CN114139176B - Industrial Internet core data protection method and system based on national security - Google Patents
Industrial Internet core data protection method and system based on national securityInfo
- Publication number
- CN114139176B CN114139176B CN202111342209.2A CN202111342209A CN114139176B CN 114139176 B CN114139176 B CN 114139176B CN 202111342209 A CN202111342209 A CN 202111342209A CN 114139176 B CN114139176 B CN 114139176B
- Authority
- CN
- China
- Prior art keywords
- data
- cloud platform
- platform
- user
- key
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/602—Providing cryptographic facilities or services
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
- G06F21/33—User authentication using certificates
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Storage Device Security (AREA)
Abstract
The invention provides a protection method and a system for industrial Internet core data based on national security, which relate to the field of data processing, wherein the protection system comprises a Certificate Authority (CA), an edge computing gateway, a cloud platform, a user platform and a password service platform, and the password service platform comprises a KEY management subsystem; the method comprises the steps of establishing an SSL data channel based on a digital certificate USB-KEY and a CA certificate issued by CA and based on a national secret SM2 algorithm, establishing a cloud platform and each edge computing gateway by two-way authentication, logging in the cloud platform by the user platform based on a user ID and a national secret dynamic password, transmitting the data plaintext to a KEY management subsystem by the cloud platform when the user platform transmits the data plaintext of industrial Internet core data to the cloud platform, encrypting the data plaintext by the KEY management subsystem, and transmitting the encrypted data ciphertext to the cloud platform for storage. By the method and the system, the national cryptographic algorithm can be completely used, a complete set of solution and system for protecting the data security are provided, and the data security is improved.
Description
Technical Field
The invention relates to the field of data processing, in particular to a protection method and system for industrial Internet core data based on national security.
Background
The industrial internet is in the vigorous development period, core data generated in the industrial production process can undergo multiple stages of data generation, data acquisition, data transmission, data analysis, data display and the like, and in the life cycle process of the data, it is important to ensure the safety of the data.
In the current industrial internet field, encryption of core data is mainly performed by using international key standards such as RSA, DES, etc. There is no completely state-secret-based, sophisticated solution to protect the core data in an industrial process from being safe and reliable throughout the life cycle. Therefore, a data protection method based on national security is needed.
Disclosure of Invention
According to an aspect of the disclosure, a protection method of national secret-based industrial internet core data is provided, the protection method of the national secret-based industrial internet core data is realized by a protection system of the national secret-based industrial internet core data, the protection system comprises a Certificate Authority (CA), an edge computing gateway, a cloud platform, a user platform and a password service platform, and the password service platform comprises a key management subsystem;
the method comprises the following steps:
based on a digital certificate USB-KEY and a CA certificate issued by the CA and based on a national secret SM2 algorithm, the cloud platform performs mutual authentication with each edge computing gateway, and an SSL data channel is constructed for data transmission;
the user platform logs in the cloud platform based on a user ID and a national password;
When the user platform transmits the data plaintext of the industrial Internet core data to the cloud platform, the cloud platform transmits the data plaintext to the key management subsystem;
And the key management subsystem encrypts the data plaintext, and transmits the encrypted data ciphertext to the cloud platform for storage, so that the storage protection operation of the industrial Internet core data is completed.
According to another aspect of the present disclosure, there is provided a protection system for industrial internet core data based on national security, the protection system comprising a Certificate Authority (CA), an edge computing gateway, a cloud platform, a user platform, and a cryptographic service platform, wherein the cryptographic service platform comprises a key management subsystem, and wherein:
The CA is used for issuing digital certificates USB-KEY and CA certificates based on a national secret SM2 algorithm to the cloud platform and each edge computing gateway;
the edge computing gateway is used for performing bidirectional authentication with the cloud platform, constructing an SSL data channel with the cloud platform for data transmission, and enabling the user platform to log in the cloud platform;
the user platform is used for logging in the cloud platform and transmitting a data plaintext of industrial Internet core data to the cloud platform;
the cloud platform is used for performing two-way authentication with the edge computing gateway, constructing an SSL data channel with the edge computing gateway for data transmission, receiving data plaintext sent by the user platform, sending the data plaintext to the key management subsystem, receiving data ciphertext sent by the key management subsystem, and storing the data ciphertext;
The key management subsystem is used for receiving the data plaintext sent by the cloud platform, encrypting the data plaintext and sending the encrypted data ciphertext to the cloud platform;
the password service platform is used for distributing entity password tokens to the cloud platform, verifying the user identity of the user platform and sending verification passing instructions or verification failing instructions to the cloud platform.
