Water conservancy information safety protection method and system

Abstract

The invention provides a water conservancy information security protection method and system. The method comprises the following steps: S1, edge equipment physical security reinforcement; S2, dynamic encrypted data acquisition; S3, adaptive fragmentation redundancy transmission; a protection module is deployed in a water conservancy sensor and an RTU, equipment vibration, uncovering and environmental parameters are monitored, abnormal physical attacks or environmental overrun are detected, a secret key is automatically erased, a data protection mode is started, data leakage when equipment is physically damaged is prevented, data security of edge equipment is guaranteed, and the safety of the equipment is improved. And in cross-system data interaction, an MPC or federated learning technology is adopted, original data is locally reserved, and a block chain audit log is generated to record a calling behavior, so that data sharing is realized, data is ensured not to be locally out, data privacy is guaranteed, and a data calling tracing basis is provided.

Description

Technical Field

[0001] The present invention belongs to the field of information protection, and specifically relates to a water conservancy information security protection method and system. Background Art

[0002] With the development of information technology, data security protection is crucial. Water conservancy information differs significantly from general enterprise information. Water conservancy information involves numerous edge devices, such as water conservancy sensors and RTU remote terminal units, distributed in complex field environments and exposed to physical attack risks such as flooding and vandalism. Furthermore, data real-time and integrity requirements are extremely high. Data leaks or equipment failures can trigger major security incidents. General enterprise information, on the other hand, is primarily stored in relatively secure internal network environments. Security threats often come from network attacks and unauthorized internal access, so its security priorities differ from those of water conservancy information.

[0003] For example, the information security protection method and system disclosed in publication number CN117852015B has deficiencies in rights management within the information security protection field. For enterprise data access, one approach is to verify only device permissions. When a high-privileged user uses a low-privileged device to access high-privileged data, a mismatch between the access data range and the user's permissions occurs. Another approach is to verify only user permissions. When a high-privileged user uses a low-privileged device to access low-privileged data, additional user identity authentication steps are required, impacting the user experience.

[0004] In the water conservancy information scenario, relying solely on device permission verification can fail to effectively protect data security when sensing devices are subjected to physical attacks or environmental conditions exceed their limits, potentially leading to key leakage and illegal data access. Relying solely on user permission verification can delay timely data protection measures when devices face physical risks, and additional identity authentication operations can delay emergency response, making it impossible to ensure the security and integrity of water conservancy data in extreme situations. Summary of the Invention

[0005] In order to solve the above technical problems, the present invention provides a water conservancy information security protection method and system for solving the problems raised in the background technology.

[0006] A water conservancy information security protection method comprises the following steps:

[0007] S1 edge device physical security reinforcement: Physical security protection modules are deployed in water conservancy sensors and RTU remote terminal units to monitor equipment vibration, cover opening status, and environmental parameters in real time. When abnormal physical attacks or environmental conditions are detected, the key is automatically erased and data protection mode is activated.

[0008] S2 dynamic encryption data collection: Generates a unique device fingerprint based on the PUF physical unclonable function, dynamically generates an encryption key based on environmental noise, and encrypts the collected water conservancy monitoring data after adding the device fingerprint, timestamp, and geographic coordinate triplet identifier. The key validity period is set to 3-10 minutes;

[0009] S3 adaptive sharding redundant transmission: The number of data shards (N≥3) is dynamically determined based on network latency and packet loss rate. The primary transmission path is encrypted using the national SM4 algorithm, and the backup path uses a lightweight encryption algorithm. The receiving end verifies data integrity through hash checksums and blockchain evidence storage.

[0010] S4 Blockchain - Distributed Joint Storage: Data hash values ​​are written into alliance chain nodes. The original data is encrypted and stored in shards in the IPFS interstellar file system. Expired data is destroyed through smart contracts.

