Shipborne communication data encryption transmission method and system based on satellite 5G fusion network

Abstract

The invention discloses a shipborne communication data encryption transmission method and system based on a satellite 5G fusion network, and relates to the technical field of satellite communication encryption. Data classification and priority division: dividing the data into five types of navigation instructions according to service types, marking P1-P4 priorities, and adding information; encryption strategy selection: adding random salt values by using algorithms such as hybrid encryption, AES, DES, TEA and the like according to priorities; network routing is fused, satellite and 5G state parameters are collected, and paths are selected according to priorities; real-time encryption transmission, fragmentation and information addition are carried out, FEC is used for satellites, and HARQ is used for 5G; the transmission state is monitored and dynamically adjusted, and the parameters are synchronously encrypted during over-limit time adjustment and switching; decrypting and verifying, namely decrypting and verifying after verifying and recombining; secret key updating management, life cycle setting, KDC distribution and emergency updating are carried out. According to the method, the shipborne data transmission security and network adaptability are improved, the encryption efficiency and continuity are optimized, the cost is reduced, multiple scenes are adapted, and the security and high efficiency of maritime communication are ensured.

Description

TECHNICAL FIELD

[0001] The application relates to the field of satellite communication encryption technology, and in particular to a shipborne communication data encryption transmission method and system based on a satellite 5G fusion network. BACKGROUND

[0002] With the rapid development of the marine economy, the demand for communication is increasing in activities such as maritime shipping, fishing and tourism. Shipborne communication, as a key support for maritime activities, is of great concern in terms of stability, security and efficiency. At present, shipborne communication mainly relies on the fusion application of satellite communication and ground 5G network: the 5G network can provide high-bandwidth, low-latency communication services in the near sea area, meeting the needs of high-definition video transmission and real-time data interaction; satellite communication can guarantee basic communication links in the open sea and remote sea areas due to its wide coverage. However, the fusion application of the two networks still faces the problem of data transmission security. The marine environment is complex, and communication links are vulnerable to electromagnetic interference and signal hijacking. If sensitive information such as navigation instructions, ship monitoring data and crew communication is stolen or tampered with during transmission, it may cause safety accidents or commercial information leakage.

[0003] Existing shipborne communication encryption technologies are mostly designed for a single network and are difficult to adapt to the dynamic scenario of satellite and 5G fusion. For example, traditional satellite communication encryption schemes focus on key synchronization under long latency, but cannot cope with encryption state disruption caused by high-frequency switching of 5G networks; although the encryption mechanism of 5G networks can guarantee high-speed transmission security, it is easy to consume too many bandwidth resources due to redundant encryption in the narrow bandwidth and high error environment of satellite networks, resulting in delay in transmission of critical data. At the same time, shipborne data types are diverse (such as navigation instructions, entertainment videos and operation data), and the sensitivity and transmission needs differ significantly. Using a unified encryption strategy can cause 'over-encryption' or 'insufficient encryption' - the former increases the terminal computing power burden and transmission latency, and the latter poses a security risk. In addition, the encryption connection problem during network switching has not been effectively solved. When a ship enters a satellite coverage area from a 5G coverage area, the synchronization delay of the encryption key may cause data transmission interruption or security vulnerabilities, affecting communication continuity.

[0004] With the large-scale application of satellite and 5G fusion networks, the adaptability, flexibility and security of data encryption transmission have become key bottlenecks restricting the development of shipborne communication. Existing technologies lack a layered encryption mechanism tailored to the characteristics of fusion networks, and cannot dynamically adjust the encryption strategy according to network conditions (such as bandwidth, latency and error rate); the key management system also does not take into account the computing power limitations and network fluctuations of marine equipment, resulting in delayed key updates or failed distribution. These problems not only affect the user experience of shipborne communication, but also pose a potential threat to maritime navigation safety. Therefore, there is an urgent need for a shipborne communication data encryption transmission scheme that can adapt to satellite 5G fusion networks and balance security and transmission efficiency. SUMMARY

[0005] The application provides a shipborne communication data encryption transmission method and system based on a satellite 5G fusion network to solve the problems in the prior art.

[0006] To achieve the above-mentioned purpose, the application adopts the following technical scheme: a shipborne communication data encryption transmission method based on a satellite 5G fusion network, comprising:

[0007] The data classification and priority division step: classifying the shipborne data to be transmitted according to the service type, including navigation instruction data, real-time monitoring video data, crew communication data, ship operation data and entertainment and leisure data; dividing the priority through a preset rule, wherein the navigation instruction data priority is marked as P1, the real-time monitoring video data and the crew communication data are marked as P2, the ship operation data is marked as P3, and the entertainment and leisure data is marked as P4; adding a timestamp, data size and service identification information to each type of data to form a structured data unit;

[0008] The encryption strategy selection step: selecting an encryption algorithm according to the data priority and sensitivity; the P1-level data adopts a "hybrid strategy" of asymmetric encryption + symmetric encryption, first encrypting the symmetric key through the RSA algorithm, and then encrypting the data body through the AES-256 algorithm; the P2-level data is encrypted through the AES-128 algorithm, the P3-level data is encrypted through the DES algorithm, and the P4-level data is encrypted through the TEA algorithm; a random salt value is added to all encryption processes to avoid the same plaintext from producing the same ciphertext after encryption;

[0009] The fusion network transmission path selection step: collecting the state parameters of the satellite network and the 5G network in real time, including the instantaneous bandwidth, transmission delay and error rate of the satellite network, and the signal strength, available bandwidth and switching delay of the 5G network; selecting a path according to the data priority: the P1 / P2-level data preferentially selects a path with a low error rate, and when the satellite error rate is less than or equal to 5*10 -7 -100dBm, the satellite network is selected, otherwise the 5G network is selected; the P3 / P4-level data preferentially selects a path with a high bandwidth, and when the available bandwidth of the 5G network is greater than or equal to 15Mbps, the 5G network is preferentially selected, otherwise the satellite network is selected; the network identification is added to the path selection result and written into the data header;

[0010] The real-time encryption transmission step: the encrypted ciphertext is fragmented according to the network transmission unit MTU, the fragmentation size of the satellite network is set to 1024 bytes, and the fragmentation size of the 5G network is set to 1500 bytes; the sequence number, check code and retransmission identification are added to each fragment; the data is forwarded through the fusion gateway, the forward error correction coding FEC is enabled during the satellite network transmission, and the HARQ mechanism is enabled during the 5G network transmission; the fragment sending time, receiving confirmation time and packet loss are recorded in real time during the transmission process;

[0011] Transmission state monitoring and dynamic adjustment step: monitor the data transmission state every 100 ms, including packet loss rate, transmission delay fluctuation, and encryption key synchronization state; when the packet loss rate exceeds the limit, automatically adjust the fragmentation size and increase the FEC coding efficiency; when network switching is detected, suspend the current transmission, synchronize the encryption state through pre-shared keys, and resume transmission from the breakpoint after switching is completed; set a transmission timeout threshold for P1 level data, and trigger the backup path when the timeout is exceeded;

[0012] Decryption and integrity verification step: the receiving end receives the ciphertext, first verifies the network identifier and fragment sequence number in the data header; decrypts according to the corresponding encryption algorithm and key, and removes the salt value; verifies the data integrity through the check code, if the verification fails, requests the sender to retransmit the corresponding fragment; for P2 level video data, frame level verification is used;

[0013] Key update and management step: establish a key life cycle management mechanism, the effective period of asymmetric key RSA is 7 days, and the effective period of symmetric key AES / DES is dynamically adjusted according to the data priority; distribute new keys through the key distribution center KDC, and the distribution process uses end-to-end encryption; the keys are stored in the hardware security module HSM of the shipborne terminal, and plaintext export is prohibited; when the key leakage risk is detected, trigger the emergency key update.

