WO2021012728A1

WO2021012728A1 - Channel encryption method for fieldbus in water management automation control system

Info

Publication number: WO2021012728A1
Application number: PCT/CN2020/085959
Authority: WO
Inventors: 傅晓; 王志坚
Original assignee: 河海大学
Priority date: 2019-07-19
Filing date: 2020-04-21
Publication date: 2021-01-28
Also published as: CN110430014A; CN110430014B

Abstract

Disclosed is a channel encryption method for a fieldbus in a water management automation control system. By means of a hardware encryption gateway deployed between an automation control device and the fieldbus, transparent encryption of a protocol data unit is implemented. In the hardware encryption gateway, by means of a mixed encryption solution combining a domestic symmetric encryption algorithm and an asymmetric encryption algorithm, automation control device identity authentication, fieldbus communication data confidentiality, and protocol packet integrity check functions are implemented, an unauthorized invalid device is effectively prevented from listening to, intercepting, and tampering with data monitoring and control information on a channel of the fieldbus, increased resistance against a man-in-the-middle attack is provided, and security risks in the water management automation control system resulting from a fieldbus channel intrusion are reduced. The hardware encryption gateway is capable of seamlessly accessing a fieldbus of an existing water management automation control system and provides increased device compatibility and versatility.

Description

Method for encrypting field bus channel in water conservancy automation control system

Technical field

The invention belongs to the field of information technology, and in particular relates to a field bus channel encryption method in a water conservancy automation control system.

Background technique

In the water conservancy automation control systems currently deployed in my country, most of them use Field Bus (Field Bus) network to network the programmable logic controller (PLC) and the lower computer. The reason is that the physical layer media used in computer networks, such as STP, single-mode or multi-mode fiber, etc., cannot meet the physical properties of high weather resistance and high strength industrial application scenarios. With its excellent performance and price advantage, RS232/485 cable has more than 20 years of application history in industrial automation control systems, and cannot be replaced in a short time. To replace the existing physical layer, the cost of implementing the transformation is too high, and will even be higher than the cost of the original deployment system. If wireless networking is used, the reliability and stability of the network will be reduced, and it cannot be implemented in a signal shielding scene, which has high limitations.

At present, most PLCs used in water conservancy automation control systems do not have computer network communication capabilities, and must be equipped with matching hardware interfaces. For the transformation of existing equipment, the implementation cost is also too high, and the different electrical and interface specifications between different manufacturers must be considered, and the cost-effectiveness is low. Although the Modbus TCP protocol supports transparent transmission in computer networks, its implementation is relatively simple and cannot support the network layer and transport layer security features in the TCP/IP protocol. Special modifications to the network module are required, and the versatility is not strong.

Most electrical engineers only have the development experience of data communication in the fieldbus network. If a computer network is used to replace the fieldbus, there must be sufficient personnel support, which means that the relevant knowledge system, training materials, courses, practices, and processes need to be established first. Due to the long training period of electrical engineers, the personnel base for implementing computer network transformation is not yet available.

In summary, the idea of reusing relevant theories and technologies in computer networks to solve the security problems of fieldbus networks in water conservancy automation control systems has considerable limitations under current personnel and technical conditions.

Therefore, how to propose a low-cost, highly applicable encryption scheme for the fieldbus channel under the premise of reducing the cost of reconstruction, and realize it through a hybrid encryption scheme (Hybrid Encryption Scheme) combining domestic symmetric encryption algorithms and asymmetric encryption algorithms Automated control equipment identity verification, fieldbus communication data confidentiality, and protocol packet integrity verification functions are a subject with high research and application value.

Summary of the invention

Purpose of the invention: In view of the above problems, the present invention proposes a fieldbus channel encryption method in a water conservancy automation control system to realize the functions of automatic control equipment identity verification, fieldbus communication data confidentiality, and protocol packet integrity verification.

Technical solution: In order to achieve the purpose of the present invention, the technical solution adopted by the present invention is: a hardware encryption gateway for fieldbus channel encryption, consisting of two serial communication modules, encryption modules, key storage modules, and power supply modules .

The two serial communication modules are respectively connected to the network physical interface of the automation control equipment and the field bus for receiving or sending serial communication protocol packets. The two serial communication modules are respectively connected to the encryption module through a high-speed serial data bus interface. The network physical interface used by the serial communication module includes, but is not limited to, an electrical interface that conforms to the RS485/232 standard. The high-speed serial data bus interface used by the serial communication module includes, but is not limited to, bus interfaces that comply with UART, I2C, and SPI standards.