According to another aspect of the present disclosure, there is provided a protection device for national security-based industrial internet core data, where the device is disposed in a protection system for the national security-based industrial internet core data, the protection system includes a certificate authority CA, an edge computing gateway, a cloud platform, a user platform, and a cryptographic service platform, and the cryptographic service platform includes a key management subsystem;
the device comprises:
The construction module is used for constructing an SSL data channel for data transmission based on a digital certificate USB-KEY and a CA certificate which are issued by the CA and are based on a national secret SM2 algorithm, and the cloud platform performs mutual authentication with each edge computing gateway;
The login module is used for the user platform to log in the cloud platform through the edge computing gateway based on the user ID and the national password;
the transmission module is used for transmitting the data plaintext of the industrial Internet core data to the cloud platform by the cloud platform when the user platform transmits the data plaintext to the key management subsystem;
And the encryption module is used for encrypting the data plaintext by the key management subsystem, and transmitting the encrypted data ciphertext to the cloud platform for storage, so that the storage protection operation of the industrial Internet core data is completed.
According to another aspect of the present disclosure, there is provided an electronic device including:
Processor, and
A memory in which a program is stored,
The program comprises instructions which, when executed by the processor, cause the processor to perform the above-described protection method for national security-based industrial internet core data.
According to another aspect of the present disclosure, there is provided a non-transitory computer-readable storage medium storing computer instructions for causing a computer to perform the above-described protection method of national secret-based industrial internet core data.
The technical scheme provided by the embodiment of the application can realize the complete use of the national cryptographic algorithm, provide a complete set of solution and system for the security protection of data, and improve the security of industrial Internet core data.
Drawings
Further details, features and advantages of the present disclosure are disclosed in the following description of exemplary embodiments, with reference to the following drawings, wherein:
FIG. 1 illustrates a flowchart of a method for protecting national security based industrial Internet core data in accordance with an exemplary embodiment of the present disclosure;
FIG. 2 illustrates a state-based edge computing gateway identity authentication flow diagram according to an exemplary embodiment of the present disclosure;
FIG. 3 illustrates a state-based user platform identity authentication flow diagram according to an exemplary embodiment of the present disclosure;
FIG. 4 illustrates a state-based core data encryption storage flow diagram according to an exemplary embodiment of the present disclosure;
FIG. 5 shows a schematic block diagram of a national-security-based industrial Internet core data protection system in accordance with an exemplary embodiment of the present disclosure;
FIG. 6 shows a schematic block diagram of a protection device for national-security-based industrial Internet core data, according to an exemplary embodiment of the present disclosure;
fig. 7 illustrates a block diagram of an exemplary electronic device that can be used to implement embodiments of the present disclosure.
Detailed Description
Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While certain embodiments of the present disclosure have been shown in the accompanying drawings, it is to be understood that the present disclosure may be embodied in various forms and should not be construed as limited to the embodiments set forth herein, but are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustration purposes only and are not intended to limit the scope of the present disclosure.
It should be understood that the various steps recited in the method embodiments of the present disclosure may be performed in a different order and/or performed in parallel. Furthermore, method embodiments may include additional steps and/or omit performing the illustrated steps. The scope of the present disclosure is not limited in this respect.
The term "including" and variations thereof as used herein are intended to be open-ended, i.e., including, but not limited to. The term "based on" is based at least in part on. The term "one embodiment" means "at least one embodiment," another embodiment "means" at least one additional embodiment, "and" some embodiments "means" at least some embodiments. Related definitions of other terms will be given in the description below. It should be noted that the terms "first," "second," and the like herein are merely used for distinguishing between different systems, modules, or units and not for limiting the order or interdependence of the functions performed by such systems, modules, or units.
It should be noted that references to "one", "a plurality" and "a plurality" in this disclosure are intended to be illustrative rather than limiting, and those of ordinary skill in the art will appreciate that "one or more" is intended to be understood as "one or more" unless the context clearly indicates otherwise.