[0014] Further, it also includes:

[0015] Dynamic key strength adjustment step and transmission redundancy control step: adjust the encryption key length in real time according to the data sensitivity coefficient and network security level, the sensitivity coefficient S is determined by the data type, the network security level L is determined by the threat detection result, the key length adjustment coefficient K=SxL, when K≥0.6, the AES key is upgraded to 256 bits, 0.3≤K<0.6 remains 128 bits, and K<0.3 reduces to 64 bits; the transmission redundancy control step calculates the redundancy through the formula R=αx(1 / B)+βxD, where R is the redundancy packet ratio, α is the bandwidth weight, B is the real-time bandwidth, β is the time delay weight, and D is the transmission time delay; the redundancy packet and the original data packet use different encryption keys, when the network is congested, R automatically increases to 0.3-0.5; when the network is smooth, R decreases to 0-0.1.

[0016] Network switching encryption synchronization step and cross-network data verification step: when the satellite and the 5G network are switched, the encryption state is maintained through the pre-synchronization mechanism: 100 ms before switching, the sending end generates a switching key Kswitch and sends it to the receiving end through the control channel, and the receiving end verifies the validity of Kswitch and enables the temporary encryption mode; during the switching process, the uncompleted transmission fragments are encrypted using Kswitch; the cross-network data verification step is used to verify the consistency of the satellite and 5G network transmission data, and the comprehensive verification value is calculated through the formula C = ∑(hi×wi) / ∑wi, wherein hi is the hash value of the i-th network transmission data, and wi is the weight of the network; when the deviation of the comprehensive verification value from the original hash value of the sending end is ≤2 -256 , it is determined that the data is consistent; when the deviation exceeds the limit, the network data with high weight is selected as the reference, and the inconsistent fragments of the other network are requested to be retransmitted.

[0017] Further, the data classification and priority division step further includes a dynamic priority adjustment mechanism: real-time monitoring of the ship operation state, collecting sailing parameters through on-board sensors, when the ship is in an emergency state, the crew communication data P2 priority is raised to P1, and the ship operation data P3 is raised to P2, and the duration of the promotion is 3 minutes after the emergency state is removed; monitoring the emergency degree of data transmission, identifying emergency data through the emergency identification field in the data header, temporarily raising the priority of P3 level data marked as emergency to P2; after priority adjustment, it is automatically synchronized to the encryption strategy selection step and the transmission path selection step, and the synchronization process is realized through an internal message queue to ensure that the encryption strength and the transmission path are adapted; the adjustment record is written into the data log.

[0018] Further, the encryption strategy selection step further includes encryption algorithm adaptive optimization: for the fluctuation of the on-board terminal computing power, the encryption algorithm complexity is automatically reduced, and the AES algorithm is switched from the CBC mode to the ECB mode; when the terminal computing power is sufficient, double encryption is enabled for P1 / P2 level data; the encryption efficiency is calculated in real time during the encryption process, and the hardware acceleration module is triggered when the efficiency < 1 Mbps; all encryption parameters are recorded in the encryption configuration table, which allows remote query and prohibits modification.

[0019] Further, the fusion network transmission path selection step further includes a load balancing mechanism: when the satellite network and the 5G network both meet the transmission conditions, P3 / P4 level data is allocated to the two networks in proportion, and the allocation proportion is calculated according to the network load rate, the load rate L = current bandwidth occupancy / maximum bandwidth, the 5G network allocation proportion = 1-L5G / (L5G+Lsat), and the satellite network allocation proportion = 1-Lsat / (L5G+Lsat); the continuity of the same service data is maintained during the allocation process, and the data is suspended when the network load rate > 80%.

[0020] Further, the key update and management step further includes a key leakage emergency treatment: a key abnormal use monitoring mechanism is established, when it is detected that the same key is used simultaneously in different terminals, it is determined that the key is leaked; an emergency response is triggered immediately, including: broadcasting a key revocation instruction to all terminals, generating an emergency key pool, distributing the emergency key according to the terminal ID, each terminal only receives one group, and immediately enables and feeds back after receiving.

[0021] A system for implementing a shipborne communication data encryption transmission method based on a satellite 5G fusion network, comprising:

[0022] A data classification module: for classifying and prioritizing shipborne data, including a service type identification component, a priority marking component, and a data structuring component; the service type identification component identifies the data type through deep packet inspection (DPI) technology and analyzes the protocol identifier in the data header; the priority marking component marks the data with P1-P4 priority according to the preset rules, and dynamically adjusts the priority in an emergency state through a ship state sensor; the data structuring component adds a timestamp, data size, and service identifier to the data to form a standard data unit;

[0023] An encryption processing module: for selecting an encryption strategy and performing encryption operations according to the data priority, including an algorithm selection component, a key management component, and an encryption execution component; the algorithm selection component calls the corresponding encryption algorithms RSA, AES, DES, and TEA according to the data priority, and dynamically adjusts the algorithm complexity according to the terminal computing power; the key management component generates a random salt value, manages the key life cycle, stores the key through a hardware security module (HSM), and prohibits plaintext derivation; the encryption execution component encrypts the data according to the algorithm;

[0024] A fusion transmission module: for selecting a satellite / 5G network path and transmitting encrypted data, including a network state monitoring component, a path selection component, and a data forwarding component; the network state monitoring component collects the parameters of the satellite network and the 5G network in real time; the path selection component selects the transmission path according to the data priority and the network parameters, generates the path selection result and adds the network identifier; the data forwarding component fragments the ciphertext according to the MTU, adds the sequence number, the check code, and the retransmission identifier, and forwards it through the fusion gateway, enables the FEC for satellite transmission, and enables the HARQ for 5G transmission;

[0025] A state monitoring module: for monitoring the transmission state and dynamically adjusting the strategy, including a transmission quality monitoring component, a network switching processing component, and a parameter adjustment component; the transmission quality monitoring component monitors the packet loss rate, the delay fluctuation, and the key synchronization state every 100ms, and generates a quality report; the network switching processing component detects the network switching event and triggers the encryption state synchronization; the parameter adjustment component adjusts the fragmentation size, the FEC coding efficiency, and the number of retransmissions according to the quality report;

[0026] Decryption and verification module: used for receiving end decryption and integrity verification, including ciphertext receiving component, decryption execution component and integrity verification component; the ciphertext receiving component receives the fragmented data, verifies the serial number and network identifier, and recombines the complete ciphertext; the decryption execution component calls the corresponding algorithm and key decryption, removes the salt value, and restores the plaintext; the integrity verification component verifies the data integrity through the CRC32 check code, and requests retransmission when it fails, and frame-level verification is adopted for video data, and non-critical frame loss is allowed;

[0027] Key management module: used for key generation, distribution and update, including key generation component, distribution component and emergency processing component; the key generation component generates asymmetric key RSA2048 and symmetric key AES / DES according to the period, and introduces random noise in the generation process; the distribution component distributes the key through KDC, and adopts ECC encryption transmission; the emergency processing component monitors the key leakage risk and triggers emergency update.

