Station synchronous guidance system based on national secret security policy

Abstract

The invention discloses a station synchronous guidance system based on a national secret security policy, and belongs to the technical field of information security. The invention comprises a background monitoring subsystem, a client display subsystem and a remote management subsystem, and particularly relates to a data encryption and decryption system applied to a synchronous guide screen device, the system is suitable for synchronous information guide screens such as a station entry screen, a station exit screen, a remaining ticket screen and a PDP screen, and the system adopts a step-by-step encryption method. The method not only improves the security level of data transmission, but also gives consideration to the practicability and expandability of the system, provides powerful guarantee for the information security of the synchronous guide screen, and is of great significance for improving the data security of the station guide system.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a station synchronization guidance system based on national secret security strategy. Background Art

[0002] With the rapid development of information technology, public information display systems have become an indispensable part of modern society. As an important medium for information dissemination at railway stations, synchronous guidance screens are responsible for delivering train arrival and departure information to passengers instantly and accurately. However, during data transmission, the risks of information leakage, tampering and unauthorized access are becoming increasingly prominent, posing a serious threat to data security. Therefore, how to achieve reliable data protection while ensuring the efficiency of information update has become a problem that needs to be solved urgently in current technology. Summary of the invention

[0003] The purpose of the present invention is to provide a station synchronization guidance system based on national secret security strategy to solve the problems raised in the above background technology.

[0004] In order to solve the above technical problems, the present invention provides the following technical solutions: a station synchronization guidance system based on the national secret security strategy, characterized in that the station synchronization guidance system includes a background monitoring subsystem, a client display subsystem, and a remote management subsystem. The background monitoring subsystem is used to monitor the security of data transmission and the usage of CPU, memory, and disk throughout the process, and can respond to client abnormalities in a timely manner. The client display subsystem is used to decrypt data and complete data assembly for the decrypted data through a guidance calculation module. The remote management subsystem is used to manage and maintain the guidance screen layout and notify the background monitoring subsystem to update the data through message triggers, ensuring real-time synchronization with the client display content. The background monitoring subsystem establishes a communication connection with the client display subsystem.

[0005] The background monitoring subsystem includes a data interface, a data acquisition module, a central processing module, an encryption and decryption processing module, and a client security monitoring module. The data interface is used to receive data and trigger signals. The data acquisition module is responsible for collecting station train schedule information and real-time train status information. The system automatically obtains the basic information, layout information and data display information of the guide screen through the station passenger service and production control platform data interface. The central processing module is responsible for data assembly, distribution and message processing functions. By performing operations on the collected data, it completes data filtering and distribution according to different terminal addresses. At the same time, it communicates with the client through the trigger signal of message processing to ensure accurate synchronization of data. The security monitoring module is used to manage all client display subsystems, including authentication, performance, and status.

[0006] The client display subsystem includes an encryption and decryption processing module, a logic processing module, and an LCD synchronous guide screen display module. The logic processing module is used to transmit messages and process data, and mainly includes layout assembly and data packaging display. The LCD synchronous guide screen display module includes an entry ticket checking screen, an exit ticket checking screen, a remaining ticket screen, static text, an analog clock, a digital clock, announcements, pictures, basic configurations, and a guide calculation module. The guide calculation module is used to calculate non-binding data, including current position calculation and dynamic calculation of passenger guide identification. The initialization of the position and size of the visible area is completed through the basic information of the guide screen in the data interface, and the non-visible area of ​​the system is shielded to prevent the passenger's visible area from being covered by non-system content.

[0007] The management end includes a data interface, a function configuration module, a remote maintenance module, and a message trigger module. The function configuration module and the remote maintenance module are responsible for managing and maintaining all boot screen layouts. The message trigger module is used to notify the background to update data to ensure real-time synchronization with the client display content.

