Financial data encryption transmission system and method based on circuit board

Abstract

The invention provides a financial data encryption transmission system and method based on a circuit board. The system comprises an identity authentication module, a main control circuit module, a secret key processing module and a distributed storage module which are connected in sequence, and a security monitoring module connected with the secret key processing module, the identity authentication module adopts a biological characteristic matching algorithm based on mahalanobis distance to realize identity authentication, the key processing module adopts a key fragmentation technology based on a threshold scheme, a true random number generator realized by combining a ring oscillator ensures key security, the distributed storage module adopts Reed-Solomon coding to realize reliable fragmentation storage, and the distributed storage module adopts a random number generator realized by combining a random number generator realized by combining a random number generator realized by combining a random number generator realized by a random number generator. The safety monitoring module monitors temperature, voltage and physical invasion behaviors in real time; the method can effectively improve the safety and reliability of the financial data transmission process, and is suitable for financial data processing scenes needing high safety guarantee.

Description

Technical Field

[0001] The present invention belongs to the technical field of data transmission, and in particular relates to a financial data encryption transmission system and method based on a circuit board. Background Art

[0002] Traditional financial data encryption transmission systems mostly rely on software-level encryption algorithms and key management strategies. However, these systems face many security challenges. For example, software encryption algorithms are vulnerable to hacker attacks and malware cracking, and the complexity of key management strategies may also lead to the risk of key leakage or mismanagement. In addition, with the increase in financial transaction volume, the efficiency of data encryption and transmission has also become a key factor restricting system performance.

[0003] In recent years, hardware encryption technology has gradually attracted attention due to its high security and high efficiency. A financial data encryption transmission system based on circuit boards has emerged. This system embeds encryption algorithms and key management strategies into hardware circuits to achieve security and efficiency in data encryption and transmission. However, the existing hardware encryption systems still have some shortcomings. For example, some systems lack a complete identity authentication mechanism, which allows illegal users to easily access the system and steal data; some systems have defects in key management, such as insecure key storage and untimely key updates, which may bring serious security risks to the system. Summary of the invention

[0004] The purpose of the present invention is to provide a financial data encryption transmission system and method based on a circuit board, which fragments the master key through the key processing module of the circuit board combined with a threshold secret sharing scheme, and stores the fragments in a distributed storage module to ensure the secure storage and management of the key, thereby achieving secure management of the key and efficient encryption of transmission.

[0005] In the first aspect, the present invention provides a financial data encryption transmission system based on a circuit board, wherein the system realizes financial data encryption management and transmission based on a distributed key processing circuit on the circuit board, and the system includes an identity authentication module, a main control circuit module, a key processing module and a distributed storage module connected in sequence, and the system also includes a security monitoring module connected to the key processing module.

[0006] Furthermore, the identity authentication module includes an identity feature collection unit, a feature comparison unit and an access control unit; the identity feature collection unit is used to collect user biometric data and identity credential information in real time; the feature comparison unit is used to execute a feature matching algorithm, and perform similarity calculation and threshold judgment on the collected features and pre-stored templates; the access control unit is used to dynamically allocate and manage the user's system access rights based on the identity authentication results and preset access control policies.

[0007] Furthermore, the main control circuit module includes a central processing unit, a memory and a bus interface; the central processing unit is used to coordinate the work of various functional modules of the system, execute the core control logic of data encryption transmission, complete the parameter configuration and initialization of each functional module, and allocate and schedule system resources. The core control logic of data encryption transmission at least includes: receiving and parsing financial data encryption transmission requests, selecting encryption algorithms and key management strategies according to data security levels, and controlling the execution order of data encryption and decryption processes; the memory is used to store program codes and configuration parameters required for system operation, provide temporary cache space for data encryption processing, and save system operation status and log information; the bus interface is used to realize data communication interface with external devices, provide standardized data transmission protocol support, and manage data transmission bandwidth and priority.

[0008] Furthermore, the key processing module includes a key sharding hardware circuit unit, a hardware random number generator and a threshold reconstruction circuit unit; the key sharding hardware circuit unit is used to perform key sharding operations, perform key sharding based on a threshold secret sharing scheme, and generate multiple key shards; the hardware random number generator is used to generate key sharding parameters, and the threshold reconstruction circuit unit is used for key reconstruction operations. When the master key needs to be restored, valid key shards are collected and the original master key is restored through a reconstruction algorithm.

[0009] Furthermore, the security monitoring module is connected to the key processing module, and includes a temperature detection unit, a voltage monitoring unit and an intrusion detection unit; the temperature detection unit is used to monitor the operating temperature of the key processing module in real time, and trigger a protection mechanism when the temperature exceeds a preset threshold; the voltage monitoring unit is used to monitor the power supply voltage fluctuation of the key processing module to prevent key leakage caused by voltage abnormality; the intrusion detection unit is used to detect physical intrusion behavior, including shell opening and probe contact, and immediately clear sensitive data when intrusion is detected.