[0028] Further, it further comprises:

[0029] Dynamic key strength adjustment module and transmission redundancy control module: including sensitive coefficient calculation component and key length adaptation component, the sensitive coefficient calculation component calculates S value according to data type, the network security level evaluation component determines L value according to threat detection result, and the adjustment coefficient is calculated through K=S*L; the key length adaptation component adjusts the AES key length according to the K value; the transmission redundancy control module includes redundancy calculation component and redundant data packet generation component, the redundancy calculation component calculates the redundancy ratio through R=alpha*(1 / B)+beta*D, alpha=0.6, beta=0.4, B is the real-time bandwidth Mbps, and D is the transmission delay seconds; the redundant data packet generation component generates the redundant packet with different key from the original data packet, R=0.3-0.5 when the network is congested, R=0-0.1 when the network is smooth, the redundant packet and the original data packet are synchronously transmitted, and the receiving end selects the optimal one.

[0030] Network switching encryption synchronization module and cross-network data verification module: including switching key generation component and encryption state synchronization component, the switching key generation component generates Kswitch 100ms before network switching, and sends it through the control channel; the encryption state synchronization component verifies the validity of Kswitch, and enables the temporary encryption mode; the cross-network data verification module includes hash calculation component and comprehensive verification component, the hash calculation component calculates SHA-256 hash value hi for the data transmitted by the satellite and 5G respectively; the comprehensive verification component calculates the comprehensive verification value C=∑(hi*wi) / ∑wi, and when the deviation from the original hash value is ≤2 -256 , it is determined to be consistent, otherwise, the inconsistent fragments are requested to be retransmitted.

[0031] Compared with the existing technology, the beneficial effects of the present application are:

[0032] By adopting a hierarchical encryption strategy for different priority data (such as navigation instructions, entertainment data), high-sensitivity data is provided with high-strength encryption protection, and low-sensitivity data is selected with a lightweight encryption algorithm, which not only ensures that critical information is not stolen or tampered with, but also avoids unnecessary computing power and bandwidth consumption. The dynamic key management mechanism can adjust the key length and update period in real time according to the network state and data characteristics, reducing the risk of key leakage and improving the anti-attack ability of the encryption system.

[0033] The system performs excellently in terms of network adaptability. In view of the differences in characteristics such as latency, bandwidth, and error rate between satellite and 5G networks, differentiated encryption transmission strategies are designed: in 5G networks, encryption speed is optimized to match high-bandwidth transmission, and in satellite networks, encryption redundancy is enhanced to cope with high-error environments. The encryption synchronization mechanism during network switching ensures seamless connection of key states, avoids data transmission interruption or security vulnerabilities, and guarantees communication continuity.

[0034] This scheme can also improve the overall efficiency and economy of shipborne communication. By intelligently selecting encryption algorithms and transmission paths, the impact of encryption on transmission latency is reduced under the premise of ensuring security, meeting the timeliness requirements of real-time monitoring, navigation instructions, and other services. At the same time, hierarchical encryption reduces unnecessary encryption operations, reducing the energy consumption and computing burden of shipborne terminals and prolonging the device's endurance time. In addition, precise utilization of satellite bandwidth resources (such as reducing redundant encryption data) helps to reduce satellite communication costs, bringing actual cost benefits to ship companies and crew.

[0035] In terms of application scalability, the system supports various shipborne business scenarios such as maritime supervision, marine tourism, and ocean transportation, and can flexibly adjust encryption strategies according to different communication needs, providing comprehensive and adaptive security protection for maritime communication, promoting the large-scale application and industrial development of shipborne satellite 5G fusion networks. BRIEF DESCRIPTION OF DRAWINGS

[0036] Figure 1 A schematic block diagram of a shipborne communication data encryption transmission system based on a satellite 5G fusion network according to the present application;

[0037] Figure 2 A schematic block diagram of a shipborne communication data encryption transmission method based on a satellite 5G fusion network according to the present application;

[0038] Figure 3 A satellite and 5G network performance comparison diagram under different offshore distances for shipborne communication data encryption transmission based on a satellite 5G fusion network according to the present application;

[0039] Figure 4The figure shows the demand of different service types on the ship for the satellite 5G fusion network based on the shipboard communication data encryption transmission of the application. DETAILED DESCRIPTION

[0040] The technical solutions in the embodiments of the application will be clearly and completely described below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, rather than all the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the application.

[0041] In the description of the application, it should be understood that the terms "center", "longitudinal", "transverse", "length", "width", "thickness", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", "clockwise", "counterclockwise" and the like indicate the orientation or positional relationship shown in the drawings, and are only used to facilitate the description of the application and simplify the description, and do not indicate or imply that the device or element referred to must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as a limitation on the application.

[0042] In addition, the terms "first", "second" are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined with "first", "second" can explicitly or implicitly include one or more of the features. In the description of the application, the meaning of "multiple" is two or more, unless otherwise specifically limited. In addition, the terms "mounting", "connecting", "connecting" should be broadly understood, for example, it can be fixedly connected, or it can be detachably connected, or integrally connected; it can be mechanically connected, or it can be electrically connected; it can be directly connected, or it can be indirectly connected through an intermediate medium, or it can be the communication between two elements. For those skilled in the art, the specific meaning of the above terms in the application can be understood according to the specific circumstances, and the application will be further described in detail below with reference to the drawings.

[0043] Reference Figures 1 to 4 A satellite 5G fusion network based shipboard communication data encryption transmission method, comprising the following steps:

[0044] Data classification and priority division step: classify the data to be transmitted on the ship by service type, including navigation instruction data, real-time monitoring video data, crew communication data, ship operation data and entertainment and leisure data; the priority is divided by pre-set rules, among which the navigation instruction data has the highest priority (marked as P1), the real-time monitoring video data and the crew communication data come second (marked as P2), the ship operation data has a medium priority (marked as P3), and the entertainment and leisure data has the lowest priority (marked as P4); a timestamp, data size and business identification information are added to each type of data to form a structured data unit.

[0045] Encryption strategy selection step: select an encryption algorithm according to the data priority and sensitivity: P1-level data adopts a "asymmetric encryption + symmetric encryption" hybrid strategy, first encrypts the symmetric key through the RSA algorithm (key length 2048 bits), and then encrypts the data body using the AES-256 algorithm; P2-level data is encrypted using the AES-128 algorithm, and the key is dynamically updated every 30 minutes; P3-level data is encrypted using the DES algorithm, and the key is updated every 2 hours; P4-level data uses a lightweight encryption algorithm (such as TEA) to reduce terminal computing power consumption; a random salt value (length 16 bytes) is added to all encryption processes to avoid the same plaintext from producing the same ciphertext after encryption.

[0046] Fusion network transmission path selection step: real-time collection of state parameters of satellite network and 5G network, including instantaneous bandwidth (≥2 Mbps), transmission delay (≤500 ms), error rate (≤10 -6 of satellite network, signal strength (≥-90 dBm), available bandwidth (≥10 Mbps), and handover delay (≤50 ms) of 5G network; select a path according to the data priority: P1 / P2-level data preferentially selects a path with a low error rate, and when the satellite error rate is ≤5×10 -7 and the 5G signal strength is < -100 dBm, the satellite network is selected, otherwise the 5G network is selected; P3 / P4-level data preferentially selects a path with a high bandwidth, and when the 5G available bandwidth is ≥15 Mbps, the 5G network is preferentially selected, otherwise the satellite network is selected; the network identifier is added to the path selection result and written into the data header.