[0011] S5 Privacy-Secure Data Sharing: When interacting with data across systems, MPC secure multi-party computing or federated learning technology is used to ensure that the original data does not leave the local storage node, and a blockchain audit log is generated to record data call behavior;

[0012] S6 multi-dimensional threat real-time processing: Based on the user's historical operation sequence training behavior baseline model, real-time detection of abnormal access behavior, when identifying overseas IP login during non-working hours or high-risk port scanning, the network security device is linked to generate an access control list (ACL) for millisecond-level blocking;

[0013] S7 dynamic permission intelligent control: establishes a risk assessment matrix, comprehensively calculates the dynamic permission level based on user role permissions, equipment health indicators and network environment parameters, and automatically downgrades remote control command permissions to read-only mode when the network delay of the reservoir monitoring point is greater than 200ms or the water level exceeds the warning line.

[0014] Preferably, the judgment conditions for the abnormal physical attack include vibration frequency ≥50Hz, corresponding acceleration ≥5g or the device casing is opened for more than 2 seconds, and the environmental parameter violations include temperature exceeding the range of -20℃ to +60℃, humidity >90% RH or GPS position deviation ≥5 meters.

[0015] Preferably, the generation rule of the dynamic encryption key is that the key validity period is dynamically adjusted according to the water conservancy monitoring parameters. The greater the difference between the water level and the warning water level, the shorter the key validity period. When the dam displacement rate reaches 2 mm per hour or above, the key validity period will be shortened to 50% of the normal state. The encrypted data packet header is supplemented with water conservancy project metadata, including monitoring point elevation, data collection time and equipment installation coordinates. The key validity period T is dynamically associated with the water conservancy monitoring parameters, satisfying the formula:

[0016] Preferably, the number of fragments is dynamically determined according to the network quality. The higher the network delay, the more fragments there are. When the network delay exceeds 300 milliseconds, the Beidou short message is forcibly enabled as a backup transmission path. The main path adopts the SM4-GCM encryption mode, and the backup path adopts the ChaCha20-Poly1305 algorithm. The key is independently generated and not reused. The number of fragments N is dynamically calculated according to the network quality and satisfies the formula:

[0017]

[0018] Preferably, the user risk levels of the risk assessment matrix are divided into levels 1-3, level 1 is an ordinary inquirer, and level 3 is a system administrator. The equipment health is calculated based on the equipment vibration speed. The greater the vibration speed, the lower the equipment health. When the vibration speed exceeds a certain threshold, the equipment health returns to zero. The network environment risk coefficient takes a value of 1 when the network delay exceeds 200 milliseconds, otherwise it takes a value of 0. When the risk assessment result reaches 6 or above, it is prohibited to perform high-risk operations such as adjusting the opening of the flood discharge gate and starting and stopping the pump station unit. The calculation formula of the risk assessment matrix is: Risk = 0.5Puser+0.3Sdevice+0.2Nenu, and Puser is the user risk level, Sdevice is the equipment health, and Nenu is the network environment risk coefficient.

[0019] Preferably, when the temperature rise of the gate motor reaches 40K relative to the ambient temperature, or the power supply voltage fluctuates by more than ±20% based on the rated 24VDC, the equipment health will be directly reset to zero. When the reservoir water level exceeds the design flood level, the network environment risk coefficient will be forced to be set to the maximum value of 1.

[0020] A water conservancy information security protection system includes the following modules:

[0021] Physical security perception module: deployed on water conservancy terminal equipment, integrating anti-tampering self-destruction units and environmental sensors to monitor the physical status of equipment in real time;

[0022] Dynamic encryption collection module: Generates a unique device fingerprint through the PUF physical unclonable function, dynamically generates an encryption key based on environmental noise, and encrypts the collected water conservancy project data;

[0023] Adaptive fragmentation transmission module: Based on network latency, packet loss rate, and water conservancy service priority, it fragments encrypted data and transmits it through multiple paths, supporting dynamic switching between the national encryption SM4 and ChaCha20 algorithms;

[0024] Distributed storage and evidence module: It consists of blockchain nodes and IPFS storage clusters. The blockchain records data hash values ​​and operation logs, while IPFS stores encrypted fragments and performs smart contract-driven lifecycle management.