[0010] Furthermore, the distributed storage module includes multiple storage units and a storage status monitoring unit. The storage unit is used to distribute the key shards to multiple storage nodes and establish a shard index table. The storage status monitoring unit is used to achieve secure storage and management of the shards.

[0011] Furthermore, the feature comparison unit uses a biometric matching algorithm based on Mahalanobis distance to achieve feature similarity calculation; The feature similarity calculation is specifically as follows: obtaining the feature vector to be compared and pre-stored template feature vectors ,in , Both Sample points in the dimensional feature space, is the feature dimension.

[0012] Calculate the Mahalanobis distance between two eigenvectors based on the covariance matrix of the eigenspace , the specific calculation formula is:

[0013] in, for dimensional covariance matrix, , indicating the characteristics and Features The expected value of the covariance between For the The mean of the dimensional features, is the inverse of the covariance matrix, Representation vector The transpose of .

[0014] Furthermore, the calculated similarity metric With preset threshold For comparison, When the match is successful, the result is output.

[0015] The key sharding hardware circuit unit adopts a threshold scheme to realize the segmentation and reconstruction of the key, and the threshold scheme includes: Perform basic operations on a finite field GF(p) characterized by a large prime number p, based on the master key to be split and Random coefficient construction Polynomial , its construction formula is: ; in, is the master key to be split, , are randomly selected polynomial coefficients, each of which also belongs to GF(p), , The minimum number of shards required to reconstruct a key.

[0016] Furthermore, we calculate the polynomial exist Differences , The value at which Key Shards , these shards are assigned to different storage locations so that any , shards can be used to reconstruct the master key, and Shards with 1 or fewer shards cannot obtain any information about the master key.

[0017] Furthermore, the hardware random number generator realizes true random number generation based on a ring oscillator, including a ring oscillation circuit, a sampling processing circuit and a randomness detection circuit.

[0018] The ring oscillator circuit is composed of N stages of NOT gates connected in series to form a ring structure. The oscillation frequency generated satisfy: , where N is the number of NOT gates, is the propagation delay of a single NOT gate; The sampling processing circuit uses the VonNeumann post-processing algorithm to eliminate the deviation and group the original sequence into bits. ,like Then discard the group if Then output 1, if Then the output is 0.

[0019] Furthermore, the randomness detection circuit performs single-bit frequency test, poker test, run test and long run test based on FIPS140-2 standard.

[0020] Furthermore, the distributed storage module uses Reed-Solomon coding to achieve reliable shard storage, including a coding processing unit, a shard distribution unit and a fault recovery unit.

[0021] Furthermore, the encoding processing unit is used to encode the key fragments into Reed-Solomon codewords, where is the total number of storage nodes in the system, and k is the number of original key shards.

[0022] The encoding process is based on finite fields The generating polynomial g(x) on : ;in, for The original element in The number of expansions for a finite field is p = , the minimum codeword distance .

[0023] Furthermore, the shard distribution unit is used to distribute the encoded data to each storage node and maintain the shard index table.

[0024] The fault recovery unit is used to recover data when a storage node fails.

[0025] Furthermore, the security monitoring module also includes: a security status management unit, which is used to centrally manage and record status information of each monitoring circuit.

[0026] The detection accuracy of the temperature detection circuit is not less than ±0.5°C, and the sampling frequency is not less than 10Hz.

[0027] The voltage monitoring circuit can detect power supply ripple and support overvoltage protection and undervoltage protection functions.

[0028] The intrusion detection circuit adopts a multiple sensor redundancy design, including a micro switch, a photoelectric sensor and an electromagnetic field sensor.

[0029] Furthermore, the following communication interfaces and protocols are used between the functional modules of the system: The identity authentication module and the main control circuit module communicate via an SPI interface, with a transmission rate of no less than 10Mbps.

[0030] An encrypted channel is used between the main control circuit module and the key processing module to ensure data confidentiality and integrity based on the AES-GCM protocol.

[0031] An independent hardware bus is used between the key processing module and the security monitoring module to support real-time interrupt response.

[0032] A redundant communication link is used between the security monitoring module and the distributed storage module to ensure the reliable transmission of monitoring instructions.

[0033] In a second aspect, the present invention provides a circuit board-based financial data encryption transmission method, the method is implemented based on the circuit board-based financial data encryption transmission system described in the first aspect, and the method comprises the following steps: Step S1, collecting and verifying user identity information and allocating access rights.

[0034] Get the feature vector to be compared consisting of the user's biometric data and identity identifier , pre-stored template feature vector ,in , Both Sample points in the dimensional feature space, is the feature dimension.