The names of messages or information interacted between the various systems in the embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.
The embodiment of the disclosure provides a protection method for industrial internet core data based on national secret, which can be realized by a protection system for the industrial internet core data based on the national secret, wherein the protection system can comprise a CA (CERTIFICATE AUTHORITY ), an edge computing gateway, a cloud platform, a user platform and a password service platform, and the password service platform can comprise a key management subsystem. As shown in fig. 1, a flowchart of a method for protecting industrial internet core data based on national security, the process flow of the method may include the following steps:
step 101, based on a digital certificate USB-KEY and a CA certificate issued by CA and based on a national secret SM2 algorithm, a cloud platform performs two-way authentication with each edge computing gateway, and an SSL data channel is constructed for data transmission;
Step 102, a user platform logs in a cloud platform based on a user ID and a national password;
Step 103, when the user platform transmits the data plaintext of the industrial Internet core data to the cloud platform, the cloud platform transmits the data plaintext to the key management subsystem;
And 104, encrypting the data plaintext by the key management subsystem, and transmitting the encrypted data ciphertext to the cloud platform for storage, so as to finish the storage protection operation of the industrial Internet core data.
Optionally, based on a digital certificate USB-KEY and a CA certificate issued by CA and based on a national secret SM2 algorithm, the cloud platform performs mutual authentication with each edge computing gateway, and constructs an SSL data channel for data transmission, including:
CA issues digital certificates USB-KEY and CA certificates based on SM2 national cryptographic algorithm to the cloud platform and each edge computing gateway respectively;
the cloud platform exchanges a digital certificate USB-KEY with each edge computing gateway to perform bidirectional authentication;
when the bidirectional authentication of the cloud platform and the edge computing gateway passes, the edge computing gateway establishes connection with the cloud platform, and an SSL data channel is constructed for data transmission.
Optionally, the cloud platform exchanges a digital certificate USB-KEY with each edge computing gateway, and after performing bidirectional authentication, the cloud platform further includes:
when the bidirectional authentication of the cloud platform and the edge computing gateways fails, the CA issues digital certificates USB-KEY and CA certificates based on a national secret SM2 algorithm to the cloud platform and each edge computing gateway again;
and the cloud platform exchanges the digital certificate USB-KEY with each edge computing gateway again to perform bidirectional authentication.
Optionally, the user platform logs in the cloud platform based on the user ID and the national password, including:
When the cloud platform receives a registration request instruction sent by the user platform, the cloud platform applies an entity password token for the user platform from the password service platform;
When a user platform sends a login request instruction to a cloud platform, the cloud platform receives a user ID and a national password sent by the user platform;
The cloud platform verifies the identity of the user to the password service platform based on the user ID and the national password dynamic password;
when the cloud platform receives the verification passing instruction sent by the password service platform, the cloud platform sends a login success instruction to the user platform.
Optionally, after the cloud platform verifies the user identity to the password service platform based on the user ID and the national password dynamic password, the cloud platform further includes:
when the cloud platform receives the verification failing instruction sent by the password service platform, the cloud platform sends a login failure instruction to the user platform, and prompts the user platform to input the user ID and the national password again.
Optionally, the cloud platform transmits the data plaintext to the key management subsystem, including:
after the cloud platform establishes an SSL channel with the key management subsystem, the cloud platform sends a key application instruction to the key management subsystem;
When the key management subsystem receives a key application instruction, the key management subsystem generates a key and a key identification and sends the key identification to the cloud platform;
And after receiving the key identification, the cloud platform transmits the data plaintext and the key identification to the key management subsystem.
Optionally, the key management subsystem encrypts the data plaintext, and transmits the encrypted data ciphertext to the cloud platform for storage, including:
When the key management subsystem receives the data plaintext and the key identification, the corresponding key is obtained through the key identification;
The key management subsystem encrypts the data plaintext through a key to obtain a data ciphertext corresponding to the data plaintext, and sends the data ciphertext to the cloud platform;
and the cloud platform stores the received data ciphertext.