[0025] Privacy computing sharing module: Based on MPC secure multi-party computing and federated learning framework, it realizes cross-regional water conservancy data joint analysis, and the original data does not leave the local storage node;

[0026] Intelligent permission control module: Built-in risk assessment matrix and user behavior baseline model, dynamically adjust user operation permissions, and work with the firewall to implement real-time blocking strategies.

[0027] Preferably, the water conservancy terminal equipment includes a water level meter, a displacement sensor, and a gate controller, and the flood prevention instructions in the water conservancy business are the highest level.

[0028] Compared with the prior art, the present invention has the following beneficial effects:

[0029] 1. The present invention deploys protection modules in water conservancy sensors and RTUs to monitor equipment vibration, cover opening and environmental parameters. When abnormal physical attacks or environmental violations are detected, the key is automatically erased and the data protection mode is activated to prevent data leakage when the equipment is physically damaged, thereby ensuring the data security of edge devices.

[0030] 2. The present invention adopts MPC or federated learning technology in cross-system data interaction. The original data is kept locally, and a blockchain audit log is generated to record the call behavior, realizing data sharing while ensuring that the data does not leave the local area, protecting data privacy, and providing a basis for data call tracing.

[0031] 3. This system calculates permission levels based on a risk assessment matrix, combining user roles, device health, and network parameters. When network latency is high or water levels exceed warning levels, remote control permissions are automatically downgraded to read-only, preventing misoperation under abnormal circumstances and ensuring safe control of water conservancy facilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 is a flow chart of the method of the present invention;

[0033] Figure 2 It is a tree diagram of system modules of the present invention;

[0034] Figure 3 It is the dynamic permission evaluation tree of the present invention;

[0035] Figure 4 It is a timing diagram of data fragmentation transmission of the present invention;

[0036] Figure 5 It is the key management state diagram of the present invention. DETAILED DESCRIPTION

[0037] The following embodiments of the present invention are described in further detail with reference to the accompanying drawings and examples. The following examples are used to illustrate the present invention but are not intended to limit the scope of the present invention.

[0038] A water conservancy information security protection method and system, comprising the following steps:

[0039] S1 edge device physical security reinforcement: Physical security protection modules are deployed in water conservancy sensors and RTU remote terminal units to monitor equipment vibration, cover opening status, and environmental parameters in real time. When abnormal physical attacks or environmental conditions are detected, the key is automatically erased and data protection mode is activated.

[0040] Among them, the edge device physical security reinforcement step realizes the physical layer active protection of water conservancy terminal equipment by integrating multimodal sensors and security control units. The physical security protection module is composed of a high-sensitivity three-axis accelerometer, a digital temperature and humidity sensor, a dual-frequency GPS positioning module and a three-axis tilt sensor. The accelerometer has a range of ±20g and a resolution of 0.1g. It collects the vibration spectrum characteristics of the equipment in real time and compares them with the preset security baseline. When the vibration energy is detected to exceed the threshold for 2 seconds in the 50-200Hz frequency band or the Hall effect cover opening detection circuit is triggered for more than 1 second, it is determined to be a physical attack event, and an event fingerprint containing the attack time, vibration spectrum characteristics and GPS coordinates is generated simultaneously, and written into the tamper-proof log area after SM3 hash operation;

[0041] In addition, for environmental anomaly monitoring, the temperature safety range is set to -20℃~+60℃, the GPS position offset threshold is ≥5 meters, and the tilt angle tolerance is ±2°. When the temperature exceeds the limit for 5 minutes without recovery, the position offset exceeds the threshold, or the tilt angle is abnormal, the environmental limit response protocol is activated;

[0042] The security control unit has a built-in trusted execution environment based on the ARM Cortex-M4 architecture. It erases the encryption master key and session key stored in the TEE within 0.3 seconds after detecting a physical attack or environmental violation, and transfers the untransmitted encrypted data to the physical write-protected NORFlash memory. At the same time, it sends encrypted alarm information to the monitoring center via the Beidou RDSS short message service. The alarm content includes the device ID, event type and WGS-84 geographic coordinates.