[0035] Calculate the Mahalanobis distance between two eigenvectors based on the covariance matrix of the eigenspace , compare the calculated similarity measurement value d with the preset threshold θ, and output the judgment result of successful matching when d<θ; assign access rights based on the judgment result of successful matching and the security policy.

[0036] Step S2, generate a master key and shard the key.

[0037] The hardware random number generator is called to generate the master key K, and the threshold scheme is used to perform key sharding. The threshold scheme includes: Perform basic operations on a finite field GF(p) characterized by a large prime number p, based on the master key to be split and Random coefficient construction Polynomial , its construction formula is: ; in, is the master key to be split, , are randomly selected polynomial coefficients, each of which also belongs to GF(p), , The minimum number of shards required to reconstruct a key.

[0038] Evaluating Polynomials exist Differences , The value at which Key Shards , these shards are assigned to different storage locations so that any , shards can be used to reconstruct the master key, and Shards with 1 or fewer shards cannot obtain any information about the master key.

[0039] Step S3, establishing a secure channel for encrypted data transmission and real-time monitoring of system working environment parameters.

[0040] Calculate the information entropy H(D) of the data D to be transmitted, determine the security level L, select the encryption algorithm and key length according to the security level to encrypt the financial data, and establish a secure channel for encrypted data transmission.

[0041] Collect system working environment parameters in real time, including temperature, voltage and physical status; perform anomaly detection based on preset thresholds, and when an anomaly is detected, trigger corresponding protective measures according to the threat level L.

[0042] Furthermore, the key is sharded using a dynamic allocation strategy based on KL divergence; Calculate the KL divergence of data distribution between different storage nodes:

[0043] in: , Respectively represent the first The distribution probability of key shards, k is the number of original key shards, when When the load redistribution is triggered, is the preset imbalance threshold, ranging from 0.01 to 0.1; Adjusting allocation weights ,express and The inverse of the KL divergence between ; where, is the mean value of all probability distributions, For the The allocation weight of each storage node.

[0044] Furthermore, when the original key needs to be restored When holding at least key shards, using Lagrange interpolation to calculate the polynomial exist The value at, that is: ;in, Corresponding to the key shard held value, The corresponding key shard coordinate.

[0045] The beneficial effects of the present invention are as follows: The present invention realizes high security of financial data during transmission through distributed key processing circuits and encryption algorithms. The sharded storage and dynamic management strategy of keys, as well as a hardware-based security monitoring module, can effectively prevent data leakage and illegal access, and improve the security of financial data interaction. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a schematic diagram of the composition of the financial data encryption transmission system based on the circuit board of the present invention; Figure 2 This is a flow chart of the circuit board-based financial data encryption transmission method of the present invention. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention is described clearly and completely below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] Example 1 like Figure 1As shown, it is a schematic diagram of the composition of the circuit board-based financial data encryption transmission system of the present invention. The system realizes financial data encryption management and transmission based on the distributed key processing circuit on the circuit board. The system includes an identity authentication module, a main control circuit module, a key processing module and a distributed storage module connected in sequence. The system also includes a security monitoring module connected to the key processing module.

[0049] It should be noted that this system adopts a modular design concept, dividing the financial data encryption transmission process into multiple independent but mutually cooperative functional modules; this design has the following advantages: the functional boundaries of each module are clear, which is convenient for fault isolation and maintenance and upgrades, and physical isolation is used to reduce the risk of mutual interference between modules. Interfaces are reserved to facilitate subsequent functional expansion and upgrades, and each module can work in parallel to improve the overall processing efficiency of the system.

[0050] In actual application scenarios, the modular design of this system can flexibly respond to different financial business needs; for example: in the payment and clearing system, the identity authentication module is responsible for the identity authentication of inter-bank clearing personnel, the main control circuit module processes inter-bank clearing instructions, the key processing module encrypts fund transaction data, the distributed storage module saves transaction records, and the security monitoring module monitors the system status in real time; in the securities trading system, the identity authentication module verifies the identity of the trader, the main control circuit module processes transaction instructions, the key processing module encrypts transaction data, the distributed storage module stores transaction records, and the security monitoring module monitors the trading environment; in the digital currency system, the identity authentication module verifies the user's identity, the main control circuit module processes transfer requests, the key processing module encrypts the wallet private key, the distributed storage module saves transaction history, and the security monitoring module prevents private key leakage.

[0051] For example, in a bank's cross-border payment business scenario, when a customer initiates an international transfer: first, the customer's identity is verified through the identity authentication module, the main control circuit module is responsible for processing the transfer request and planning the execution process, the key processing module ensures the encrypted transmission of financial data, the distributed storage module securely saves transaction records, and the security monitoring module monitors the system operation status throughout the process.