[0047] Real-time encryption transmission step: the encrypted ciphertext is fragmented according to the maximum transmission unit (MTU) of the network, the fragmentation size of the satellite network is set to 1024 bytes, and the fragmentation size of the 5G network is set to 1500 bytes; each fragment is attached with a serial number, a check code (using the CRC32 algorithm) and a retransmission identifier; the data is forwarded through the fusion gateway, the forward error correction coding (FEC) is enabled during satellite network transmission, and the coding efficiency is 1 / 2, the HARQ mechanism is enabled during 5G network transmission, and the maximum number of retransmissions is 3; the transmission time, the reception confirmation time and the packet loss are recorded in real time during the transmission process.

[0048] Transmission state monitoring and dynamic adjustment step: monitor the data transmission state every 100 ms, including packet loss rate (P1 / P2 level allowed <=1%, P3 / P4 level allowed <=5%), transmission delay fluctuation (<=20%) and encryption key synchronization state; when the packet loss rate is out of limit, automatically adjust the fragmentation size (satellite network to 512 bytes, 5G network to 1000 bytes) and increase the FEC coding efficiency (to 3 / 4); when network switching is detected (such as switching from 5G to satellite), immediately suspend the current transmission, synchronize the encryption state through the pre-shared key, and resume transmission from the breakpoint after switching is completed; set a transmission timeout threshold (<=500 ms) for P1 level data, and trigger a backup path (such as satellite and 5G dual launch) after timeout.

[0049] Decryption and integrity verification step: the receiving end receives the ciphertext, first verifies the network identifier and fragmentation sequence number in the data header to ensure that the fragmentation is complete and in order; decrypt according to the corresponding encryption algorithm and key, and remove the salt value; verify the data integrity through the check code, if the verification fails, request the sending end to retransmit the corresponding fragmentation (maximum of 3 times); for P2 level video data, frame level verification is used, allowing individual non-key frames to be lost (<=3 frames / second), to avoid frequent retransmission affecting real-time performance.

[0050] Key update and management step: establish a key life cycle management mechanism: the effective period of asymmetric key (RSA) is 7 days, and the effective period of symmetric key (AES / DES) is dynamically adjusted according to the data priority (P1 level 30 minutes, P2 level 1 hour, P3 level 2 hours, P4 level 4 hours); distribute new keys through the key distribution center (KDC), and the distribution process uses end-to-end encryption (based on ECC algorithm, key length 256 bits); the key is stored in the hardware security module (HSM) of the shipborne terminal, and plaintext derivation is prohibited; when the key leakage risk is detected (such as 3 consecutive decryption failures), emergency key update is triggered immediately, and the whole terminal key replacement is completed within 5 minutes.

[0051] In the present application, it also includes:

[0052] Dynamic key strength adjustment and transmission redundancy control: The dynamic key strength adjustment adjusts the encryption key length in real time according to the data sensitivity coefficient and the network security level: the sensitivity coefficient S is determined by the data type (navigation instruction S = 0.9, video data S = 0.7, entertainment data S = 0.3), the network security level L is determined by the threat detection result (no threat L = 1.0, potential threat L = 0.7, high threat L = 0.4), and the key length adjustment coefficient K = S x L, when K ≥ 0.6, the AES key is upgraded to 256 bits, 0.3 ≤ K < 0.6, remains 128 bits, and K < 0.3, reduces to 64 bits (only for P4 level data). The transmission redundancy control step calculates the redundancy by the formula R = a x (1 / B) + β x D, where R is the redundancy packet ratio (0-0.5), a is the bandwidth weight (0.6), B is the real-time bandwidth (unit: Mbps), β is the time delay weight (0.4), D is the transmission time delay (unit: seconds), and the redundant data packets and the original data packets use different encryption keys, when the network is congested (B < 5 Mbps), R is automatically increased to 0.3-0.5, to ensure the data anti-packet loss ability; when the network is smooth (B ≥ 20 Mbps), R is reduced to 0-0.1, to reduce bandwidth waste.

[0053] Network switching encryption synchronization and cross-network data verification: The network switching encryption synchronization step maintains the encryption state when the satellite and the 5G network switch through the pre-synchronization mechanism: 100 ms before switching, the sending end generates a switching key Kswitch (based on the current key and network identification hash generation), and sends it to the receiving end through the control channel, and the receiving end verifies the validity of Kswitch (the check value matches and the generation time is < 50 ms) and enables the temporary encryption mode (for 200 ms); during the switching process, the fragments not completed are encrypted with Kswitch to ensure the continuity of the ciphertext before and after the switching. The cross-network data verification step is used to verify the consistency of the satellite and 5G network transmission data, and the comprehensive check value is calculated by the formula C = ∑(hi x wi) / ∑wi, where hi is the hash value of the i-th network transmission data (using SHA-256 algorithm), wi is the weight of the network (5G network w = 0.7, satellite network w = 0.3, dynamically adjusted according to the real-time error rate), when the deviation of the comprehensive check value and the original hash value of the sending end is ≤2 -256 , the data is consistent; when the deviation is out of limit, the network data with high weight is selected as the reference, and the inconsistent fragments of the other network are requested to be retransmitted.

[0054] In the application, the data classification and priority division step further comprises a dynamic priority adjustment mechanism: real-time monitoring of the ship operation state, collecting sailing parameters through on-board sensors (such as GPS positioning module, emergency button sensor, fault diagnosis system), when the ship is in an emergency state (such as GPS positioning display deviating from the route ≥ 5 nautical miles, emergency button triggered, fault diagnosis system reporting a first level alarm), the crew communication data (original P2) priority is immediately promoted to P1, and the ship operation data (original P3) is promoted to P2, and the promotion duration is 3 minutes after the emergency state is removed; monitoring the emergency degree of data transmission, identifying emergency data through the "emergency identifier" field (1-bit binary, 1 indicating emergency) in the data header, temporarily promoting the priority of P3 level data marked "emergency" (such as engine fault alarm, cabin water leakage monitoring data) to P2, the duration is 5 minutes, during which it is prohibited to be covered by other adjustments; after priority adjustment, it is automatically synchronized to the encryption strategy selection step and the transmission path selection step, the synchronization process is realized through an internal message queue, the message delay is ≤ 50 ms, ensuring that the encryption strength (such as P3 level promotion using AES-128 algorithm) and the transmission path (such as preferentially selecting a low error rate path) are adapted accordingly; adjustment records are written into a tamper-proof data log, each record contains adjustment time (accurate to milliseconds), trigger reason (such as "emergency button trigger"), original priority, new priority and adjuster (system automatically marked as "automatic adjustment"), the log adopts a chain encryption mechanism, that is, the hash value (SHA-256) of each log contains the ciphertext of the previous log, and the log file only allows append write, prohibits deletion or modification of historical records, ensuring that the adjustment process is traceable.