[0008] The encryption and decryption processing module uses SM2, SM3 and SM4 in the national secret standard algorithm for step-by-step encryption. The SM2 is a public key cryptographic algorithm based on elliptic curves, which encrypts the content during the instruction transmission process. The SM2 has high security but slow performance. The SM4, as a block cipher algorithm, encrypts the content during the data transmission process. The SM4 is less secure than SM2 but has extremely high efficiency for a large amount of encrypted data. The SM3 is a cryptographic hash function used to verify the integrity of the data. The entire security strategy flow of the encryption and decryption module is as follows:

[0009] 1) The background monitoring subsystem uses SM2 to encrypt the data instructions through the trigger signal, and then sends it to the client display subsystem. After receiving the message, the client display subsystem executes SM2 decryption through the decryption module, and verifies the integrity of the data through SM3. When the data is complete, the corresponding instruction operation is completed, including startup, refresh, update format, update data, and time calibration;

[0010] 2) After the client display subsystem is started, it encrypts its own IP, MAC, CPU, memory and other hardware device information using SM4 and sends it to the background monitoring subsystem. The background monitoring subsystem completes SM4 decryption through the encryption and decryption module, then verifies the device access and adds non-authenticated terminals to the blacklist;

[0011] 3) The backend monitoring subsystem encapsulates the basic information of the screen and the layout information of the verified client display subsystem according to the IP address and port, and then encrypts it using SM4 and sends it to the client display subsystem. The client display subsystem decrypts the layout information using SM4, and verifies the data integrity according to the SM3 algorithm. Finally, the layout information including the screen size, position, color, layout, etc. is loaded. After the layout is loaded, the SM2 algorithm is used to send a receiving completion instruction to the backend monitoring subsystem;

[0012] 4) After receiving the format confirmation information sent by the client display subsystem, the background monitoring subsystem filters the data obtained by the data acquisition module, selects the corresponding display data according to the configuration conditions of different formats, and finally completes the encrypted transmission of the data through the SM4 encryption algorithm. After receiving the data message, the client display subsystem performs the corresponding SM4 decryption and SM3 integrity verification, and finally displays the data that meets the integrity requirements according to the format information;

[0013] 5) The background monitoring subsystem or data acquisition module can send command information through the manual intervention mode, and the instructions are transmitted through the background using SM2 encryption. The client display subsystem performs SM2 decryption and SM3 verification on the received messages respectively. On the basis of data integrity, the corresponding manual operations including energy-saving mode switching, screen on and screen off are completed.

[0014] The background subsystem adopts a centralized deployment mode, and the client display subsystem adopts a distributed deployment mode. The specific deployment scheme is as follows:

[0015] The backend monitoring subsystem is centrally deployed on the railway bureau or central station application server, connected to the interface server through the firewall and the safety production network, and the data exchange is completed through the data acquisition module. At the same time, the central station hosting mode can be realized;

[0016] The client display subsystem is deployed at the station terminal, connected to the display screen through the controller and the photoelectric conversion module. Each station synchronous guide screen terminal is connected to the application server through the station network and the firewall to achieve data communication and authentication encryption and decryption operations with the background monitoring subsystem;

[0017] The client display subsystem is in independent station mode. The entire network structure is that the terminal equipment is connected to the station application server through the station network through the station firewall. The station application server completes the interconnection of data interfaces through the firewall and the safety production network.

[0018] In the client display subsystem central station mode, each station deploys a client monitoring subsystem, and then each station network is interconnected through the firewall and the central station application server. The central station application server then accesses the interface server through the firewall and the safety production network.

[0019] Compared with the prior art, the beneficial effects achieved by the present invention are:

[0020] 1. Enhanced data security: Adopting national secret algorithms, in line with national information security standards, effectively preventing data leakage and tampering during transmission, and ensuring the confidentiality and integrity of information;

[0021] 2. Promote standardization: comply with national commercial encryption policy requirements and promote the industry to develop in a safer and more standardized direction;

[0022] 3. Optimize resource utilization: Through carefully designed encryption processes and algorithm selection, it balances security and transmission efficiency, ensures low latency in the encryption process, and meets application scenarios with high real-time requirements;

[0023] 4. Wide applicability: The compatibility with multiple platforms and existing systems makes this technical solution easy to deploy in various synchronous guide screen application scenarios, promoting the security upgrade of information dissemination;

[0024] 5. Applicability and compatibility design: This invention takes into account the needs of different application scenarios and designs a flexible configuration interface, allowing the selection of appropriate national encryption algorithm combinations according to actual needs, ensuring stable operation under different hardware platforms and network environments, and adapting the trusted operating system to meet localization requirements.