[0052] The identity authentication module includes an identity feature collection unit, a feature comparison unit and an access control unit; the identity feature collection unit is used to collect user biometric data and identity credential information in real time; the feature comparison unit is used to execute a feature matching algorithm to perform similarity calculation and threshold judgment on the collected features and pre-stored templates; the access control unit is used to dynamically allocate and manage the user's system access rights based on the identity authentication results and the preset access control policy.

[0053] The identity authentication module adopts a multiple authentication mechanism to provide multi-level identity authentication protection; the identity feature collection unit supports the collection of multiple biometric features: fingerprint, face, iris, etc., uses high-precision sensors to ensure the collection quality, and real-time data preprocessing to remove noise interference; the feature comparison unit uses a deep learning algorithm to improve the accuracy of feature extraction, establishes a dynamic update mechanism for feature templates, and supports multi-modal feature fusion comparison; the access control unit implements role-based access control (RBAC), supports dynamic permission adjustment and temporary authorization, and records detailed access logs; for example, in the bank teller operation scenario, the teller's fingerprints and facial features are collected, and the employee number and password are required to be entered. The corresponding operation permissions are allocated according to the teller level, and multiple authentications are required for sensitive operations.

[0054] The main control circuit module includes a central processing unit, a memory and a bus interface; the central processing unit is used to coordinate the work of various functional modules of the system, execute the core control logic of data encryption transmission, complete the parameter configuration and initialization of each functional module, and allocate and schedule system resources. The core control logic of data encryption transmission at least includes: receiving and parsing financial data encryption transmission requests, selecting encryption algorithms and key management strategies according to data security levels, and controlling the execution order of data encryption and decryption processes; the memory is used to store program codes and configuration parameters required for system operation, provide temporary cache space for data encryption processing, and save system operation status and log information; the bus interface is used to realize data communication interface with external devices, provide standardized data transmission protocol support, and manage data transmission bandwidth and priority.

[0055] It should be noted that the main control circuit module, as the core control unit of the system, adopts a high-performance microprocessor architecture. The central processing unit adopts a multi-core processor architecture, supports parallel task processing, realizes real-time task scheduling and priority management, and has a built-in hardware acceleration engine that supports common cryptographic algorithms and provides fault detection and automatic recovery mechanisms. The specific implementation methods include: using high-performance MCUs such as ARMCortex-M7, supporting real-time operating system (RTOS) scheduling, integrating hardware accelerators such as AES / RSA, and realizing a watchdog protection mechanism.

[0056] The memory architecture design adopts a hierarchical storage architecture, L1Cache: high-speed instruction and data cache; L2Cache: large-capacity secondary cache; main memory: DDR4 high-speed memory; non-volatile storage: secure Flash storage.

[0057] The bus interface supports a variety of high-speed interface protocols: PCIeGen4, USB3.1, MIPI, LVDS, etc.; in high-frequency trading scenarios, the central processor processes multiple transaction requests in parallel, the multi-level cache of the memory reduces access latency, the bus interface ensures high-speed data transmission, and real-time monitoring of system performance indicators.

[0058] The key processing module adopts hardware implementation to ensure the security of key operation. The key sharding hardware circuit unit supports multiple key sharding algorithms: Shamir threshold scheme, Chinese Remainder Theorem (CRT) scheme, and Blakley's scheme.

[0059] The key processing module includes a key sharding hardware circuit unit, a hardware random number generator and a threshold reconstruction circuit unit; the key sharding hardware circuit unit is used to perform key sharding operations, perform key sharding based on a threshold secret sharing scheme, and generate multiple key shards; the hardware random number generator is used to generate key sharding parameters, and the threshold reconstruction circuit unit is used for key reconstruction operations. When the master key needs to be restored, valid key shards are collected and the original master key is restored through a reconstruction algorithm.

[0060] The security monitoring module is connected to the key processing module, and includes a temperature detection unit, a voltage monitoring unit and an intrusion detection unit; the temperature detection unit is used to monitor the operating temperature of the key processing module in real time, and trigger a protection mechanism when the temperature exceeds a preset threshold; the voltage monitoring unit is used to monitor the power supply voltage fluctuation of the key processing module to prevent key leakage caused by voltage abnormality; the intrusion detection unit is used to detect physical intrusion behavior, including shell opening and probe contact, and immediately clear sensitive data when intrusion is detected.

[0061] The distributed storage module includes multiple storage units and a storage status monitoring unit. The storage unit is used to distribute the key shards to multiple storage nodes and establish a shard index table. The storage status monitoring unit is used to achieve secure storage and management of the shards.

[0062] The feature comparison unit uses a biometric matching algorithm based on Mahalanobis distance to calculate feature similarity; The feature similarity calculation is specifically as follows: obtaining the feature vector to be compared and pre-stored template feature vectors ,in , Both Sample points in the dimensional feature space, is the feature dimension.