Optionally, the method further comprises:
When the cloud platform receives a data plaintext acquisition instruction sent by the user platform, the cloud platform transmits a data ciphertext corresponding to the data plaintext acquisition instruction to the key management subsystem;
The key management subsystem decrypts the data ciphertext to obtain the data plaintext and a key identifier;
the key management subsystem sends the data plaintext and the key identification to the cloud platform;
and the cloud platform sends the data plaintext to the user platform.
In the embodiment of the disclosure, a complete set of solution and system are provided for protecting the safety of data through completely using a national encryption algorithm, in the industrial Internet field, data transmission from a production site data acquisition, an edge computing gateway to a cloud platform, data encryption and decryption processing and data disk-falling storage on the cloud platform, and data life cycle processes such as data display and the like, so that the safety of the industrial Internet core data storage is improved, and good practice is provided for application and popularization of the national encryption algorithm in the industrial Internet field.
The embodiment of the disclosure provides a method for authenticating an edge computing gateway based on national secret, which can be realized by a CA, an edge computing gateway and a cloud platform in a protection system of industrial internet core data based on national secret, as shown in an edge computing gateway identity authentication flow chart based on national secret in fig. 2, and the processing flow of the method can comprise the following steps:
Step 201, the CA issues digital certificates USB-KEY and CA certificates based on a national secret SM2 algorithm to the cloud platform and each edge computing gateway respectively.
Step 202, the cloud platform exchanges digital certificates USB-KEY with each edge computing gateway to perform bidirectional authentication.
And 203, when the bidirectional authentication of the cloud platform and the edge computing gateway is passed, the edge computing gateway establishes connection with the cloud platform, and an SSL data channel is constructed for data transmission.
Step 204, when the two-way authentication of the cloud platform and the edge computing gateway is not passed, the CA re-issues a digital certificate USB-KEY and CA certificates based on the SM2 cryptographic algorithm to the cloud platform and each edge computing gateway.
Step 205, the cloud platform exchanges the digital certificate USB-KEYs with each edge computing gateway again to perform bidirectional authentication.
According to the embodiment of the disclosure, through the bidirectional certificate authentication process of the national secret SM2 algorithm, the edge computing gateway is ensured to be a legal platform user authenticated by CA, and malicious users are prevented from connecting with the cloud platform. The subsequent data transmission of the edge computing gateway is carried out through an SSL (Secure Sockets Layer, secure socket protocol) channel, and the data is encrypted by a national secret symmetric key SM4 in the transmission process, so that the leakage and the tampering of the data in the end-to-end transmission process are prevented.
The embodiment of the disclosure provides a user platform identity authentication method based on national secret, which can be realized by a user platform, a cloud platform and a password service platform in a protection system of industrial internet core data based on national secret, as shown in a user platform identity authentication flow chart based on national secret in fig. 3, and the processing flow of the method can comprise the following steps:
step 301, when the cloud platform receives a registration request instruction sent by the user platform, the cloud platform applies for an entity password token for the user platform from the password service platform.
Step 302, when the user platform sends a login request instruction to the cloud platform, the cloud platform receives a user ID and a national password sent by the user platform.
Step 303, the cloud platform verifies the identity of the user to the password service platform based on the user ID and the national password dynamic password.
Step 304, when the cloud platform receives the verification passing instruction sent by the password service platform, the cloud platform sends a login success instruction to the user platform.
And 305, when the cloud platform receives a verification failing instruction sent by the password service platform, the cloud platform sends a login failure instruction to the user platform to prompt the user platform to input the user ID and the national password again.
In the embodiment of the disclosure, the identity authentication is performed on the user platform through the user ID and the national password dynamic password, the dynamic password has short timeliness, and the probability that a malicious user logs in the cloud platform and views and operates core data in industrial production due to password leakage is reduced.
The embodiment of the disclosure provides a cryptographic storage method for core data based on national secret, which can be realized by a user platform, a cloud platform and a key management subsystem in a protection system for industrial internet core data based on national secret, as shown in a cryptographic storage flow chart of core data based on national secret in fig. 4, and the processing flow of the method can comprise the following steps:
In step 401, when the user platform transmits the data plaintext of the industrial internet core data to the cloud platform, after the cloud platform establishes an SSL channel with the key management subsystem, the cloud platform sends a key application instruction to the key management subsystem.
