sub-modulus numbers and a timestamp corresponding to each slot; and directly performing homomorphic operations on multiple packaged ciphertexts to obtain aggregated ciphertext includes: multiplying the multiple packaged ciphertexts corresponding to each other and then taking the modulus of the square of the public key modulus to obtain the aggregated ciphertext; and decrypting the aggregated ciphertext to obtain the merged plaintext is the sum of the multiple packaged plaintexts divided by the public key modulus.

4. The industrial IoT big data security protection software according to claim 3, characterized in that: The plurality of sub-modulo numbers are pairwise coprime, and the value of each sub-modulo number is greater than the data value of the corresponding slot in the packaging cycle, so as to avoid cross-slot carry pollution caused by the homomorphic operation.

5. The industrial IoT big data security protection software according to claim 1, characterized in that, Also includes: The edge computing node derives a session key based on the response generated by the physically unclonable function, and uses the white-box lookup table corresponding to the session key to complete the trapdoor generation operation and the key-related operation in the semi-homomorphic encryption algorithm.

6. A method for dynamic derivation of edge keys in the Industrial Internet of Things, characterized in that, include: The edge gateway security chip generates a random challenge value, which is then input into a physical non-cloning function circuit to obtain a corresponding stimulus response. An error correction process is performed on the stimulus response using a fuzz extractor to obtain stable key material. This stable key material, a session sequence identifier, and a random number for the current session are concatenated and input into a cryptographic hash function to obtain the current session key. The session sequence identifier reflects the temporal order of the current session. The session key is then input into a white-box obfuscation transformation module to obtain a white-box lookup table corresponding to the session key. Subsequent encryption and decryption operations are performed using this white-box lookup table. The session key is not stored in plaintext in registers or memory. After the current session operation is completed, the stable key material, the session key, and the data in the relevant intermediate registers are erased.

7. The method for dynamic derivation of edge keys in industrial IoT according to claim 6, characterized in that: The excitation response is affected by temperature and voltage fluctuations, resulting in bit errors. The fuzz extractor uses pre-generated auxiliary data to correct the excitation response, so that the same random challenge value can yield the same stable key material under different environmental conditions.

8. A method for adaptive dimensionality reduction storage of encrypted temporal data, characterized in that, include: A fixed-length sliding window continuously collects raw telemetry sample values ​​at multiple time points. The standard deviation of the sample values ​​within the sliding window is calculated and compared with a preset fluctuation threshold. When the standard deviation is less than the preset fluctuation threshold, differential encoding is performed on the raw telemetry sample values ​​to obtain the initial value and a point-by-point difference sequence. When the standard deviation is not less than the preset fluctuation threshold, the raw telemetry sample values ​​are retained. Based on the numerical range of the data obtained in the previous steps, the corresponding sub-modulus bit width is dynamically calculated, and the number of slots used for Chinese Remainder Theorem (CRT) packaging is adjusted according to the sub-modulus bit width. Based on the adjusted number of slots, CRT packaging and semi-homomorphic encryption are performed on the data to obtain a ciphertext packet. The ciphertext packet is uploaded to the cloud. When it is necessary to restore the original telemetry sequence, the ciphertext packet is decrypted to obtain the difference sequence and the initial value. An accumulation operation is performed on the difference sequence based on the initial value to restore the original telemetry sequence.

9. The method for adaptive dimensionality reduction storage of encrypted temporal data according to claim 8, characterized in that: The sub-module bit width satisfies the constraint that no carry contamination occurs between slots, and the number of slots is recalculated based on the current data bit width under the premise of satisfying the constraint.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 9.

Images