[0063] Calculate the Mahalanobis distance between two eigenvectors based on the covariance matrix of the eigenspace , the specific calculation formula is:

[0064] in, for dimensional covariance matrix, , indicating the characteristics and Features The expected value of the covariance between For the The mean of the dimensional features, is the inverse of the covariance matrix, Representation vector The transpose of .

[0065] The calculated similarity metric With preset threshold For comparison, When the match is successful, the result is output.

[0066] For example, in a verification, suppose the collected fingerprint feature vector , pre-stored template feature vector , first calculate the mean of each dimension feature: μ1=0.876, μ2=0.85; then calculate each element of the covariance matrix: , ; Calculate the entire 5×5 covariance matrix in this way; Find the inverse matrix of the covariance matrix , calculate the Mahalanobis distance d=0.0823; if the preset threshold θ=0.1, then 0.0823<0.1, and the match is determined to be successful.

[0067] The key sharding hardware circuit unit adopts a threshold scheme to realize the segmentation and reconstruction of the key, and the threshold scheme includes: Perform basic operations on a finite field GF(p) characterized by a large prime number p, based on the master key to be split and Random coefficient construction Polynomial , its construction formula is: ; in, is the master key to be split, , are randomly selected polynomial coefficients, each of which also belongs to GF(p), , The minimum number of shards required to reconstruct a key.

[0068] Evaluating Polynomials exist Differences , The value at which Key Shards , these shards are assigned to different storage locations so that any , shards can be used to reconstruct the master key, and Shards with 1 or fewer shards cannot obtain any information about the master key.

[0069] The hardware random number generator realizes true random number generation based on a ring oscillator, including a ring oscillator circuit, a sampling processing circuit, and a randomness detection circuit. The HRNG based on the ring oscillator utilizes the characteristics of NOT gates to generate random signals. The ring oscillator circuit forms a closed loop through N-level NOT gates to generate high-frequency oscillation signals. The frequency of these signals is related to the number of NOT gates and the propagation delay of each NOT gate. The sampling processing circuit uses the VonNeumann algorithm to process the oscillation signal to reduce the deviation caused by the manufacturing process or other factors; the randomness detection circuit verifies whether the generated random number meets the requirements of true randomness according to the FIPS140-2 standard.

[0070] The following are examples of performance parameters and test standards for random number generators: Ring oscillator parameters: N=13 NOT gates, single NOT gate delay td=2ns, theoretical oscillation frequency fosc=38.46MHz; VonNeumann post-processing: original sequence: 110010100011, grouping: (11)(00)(10)(10)(00)(11), processing results: empty, empty, 1, 1, empty, empty; final output: 11. FIPS140-2 test parameters: single bit frequency test: the difference between the number of 0 and 1 should be within ±0.01%, poker test: the χ² statistic of 16-bit grouping should be less than 46.17, run test: the longest run does not exceed 34 bits, entropy evaluation: the entropy value of each bit should be greater than 0.997.

[0071] The ring oscillator circuit is composed of N stages of NOT gates connected in series to form a ring structure. The oscillation frequency generated satisfy: , where N is the number of NOT gates, is the propagation delay of a single NOT gate; The sampling processing circuit uses the VonNeumann post-processing algorithm to eliminate the deviation and group the original sequence into bits. ,like Then discard the group if Then output 1, if Then the output is 0.

[0072] The randomness detection circuit performs single-bit frequency test, poker test, run test and long run test based on FIPS140-2 standard.

[0073] The distributed storage module uses Reed-Solomon coding to achieve reliable shard storage, including a coding processing unit, a shard distribution unit, and a fault recovery unit.

[0074] The encoding processing unit is used to encode the key fragments into Reed-Solomon codewords, where is the total number of storage nodes in the system, and k is the number of original key shards.

[0075] The encoding process is based on finite fields The generating polynomial g(x) on : ;in, for The original element in The number of expansions for a finite field is p = , the minimum codeword distance .

[0076] The shard distribution unit is used to distribute the encoded data to each storage node and maintain the shard index table.

[0077] The fault recovery unit is used to recover data when a storage node fails.

[0078] The security monitoring module also includes: a security status management unit, which is used to centrally manage and record the status information of each monitoring circuit.

[0079] The detection accuracy of the temperature detection circuit is not less than ±0.5°C, and the sampling frequency is not less than 10Hz.

[0080] The voltage monitoring circuit can detect power supply ripple and support overvoltage protection and undervoltage protection functions.

[0081] The intrusion detection circuit adopts a multiple sensor redundancy design, including a micro switch, a photoelectric sensor and an electromagnetic field sensor.