Step 402, when the key management subsystem receives the key application instruction, the key management subsystem generates a key and a key identifier, and sends the key identifier to the cloud platform.
Step 403, after receiving the key identifier, the cloud platform transmits the data plaintext and the key identifier to the key management subsystem.
Step 404, when the key management subsystem receives the data plaintext and the key identifier, the corresponding key is obtained through the key identifier.
And 405, the key management subsystem encrypts the data plaintext through a key to obtain a data ciphertext corresponding to the data plaintext, and sends the data ciphertext to the cloud platform.
And step 406, the cloud platform stores the received data ciphertext.
Step 407, when the cloud platform receives the data plaintext acquisition instruction sent by the user platform, the cloud platform transmits the data ciphertext corresponding to the data plaintext acquisition instruction to the key management subsystem.
And step 408, the key management subsystem decrypts the data ciphertext to obtain the data plaintext and the key identification.
Step 409, the key management subsystem sends the data plaintext and the key identifier to the cloud platform.
Step 410, the cloud platform sends the data plaintext to the user platform.
In the embodiment of the disclosure, the life cycle of the encryption key is given to the key management subsystem for management, and the security level of the key management subsystem is far higher than that of the cloud platform, so that the processing has the advantages that even if the cloud platform is broken to cause the leakage of the core data ciphertext, the core data plaintext can be still ensured not to be broken, and the security of the industrial Internet core data is improved.
The embodiment of the disclosure provides a protection system for industrial Internet core data based on national density, which is used for realizing the protection method for the industrial Internet core data based on national density. As shown in fig. 5, which is a schematic block diagram of a protection system for national security based industrial internet core data, the protection system 500 includes a certificate authority CA 510, an edge computing gateway 520, a cloud platform 530, a user platform 540, and a key management subsystem 550, the key management subsystem 550 being subordinate to a cryptographic service platform 560, wherein:
CA 510, which is used for issuing digital certificates USB-KEY and CA certificates based on SM2 cryptographic algorithm to the cloud platform and each edge computing gateway;
The edge computing gateway 520 is configured to perform bidirectional authentication with the cloud platform, and construct an SSL data channel with the cloud platform to perform data transmission, so that the user platform logs in the cloud platform;
the user platform 530 is used for logging in the cloud platform and transmitting the data plaintext of the industrial internet core data to the cloud platform;
The cloud platform 540 is used for performing two-way authentication with the edge computing gateway, constructing an SSL data channel with the edge computing gateway for data transmission, receiving a data plaintext sent by the user platform, sending the data plaintext to the key management subsystem, receiving a data ciphertext sent by the key management subsystem, and storing the data ciphertext;
The key management subsystem 550 is configured to receive the data plaintext sent by the cloud platform, encrypt the data plaintext, and send the encrypted data ciphertext to the cloud platform;
and the password service platform 560 is used for distributing entity password tokens to the cloud platform, verifying the user identity of the user platform, and sending verification passing instructions or verification failing instructions to the cloud platform.
In the embodiment of the disclosure, a complete set of solution and system are provided for protecting the safety of data through completely using a national encryption algorithm, in the industrial Internet field, data transmission from a production site data acquisition, an edge computing gateway to a cloud platform, data encryption and decryption processing and data disk-falling storage on the cloud platform, and data life cycle processes such as data display and the like, so that the safety of the industrial Internet core data storage is improved, and good practice is provided for application and popularization of the national encryption algorithm in the industrial Internet field.
The embodiment of the disclosure provides a protection device for national secret-based industrial internet core data, which is arranged in the protection system for the national secret-based industrial internet core data, and the protection system comprises a Certificate Authority (CA), an edge computing gateway, a cloud platform, a user platform and a password service platform, wherein the password service platform comprises a key management subsystem.
As shown in fig. 6, a schematic block diagram of a protection device for national-security-based industrial internet core data, the protection device 600 for national-security-based industrial internet core data includes a construction module 601, a login module 602, a transmission module 603, and an encryption module 604.