[0025] To sum up, the present invention proposes an efficient and secure synchronous guide screen data protection method based on the national secret algorithm, which not only improves the security level of data transmission, but also takes into account the practicality and scalability of the system, and provides a strong guarantee for the information security of the synchronous guide screen. It is of great significance to improve the data security of the station guidance system. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0027] Figure 1 It is a system architecture diagram of a station synchronization guidance system based on a national secret security strategy;

[0028] Figure 2 It is a functional architecture diagram of a station synchronization guidance system based on the national secret security strategy. DETAILED DESCRIPTION

[0029] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0030] See also Figure 1-Figure 2 The present invention provides a technical solution: a station synchronization guidance system based on national secret security strategy, the system includes a background monitoring subsystem, a client display subsystem, and a remote management subsystem.

[0031] The background monitoring subsystem is used to monitor the security of data transmission and the usage of CPU, memory, and disk throughout the process, and can respond to client abnormalities in a timely manner. The client display subsystem is used to decrypt the data and complete the data assembly of the decrypted data through the boot calculation module. The remote management subsystem is used to manage and maintain the boot screen layout and notify the background monitoring subsystem to update the data through message triggers to ensure real-time synchronization with the client display content. The background monitoring subsystem establishes a communication connection with the client display subsystem.

[0032] The background monitoring subsystem includes a data interface, a data acquisition module, a central processing module, an encryption and decryption processing module, and a client security monitoring module. The data interface is used to receive data and trigger signals. The data acquisition module is responsible for collecting station train schedule information and real-time train status information. The system automatically obtains the basic information, layout information and data display information of the guide screen through the station passenger service and production control platform data interface. The central processing module is used to assemble data and process and distribute messages. By performing operations on the collected data, it completes data filtering and distribution according to different terminal addresses. At the same time, it communicates with the client through the trigger signal of message processing to ensure accurate synchronization of data. The security monitoring module is responsible for the unified management of all clients, including authentication, performance, and status.

[0033] The client display subsystem includes encryption and decryption processing module, logic processing module, and LCD synchronous guide screen display module. The logic processing module is responsible for message transmission and data processing, mainly including layout assembly and data packaging display. The LCD synchronous guide screen display module includes the entry ticket inspection screen, exit ticket inspection screen, remaining ticket screen, static text, analog clock, digital clock, announcement, picture, basic configuration and guide calculation module.

[0034] The station entry ticket inspection screen is used to associate the configuration and data of the station entry guidance layout, including timetable information display, waiting area display, train delay change display, train departure status display, train current car position display, surface color display, multi-language switching display, different area data filtering display, number of rows displayed per page control, page turning control, start and stop inspection top display, column attribute dynamic configuration, font size control, font color control, multi-page mode control, display area control;

[0035] The exit ticket inspection screen is associated with the configuration and data of the exit guide layout, including timetable information display, exit location display, train delay change display, train arrival status display, train compartment location display, multi-language switching display, top display of arriving trains, data filtering display in different areas, control of the number of rows displayed per page, page turning control, dynamic configuration of column attributes, font size control, font color control, multi-page mode control, and display area control;

[0036] The remaining ticket screen in the ticket office is used to associate the configuration and data of the remaining ticket layout, including the display of all-day timetable information, full ticket data update time reminder, display of the number of remaining tickets for different seats, control of the number of rows displayed per page, high-speed rail / conventional speed content switching, page turning control, font size control, font color control, and display area control;

[0037] Static text is used to display short text, including font size control, font color control, scroll mode control, text content editing, and display area control;

[0038] The analog clock is used to display the functions of the analog clock, including dial background switching display, hand color change, second hand display control, and dial size control;

[0039] The digital clock is used to display the functions of the digital clock, including font size control, font color control, time format setting, and display area control;

[0040] Announcement is used to display long-length propaganda and announcement texts, including announcement content editing, announcement font color control, page turning mode setting, and display area control;

[0041] Pictures are used to display guide signs, background maps, and static graphic guide content, including picture stretching mode settings, picture path configuration, and display area control;

[0042] The basic configuration is used for security authentication and control of the passenger's visible area, including display area control, starting position control, IP address authentication management, background color control, and energy-saving mode control.