The encryption module is a single chip microcomputer system (SOC), which can realize asymmetric encryption algorithms, symmetric encryption algorithms, hash algorithms, and random key generation algorithms through software codes with built-in registers or arithmetic logic unit hardware devices. Among them, asymmetric encryption algorithms include but are not limited to SM2, ECC, and RSA algorithms, symmetric encryption algorithms include but are not limited to SM1, RC4, and AES algorithms, and hash algorithms include but are not limited to SM3, MD5, and SHA-1 algorithms. The encryption module is connected to the serial communication module through its high-speed serial data bus interface, is connected to the key storage module through its data bus and address bus interface, and is connected to the power supply module through its power cord interface.

The key storage module is a flash-write read-only memory. The gateway stores the destination address code, and the corresponding public key and private key through the key storage module. The key storage module is connected to the encryption module through its data bus and address bus interface, and the interface includes but is not limited to an expansion bus interface that conforms to eMMC and UFS standards.

The power supply module is a DC power supply. The gateway is powered by a power supply module, and the power supply module converts the wide-voltage DC power input on the field bus into voltage and current that meet the requirements of the gateway's working conditions. The power supply module is connected to the encryption module through a two-core (VCC, GND) power cord interface, and the input voltage is 12V to 24V.

The two serial communication modules of the hardware encryption gateway are respectively connected to the network physical interface of the automation control device and the field bus. The serial communication module connected to the network physical interface of the automation control device is called the device end, and the serial communication module connected to the field bus network physical interface is called It is the field bus terminal.

A field bus channel encryption method in a water conservancy automation control system includes the following steps:

S1: Connect a hardware encryption gateway between each automation control device connected to the field bus and the network physical interface of the field bus, and write the corresponding key in the key storage module of the hardware encryption gateway in advance And the destination address code. The automation control equipment includes but not limited to PLC, lower computer, sensor, and controller.

S2: After the power supply module of the hardware encryption gateway starts working, the hardware encryption gateway starts and initializes the key storage module of the hardware encryption gateway; if the initialization process is completed, go to step S3; if the initialization process is terminated, no subsequent operations are performed; the initialization process as follows:

(2-1) Find all the stored destination address codes in the key storage module, and the corresponding public and private key records;

(2-2) At least one destination address code and the corresponding private key are stored in the key storage module; judge whether the number of private key records is unique, if the number of private key records is unique, go to step (2-3); otherwise , The initialization process is terminated and subsequent operations are not performed;

(2-3) At least one destination address code and the corresponding public key are stored in the key storage module; judge whether the number of public key records is greater than or equal to 1, if the number of public key records is greater than or equal to 1, the initialization process is completed ; Otherwise, the initialization process is terminated and subsequent operations are not performed.

S3: After the initialization of the key storage module of the hardware encryption gateway is completed, the monitoring process starts; the monitoring process includes two parts: one, on the serial communication module connected to the fieldbus side, for all serial communication application data incoming to the hardware encryption gateway Unit ADU monitors; second, monitor all serial communication application data unit ADUs incoming to the hardware encryption gateway on the serial communication module of the connected device; the steps are as follows:

(3-1) Monitor all the serial communication application data units ADUs incoming to the hardware encryption gateway on the serial communication module connected to the fieldbus end;

(3-1-1) When the serial communication module of the hardware encryption gateway connected to the fieldbus side receives the incoming serial communication application data unit ADU, it sends an interrupt request to the encryption module. The encryption module responds to the interrupt and enters the interrupt processing process, using the check code CRC at the end of the application data unit ADU to check the remaining part of the data in the unit except the CRC. The check algorithm uses the hash algorithm preset in the encryption module , Including but not limited to SM3, MD5, SHA-1 algorithms.

(3-1-2) If the verification fails, the encryption module interrupts and returns, and does not respond to the application data unit ADU. If the verification is successful, the encryption module uses the destination address code ADDR of the ADU header of the application data unit to find the private key PRK or the public key PUK corresponding to the destination address code ADDR in the key management module. ADDR is hexadecimal (HEX) data greater than or equal to 1 byte.