[0082] The following communication interfaces and protocols are used between the functional modules of the system: The identity authentication module and the main control circuit module communicate via an SPI interface, with a transmission rate of no less than 10Mbps.

[0083] An encrypted channel is used between the main control circuit module and the key processing module to ensure data confidentiality and integrity based on the AES-GCM protocol.

[0084] An independent hardware bus is used between the key processing module and the security monitoring module to support real-time interrupt response.

[0085] A redundant communication link is used between the security monitoring module and the distributed storage module to ensure the reliable transmission of monitoring instructions.

[0086] Example 2 like Figure 2 As shown, it is a flow chart of the method for encrypting and transmitting financial data based on a circuit board. The method is implemented based on the system for encrypting and transmitting financial data based on a circuit board described in Example 1. The method includes the following steps: Step S1, collecting and verifying user identity information and allocating access rights.

[0087] Get the feature vector to be compared consisting of the user's biometric data and identity identifier , pre-stored template feature vector ,in , Both Sample points in the dimensional feature space, is the feature dimension.

[0088] Calculate the Mahalanobis distance between two eigenvectors based on the covariance matrix of the eigenspace , the calculated similarity measure With preset threshold For comparison, The successful matching result is output; and access rights are assigned based on the successful matching result and security policy.

[0089] Step S2, generate a master key and shard the key.

[0090] The hardware random number generator is called to generate the master key K, and the threshold scheme is used to perform key sharding. The threshold scheme includes: Perform basic operations on a finite field GF(p) characterized by a large prime number p, based on the master key to be split and Random coefficient construction Polynomial , its construction formula is: ; in, is the master key to be split, , are randomly selected polynomial coefficients, each of which also belongs to GF(p), , The minimum number of shards required to reconstruct a key.

[0091] Evaluating Polynomials exist Differences , The value at which Key Shards , these shards are assigned to different storage locations so that any , shards can be used to reconstruct the master key, and Shards with 1 or fewer shards cannot obtain any information about the master key.

[0092] An example to illustrate the key sharding process: Assume that the master key s=123456 (decimal), select the prime number p=2147483647 (2³¹-1), set the threshold value t=3, the number of shards k=5; randomly generate coefficients: a1=1234567, a2=7654321; construct the quadratic polynomial: f(x)=123456+1234567x+7654321x²mod2147483647; Calculate the values ​​of 5 shard points: f(1)=(123456+1234567+7654321)mod2147483647=9012344; f(2)=(123456+2×1234567+4×7654321)mod2147483647=33456789; And so on, calculate f(3), f(4), f(5); The five key shards generated are: (1, 9012344), (2, 33456789), (3, 74568123), (4, 132456789), (5, 207654321); any 3 shards can reconstruct the original key 123456, while any 2 or fewer shards cannot obtain any valid information about the key.

[0093] Step S3, establishing a secure channel for encrypted data transmission and real-time monitoring of system working environment parameters.

[0094] Calculate the information entropy H(D) of the data D to be transmitted, determine the security level L, select the encryption algorithm and key length according to the security level to encrypt the financial data, and establish a secure channel for encrypted data transmission.

[0095] Collect system working environment parameters in real time, including temperature, voltage and physical status; perform anomaly detection based on preset thresholds, and when an anomaly is detected, trigger corresponding protective measures according to the threat level L.

[0096] The key is sharded using a dynamic allocation strategy based on KL divergence; Calculate the KL divergence of data distribution between different storage nodes:

[0097] in: , Respectively represent the first The distribution probability of key shards, k is the number of original key shards, when When the load redistribution is triggered, is the preset imbalance threshold, ranging from 0.01 to 0.1; Adjusting allocation weights ,express and The inverse of the KL divergence between ; where, is the mean value of all probability distributions, For the The allocation weight of each storage node.

[0098] Assume that the system has 3 storage nodes and the current shard distribution is as follows: Node 1: P(1)=0.4, P(2)=0.3, P(3)=0.3; Node 2: Q(1)=0.3, Q(2)=0.4, Q(3)=0.3; Node 3: R(1)=0.3, R(2)=0.3, R(3)=0.4; Calculate the KL divergence between nodes: D(P||Q)=0.4×log2(0.4 / 0.3)+0.3×log2(0.3 / 0.4)+0.3×log2(0.3 / 0.3)=0.0224; Calculate D(P||R) and D(Q||R). If the unbalance threshold δ=0.02 is set, load redistribution is triggered because 0.0224>0.02. Calculate the average distribution: Qavg(1)=Qavg(2)=Qavg(3)=0.333; Calculate the new distribution weight: w1=1 / D(P||Qavg)=31.25, w2=1 / D(Q||Qavg)=35.71, w3=1 / D(R||Qavg)=33.33; adjust the allocation ratio of subsequent shards according to these weights to make the system tend to load balance.