[0043] The guidance calculation module is responsible for the calculation functions of non-bound data, including current position calculation, dynamic calculation of passenger guidance signs, etc. It completes the initialization of the position and size of the visible area through the basic information of the guidance screen in the data interface, and shields the non-visible area of ​​the system.

[0044] According to the location data of the basic information of the guidance screen, such as the physical location and screen orientation, combined with the actual number of train formations, the actual entry direction, the actual formation direction and other data, the corresponding color value is matched according to the landmark color dictionary table. The screen position is based on the corresponding car number of different screens, combined with the screen orientation, the screens on the same side follow the forward guidance, such as 1 car forward, and the screens on the other side take the reverse guidance, such as 1 car backward. Finally, all the calculation results are combined to complete the guidance information and combination display, such as: there are currently 8 cars, 1-7 forward, 9-16 backward, please press the yellow landmark to queue up and wait for the train, etc.

[0045] The high-speed rail landmark color calculation method is dynamically matched according to the station landmark color dictionary, in accordance with the national railway unified standard:

[0046]

[0047]

[0048] The management end includes a data interface, a function configuration module, a remote maintenance module, and a message trigger module. The function configuration module and the remote maintenance module are responsible for managing and maintaining all boot screen layouts. The message trigger module is used to notify the background to update the data to ensure real-time synchronization with the client display content.

[0049] The encryption and decryption processing module uses SM2, SM3 and SM4 in the national secret standard algorithm for step-by-step encryption. SM2 is a public key cryptographic algorithm based on elliptic curves, which encrypts the content during instruction transmission. SM4 is a block cipher algorithm that encrypts the content during data transmission. SM3 is a cryptographic hash function used to verify data integrity. The entire security strategy process of the encryption and decryption module is as follows:

[0050] 1) The background monitoring subsystem uses SM2 to encrypt the data instructions through the trigger signal, and then sends it to the client display subsystem. After receiving the message, the client display subsystem executes SM2 decryption through the decryption module, and verifies the integrity of the data through SM3. When the data is complete, the corresponding instruction operation is completed, including startup, refresh, update format, update data, and time calibration;

[0051] 2) After the client display subsystem is started, it encrypts its own IP, MAC, CPU, memory and other hardware device information using SM4 and sends it to the background monitoring subsystem. The background monitoring subsystem completes SM4 decryption through the encryption and decryption module, then verifies the device access and adds non-authenticated terminals to the blacklist;

[0052] 3) The backend monitoring subsystem encapsulates the basic information of the screen and the layout information of the verified client display subsystem according to the IP address and port, and then encrypts it using SM4 and sends it to the client display subsystem. The client display subsystem decrypts the layout information using SM4, and verifies the data integrity according to the SM3 algorithm. Finally, the layout information including the screen size, position, color, layout, etc. is loaded. After the layout is loaded, the SM2 algorithm is used to send a receiving completion instruction to the backend monitoring subsystem;

[0053] 4) After receiving the format confirmation information sent by the client display subsystem, the background monitoring subsystem filters the data obtained by the data acquisition module, selects the corresponding display data according to the configuration conditions of different formats, and finally completes the encrypted transmission of the data through the SM4 encryption algorithm. After receiving the data message, the client display subsystem performs the corresponding SM4 decryption and SM3 integrity verification, and finally displays the data that meets the integrity requirements according to the format information;

[0054] 5) The background monitoring subsystem or data acquisition module can send command information through the manual intervention mode, and the instructions are transmitted through the background using SM2 encryption. The client display subsystem performs SM2 decryption and SM3 verification on the received messages respectively. On the basis of data integrity, the corresponding manual operations including energy-saving mode switching, screen on and screen off are completed.