The construction module 601 is configured to perform bidirectional authentication with each edge computing gateway by using the cloud platform based on a digital certificate USB-KEY and a CA certificate issued by the CA and based on a national secret SM2 algorithm, and construct an SSL data channel for data transmission;
a login module 602, configured to login, by the user platform, to the cloud platform based on a user ID and a password;
the transmission module 603 is configured to, when the user platform transmits a data plaintext of industrial internet core data to the cloud platform, transmit the data plaintext to the key management subsystem by the cloud platform;
And the encryption module 604 is configured to encrypt the data plaintext by using the key management subsystem, and transmit the encrypted data ciphertext to the cloud platform for storage, so as to complete the storage protection operation of the industrial internet core data.
Optionally, the building module 601 is configured to:
The CA issues digital certificates USB-KEY and CA certificates based on a national secret SM2 algorithm to the cloud platform and each edge computing gateway respectively;
The cloud platform exchanges a digital certificate USB-KEY with each edge computing gateway to perform bidirectional authentication;
When the bidirectional authentication of the cloud platform and the edge computing gateway is passed, the edge computing gateway establishes connection with the cloud platform, and an SSL data channel is constructed for data transmission.
Optionally, the building module 601 is further configured to:
when the bidirectional authentication of the cloud platform and the edge computing gateways is not passed, the CA re-issues digital certificates USB-KEY and CA certificates based on a national secret SM2 algorithm to the cloud platform and each edge computing gateway;
and the cloud platform exchanges the digital certificate USB-KEY with each edge computing gateway again to perform bidirectional authentication.
Optionally, the login module 602 is configured to:
When the cloud platform receives a registration request instruction sent by the user platform, the cloud platform applies for an entity password token for the user platform from the password service platform;
when the user platform sends a login request instruction to the cloud platform, the cloud platform receives a user ID and a national password sent by the user platform;
the cloud platform verifies the user identity to the password service platform based on the user ID and the national password dynamic password;
when the cloud platform receives the verification passing instruction sent by the password service platform, the cloud platform sends a login success instruction to the user platform.
Optionally, the login module 602 is further configured to:
When the cloud platform receives the verification failing instruction sent by the password service platform, the cloud platform sends a login failure instruction to the user platform to prompt the user platform to input a user ID and a national password again.
Optionally, the transmission module 603 is configured to:
After the cloud platform establishes an SSL channel with the key management subsystem, the cloud platform sends a key application instruction to the key management subsystem;
When the key management subsystem receives a key application instruction, the key management subsystem generates a key and a key identifier and sends the key identifier to the cloud platform;
And after receiving the key identification, the cloud platform transmits the data plaintext and the key identification to the key management subsystem.
Optionally, the encryption module 604 is configured to:
when the key management subsystem receives the data plaintext and the key identification, the corresponding key is obtained through the key identification;
the key management subsystem encrypts the data plaintext through the key to obtain a data ciphertext corresponding to the data plaintext, and sends the data ciphertext to the cloud platform;
and the cloud platform stores the received data ciphertext.
Optionally, the transmission module 603 is further configured to:
When the cloud platform receives a data plaintext acquisition instruction sent by the user platform, the cloud platform transmits a data ciphertext corresponding to the data plaintext acquisition instruction to the key management subsystem;
the key management subsystem decrypts the data ciphertext to obtain a data plaintext and a key identifier;
The key management subsystem sends the data plaintext and a key identification to the cloud platform;
And the cloud platform sends the data plaintext to the user platform.
In the embodiment of the disclosure, a complete set of solution and system are provided for protecting the safety of data through completely using a national encryption algorithm, in the industrial Internet field, data transmission from a production site data acquisition, an edge computing gateway to a cloud platform, data encryption and decryption processing and data disk-falling storage on the cloud platform, and data life cycle processes such as data display and the like, so that the safety of the industrial Internet core data storage is improved, and good practice is provided for application and popularization of the national encryption algorithm in the industrial Internet field.
The exemplary embodiments of the present disclosure also provide an electronic device comprising at least one processor and a memory communicatively coupled to the at least one processor. The memory stores a computer program executable by the at least one processor for causing the electronic device to perform a method according to embodiments of the present disclosure when executed by the at least one processor.
The present disclosure also provides a non-transitory computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor of a computer, is for causing the computer to perform a method according to an embodiment of the present disclosure.
The present disclosure also provides a computer program product comprising a computer program, wherein the computer program, when executed by a processor of a computer, is for causing the computer to perform a method according to embodiments of the disclosure.