[0055] In the application, the encryption strategy selection step further comprises adaptive optimization of encryption algorithm: for on-board terminal computing power fluctuations (such as CPU occupancy rate > 80%), automatically reduce the encryption algorithm complexity, AES algorithm switches from CBC mode to ECB mode (only P3 / P4 level data), reduce the operation time consumption; when the terminal computing power is sufficient (CPU occupancy rate < 30%), enable double encryption (first AES-256 encryption, then SM4 algorithm secondary encryption) for P1 / P2 level data, improve the security level; real-time calculation of encryption efficiency (number of encrypted bytes per second) during encryption, when the efficiency < 1 Mbps (P1 level data), trigger the hardware acceleration module (such as GPU encryption engine), ensure that the encryption speed is not lower than the data generation speed; all encryption parameters (mode, key length, acceleration state) are recorded in the encryption configuration table, allowing remote query but prohibiting modification.

[0056] In the application, the fusion network transmission path selection step further comprises an intelligent load balancing mechanism: when both the satellite network and the 5G network meet the transmission conditions (P1 level data error rate ≤ 10 -6), the P3 / P4 level data is proportionally distributed to two networks, the distribution proportion is calculated according to a network load rate, the load rate L = current bandwidth occupation / maximum bandwidth, the 5G network distribution proportion = 1 - L5G / (L5G + Lsat), and the satellite network distribution proportion = 1 - Lsat / (L5G + Lsat), so that the network with a high load rate bears a smaller amount of data; the continuity of the same service data is maintained during the distribution process, for example, the fragments of the same video stream are not transmitted across networks; when the load rate of a certain network is greater than 80 %, the distribution of data to the network is suspended until the load rate is reduced to below 60 %; the load balancing decision is updated once every 500 ms, so that frequent adjustment is avoided.

[0057] In the application, the key updating and management step further comprises key leakage emergency treatment: a key abnormal use monitoring mechanism is established, and when it is detected that the same key is used simultaneously in different terminals (time difference < 100 ms and terminal distance > 10 km), it is determined that the key is leaked; an emergency response is triggered immediately, including: 1) a key revocation instruction is broadcast to all terminals (using an encrypted channel, and the instruction is valid for 10 s); 2) an emergency key pool is generated (containing 10 groups of temporary keys, and each group of keys is encrypted by an ECC algorithm); 3) the emergency keys are distributed according to the terminal ID, and each terminal only receives one group, and immediately enables and feeds back the confirmation after receiving; 4) the key system of the whole system is reset within 24 hours (all sub-keys are derived from the root key); the whole process of the emergency treatment is recorded, including the leakage time, the involved terminals, the key revocation time consumption and the reset completion time, and the record is backed up by offline storage (such as a local hard disk on the ship) to prevent remote tampering.

[0058] The application further discloses a system of a shipborne communication data encryption transmission method based on a satellite 5G fusion network.

[0059] The data classification module is used for classifying and prioritizing the shipborne data, and comprises a service type identification component, a priority marking component and a data structuring component; the service type identification component identifies the data type by using a deep packet inspection (DPI) technology, analyzes the protocol identifier in the data header (for example, navigation data adopts an NMEA protocol, and video data adopts an RTSP protocol), and the identification accuracy is greater than or equal to 98 %; the priority marking component marks the data with P1-P4 priorities according to preset rules (for example, the rules in claim 1), and dynamically adjusts the priorities in an emergency state by using a ship state sensor (for example, an emergency button signal); and the data structuring component adds a timestamp (accurate to milliseconds), a data size (number of bytes) and a service identifier (16-bit coding) to the data, so as to form a standard data unit, and facilitate subsequent encryption and transmission.

[0060] Encryption processing module: used for selecting encryption strategy according to data priority and performing encryption operation, containing algorithm selection component, key management component and encryption execution component; algorithm selection component calls corresponding encryption algorithm (RSA, AES, DES, TEA) according to data priority, and dynamically adjusts algorithm complexity according to terminal computing power (CPU occupancy rate); key management component generates random salt value (16 bytes), manages key life cycle (sets effective period according to priority), stores key through hardware security module (HSM), and prohibits plaintext derivation; encryption execution component encrypts data according to algorithm, outputs ciphertext and encryption parameters (algorithm type, key ID, salt value), and encryption speed satisfies: P1 level data ≥ 5 Mbps, P4 level data ≥ 2 Mbps.

[0061] Fusion transmission module: used for selecting satellite / 5G network path and transmitting encrypted data, containing network state monitoring component, path selection component and data forwarding component; network state monitoring component collects parameters of satellite network (bandwidth, time delay, error rate) and 5G network (signal strength, available bandwidth, switching time delay) in real time, sampling frequency is 10 Hz; path selection component selects transmission path according to data priority and network parameters (as described in claim 1), generates path selection result and adds network identifier; data forwarding component fragments ciphertext according to MTU (satellite 1024 bytes, 5G 1500 bytes), adds sequence number, check code and retransmission identifier, forwards through fusion gateway, satellite transmission enables FEC, and 5G transmission enables HARQ.

[0062] State monitoring module: used for monitoring transmission state and dynamically adjusting strategy, containing transmission quality monitoring component, network switching processing component and parameter adjustment component; transmission quality monitoring component monitors packet loss rate, time delay fluctuation and key synchronization state every 100 ms, and generates quality report; network switching processing component detects network switching event, triggers encryption state synchronization (pre-shared key verification, breakpoint resume), and switching completion time is ≤ 100 ms; parameter adjustment component adjusts fragmentation size, FEC coding efficiency and retransmission number according to the quality report, and ensures that P1 / P2 level data packet loss rate is ≤ 1%.

[0063] Decryption and verification module: used for decrypting data at receiving end and verifying integrity, containing ciphertext receiving component, decryption execution component and integrity verification component; ciphertext receiving component receives fragmented data, verifies sequence number and network identifier, and recombines complete ciphertext; decryption execution component calls corresponding algorithm and key decryption, removes salt value, and restores plaintext; integrity verification component verifies data integrity through CRC32 check code, requests retransmission (at most 3 times) when failure occurs, adopts frame-level verification for video data, and allows a small amount of non-key frame loss.

[0064] Key management module: for key generation, distribution and update, including key generation component, distribution component and emergency processing component; the key generation component generates asymmetric key (RSA 2048 bits) and symmetric key (AES / DES) according to the period, and the generation process introduces random noise (based on terminal hardware entropy source); the distribution component distributes the key through KDC, and adopts ECC encryption transmission to ensure the safety of the distribution process; the emergency processing component monitors the key leakage risk, triggers emergency update, completes the whole terminal key replacement within 5 minutes, and records the emergency processing log.

[0065] In the application, the following are further included:

[0066] Dynamic key strength adjustment module and transmission redundancy control module: the dynamic key strength adjustment module includes a sensitive coefficient calculation component and a key length adaptation component, the sensitive coefficient calculation component calculates S value according to data type (navigation instruction 0.9, video 0.7, entertainment 0.3), the network security level evaluation component determines L value according to threat detection result (no threat 1.0, potential threat 0.7, high threat 0.4), and the adjustment coefficient is calculated through K=S*L; the key length adaptation component adjusts the AES key length according to K value (≥0.6, 256 bits; 0.3-0.6, 128 bits; <0.3, 64 bits), and the adjustment response time is ≤100 ms. The transmission redundancy control module includes a redundancy calculation component and a redundant data packet generation component, the redundancy calculation component calculates redundancy ratio through R=α×(1 / B)+β×D (α=0.6, β=0.4, B is real-time bandwidth Mbps, and D is transmission delay seconds); the redundant data packet generation component generates redundant packets with different keys from original data packets, R=0.3-0.5 when network is congested (B<5 Mbps), R=0-0.1 when network is smooth (B≥20 Mbps), the redundant packets and the original data packets are transmitted synchronously, and the receiving end selects the optimal one.