(3-1-3) If the private key PRK or public key PUK does not exist, the encryption module interrupts and returns, and does not respond to the application data unit ADU; if the private key PRK or public key PUK exists, use the private key PRK or public key PUK , Decrypt the symmetric key ciphertext CK located at the header of the protocol data unit (Protocol Data Unit, PDU) in the application data unit ADU through the built-in asymmetric encryption algorithm in the encryption module to obtain the symmetric key RK. Asymmetric encryption algorithms include but are not limited to SM2, ECC, and RSA algorithms.

(3-1-4) Using the symmetric key RK, through the built-in symmetric encryption algorithm in the encryption module, decrypt the encapsulated data payload ciphertext EC in the protocol data unit PDU except for the header to obtain the encapsulated data payload EP. The encapsulated data payload EP is composed of the data plaintext PD at the head and the hash data DH at the tail. Symmetric encryption algorithms include but are not limited to SM1, RC4, and AES algorithms.

(3-1-5) The encryption module uses the data plaintext PD in the EP header, calculates the plaintext hash value PH through the built-in hash algorithm, and compares it with the hash data DH at the end of the EP. Hash algorithms include but are not limited to SM3, MD5, and SHA-1 algorithms.

(3-1-6) If the plaintext hash value PH is different from the hash data DH, the encryption module interrupts and returns, discards the application data unit ADU, and does not respond; if the plaintext hash value PH is the same as the hash data DH, The data plaintext PD is used as the new protocol data unit PDU2. The destination address code ADDR is appended to the header of PDU2, and the check code CRC2 of PDU2 is calculated and appended to the end of PDU2 as a new application data unit ADU2. The verification algorithm uses the internal hash algorithm preset in the encryption module, including but not limited to SM3, MD5, and SHA-1 algorithms.

(3-1-7) Send ADU2 through the serial communication module on the device side.

(3-2) Monitor all the serial communication application data units ADU that are passed into the hardware encryption gateway on the serial communication module of the connected device;

(3-2-1) When the serial port communication module of the device connected to the gateway receives the incoming serial port communication application data unit ADU, it sends an interrupt request to the encryption module. The encryption module responds to the interrupt and enters the interrupt processing process, using the check code CRC at the end of the application data unit ADU to check the remaining part of the data in the unit except the CRC. The check algorithm uses the hash algorithm preset in the encryption module , Including but not limited to SM3, MD5, SHA-1 algorithms.

(3-2-2) If the verification fails, the encryption module interrupts and returns, and does not respond to the application data unit ADU. If the verification is successful, the encryption module uses the destination address code ADDR of the ADU header of the application data unit to find the public key PUK or private key PRK corresponding to the destination address code ADDR in the key management module. Among them, ADDR is hexadecimal (HEX) data greater than or equal to 1 byte.

(3-2-3) If the public key PUK or private key PRK does not exist, the encryption module interrupts and returns, and does not respond to the application data unit ADU; if the public key PUK or private key PRK exists, use the application data unit ADU The protocol data unit PDU is used as the data plaintext PD, the plaintext hash value PH is calculated through the built-in hash algorithm, and the PH is appended to the end of the data plaintext PD to form the encapsulated data payload EP. Hash algorithms include but are not limited to SM3, MD5, and SHA-1 algorithms.

(3-2-4) Generate a random symmetric key RK through the built-in random key generation algorithm, use RK to encrypt the encapsulated data payload EP through the built-in symmetric encryption algorithm, and obtain the encapsulated data payload ciphertext EC. Symmetric encryption algorithms include but are not limited to SM1, RC4, and AES algorithms.

(3-2-5) Use the public key PUK or the private key PRK to encrypt the random symmetric key RK through the built-in asymmetric encryption algorithm to obtain the symmetric key ciphertext CK. Asymmetric encryption algorithms include but are not limited to SM2, ECC, and RSA algorithms.

(3-2-6) Attach the symmetric key ciphertext CK to the header of the encapsulated data payload ciphertext EC as a new protocol data unit PDU2. The destination address code ADDR is appended to the header of PDU2, the check code CRC2 of PDU2 is calculated and appended to the end of PDU2 as a new application data unit ADU2. The check algorithm uses the hash algorithm preset in the encryption module, including but not limited to SM3, MD5, SHA-1 algorithm.

(3-2-7) Send ADU2 through the serial communication module on the fieldbus side.