[0055] The functional flow of the LCD synchronous boot screen display module is: layout configuration → unified management of the background monitoring subsystem → encryption and decryption authentication → client display subsystem boot display:

[0056] The layout configuration process is uniformly processed in the remote management subsystem. Through the nine functional modules of the guide screen, the visual area is planned according to the basic configuration. Within the visual range, different functional combinations are performed according to different screen guidance requirements. Among them, the entry ticket inspection screen, the exit ticket inspection screen and the remaining ticket screen are business layouts. Dynamic columns need to be configured for data binding, and finally the association of train schedules, remaining tickets and other information in the data interface is completed. The analog clock completes the regional display according to the editing of position and size, and the digital clock has the selection of time format and real-time time update;

[0057] The background monitoring subsystem unifies the management process. After the remote management subsystem is configured, it notifies the background monitoring subsystem to perform data update operations through message triggering. The background first needs to establish a connection with all client display subsystems through TCP, and then forcefully close the unauthorized client connection status through the boot screen authorization status in the data interface. For the authorized client display subsystem, the corresponding layout information is matched according to the IP and port number. After the layout information is encrypted and transmitted through the encryption algorithm, the change status of the train arrival and departure data is monitored. Each time a change instruction is received, the arrival and departure data is encrypted and transmitted to ensure the synchronous update of the data;

[0058] In the encryption and decryption authentication process, all messages between the background monitoring subsystem and the client display subsystem adopt the encryption authentication mode to ensure the security and controllability of data in each link. The messages include configuration information, delivery information, and instruction information. The instruction information is within 5 characters in length and adopts the SM2 encryption and decryption algorithm, which has higher encryption security and does not affect performance. The configuration information and delivery information are long and are sent in the form of JSON strings. The SM4 encryption and decryption algorithm is adopted, giving priority to encryption efficiency. In the decryption link, SM3 is used to verify the integrity to prevent tampering during data transmission.

[0059] The client display subsystem guides the display process. After the client display subsystem and the background monitoring subsystem establish a communication connection, the data channel is monitored for messages. After receiving the data, it is first decrypted. For data that meets the integrity requirements, it is classified according to configuration information, arrival and departure information, and instruction information. Through the basic configuration function of the remote management subsystem, the visual area is loaded in the client display subsystem. This area is the content range of the display screen actually seen by passengers, including background pictures, background colors, train timetables, remaining ticket lists, clocks, announcements, etc.; according to the configuration content of the remote management subsystem, different functional modules are loaded in different areas to complete the static layout initialization. If there is a business layout (entry screen, exit screen, remaining ticket screen), it actively sends a data loading request. After receiving the instruction, the background monitoring subsystem sends the corresponding data. The client display subsystem completes data binding according to the association relationship between different columns; when the data changes, the background monitoring subsystem updates the data content and uses the SM4 encryption algorithm to encrypt the data and send it to the client. When the client receives the message, the data update is completed through the SM4 decryption algorithm and SM3 integrity verification.

[0060] The backend monitoring subsystem establishes a communication connection with the client display subsystem. The backend subsystem adopts a centralized deployment mode, and the client display subsystem adopts a distributed deployment mode. The specific deployment scheme is as follows:

[0061] The backend monitoring subsystem is centrally deployed on the railway bureau or central station application server, connected to the interface server through the firewall and the safety production network, and the data exchange is completed through the data acquisition module. At the same time, the central station hosting mode can be realized;

[0062] The client display subsystem is deployed at the station terminal, connected to the display screen through the controller and the photoelectric conversion module. Each station synchronous guide screen terminal is connected to the application server through the station network and the firewall to achieve data communication and authentication encryption and decryption operations with the background monitoring subsystem;

[0063] The client display subsystem is in independent station mode. The entire network structure is that the terminal equipment is connected to the station application server through the station network through the station firewall. The station application server completes the interconnection of data interfaces through the firewall and the safety production network.