[0067] Network switching encryption synchronization module and cross-network data verification module: the network switching encryption synchronization module includes a switching key generation component and an encryption state synchronization component, the switching key generation component generates Kswitch (based on the current key and network identification hash) 100 ms before network switching, and sends it through the control channel; the encryption state synchronization component verifies the validity of Kswitch (the check value matches and the generation time is <50 ms), enables the temporary encryption mode (200 ms), and ensures the continuity of ciphertext before and after switching. The cross-network data verification module includes a hash calculation component and a comprehensive verification component, the hash calculation component calculates SHA-256 hash values hi for the data transmitted by the satellite and 5G respectively; the comprehensive verification component calculates the comprehensive verification value C=∑(hi×wi) / ∑wi (5G weight w=0.7, satellite w=0.3), when the deviation from the original hash value is ≤2 -256 , it is determined to be consistent, otherwise, retransmission is requested for inconsistent fragments, and the cross-network data consistency is ensured.

[0068] Embodiment 1: Offshore tourist ship satellite 5G fusion communication scenario (5G as the main, satellite as the auxiliary)

[0069] Embodiment 1: Offshore tourist ship satellite 5G fusion communication scenario (5G as the main, satellite as the auxiliary)

[0070] A certain coastal tourist ship carries two-axis 65 cm KU band and 5G fusion antenna (overall size φ810mm*920mm, protection level IP65), sailing in the offshore area 30km away from the shore, and needs to transmit navigation instructions, real-time monitoring video of tourists, crew communication and tourist entertainment data.

[0071] In the data classification and priority division step, the system identifies the data type through deep packet detection: navigation instructions (NMEA protocol) are marked as P1, deck monitoring video (RTSP protocol) and crew intercom data are marked as P2, ship fuel consumption report is marked as P3, and tourist live video is marked as P4. When the ship engine suddenly makes an abnormal sound (the fault diagnosis system reports a level 1 alarm), the system automatically sets the "emergency identifier" of the engine fault data (original P3) to 1, temporarily promotes it to P2, and lasts for 5 minutes. During this period, it is synchronized to the encryption and transmission module through the internal message queue, records the log "2024-07-1014:30:22 engine fault triggers priority adjustment, original P3→new P2", and generates a chain hash (containing the previous log ciphertext).

[0072] In the encryption strategy selection step, P1 level navigation instructions use RSA-2048 to encrypt AES-256 key (salt value 0x7a3f9d2b...), and then encrypt the data body; P2 level monitoring video uses AES-128 (key updated every 30 minutes), because the terminal CPU occupancy rate is 65% (sufficient computing power), double encryption (SM4 superimposed after AES) is enabled; P3 level fuel consumption report uses DES encryption; P4 level entertainment data uses TEA algorithm. The encryption efficiency is monitored in real time, and the encryption speed of P1 level reaches 8Mbps, which meets the navigation data generation speed (5Mbps).

[0073] In the fusion network transmission path selection step, the 5G module (working frequency band 1710-2690MHz, azimuth gain ≥4dBi) detects that the signal strength is-85dBm, and the available bandwidth is 25Mbps; the satellite module (KU band 10.7-12.75GHz, receiving gain ≥36.7dBi) instantaneous bandwidth 3Mbps, error rate 3×10 -7 P1 / P2 level data because 5G error rate (2×10 -8) lower, select 5G path; P3 / P4 level due to higher 5G bandwidth, load balancing distribution (5G load rate 30%, bear 70% data; satellite load rate 50%, bear 30%), the same tourist live stream does not cross network transmission.

[0074] In the real-time encryption transmission step, the 5G network is divided into 1500 byte fragments (with CRC32 check code), and HARQ (retransmission 2 times) is enabled; the satellite network is divided into 1024 byte fragments, and FEC (coding efficiency 1 / 2) is enabled. P2 level monitoring video fragment number 001-100, sending time interval 20ms, receiving confirmation time difference ≤50ms.

[0075] In the transmission state monitoring and dynamic adjustment step, 100ms interval monitoring shows that the 5G packet loss rate is 0.8% (normal), and the satellite packet loss rate is 2% (normal). When the ship sails to 45km from the shore, the 5G signal decreases to -105dBm, the system detects network switching, triggers encryption synchronization: generates Kswitch (based on the current AES key and satellite identification hash), sends it through the control channel, and the receiving end verifies its generation time (30ms < 50ms) to enable temporary encryption mode, and the untransmitted P2 level fragments (number 80-100) are encrypted with Kswitch, the switching time is 80ms, and the transmission is continued from the breakpoint.

[0076] In the decryption and integrity verification step, the receiving end reorganizes the P2 level video fragments, decrypts them, and then verifies them by frame level (allowing 1 frame / second to be lost), and requests retransmission (2 times successful) for the verification failed fragment 089.

[0077] In the key update and management step, the P1 level key is updated every 30 minutes, distributed by KDC (based on ECC-256); 3 consecutive decryption failures are detected, and the full terminal key replacement is completed within 5 minutes, and the emergency log is stored on the shipboard hard disk.

[0078] In dynamic key strength adjustment, engine fault data S = 0.7 (service sensitive), network threat L = 1.0, K = 0.7 x 1.0 = 0.7 >= 0.6, AES key is upgraded to 256 bits; tourist entertainment data S = 0.3, L = 1.0, K = 0.3, key is reduced to 64 bits. In transmission redundancy control, 5G bandwidth is 25Mbps, time delay is 0.05s, R = 0.6 x (1 / 25) + 0.4 x 0.05 = 0.024 + 0.02 = 0.044 (redundancy 4.4%); satellite bandwidth is 3Mbps, time delay is 0.5s, R = 0.6 x (1 / 3) + 0.4 x 0.5 = 0.2 + 0.2 = 0.4 (redundancy 40%). In cross-network verification, 5G transmission data hash h1 = 0x2f..., satellite h2 = 0x3a..., weight w1 = 0.7, w2 = 0.3, C = (0x2f x 0.7 + 0x3a x 0.3) / (0.7 + 0.3), deviation from original hash <= 2 -256 , consistent.

[0079] Example 2: Satellite 5G fusion communication scenario of far sea cargo ship (satellite as main, 5G as auxiliary)

[0080] A certain ocean cargo ship (carrying the same fusion antenna) sails in the open sea 200km away from the shore, mainly transmitting navigation instructions, cargo hold monitoring data, fault alarm and crew communication data.

[0081] In data classification, navigation instructions (P1), cargo hold temperature monitoring (P2), ship vibration data (emergency P3->P2), crew voice (P2). Since it is in the open sea, the 5G signal is -120dBm (unavailable), and the satellite network (KU band 13.75-14.5GHz, transmit gain >= 37.8dBi) is the main path.

[0082] In encryption strategy, P1 level uses RSA + AES-256, because the terminal CPU occupancy rate is 25% (sufficient), and SM4 encryption is superimposed; P2 level uses AES-128 (key updated every 30 minutes), and cargo hold monitoring data is sensitive S = 0.7, network potential threat L = 0.7, K = 0.49, and 128-bit key is maintained.

[0083] In transmission path selection, all data goes through satellite network, fragmentation 1024 bytes, FEC encoding efficiency 3 / 4 (because the packet loss rate is 5 x 10 -7 high). When the ship approaches an island (5G signal rises to -95dBm), the system will switch the crew's leisure video (P4) to 5G according to the P3 / P4 level priority switching principle, and the synchronization encryption state will be switched through Kswitch, which takes 90ms.