[0099] When you need to restore the original key When holding at least key shards, using Lagrange interpolation to calculate the polynomial exist The value at, that is: ;in, Corresponding to the key shard held value, The corresponding key shard coordinate.

[0100] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A financial data encryption transmission system based on a circuit board, the system realizes financial data encryption management and transmission based on a distributed key processing circuit on a circuit board, characterized in that: The system comprises an identity authentication module, a main control circuit module, a key processing module and a distributed storage module connected in sequence, and the system also comprises a security monitoring module connected to the key processing module; The identity authentication module includes an identity feature collection unit, a feature comparison unit and an access control unit; the identity feature collection unit is used to collect user biometric data and identity credential information in real time; the feature comparison unit is used to execute a feature matching algorithm to calculate the similarity and threshold judgment of the collected features with the pre-stored templates; the access control unit is used to dynamically allocate and manage the user's system access rights according to the identity authentication results and the preset access control policy; The main control circuit module includes a central processing unit, a memory and a bus interface; the central processing unit is used to coordinate the work of various functional modules of the system, execute the core control logic of data encryption transmission, complete the parameter configuration and initialization of each functional module, and allocate and schedule system resources. The core control logic of data encryption transmission at least includes: receiving and parsing financial data encryption transmission requests, selecting encryption algorithms and key management strategies according to data security levels, and controlling the execution order of data encryption and decryption processes; the memory is used to store program codes and configuration parameters required for system operation, provide temporary cache space for data encryption processing, and save system operation status and log information; the bus interface is used to realize data communication interface with external devices, provide standardized data transmission protocol support, and manage data transmission bandwidth and priority; The key processing module includes a key sharding hardware circuit unit, a hardware random number generator and a threshold reconstruction circuit unit; the key sharding hardware circuit unit is used to perform key sharding operations, perform key sharding based on a threshold secret sharing scheme, and generate multiple key fragments; the hardware random number generator is used to generate key sharding parameters, and the threshold reconstruction circuit unit is used for key reconstruction operations. When the master key needs to be restored, valid key fragments are collected and the original master key is restored through a reconstruction algorithm; The security monitoring module is connected to the key processing module, and includes a temperature detection unit, a voltage monitoring unit, and an intrusion detection unit; the temperature detection unit is used to monitor the operating temperature of the key processing module in real time, and trigger a protection mechanism when the temperature exceeds a preset threshold; the voltage monitoring unit is used to monitor the power supply voltage fluctuation of the key processing module to prevent key leakage caused by voltage anomalies; the intrusion detection unit is used to detect physical intrusion behaviors, including shell opening and probe contact, and immediately clear sensitive data when intrusion is detected; The distributed storage module includes multiple storage units and a storage status monitoring unit. The storage unit is used to distribute the key shards to multiple storage nodes and establish a shard index table. The storage status monitoring unit is used to achieve secure storage and management of the shards.

2. The circuit board-based financial data encryption transmission system according to claim 1, characterized in that: The feature comparison unit uses a biometric feature matching algorithm based on Mahalanobis distance to calculate feature similarity; The feature similarity calculation is specifically as follows: obtaining the feature vector to be compared and pre-stored template feature vectors ,in , Both Sample points in the dimensional feature space, is the feature dimension; Calculate the Mahalanobis distance between two eigenvectors based on the covariance matrix of the eigenspace , the specific calculation formula is: ； in, for dimensional covariance matrix, , indicating the characteristics and Features The expected value of the covariance between For the The mean of the dimensional features, is the inverse of the covariance matrix, Representation vector The transpose of The calculated similarity metric With preset threshold For comparison, When the match is successful, the result is output.

3. The circuit board-based financial data encryption transmission system according to claim 2, characterized in that: The key sharding hardware circuit unit adopts a threshold scheme to realize key segmentation and reconstruction, and the threshold scheme includes: Perform basic operations on a finite field GF(p) characterized by a large prime number p, based on the master key to be split and Random coefficient construction Polynomial , its construction formula is: ； in, is the master key to be split, , are randomly selected polynomial coefficients, each of which also belongs to GF(p), , The minimum number of shards required to reconstruct the key; Evaluating Polynomials exist Differences , The value at Key Shards , these shards are assigned to different storage locations so that any , shards can be used to reconstruct the master key, and Shards with 1 or fewer shards cannot obtain any information about the master key.

4. The circuit board-based financial data encryption transmission system according to claim 3, characterized in that: The hardware random number generator realizes true random number generation based on a ring oscillator, and includes a ring oscillation circuit, a sampling processing circuit and a randomness detection circuit; The ring oscillator circuit is composed of N stages of NOT gates connected in series to form a ring structure. The oscillation frequency generated satisfy: , where N is the number of NOT gates, is the propagation delay of a single NOT gate; The sampling processing circuit uses the VonNeumann post-processing algorithm to eliminate the deviation and group the original sequence into bits. ,like Then discard the group if Then output 1, if Then the output is 0; The randomness detection circuit performs single-bit frequency test, poker test, run test and long run test based on FIPS140-2 standard.