[0064] In the client display subsystem central station mode, each station deploys a client monitoring subsystem, and then each station network is interconnected through the firewall and the central station application server. The central station application server then accesses the interface server through the firewall and the safety production network.

[0065] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0066] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A station synchronization guidance system based on national secret security strategy, characterized by The station synchronous guidance system includes a background monitoring subsystem, a client display subsystem, and a remote management subsystem. The background monitoring subsystem is used to monitor the security of data transmission and the usage of CPU, memory, and disk throughout the process, and can respond to client abnormalities in a timely manner. The client display subsystem is used to decrypt data and assemble the decrypted data. The remote management subsystem is used to manage and maintain the guidance screen layout. The background monitoring subsystem establishes a communication connection with the client display subsystem.

2. According to claim 1, a station synchronization guidance system based on national secret security strategy is characterized in that: The background monitoring subsystem includes a data interface, a data acquisition module, a central processing module, an encryption and decryption processing module, and a client security monitoring module; The data interface is used to receive data and trigger signals; The data acquisition module is used to collect station train time information and real-time train status information. The system automatically obtains the basic information, layout information and data display information of the guide screen through the station passenger service and production control platform data interface; The central processing module is used for message processing, assembling and distributing data. It performs operations on the collected data and completes data filtering and distribution according to different terminal addresses. It also communicates with the client display subsystem through the trigger signal of message processing. The security monitoring module is used to manage all client display subsystems, including authentication, performance, and status.

3. According to claim 1, a station synchronization guidance system based on national secret security strategy is characterized in that: The client display subsystem includes an encryption and decryption processing module, a logic processing module, and an LCD synchronous guide screen display module: The logic processing module is used to transmit messages and process data, mainly including format assembly and data packaging display; The LCD synchronous guide screen display module includes an entry ticket checking screen, an exit ticket checking screen, a remaining ticket screen, static text, an analog clock, a digital clock, an announcement, a picture, a basic configuration and a guide calculation module. The entry ticket checking screen is used to associate the configuration and data of the entry guide layout, the exit ticket checking screen is used to associate the configuration and data of the exit guide layout, and the remaining ticket screen is used to associate the configuration and data of the remaining ticket amount layout of the ticket office. The static text is used to display the text with short content, the analog clock is used to display the function of the analog clock, and the digital clock is used to display the function of the digital clock. The announcement is used to display long-length propaganda and announcement texts. The picture displays guide signs, background maps, and static graphic guide content. The basic configuration is used for security authentication and control of the visible area of ​​passengers. The guide calculation module is used to calculate non-binding data, including current position calculation and dynamic calculation of passenger guide signs. The initialization of the position size of the visible area is completed through the basic information of the guide screen in the data interface, and the non-visible area of ​​the system is shielded at the same time.

4. According to claim 3, a station synchronization guidance system based on national secret security strategy is characterized in that: The functional flow of the LCD synchronous guide screen display module is as follows: The layout configuration process plans the visible area according to the basic configuration functions of the remote management system, and performs different function combinations within the visible range according to different screen guidance requirements; After the backend unified management process and the configuration of the remote management subsystem are completed, the backend monitoring subsystem is notified through message triggering to perform data update operations. The backend monitoring subsystem establishes connections with all clients, and forcibly closes the connection status of unauthorized clients through the authorization status of the guide screen in the data interface. For authorized clients, the display subsystem matches the corresponding layout information according to the IP and port number, and completes the encrypted transmission of the layout information through the encryption algorithm. It monitors the change status of the train arrival and departure data, and encrypts the arrival and departure data for each change instruction received; In the encryption and decryption authentication process, all messages between the backend and the client adopt the encryption authentication mode. According to the message type, they are divided into: configuration information, delivery information, and instruction information. Different encryption methods are used for each. SM3 is used to verify the integrity in the decryption process. The client guides the display process, loads the visible area in the client display subsystem according to the configuration information of the remote management subsystem, loads different functional modules in different areas, and completes the static layout initialization; when the data changes, the background monitoring subsystem updates the data content and uses the SM4 encryption algorithm to encrypt the data and then sends it to the client display subsystem. The client display subsystem receives the message and updates the data through the SM4 decryption algorithm and SM3 integrity check.