Referring to fig. 7, a block diagram of an electronic device 700 that may be a server or a client of the present disclosure, which is an example of a hardware device that may be applied to aspects of the present disclosure, will now be described. Electronic devices are intended to represent various forms of digital electronic computer devices, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular telephones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be exemplary only, and are not meant to limit implementations of the disclosure described and/or claimed herein.
As shown in fig. 7, the electronic device 700 includes a computing unit 701 that can perform various appropriate actions and processes according to a computer program stored in a Read Only Memory (ROM) 702 or a computer program loaded from a storage unit 708 into a Random Access Memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the device 700 may also be stored. The computing unit 701, the ROM 702, and the RAM 703 are connected to each other through a bus 704. An input/output (I/O) interface 705 is also connected to bus 704.
Various components in the electronic device 700 are connected to the I/O interface 705, including an input unit 706, an output unit 707, a storage unit 708, and a communication unit 709. The input unit 706 may be any type of device capable of inputting information to the electronic device 700, and the input unit 706 may receive input numeric or character information and generate key signal inputs related to user settings and/or function controls of the electronic device. The output unit 707 may be any type of device capable of presenting information and may include, but is not limited to, a display, speakers, video/audio output terminals, vibrators, and/or printers. Storage unit 704 may include, but is not limited to, magnetic disks, optical disks. The communication unit 709 allows the electronic device 700 to exchange information/data with other devices through computer networks, such as the internet, and/or various telecommunications networks, and may include, but is not limited to, modems, network cards, infrared communication devices, wireless communication transceivers and/or chipsets, such as bluetooth (TM) devices, wiFi devices, wiMax devices, cellular communication devices, and/or the like.
The computing unit 701 may be a variety of general and/or special purpose processing components having processing and computing capabilities. Some examples of computing unit 701 include, but are not limited to, a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), various specialized Artificial Intelligence (AI) computing chips, various computing units running machine learning model algorithms, a Digital Signal Processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 701 performs the various methods and processes described above. For example, in some embodiments, the method of protecting national cryptographic based industrial internet core data may be implemented as a computer software program tangibly embodied on a machine-readable medium, such as storage unit 708. In some embodiments, part or all of the computer program may be loaded and/or installed onto the electronic device 700 via the ROM 702 and/or the communication unit 709. In some embodiments, the computing unit 701 may be configured to perform the method of protecting national cryptographic-based industrial internet core data by any other suitable means (e.g., by means of firmware).
Program code for carrying out methods of the present disclosure may be written in any combination of one or more programming languages. These program code may be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus such that the program code, when executed by the processor or controller, causes the functions/operations specified in the flowchart and/or block diagram to be implemented. The program code may execute entirely on the machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine or entirely on the remote machine or server.
In the context of this disclosure, a machine-readable medium may be a tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. The machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
As used in this disclosure, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, apparatus, and/or device (e.g., magnetic discs, optical disks, memory, programmable Logic Devices (PLDs)) used to provide machine instructions and/or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The term "machine-readable signal" refers to any signal used to provide machine instructions and/or data to a programmable processor.
To provide for interaction with a user, the systems and techniques described here can be implemented on a computer having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the computer. Other kinds of devices may also be used to provide for interaction with a user, for example, feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback), and input from the user may be received in any form, including acoustic input, speech input, or tactile input.
The systems and techniques described here can be implemented in a computing system that includes a background component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front-end component (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such background, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a Local Area Network (LAN), a Wide Area Network (WAN), and the Internet.
The computer system may include a client and a server. The client and server are typically remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other.