[0043] In addition, to improve reliability, an improved Kalman filter algorithm is used to process vibration signals to distinguish between mechanical shock and malicious attacks, polynomial fitting compensation is performed on temperature drift to eliminate interference from slowly changing environments, and a dual power supply redundancy mechanism and a three-mode redundant architecture for key sensors are deployed. The final monitoring results are output through a majority voting mechanism to ensure the continuity of protection functions under extreme weather conditions.

[0044] S2 dynamic encryption data collection: Generates a unique device fingerprint based on the PUF physical unclonable function, dynamically generates an encryption key based on environmental noise, and encrypts the collected water conservancy monitoring data after adding the device fingerprint, timestamp, and geographic coordinate triplet identifier. The key validity period is set to 3-10 minutes;

[0045] S3 adaptive sharding redundant transmission: The number of data shards (N≥3) is dynamically determined based on network latency and packet loss rate. The primary transmission path is encrypted using the national SM4 algorithm, and the backup path uses a lightweight encryption algorithm. The receiving end verifies data integrity through hash checksums and blockchain evidence storage.

[0046] S4 Blockchain - Distributed Joint Storage: Data hash values ​​are written into alliance chain nodes. The original data is encrypted and stored in shards in the IPFS interstellar file system. Expired data is destroyed through smart contracts.

[0047] S5 Privacy-Secure Data Sharing: When interacting with data across systems, MPC secure multi-party computing or federated learning technology is used to ensure that the original data does not leave the local storage node, and a blockchain audit log is generated to record data call behavior;

[0048] Among them, the privacy-safe data sharing step realizes the secure collaboration of cross-system data by integrating cryptographic protocols and distributed computing frameworks, specifically including the following progressive technical solutions: in cross-basin or cross-departmental data interaction scenarios, in response to the privacy protection needs of hydrological monitoring raw data, a privacy intersection protocol based on secure multi-party computing or a vertical federated learning architecture is adopted, wherein the MPC protocol implements additive homomorphic encryption based on Shamir secret sharing and Beaver triple pre-computation, and the participants exchange encrypted intermediate values ​​through a ring topology structure. The local data is encrypted by the Paillier algorithm and divided into multiple secret shards. The number of shards and the number of participants satisfy N≥2t+1, and t is the fault tolerance threshold;

[0049] Each shard is signed with the national secret SM2 algorithm and transmitted to the collaborating party via a quantum key distribution channel. In the federated learning framework, global model parameters are updated through homomorphic encrypted gradients to ensure the aggregability of gradients and the irreversibility of plaintext. Data callers must pass identity authentication based on zero-knowledge proof to prove that they have access rights in accordance with the "Water Conservancy Data Sharing Management Measures" and that the purpose of data use is limited to flood control scheduling or engineering safety assessment.

[0050] All data interaction behaviors trigger the generation of blockchain audit logs in real time. The log content includes the data hash value, the caller's digital certificate fingerprint, the operation timestamp, and the data usage statement. The log structure is organized using a MerklePatriciaTree and written to the consortium chain node. The block generation interval is dynamically adjusted according to the urgency of the water conservancy business, set to 5 minutes / block during the flood season and extended to 1 hour / block during the non-flood season. To cope with network partitions or node failures, an asynchronous Byzantine fault-tolerant consensus mechanism is deployed to ensure that the audit log can still reach consistency even if 1 / 3 of the nodes fail. For highly sensitive data, differential privacy (DP) protection is additionally enabled through Laplace noise injection. The noise scale ε = 0.5 is used to blur the statistical features after Laplace noise injection to prevent member reasoning attacks.

[0051] The compliance of the entire data sharing process is automatically verified by smart contracts, and the contract code solidifies the terms of the "Hydrological Data Use License Agreement". When an unauthorized data export attempt is detected, the session is immediately terminated and a security alarm event is triggered. The alarm information is stored in the IPFS shard and then linked to the blockchain traceability index.