[0084] In transmission state monitoring, the satellite packet loss rate reached 3% (exceeding the P2 level threshold of 1%), the fragmentation was automatically adjusted to 512 bytes, the FEC efficiency was improved to 3 / 4, and the packet loss rate was reduced to 0.8%.

[0085] In key management, it was detected that the same key was used at the bow and stern terminals at the same time (time difference 50ms, distance 150m>10km), and it was determined that the key was leaked: broadcast the invalidation instruction (10s valid period), generate 10 groups of emergency keys (ECC encryption), distribute according to terminal ID, and complete the key system reset within 24 hours.

[0086] The performance comparison data is as follows:

[0087]

[0088]

[0089] The scheme of the present application is superior to the traditional scheme in encryption strength, switching continuity, resource utilization and emergency response. Example 1 (offshore) has the highest bandwidth utilization due to the efficient use of 5G; example 2 (far sea) still maintains high security through encryption optimization although it relies on satellites. The improvement of network switching encryption continuity is due to the Kswitch synchronization mechanism, and the fast key emergency response is due to the pre-generated key pool and chain log, which verifies the adaptability and security of the scheme in the integrated network, especially meeting the high reliability requirements of key data transmission in the shipborne scene.

[0090] Referring to Figure 3 The figure clearly shows the performance difference between satellite and 5G network at different offshore distances. In the near sea area (0-50km), 5G has a significant advantage, with a bandwidth 6-16 times that of satellite and a time delay only 1 / 5-1 / 13 that of satellite, which is suitable for high-speed and low-latency services (such as high-definition video monitoring). As the offshore distance increases, the 5G signal attenuates significantly, with a bandwidth of only 5Mbps at 100km and no coverage after 150km. While the satellite network has lower bandwidth (3-5Mbps) and higher time delay (250-290ms), it can stably cover the far sea area and meet the basic communication needs.

[0091] Referring to Figure 4 The chart system presents the differentiated needs of various types of services on the ship. Maritime supervision and marine law enforcement have very high requirements for time delay, reliability and security (all reaching level 4-5), and need to prioritize transmission stability and encryption strength; live streaming for sea tourism values bandwidth the most (level 5) and has lower security requirements; ship remote diagnosis needs to balance bandwidth and time delay; and daily communication needs of crew are relatively basic. This hierarchical demand provides a basis for resource scheduling of integrated networks—for example, allocating satellite / 5G high-priority channels and enabling double encryption for law enforcement video, and allocating large bandwidth resources for live streaming services in 5G coverage areas.

[0092] The above merely illustrates the preferred embodiments of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can make equivalent replacements or changes within the technical scope disclosed by the present application and according to the technical solutions and the inventive concept of the present application, which should be covered within the protection scope of the present application.

Claims

1. A shipborne communication data encryption transmission method based on a satellite 5G fusion network, characterized in that, Comprise: Data classification and priority division step: classify the shipborne data to be transmitted according to the service type; The priority is divided by the preset rule, wherein the navigation instruction data priority is marked as P1, the real-time monitoring video data and the crew communication data are marked as P2, the ship operation data is marked as P3, and the entertainment and leisure data is marked as P4; Time stamp, data size and service identification information are added to each type of data to form a structured data unit; The encryption strategy selection step: according to the data priority and the sensitivity, the encryption algorithm is selected: P1 level data adopts asymmetric encryption + symmetric encryption hybrid algorithm, first encrypts the symmetric key through RSA algorithm, and then encrypts the data body through AES-256 algorithm; P2 level data adopts AES-128 algorithm for encryption, P3 level data adopts DES algorithm for encryption, and P4 level data adopts TEA encryption algorithm; Random salt value is added to all encryption processes; Fusion network transmission path selection step: real-time acquisition of satellite network and 5G network state parameters; according to data priority selection path: P1 / P2 level data priority selection low error rate path, when satellite error rate ≤5×10 -7 -100dBm, otherwise select 5G network; P3 / P4 level data priority selection high bandwidth path; path selection result is attached with network identifier and written into data header; Real-time encryption transmission step: the encrypted ciphertext is fragmented according to the network transmission unit MTU; Each fragment is attached with a serial number, a check code and a retransmission identifier; Data forwarding is carried out through the fusion gateway, forward error correction coding FEC is enabled during satellite network transmission, and HARQ mechanism is enabled during 5G network transmission; The sending time, the receiving confirmation time and the packet loss are recorded in real time during the transmission process; Transmission state monitoring and dynamic adjustment step: the data transmission state is monitored regularly; When the packet loss rate is out of limit, the fragment size is automatically adjusted and the FEC coding efficiency is increased; When network switching is detected, the current transmission is suspended, the encryption state is synchronized through pre-shared key, and the transmission is resumed from the breakpoint after switching is completed; The transmission timeout threshold is set for P1 level data, and the standby path is triggered after timeout.

2. The method for shipborne communication data encryption transmission based on satellite 5G fusion network according to claim 1, characterized in that, Also include: Decryption and integrity checking step: after receiving the ciphertext, the receiving end verifies the network identifier and the fragment serial number in the data header first; According to the corresponding encryption algorithm and key, the salt value is removed after decryption; The data integrity is verified through the check code, if the verification fails, the corresponding fragment is requested to be retransmitted by the sending end; For P2 level video data, frame level verification is adopted; Key update and management step: a key life cycle management mechanism is established, the effective period of asymmetric key RSA is 7 days, and the effective period of symmetric key AES / DES is dynamically adjusted according to the data priority; New keys are distributed through key distribution center KDC, and the distribution process adopts end-to-end encryption; The keys are stored in the hardware security module HSM of the shipborne terminal, and the plaintext export is prohibited; When the key leakage risk is detected, the emergency key update is triggered; Dynamic key strength adjustment step and transmission redundancy control step: real-time adjustment of encryption key length according to data sensitivity coefficient and network security level, sensitivity coefficient S is determined by data type, network security level L is determined by threat detection result, key length adjustment coefficient K=S×L, when K≥0.6, AES key is upgraded to 256 bits, 0.3≤K<0.6, keep 128 bits, K<0.3, reduce to 64 bits; Transmission redundancy control step is calculated by formula R=α×(1 / B)+β×D, wherein R is the proportion of redundant data packets, α is the bandwidth weight, B is the real-time bandwidth, β is the time delay weight, D is the transmission time delay, the redundant data packets and the original data packets use different encryption keys, when the network is congested, R automatically rises to 0.3-0.5; When the network is smooth, R decreases to 0-0.

1.

3. The method for shipborne communication data encryption transmission based on satellite 5G fusion network according to claim 1, characterized in that, Also includes: Network switching encryption synchronization step and cross-network data verification step: when the satellite and the 5G network are switched, the encryption state is maintained through the pre-synchronization mechanism: 100 ms before switching, the sending end generates a switching key Kswitch and sends it to the receiving end through the control channel, and the receiving end verifies the validity of Kswitch and enables the temporary encryption mode; during the switching process, the uncompleted transmission fragments are encrypted using Kswitch; the cross-network data verification step is used to verify the consistency of the satellite and the 5G network transmission data, and the comprehensive verification value is calculated through the formula C = ∑(hi×wi) / ∑wi, wherein hi is the hash value of the i-th network transmission data, and wi is the weight of the network; when the deviation of the comprehensive verification value and the original hash value of the sending end is ≤2 -256 , it is determined that the data is consistent; when the deviation exceeds the limit, the network data with high weight is selected as the reference, and the inconsistent fragments of the other network are requested to be retransmitted.