S4: After the hardware encryption gateway starts to execute the monitoring process, the monitoring process is terminated if and only when the power supply module stops supplying power. Otherwise, the monitoring process is always performed. After the power supply module stops supplying power, the hardware encryption gateway re-executes the initialization process in step S2 and the monitoring process in step S3 if and only when the power supply is performed again.

Beneficial effects: Compared with the prior art, the technical solution of the present invention has the following beneficial technical effects:

The present invention realizes the protocol data unit by deploying a hardware encryption gateway between the upper computer, lower computer and other automation control equipment of the water conservancy automation control system and the field bus, using public key encryption, private key encryption, random encryption and data hashing algorithms to realize the protocol data unit ( Protocol Data Unit (PDU) transparent encryption provides automatic control equipment authentication, fieldbus communication data confidentiality, and protocol packet integrity verification functions, which can effectively prevent unauthorized devices from monitoring and intercepting on the fieldbus channel , Tampering with data monitoring and control information, has a high resistance to man-in-the-middle attacks, and reduces the security risk caused by the intrusion of the field bus channel in the water conservancy automation control system. Compared with the link layer plaintext data transmission method adopted in the existing fieldbus, it can provide reliable safety guarantee for the water conservancy automation control system as a key infrastructure in the national economy. The invention has higher compatibility and versatility, does not need to change the field bus network topology and the physical layer transmission media, and can realize the low-cost transformation of the existing water conservancy automation control system.

Description of the drawings

Figure 1 is a structural diagram of a hardware encryption gateway;

Figure 2 is a schematic diagram of device connection;

Figure 3 is the communication packet data structure from the fieldbus end to the device end during the monitoring process;

Figure 4 is the data structure of the communication packet from the device end to the fieldbus end during the monitoring process;

Figure 5 is a flowchart of the initialization process;

Figure 6 is a flow chart of the fieldbus terminal monitoring process;

Figure 7 is a flowchart of the device-side monitoring process.

Detailed ways

The technical scheme of the present invention will be further described below in conjunction with the drawings and embodiments.

The hardware encryption gateway used for field bus channel encryption of the present invention is composed of two serial communication modules, an encryption module, a key storage module, and a power supply module. The gateway structure is shown in Figure 1, and the fieldbus and device connections are shown in Figure 2.

Each serial communication module is composed of a serial communication chip, the chip model is ADM485, which is connected to the encryption module through the UART bus interface, and the external device is connected through the RS485 interface;

The encryption module consists of a single-chip microcomputer system based on the ACH512 chip. The hardware implementation of the internal preset SM1, SM2, SM3, SM4 algorithms is connected to the serial communication module through the UART bus interface, and the key storage module is connected through the address bus interface. The VCC, GND) power cord interface is connected to the power supply module.

The key storage module is composed of a Flashrom chip, which is connected to the encryption module through the NAND Flash interface.

The power supply module is composed of a regulated DC circuit, which takes power from the field bus through the RS485 interface, and is connected to the encryption module through the two-core (VCC, GND) power cord interface to provide the standard working voltage and current of the encryption module.

Suppose that in a water conservancy automation control system, there are automation control devices D1, D2, and D3 on the same field bus. D1 is the upper computer, set to master mode, and the address is 0x01; D2, D3 are lower computer, set to slave mode , The addresses are 0x02 and 0x03 respectively.

The method for encrypting a field bus channel in a water conservancy automation control system of the present invention includes the following steps:

S1: Use the burning program in advance to write the key to the key storage module of the hardware encryption gateway G1, G2, G3 according to the following rules:

In G1, write D1 address 0x01, private key of D1; write D2 address 0x02, public key of D2; write D3 address 0x03, public key of D3.

In G2, write the address 0x02 of D2 and the private key of D2; write address 0x01 of D1 and the public key of D1.

In G3, write the address 0x03 of D3 and the private key of D3; write address 0x01 of D1 and the public key of D1.

Deploy the hardware encryption gateways G1, G2, G3 between the devices D1, D2, D3 and the field bus respectively: the device side serial communication module of G1 is connected to D1, the bus side serial communication module of G1 is connected to the field bus; the device side serial port of G2 The communication module is connected to D2, the bus end serial communication module of G2 is connected to the field bus; the device end serial communication module of G3 is connected to D3, and the bus end serial communication module of G3 is connected to the field bus.