[0052] S6 multi-dimensional threat real-time processing: Based on the user's historical operation sequence training behavior baseline model, real-time detection of abnormal access behavior, when identifying overseas IP login during non-working hours or high-risk port scanning, the network security device is linked to generate an access control list (ACL) for millisecond-level blocking;

[0053] S7 dynamic permission intelligent control: establishes a risk assessment matrix, comprehensively calculates the dynamic permission level based on user role permissions, equipment health indicators and network environment parameters, and automatically downgrades remote control command permissions to read-only mode when the network delay of the reservoir monitoring point is greater than 200ms or the water level exceeds the warning line.

[0054] Among them, the dynamic authority intelligent control step realizes real-time adaptive adjustment of water conservancy system access rights by constructing a multi-dimensional risk assessment matrix, wherein the risk assessment matrix uses user role authority as the basic weight factor, combined with the quantitative indicators of equipment health and the dynamic parameters of the network environment for comprehensive calculation, specifically including: user role authority is divided into ordinary inquirer (weight coefficient 0.2), data administrator (0.4) and system controller (0.6), equipment health index is based on sensor vibration speed (threshold ≤4.5mm / s), equipment temperature rise (gate motor ≤40K) and power supply voltage fluctuation range (±10% rated value) to calculate the normalized health score Sdevice∈[0,1], network environment parameters are based on real-time network delay (baseline value ≤200ms), packet loss rate (≤5%) and Beidou signal strength (≥-90dBm) to generate environmental risk coefficient Nenu;

[0055] The risk assessment value Risk is dynamically calculated using the linear weighted formula Risk = 0.5Puser + 0.3Sdevice + 0.2Nenu. When Risk ≥ 7 (out of 10) or the preset water conservancy business threshold is triggered, the remote control command authority is automatically downgraded to read-only mode, prohibiting gate opening adjustment, pump station start-up and shutdown, and flood discharge command issuance operations; the authority control engine is connected to the water conservancy business system in real time. When the dam displacement rate is ≥ 2mm / h or the irrigation channel flow exceeds the design value by 15m 3 / s, the risk assessment frequency is forced to increase to once per second and multi-source data cross-validation is enabled;

[0056] The permission status change information is signed by the SM2 algorithm and written into the blockchain audit chain, and is synchronously updated to the distributed access control list. After the network stabilizes or the water level drops below the safety threshold, the control authority is gradually restored according to the manual review process;

[0057] At the same time, to cope with extreme network interruption scenarios, a local edge decision-making unit is deployed to predict equipment health trends based on the LSTM model. When the vibration speed is predicted to exceed 4.0 mm / s in the next 10 minutes, permission downgrade is pre-triggered and control instructions are cached in the local trusted execution environment. After the network is restored, delayed operations are executed through dual signature authentication to ensure a balance between business continuity and security.

[0058] Example 1:

[0059] Dam safety monitoring scenario;

[0060] The application scenario is the sensor safety protection of a surface displacement monitoring point of a concrete gravity dam;

[0061] The technology is implemented by adding edge device physical security reinforcement steps to the traditional data collection process;

[0062] Operation process: When the dam displacement sensor detects an X-direction displacement of ≥20mm, the anti-tampering machine chip is triggered to erase the key;

[0063] Then, an alarm is sent to the monitoring center via Beidou short message to block the upload of abnormal data. Specific parameters are shown in Table 1.

[0064] Table 1:

[0065]

[0066] Example 2:

[0067] Cross-regional reservoir operation scenario

[0068] Application scenario: Joint flood control and dispatching data sharing among reservoir groups in inter-provincial river basins;

[0069] Technical implementation: Add privacy-focused computing to traditional data sharing processes;

[0070] Operation process:

[0071] When the reservoir water level in Province A exceeds 183m, the optimal flood discharge plan is calculated jointly with the two neighboring provinces through MPC secure multi-party computing;

[0072] The original water level data does not leave the local machine, only the encrypted intermediate values ​​are exchanged; the final calculation results are stored on the chain, and the specific parameters are shown in Table 2;

[0073] Table 2:

[0074]

[0075] Example 3:

[0076] Gate remote control system scenario;

[0077] Application scenario: Dynamic management of remote control permissions for irrigation channel gates;

