Cryptographic data entry and transmission of sensor data
Disclosed herein are systems and methods to ensure that data collected from remote sensors sent to cloud-based storage, as well as commands sent to remote actuators from cloud-based control systems remain in a highly encrypted, redundant and resilient form at all times other than in volatile memory (e.g., while in use). Device to device automated sensing and control is also considered and addressed by this focus. Data from industrial sensors requires validation in both the “root of trust” within the sensor/actuator itself to ensure that the data is being transmitted or received from a valid device as well as ensuring that the data has not been manipulated or altered or viewed while in transit.
1. A system comprising:
a plurality of endpoint devices that generate data streams that are encrypted by a local microcontroller unit prior to providing the data stream to a plurality of edge processors, the data stream remaining encrypted during transmission and when stored in non-volatile memory, wherein plaintext operation on the data streams is present only during a given operation thereon and not between operations;
the plurality of edge processors in direct physical communicative connection to the plurality of endpoint devices, wherein the plurality of edge processors are each nodes in a local distributed network that maintains a distributed blockchain data structure of the data streams in encrypted form;
non-volatile memory storage communicatively connected to the plurality of edge processors over a cloud platform, the cloud non-volatile memory storage stores the data stream as encrypted and present to a viewing device to decrypt within the viewing device for an authorized user; and
a host server that communicates with the plurality of edge processors via a remote network connection and controls distribution of decryption keys to the plurality of edge processors.
2. The system of claim 1 , further comprising:
an actuator communicatively coupled with a first edge processor of the plurality of edge processors that is configured to actuate based on commands from the first edge processor, the commands based on plaintext evaluation of at least a portion of the data streams in volatile memory.
3. The system of claim 1 , wherein the decryption keys are stored in volatile memory of the plurality of edge processors.
4. The system of claim 3 , wherein the decryption keys have a predetermined time to live in the volatile memory of the plurality of edge processors.
5. The system of claim 1 , wherein the plurality of edge processors are configured to query the host server for decryption keys and attestation upon receipt of an encrypted command input.
6. The system of claim 1 , wherein the decryption keys are each associated with paired encryption key stored locally on the plurality of endpoint devices or the plurality of edge processors.