S2: After the power supply modules of G1, G2, and G3 start to work, G1, G2, and G3 are started, and the initialization process of the key storage modules of G1, G2, and G3 is started. The process is shown in Figure 5. The initialization process is as follows:

Look up all the stored destination address codes in the key storage module, and the corresponding public key and private key records; determine whether the number of private key records is unique, if not, the initialization process is terminated, and no subsequent operations are performed; if it is unique , Determine whether the number of public key records is greater than or equal to 1. If the number of public key records is greater than or equal to 1, the initialization process is completed; otherwise, the initialization process is terminated and no subsequent operations are performed.

Since the key written in the above step S1 meets the requirements of the initialization process, the initialization process is completed, and G1, G2, and G3 start to perform the monitoring process.

S3: When D1 sends a serial communication application data unit ADU to D2, set the destination address of the ADU to be 0x02, the device-side serial communication module of G1 generates an interrupt, and its encryption module responds to the interrupt and starts the interrupt processing process, as shown in Figure 7. Shown. Since the public key of D2 is written in G1, the original ADU sent by D1 is processed by G1 and becomes an encrypted ADU, which enters the field bus. The communication packet data structure is shown in Figure 4.

When G2 receives the above-mentioned encrypted ADU sent by G1, G2's bus terminal serial communication module generates an interrupt, and its encryption module responds to the interrupt and begins to enter the interrupt processing process, as shown in Figure 6. Since the private key of D2 is written in G2, the ADU sent by G1 is processed by G2 and then restored to plaintext and transmitted to D2. The communication packet data structure is shown in Figure 3. At this time, D2 receives the serial communication application data unit ADU sent by D1, can perform related operations, and can feed data back to D1.

Since the ADU destination address returned by the slave device to the master in the Modbus protocol is always the device address, and the returned packet destination address is 0x02, the device-side serial communication module of G2 generates an interrupt, and its encryption module responds to the interrupt and begins to enter the interrupt processing process. As shown in Figure 7. Since the private key of D2 is written in G2, the original ADU sent by D2 is processed by G2 and becomes an encrypted ADU, which enters the field bus through the G2 terminal serial communication module. The communication packet data structure is shown in Figure 4. .

When G1 receives the above-mentioned encrypted ADU sent by G2, G1's bus terminal serial communication module generates an interrupt, and G1's encryption module responds to the interrupt and begins to enter the interrupt processing process, as shown in Figure 6. Since the public key of D2 is written in G1, the ADU sent by G2 is processed by G1 and restored to plaintext, and transmitted to D1 through the device-side serial communication module of G1. The communication packet data structure is shown in Figure 3.

Suppose that the malicious attacker directly connects the malicious device D4 to the field bus without a hardware encryption gateway, and the address of D4 is 0x04. The attacker knows that the address of the master device D1 is 0x01, and tries to send a malicious packet P to D1. In the Modbus protocol, the ADU destination address returned by the slave device to the master is always the device address, and the destination address of P is 0x04. After G1 receives P, it checks whether the address 0x04 and its corresponding public key exist in the key storage module. Because the address and public key do not exist, G1 discards P and the attack fails.

A malicious attacker tries to use D4 to pretend to be D3 and send a malicious packet PP to D1. Because the ADU destination address returned by the slave device to the master in the Modbus protocol is always the device address, the destination address of PP is 0x03. After G1 receives the PP, it checks whether the address 0x03 and its corresponding public key exist in the key storage module. Because the address and public key exist, G1 uses D3's public key to decrypt PP. Since D4 cannot obtain the private key of D3 in the G3 key storage module, PP will inevitably fail in the verification process of G1, and G1 discards PP and the attack fails.

After the malicious attacker removes D3 from G3, connects D4 to the device-side serial communication module of G3, and sends a malicious packet PPP to D1. Because the addresses of D3 and D4 are different, G3 cannot find the address 0x04 and its corresponding private key in the key storage module. G3 discards PPP and the attack fails.

The embodiments are merely illustrative of the technical ideas of the present invention, and cannot be used to limit the scope of protection of the present invention. Any changes made on the basis of the technical solutions based on the technical ideas proposed by the present invention fall into the protection scope of the present invention. .