[0078] Technical implementation:

[0079] Add dynamic permission adaptive adjustment to traditional access control;

[0080] When the network delay reaches 250ms and the channel water level approaches 2.6m;

[0081] And the system automatically downgrades the remote control permission to "read-only mode";

[0082] Then the gate opening adjustment command is prohibited;

[0083] At the same time, only water level data query is allowed;

[0084] Specific parameters are shown in Table 3;

[0085] Table 3:

[0086]

[0087] Example 4:

[0088] Comprehensive scenario of flood control command system;

[0089] All the method steps in the above technical solution are adopted;

[0090] Application scenario: Multi-source data fusion platform of provincial flood control and drought relief command center;

[0091] Operation process:

[0092] First, the rainfall station data is encrypted with PUF, and the key expires after 5 minutes. It is transmitted to the command center in three ways, and then the hydrological data is stored in the IPFS network;

[0093] Among them, the flood prediction model is trained through federated learning;

[0094] In addition, finally, when abnormal access to satellite cloud image data by overseas IP is detected;

[0095] This fact is that the DRL model blocks the connection and initiates retrospective review of permissions within 300ms. Furthermore, the system, with its real-time monitoring and intelligent analysis capabilities, can quickly respond and make judgments after identifying potential security risks or illegal operations. Specific parameter names and data ranges are shown in Table 4.

[0096] Table 4:

[0097]

[0098] In summary, the technical solution of the present invention addresses the issue of water conservancy information security and makes technical innovations in multiple scenarios. In the dam safety monitoring scenario, the physical security of edge devices is reinforced; in the cross-regional reservoir scheduling scenario, privacy-safe data sharing technology is adopted;

[0099] Remote gate control scenarios enable intelligent dynamic control of permissions. By integrating various innovations and applying them to the flood control command system, a full-process security protection system for data collection, transmission, storage, and decision-making is constructed. Through technological integration, a physical-logical-authority protection architecture is formed that covers water conservancy safety regulations, reduces system operation and maintenance costs, improves system security and business processing efficiency, meets the security requirements of smart water conservancy networks, and provides security for water conservancy project construction.

[0100] All aspects of the present invention are within the scope of protection of this patent.

[0101] The embodiments of the present invention are provided for the purpose of illustration and description. Although the embodiments of the present invention have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations of the present invention. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present invention.

Claims

1. A water conservancy information security protection method, characterized in that: The following steps are involved: S1 edge device physical security reinforcement: Physical security protection modules are deployed in water conservancy sensors and RTU remote terminal units to monitor equipment vibration, cover opening status, and environmental parameters in real time. When abnormal physical attacks or environmental conditions are detected, the key is automatically erased and data protection mode is activated. S2 dynamic encryption data collection: Generates a unique device fingerprint based on the PUF physical unclonable function, dynamically generates an encryption key based on environmental noise, and encrypts the collected water conservancy monitoring data after adding the device fingerprint, timestamp, and geographic coordinate triplet identifier. The key validity period is set to 3-10 minutes; S3 adaptive sharding redundant transmission: The number of data shards (N≥3) is dynamically determined based on network latency and packet loss rate. The primary transmission path is encrypted using the national SM4 algorithm, and the backup path uses a lightweight encryption algorithm. The receiving end verifies data integrity through hash checksums and blockchain evidence storage. S4 Blockchain - Distributed Joint Storage: Data hash values ​​are written into alliance chain nodes. The original data is encrypted and stored in shards in the IPFS interstellar file system. Expired data is destroyed through smart contracts. S5 Privacy-Secure Data Sharing: When interacting with data across systems, MPC secure multi-party computing or federated learning technologies are used to ensure that the original data does not leave the local storage node, and blockchain audit logs are generated to record data call behavior. S6 multi-dimensional threat real-time processing: Based on the user's historical operation sequence, the behavioral baseline model is trained to detect abnormal access behavior in real time. When an overseas IP address is detected logging in during off-hours or scanning a high-risk port, the network security device is linked to generate an access control list (ACL) for millisecond-level blocking. S7 dynamic permission intelligent control: establishes a risk assessment matrix, comprehensively calculates the dynamic permission level based on user role permissions, equipment health indicators and network environment parameters, and automatically downgrades remote control command permissions to read-only mode when the network delay of the reservoir monitoring point is greater than 200ms or the water level exceeds the warning line.