4. The method for shipborne communication data encryption transmission based on satellite 5G fusion network according to claim 1, characterized in that, The data classification and priority division step also includes a dynamic priority adjustment mechanism: real-time monitoring of ship operation state, collecting navigation parameters through on-board sensors, when the ship is in emergency state, the crew communication data P2 priority is raised to P1, and the ship operation data P3 is raised to P2, and the promotion duration is 3 minutes after the emergency state is removed; Monitor the emergency degree of data transmission, identify emergency data through the emergency identification field in the data header, and temporarily raise the priority of P3 level data marked as emergency to P2; After priority adjustment, automatically synchronize to the encryption strategy selection step and the transmission path selection step, the synchronization process is realized through internal message queue to ensure that the encryption strength and transmission path are adapted; Adjustment record is written into data log.

5. The method for shipborne communication data encryption transmission based on satellite 5G fusion network according to claim 1, characterized in that, The encryption strategy selection step also includes encryption algorithm adaptive optimization: for the fluctuation of on-board terminal computing power, the encryption algorithm complexity is automatically reduced, and the AES algorithm is switched from CBC mode to ECB mode; When the terminal computing power is sufficient, double encryption is enabled for P1 / P2 level data; Real-time calculation of encryption efficiency during encryption, hardware acceleration module is triggered when efficiency<1Mbps; All encryption parameters are recorded in the encryption configuration table, which allows remote query and prohibits modification.

6. The method for shipborne communication data encryption transmission based on satellite 5G fusion network according to claim 1, characterized in that, The fusion network transmission path selection step also includes a load balancing mechanism: when the satellite network and the 5G network both meet the transmission conditions, P3 / P4 level data is allocated to the two networks in proportion, the allocation proportion is calculated according to the network load rate, the load rate L=the current bandwidth occupancy / the maximum bandwidth, the 5G network allocation proportion=1-L5G / (L5G+Lsat), the satellite network allocation proportion=1-Lsat / (L5G+Lsat); The continuity of the same service data is maintained during the allocation process, and the allocation of data is suspended when the network load rate is greater than 80%.

7. The shipborne communication data encryption transmission method based on the satellite 5G fusion network according to claim 2, characterized in that, The key update and management step also includes key leakage emergency handling: establish a key abnormal use monitoring mechanism, when the same key is detected to be used in different terminals at the same time, it is determined that the key is leaked; Immediately trigger emergency response, including: broadcasting key revocation instructions to all terminals, generating an emergency key pool, distributing emergency keys according to terminal ID, each terminal only receives one set, and immediately enables and feeds back after receiving.

8. A system for implementing the method for encrypted transmission of communication data on board a ship based on a satellite 5G converged network according to any one of claims 1-7, characterized in that, Includes: Data classification module: used for classification and priority division of shipborne data, including business type identification component, priority marking component and data structuring component; The business type identification component identifies the data type through deep packet inspection (DPI) technology and analyzes the protocol identifier in the data header; the priority marking component marks the data with P1-P4 priority according to the preset rules, and dynamically adjusts the priority through the ship state sensor in the emergency state; The data structuring component adds a timestamp, data size and business identifier to the data to form a standard data unit; Encryption processing module: used for selecting an encryption strategy and performing an encryption operation according to the data priority, including an algorithm selection component, a key management component and an encryption execution component; the algorithm selection component calls corresponding encryption algorithms RSA, AES, DES and TEA according to the data priority, and dynamically adjusts the algorithm complexity according to the terminal computing power; the key management component generates a random salt value, manages the key life cycle, stores the key through a hardware security module (HSM) and prohibits clear text derivation; the encryption execution component encrypts the data according to the algorithm; Fusion transmission module: used for selecting a satellite / 5G network path and transmitting encrypted data, including a network state monitoring component, a path selection component and a data forwarding component; the network state monitoring component collects the parameters of the satellite network and the 5G network in real time; the path selection component selects the transmission path according to the data priority and the network parameters, generates a path selection result and adds a network identifier; the data forwarding component fragments the ciphertext according to the MTU, adds a sequence number, a check code and a retransmission identifier, forwards through the fusion gateway, enables FEC for satellite transmission and enables HARQ for 5G transmission; State monitoring module: used for monitoring the transmission state and dynamically adjusting the strategy, including a transmission quality monitoring component, a network switching processing component and a parameter adjustment component; the transmission quality monitoring component monitors the packet loss rate, the delay fluctuation and the key synchronization state every 100 ms, and generates a quality report; the network switching processing component detects the network switching event and triggers the encryption state synchronization; the parameter adjustment component adjusts the fragmentation size, the FEC coding efficiency and the retransmission number according to the quality report; Decryption and verification module: used for decrypting the data at the receiving end and verifying the integrity, including a ciphertext receiving component, a decryption execution component and an integrity verification component; the ciphertext receiving component receives the fragmented data, verifies the sequence number and the network identifier, and recombines the complete ciphertext; the decryption execution component decrypts using the corresponding algorithm and key, removes the salt value and restores the plaintext; The integrity verification component verifies the data integrity through the CRC32 check code, requests retransmission when the verification fails, adopts frame-level verification for video data and allows non-key frame loss; Key management module: used for key generation, distribution and update, including a key generation component, a distribution component and an emergency processing component; the key generation component generates asymmetric keys RSA 2048 bits and symmetric keys AES / DES according to the period, and introduces random noise in the generation process; Also includes:

9. The satellite 5G converged network based shipborne communication data encryption transmission system according to claim 8, characterized in that, ​ Dynamic key strength adjustment module and transmission redundancy control module: including sensitive coefficient calculation component and key length adaptation component, sensitive coefficient calculation component calculates S value according to data type, network security level evaluation component determines L value according to threat detection result, adjusts coefficient through K=SxL calculation; Key length adaptation component adjusts AES key length according to K value; Transmission redundancy control module includes redundancy calculation component and redundant data packet generation component, redundancy calculation component calculates redundancy ratio through R=alpha x (1 / B)+beta x D, alpha=0.6, beta=0.4, B is real-time bandwidth Mbps, D is transmission delay seconds; Redundant data packet generation component generates redundant packet with different key from original data packet, R=0.3-0.5 when network is congested, R=0-0.1 when network is smooth, redundant packet and original data packet are synchronously transmitted, and receiver selects the optimal one.

10. The satellite 5G converged network based shipborne communication data encryption transmission system according to claim 8, characterized in that, Also includes: Network switching encryption synchronization module and cross-network data verification module: contains switching key generation component and encryption state synchronization component, the switching key generation component generates Kswitch 100ms before network switching, and sends it through the control channel; the encryption state synchronization component verifies the validity of Kswitch, and enables the temporary encryption mode; the cross-network data verification module contains a hash calculation component and a comprehensive verification component, the hash calculation component calculates SHA-256 hash values hi for the data transmitted by the satellite and 5G respectively; the comprehensive verification component calculates the comprehensive verification value C=∑(hi×wi) / ∑wi, and when the deviation from the original hash value is ≤2 -256 , it is determined to be consistent, otherwise, retransmission of inconsistent fragments is requested.

Images