5. The circuit board-based financial data encryption transmission system according to claim 4, characterized in that: The distributed storage module uses Reed-Solomon coding to achieve reliable shard storage, including a coding processing unit, a shard distribution unit and a fault recovery unit; The encoding processing unit is used to encode the key fragments into Reed-Solomon codewords, where is the total number of storage nodes in the system, k is the number of original key shards; The encoding process is based on finite fields The generating polynomial g(x) on : ;in, for The original element in The number of expansions for a finite field is p = , the minimum codeword distance ; The shard distribution unit is used to distribute the encoded data to each storage node and maintain the shard index table; The fault recovery unit is used to recover data when a storage node fails.

6. The circuit board-based financial data encryption transmission system according to claim 5, characterized in that: The security monitoring module also includes: a security status management unit for centrally managing and recording status information of each monitoring circuit; The detection accuracy of the temperature detection circuit is not less than ±0.5°C, and the sampling frequency is not less than 10Hz; The voltage monitoring circuit can detect power supply ripple and support overvoltage protection and undervoltage protection functions; The intrusion detection circuit adopts a multiple sensor redundancy design, including a micro switch, a photoelectric sensor and an electromagnetic field sensor.

7. The circuit board-based financial data encryption transmission system according to claim 6, characterized in that: The following communication interfaces and protocols are used between the functional modules of the system: The identity authentication module and the main control circuit module use SPI interface communication, and the transmission rate is not less than 10Mbps; An encrypted channel is used between the main control circuit module and the key processing module to ensure data confidentiality and integrity based on the AES-GCM protocol; An independent hardware bus is used between the key processing module and the security monitoring module to support real-time interrupt response; A redundant communication link is used between the security monitoring module and the distributed storage module to ensure the reliable transmission of monitoring instructions.

8. A method for encrypting and transmitting financial data based on a circuit board, the method being implemented based on the system for encrypting and transmitting financial data based on a circuit board according to any one of claims 1 to 7, characterized in that: The method comprises the following steps: Step S1, collecting and verifying user identity information and assigning access rights; Get the feature vector to be compared consisting of the user's biometric data and identity identifier , pre-stored template feature vector ,in , Both Sample points in the dimensional feature space, is the feature dimension; Calculate the Mahalanobis distance between two eigenvectors based on the covariance matrix of the eigenspace , compare the calculated similarity measurement value d with the preset threshold θ, and output the judgment result of successful matching when d<θ; assign access rights based on the judgment result of successful matching and the security policy; Step S2, generating a master key and sharding the key; The hardware random number generator is called to generate the master key K, and the threshold scheme is used to perform key sharding. The threshold scheme includes: Perform basic operations on a finite field GF(p) characterized by a large prime number p, based on the master key to be split and Random coefficient construction Polynomial , its construction formula is: ； in, is the master key to be split, , are randomly selected polynomial coefficients, each of which also belongs to GF(p), , The minimum number of shards required to reconstruct the key; Evaluating Polynomials exist Differences , The value at Key Shards , these shards are assigned to different storage locations so that any , shards can be used to reconstruct the master key, and Shards with 1 or fewer shards cannot obtain any information about the master key; Step S3, establishing a secure channel for encrypted data transmission and real-time monitoring of system working environment parameters; Calculate the information entropy H(D) of the data to be transmitted D, determine the security level L, select the encryption algorithm and key length according to the security level to encrypt the financial data, and establish a secure channel for encrypted data transmission; Collect system working environment parameters in real time, including temperature, voltage and physical status; perform anomaly detection based on preset thresholds, and when an anomaly is detected, trigger corresponding protective measures according to the threat level L.

9. The method for encrypting and transmitting financial data based on a circuit board according to claim 8, characterized in that: The key is sharded using a dynamic allocation strategy based on KL divergence; Calculate the KL divergence of data distribution between different storage nodes: ； in: , Respectively represent the first The distribution probability of key shards, k is the number of original key shards, when When the load redistribution is triggered, is the preset imbalance threshold, ranging from 0.01 to 0.1; Adjusting allocation weights ,express and The inverse of the KL divergence between ; where, is the mean value of all probability distributions, For the The allocation weight of each storage node.

10. The method for encrypting and transmitting financial data based on a circuit board according to claim 9, characterized in that: When you need to restore the original key When holding at least key shards, using Lagrange interpolation to calculate the polynomial exist The value at, that is: ;in, Corresponding to the key shard held value, The corresponding key shard coordinate.

Images