2. A water conservancy information security protection method according to claim 1, characterized in that: The criteria for determining an abnormal physical attack include a vibration frequency ≥ 50Hz, a corresponding acceleration ≥ 5g, or the device casing being opened for more than 2 seconds. The environmental parameter violations include a temperature exceeding the range of -20°C to +60°C, humidity > 90% RH, or a GPS position offset ≥ 5 meters.

3. A water conservancy information security protection method according to claim 1, characterized in that: The generation rule of the dynamic encryption key is that the key validity period is dynamically adjusted according to the water conservancy monitoring parameters. The greater the difference between the water level and the warning water level, the shorter the key validity period; when the dam displacement rate reaches 2 mm per hour or above, the key validity period will be shortened to 50% of the normal state. The encrypted data packet header is supplemented with water conservancy project metadata, including the monitoring point elevation, data collection time and equipment installation coordinates.

4. A water conservancy information security protection method according to claim 1, characterized in that: The number of fragments is dynamically determined according to the network quality. The higher the network delay, the more fragments there are. When the network delay exceeds 300 milliseconds, the Beidou short message is forcibly enabled as a backup transmission path. The main path adopts the SM4-GCM encryption mode, and the backup path adopts the ChaCha20-Poly1305 algorithm. The key is generated independently and not reused.

5. A water conservancy information security protection method according to claim 1, characterized in that: The user risk levels of the risk assessment matrix are divided into levels 1-3, with level 1 being an ordinary inquirer and level 3 being a system administrator. The equipment health is calculated based on the equipment vibration speed. The greater the vibration speed, the lower the equipment health. When the vibration speed exceeds a certain threshold, the equipment health returns to zero. The network environment risk coefficient takes a value of 1 when the network delay exceeds 200 milliseconds, otherwise it takes a value of 0. When the risk assessment result reaches 6 or above, high-risk operations such as adjusting the opening of the flood discharge gate and starting and stopping the pump station unit are prohibited.

6. A water conservancy information security protection method according to claim 1, characterized in that: When the gate motor temperature rise reaches 40K relative to the ambient temperature, or the power supply voltage fluctuates by more than ±20% based on the rated 24VDC, the equipment health will be directly reset to zero. When the reservoir water level exceeds the design flood level, the network environment risk factor will be forcibly set to the maximum value of 1.

7. A water conservancy information security protection system, characterized in that: Includes the following modules: Physical security perception module: deployed on water conservancy terminal equipment, integrating anti-tampering self-destruct units and environmental sensors to monitor the physical status of equipment in real time; Dynamic encryption acquisition module: Generates a unique device fingerprint through the PUF physical unclonable function, dynamically generates an encryption key based on environmental noise, and encrypts the collected water conservancy project data; Adaptive fragmentation transmission module: fragments encrypted data and transmits it through multiple paths based on network latency, packet loss rate, and water conservancy service priority, supporting dynamic switching between the national encryption SM4 and ChaCha20 algorithms; Distributed storage and evidence module: It consists of blockchain nodes and IPFS storage clusters. The blockchain records data hash values ​​and operation logs, while IPFS stores encrypted shards and performs smart contract-driven lifecycle management. Privacy computing sharing module: Based on MPC secure multi-party computing and federated learning framework, it enables cross-regional joint analysis of water conservancy data, without the original data leaving the local storage node; Intelligent permission control module: Built-in risk assessment matrix and user behavior baseline model, dynamically adjust user operation permissions, and work with the firewall to implement real-time blocking strategies.

8. A water conservancy information security protection system according to claim 7, characterized in that: The water conservancy terminal equipment includes a water level meter, a displacement sensor, and a gate controller, and the flood prevention instructions in the water conservancy business are the highest level.

Images