5. According to claim 1, a station synchronous guidance system based on national secret security strategy is characterized in that: The management end includes a data interface, a function configuration module, a remote maintenance module, and a message trigger module. The function configuration module and the remote maintenance module are used to manage and maintain all guide screen layouts, and the message trigger module is used to notify the background to update data.

6. A station synchronization guidance system based on national secret security strategy according to claim 2 or 3, characterized in that: The encryption and decryption processing module adopts SM2, SM3 and SM4 in the national secret standard algorithm for step-by-step encryption. The SM2 is a public key encryption algorithm based on elliptic curves, which encrypts the content during the instruction transmission process. The SM4 is a block cipher algorithm, which encrypts the content of the data transmission process. The SM3 is a cryptographic hash function used to verify the integrity of the data.

7. A station synchronization guidance system based on national secret security strategy according to claim 6, characterized in that The entire security strategy process of the encryption and decryption module is as follows: The background monitoring subsystem uses SM2 to encrypt the data instructions through the trigger signal, and then sends it to the client display subsystem. After receiving the message, the client display subsystem executes SM2 decryption through the decryption module, and verifies the integrity of the data through SM3. When the data is complete, the corresponding instruction operations are completed, including startup, refresh, update format, update data, and time calibration; After the client display subsystem is started, it encrypts its own IP, MAC, CPU, memory and other hardware information using SM4 and sends it to the background monitoring subsystem. The background monitoring subsystem completes SM4 decryption through the encryption and decryption module, then verifies the device access and adds non-authenticated terminals to the blacklist; The backend monitoring subsystem encapsulates the basic information and layout information of the screen according to the IP address and port of the verified client display subsystem, and then encrypts it using SM4 and sends it to the client display subsystem. The client display subsystem decrypts the layout information using SM4, and verifies the data integrity according to the SM3 algorithm. Finally, the layout information including the screen size, position, color, and layout is loaded. After the layout is loaded, the SM2 algorithm is used to send a receiving completion instruction to the backend monitoring subsystem. After receiving the format confirmation information sent by the client display subsystem, the background monitoring subsystem filters the data obtained by the data acquisition module, selects the corresponding display data according to the configuration conditions of different formats, and finally completes the encrypted transmission of the data through the SM4 encryption algorithm. After receiving the data message, the client display subsystem performs the corresponding SM4 decryption and SM3 integrity verification, and finally displays the data that meets the integrity requirements according to the format information; The background monitoring subsystem or data acquisition module can send command information through the manual intervention mode, and the instructions are transmitted through the background using SM2 encryption. The client display subsystem performs SM2 decryption and SM3 verification on the received messages respectively. On the basis of data integrity, the corresponding manual operations including energy-saving mode switching, screen on and screen off are completed.

8. According to claim 1, a station synchronous guidance system based on national secret security strategy is characterized by: The background monitoring subsystem adopts a centralized deployment mode, and the client display subsystem adopts a distributed deployment mode. The specific deployment scheme is as follows: The backend monitoring subsystem is centrally deployed on the railway bureau or central station application server, connected to the interface server through the firewall and the safety production network, and the data exchange is completed through the data acquisition module. At the same time, the central station hosting mode can be realized; The client display subsystem is deployed at the station terminal, connected to the display screen through the controller and the photoelectric conversion module. Each station synchronous guide screen terminal is connected to the application server through the station network and the firewall to achieve data communication and authentication encryption and decryption operations with the background monitoring subsystem; The client display subsystem is in independent station mode. The entire network structure is that the terminal equipment is connected to the station application server through the station network through the station firewall. The station application server completes the interconnection of data interfaces through the firewall and the safety production network. In the client display subsystem central station mode, each station deploys a client monitoring subsystem, and then each station network is interconnected through the firewall and the central station application server. The central station application server then accesses the interface server through the firewall and the safety production network.

Images