Claims

A hardware encryption gateway for fieldbus channel encryption, which is characterized in that the gateway is composed of two serial communication modules, an encryption module, a key storage module, and a power supply module; the two serial communication modules are respectively connected to the automation control equipment and the field The network physical interface of the bus; the two serial communication modules are respectively connected with the encryption module through the high-speed serial data bus interface; the encryption module is a single-chip microcomputer system (SOC), which connects the key storage module through its data bus and address bus interface, and The power cord interface is connected to the power supply module; the key storage module is a flash-write read-only memory, which is connected to the encryption module through its data bus and address bus interface; the power supply module is a DC power supply through a two-core (VCC, GND) power cord The interface is connected with the encryption module.
The hardware encryption gateway for fieldbus channel encryption according to claim 1, characterized in that: the network physical interface used by the serial communication module includes but is not limited to an electrical interface conforming to the RS485/232 standard, and a serial communication module The high-speed serial data bus interfaces used include but are not limited to bus interfaces that comply with UART, I2C, and SPI standards; the data bus and address bus interfaces of the key storage module include but are not limited to expansion bus interfaces that comply with eMMC and UFS standards.
A hardware encryption gateway for fieldbus channel encryption according to claim 1, wherein the encryption module implements asymmetric encryption algorithms, symmetric encryption algorithms, and symmetric encryption algorithms through software codes in built-in registers or hardware devices of arithmetic logic units. Hash algorithm, random key generation algorithm; among them, asymmetric encryption algorithm includes but not limited to SM2, ECC, RSA algorithm, symmetric encryption algorithm includes but not limited to SM1, RC4, AES algorithm, hash algorithm includes but not limited to SM3, MD5, SHA-1 algorithm.
A hardware encryption gateway for fieldbus channel encryption according to claim 1, characterized in that: each serial communication module is composed of a serial communication chip, the chip model is ADM485, and the encryption is connected through a UART bus interface. The module uses the RS485 interface to connect to external equipment; the encryption module is composed of a single-chip microcomputer system based on the ACH512 chip; the key storage module is composed of a Flashrom chip, and the encryption module is connected through the NAND Flash interface.
A method for fieldbus channel encryption in a water conservancy automation control system implemented by the hardware encryption gateway of any one of claims 1-4, characterized in that: the method includes the following steps:

S1: Connect a hardware encryption gateway between each automation control device connected to the field bus and the network physical interface of the field bus, and write the corresponding key in the key storage module of the hardware encryption gateway in advance And destination address code;

S2: After the power supply module of the hardware encryption gateway starts working, the hardware encryption gateway is started, and the key storage module of the hardware encryption gateway is initialized; if the initialization process is completed, go to step S3; if the initialization process is terminated, no subsequent operations are performed;

S3: After the key storage module of the hardware encryption gateway is initialized, the monitoring process is started;

S4: After the hardware encryption gateway starts to perform the monitoring process, the monitoring process is terminated if and only when the power supply module stops supplying power; otherwise, the monitoring process is always performed; after the power supply module stops supplying power, and only when power supply is performed again, the hardware encryption gateway Perform the initialization process described in step S2 and the monitoring process described in step S3 again.
The method for fieldbus channel encryption in a water conservancy automation control system according to claim 5, wherein the initialization process in step S2 is as follows:

(2-1) Find all the stored destination address codes in the key storage module, and the corresponding public and private key records;

(2-2) Determine whether the number of private key records is unique, if the number of private key records is unique, go to step (2-3); otherwise, the initialization process is terminated and no subsequent operations are performed;

(2-3) Determine whether the number of public key records is greater than or equal to 1. If the number of public key records is greater than or equal to 1, the initialization process is completed; otherwise, the initialization process is terminated and no subsequent operations are performed.
The method for encrypting a fieldbus channel in a water conservancy automation control system according to claim 5, characterized in that: the monitoring process in step S3 includes two parts: one is that the serial port communication module connected to the fieldbus end is for all incoming The serial communication application data unit ADU of the hardware encryption gateway monitors; second, all the serial communication application data unit ADUs incoming to the hardware encryption gateway are monitored on the serial communication module of the connected device.
A fieldbus channel encryption method in a water conservancy automation control system according to claim 7, characterized in that: the serial communication module connected to the fieldbus terminal monitors all serial communication application data units ADUs that are passed into the hardware encryption gateway; Proceed as follows:

(3-1-1) When the serial communication module of the hardware encryption gateway connected to the fieldbus side receives the incoming serial communication application data unit ADU, it sends an interrupt request to the encryption module; the encryption module responds to the interrupt, enters the interrupt processing process, and uses the application The check code CRC at the end of the data unit ADU checks the rest of the data in the unit except the CRC, and the check algorithm uses the hash algorithm preset in the encryption module;

(3-1-2) If the verification fails, the encryption module interrupts and returns, and does not respond to the application data unit ADU; if the verification is successful, the encryption module encodes ADDR through the destination address of the ADU header of the application data unit in the key management module Find the private key PRK or public key PUK corresponding to the destination address code ADDR; ADDR is greater than or equal to 1 byte of hexadecimal (HEX) data;

(3-1-3) If the private key PRK or public key PUK does not exist, the encryption module interrupts and returns, and does not respond to the application data unit ADU; if the private key PRK or public key PUK exists, use the private key PRK or public key PUK , Through the built-in asymmetric encryption algorithm in the encryption module, decrypt the symmetric key ciphertext CK located in the protocol data unit (Protocol Data Unit, PDU) header of the application data unit ADU to obtain the symmetric key RK;

(3-1-4) Using the symmetric key RK, through the built-in symmetric encryption algorithm in the encryption module, decrypt the encapsulated data payload ciphertext EC in the protocol data unit PDU except for the header to obtain the encapsulated data payload EP; encapsulated data payload EP consists of the data plaintext PD at the head and the hash data DH at the tail;

(3-1-5) The encryption module uses the data plaintext PD in the EP header, calculates the plaintext hash value PH through the built-in hash algorithm, and compares it with the hash data DH at the end of the EP;

(3-1-6) If the plaintext hash value PH is different from the hash data DH, the encryption module interrupts and returns, discards the application data unit ADU, and does not respond; if the plaintext hash value PH is the same as the hash data DH, The data plaintext PD is used as the new protocol data unit PDU2; the destination address code ADDR is appended to the header of PDU2, the check code CRC2 of PDU2 is calculated and appended to the end of PDU2, as the new application data unit ADU2; the check algorithm uses the internal encryption module The preset hash algorithm;

(3-1-7) Send ADU2 through the serial communication module on the device side.
The method for fieldbus channel encryption in a water conservancy automation control system according to claim 7, characterized in that: all serial communication application data units (ADUs) of the incoming hardware encryption gateway are monitored on the serial communication module of the connected device; as follows:

(3-2-1) When the serial communication module of the gateway connected to the device receives the incoming serial communication application data unit ADU, it sends an interrupt request to the encryption module; the encryption module responds to the interrupt, enters the interrupt processing process, and uses the application data unit The check code CRC at the end of the ADU checks the rest of the data in the unit except the CRC, and the check algorithm uses the hash algorithm preset in the encryption module;

(3-2-2) If the verification fails, the encryption module interrupts and returns, and does not respond to the application data unit ADU; if the verification is successful, the encryption module encodes ADDR through the destination address of the ADU header of the application data unit in the key management module Find the public key PUK or private key PRK corresponding to the destination address code ADDR; where ADDR is greater than or equal to 1 byte of hexadecimal (HEX) data;

(3-2-3) If the public key PUK or private key PRK does not exist, the encryption module interrupts and returns, and does not respond to the application data unit ADU; if the public key PUK or private key PRK exists, use the application data unit ADU The protocol data unit PDU is used as the data plaintext PD, the plaintext hash value PH is calculated through the built-in hash algorithm, and the PH is appended to the end of the data plaintext PD to form the encapsulated data payload EP;

(3-2-4) Generate a random symmetric key RK through the built-in random key generation algorithm, use RK to encrypt the package data payload EP through the built-in symmetric encryption algorithm, and obtain the package data payload ciphertext EC;

(3-2-5) Use the public key PUK or the private key PRK to encrypt the random symmetric key RK through the built-in asymmetric encryption algorithm to obtain the symmetric key ciphertext CK;

(3-2-6) Append the symmetric key ciphertext CK to the header of the encapsulated data payload ciphertext EC as a new protocol data unit PDU2; append the destination address code ADDR to the header of PDU2, calculate the check code CRC2 of PDU2 and Attached to the end of PDU2, as a new application data unit ADU2, the verification algorithm uses the hash algorithm preset in the encryption module;

(3-2-7) Send ADU2 through the serial communication module on the fieldbus side.