Claims (10)
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111342209.2A CN114139176B (en) | 2021-11-12 | 2021-11-12 | Industrial Internet core data protection method and system based on national security |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111342209.2A CN114139176B (en) | 2021-11-12 | 2021-11-12 | Industrial Internet core data protection method and system based on national security |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114139176A CN114139176A (en) | 2022-03-04 |
| CN114139176B true CN114139176B (en) | 2025-07-29 |
Family
ID=80393113
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202111342209.2A Active CN114139176B (en) | 2021-11-12 | 2021-11-12 | Industrial Internet core data protection method and system based on national security |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114139176B (en) |
Families Citing this family (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114915443A (en) * | 2022-03-09 | 2022-08-16 | 深圳市明泰智能技术有限公司 | Industrial edge operating system supporting national encryption algorithm |
| CN115102987B (en) * | 2022-06-16 | 2023-10-13 | 平安银行股份有限公司 | Edge equipment management system for banking outlets |
| CN116545671A (en) * | 2023-04-23 | 2023-08-04 | 中国银行股份有限公司 | Secure communication system and method |
| CN121098640B (en) * | 2025-11-11 | 2026-01-30 | 江苏省数据集团数字科技有限公司 | AI Model Security Protection System and Method Based on Domestic Cryptographic Algorithms and Digital Certificates |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101674304A (en) * | 2009-10-15 | 2010-03-17 | 浙江师范大学 | System and method for network identity authentication |
| CN109672521A (en) * | 2018-12-26 | 2019-04-23 | 贵州华芯通半导体技术有限公司 | Safe storage system and method based on encription algorithms approved by the State Password Administration Committee Office engine implementation |
| CN109714307A (en) * | 2018-06-12 | 2019-05-03 | 广东工业大学 | A kind of cloud platform client data encrypting and deciphering system and method based on national secret algorithm |
Family Cites Families (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US11201730B2 (en) * | 2019-03-26 | 2021-12-14 | International Business Machines Corporation | Generating a protected key for selective use |
| CN111865609A (en) * | 2020-07-03 | 2020-10-30 | 上海缔安科技股份有限公司 | Private cloud platform data encryption and decryption system based on state cryptographic algorithm |
-
2021
- 2021-11-12 CN CN202111342209.2A patent/CN114139176B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101674304A (en) * | 2009-10-15 | 2010-03-17 | 浙江师范大学 | System and method for network identity authentication |
| CN109714307A (en) * | 2018-06-12 | 2019-05-03 | 广东工业大学 | A kind of cloud platform client data encrypting and deciphering system and method based on national secret algorithm |
| CN109672521A (en) * | 2018-12-26 | 2019-04-23 | 贵州华芯通半导体技术有限公司 | Safe storage system and method based on encription algorithms approved by the State Password Administration Committee Office engine implementation |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114139176A (en) | 2022-03-04 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN114139176B (en) | Industrial Internet core data protection method and system based on national security | |
| CN108512846B (en) | Bidirectional authentication method and device between terminal and server | |
| CN105790938B (en) | Secure unit key generation system and method based on trusted execution environment | |
| US9467430B2 (en) | Device, method, and system for secure trust anchor provisioning and protection using tamper-resistant hardware | |
| US9231925B1 (en) | Network authentication method for secure electronic transactions | |
| CN108390851B (en) | Safe remote control system and method for industrial equipment | |
| US9838205B2 (en) | Network authentication method for secure electronic transactions | |
| WO2022206349A1 (en) | Information verification method, related apparatus, device, and storage medium | |
| US9998287B2 (en) | Secure authentication of remote equipment | |
| TW201706900A (en) | Method and device for authentication using dynamic passwords | |
| CN102957584B (en) | Home network equipment management method, control equipment and home network equipment | |
| CN116633530A (en) | Quantum key transmission method, device and system | |
| CN103916363B (en) | The communication security management method and system of encryption equipment | |
| CN102811224A (en) | Method, device and system for implementation of SSL (secure socket layer)/TLS (transport layer security) connection | |
| WO2023151427A1 (en) | Quantum key transmission method, device and system | |
| WO2025236608A1 (en) | Information verification method and related device | |
| CN113411187A (en) | Identity authentication method and system, storage medium and processor | |
| WO2018120938A1 (en) | Offline key transmission method, terminal and storage medium | |
| CN119808042B (en) | Container access control method, device, equipment and storage medium | |
| CN111654503A (en) | Remote control method, device, equipment and storage medium | |
| JP2016536678A (en) | Network management security authentication method, apparatus, system, and computer storage medium | |
| CN106789845A (en) | A kind of method of network data security transmission | |
| CN102594564B (en) | Equipment for traffic guidance information security management | |
| CN111064577A (en) | A security authentication method, device and electronic device | |
| CN208707655U (en) | A distribution automation key agreement system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |