Intelligent tamper alarm and data self-destruction protection terminal equipment system

Abstract

The invention discloses an intelligent tamper alarm and data self-destruction protection terminal equipment system, which relates to the technical field of data security, and comprises a sensor detection module, an environment sensing module, an operation recording module, a data summarization module, a data analysis module and a risk assessment module. In combination with the environment sensing module, the physical state and surrounding environment information of the equipment can be comprehensively and accurately collected, meanwhile, the operation recording module records all operation behaviors of the equipment in detail, the data analysis module carries out deep analysis on the data through an advanced algorithm, and the risk assessment module can calculate risk coefficients according to the comprehensive data. Therefore, the state of the current terminal equipment can be analyzed according to the risk coefficient, normal operation or environment change is effectively prevented from being misjudged as a disassembly or intrusion behavior, the false alarm rate is remarkably reduced, and unnecessary troubles brought to a user due to false alarm are reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of data security, and in particular to an intelligent anti-disassembly alarm and data self-destruction protection terminal equipment system. Background Art

[0002] With the rapid development of information technology, various intelligent devices have been widely used in people's lives and work. However, these devices also face many security threats, such as theft, illegal disassembly, data leakage, etc. Especially in some fields with extremely high security requirements, such as military, finance, scientific research, etc., it is very important to ensure the physical security and data security of the devices;

[0003] The existing terminal equipment systems with anti-dismantling alarm and data self-destruction protection are prone to false alarms when working, and may misjudge normal operations or environmental changes as disassembly or intrusion behaviors, thereby causing unnecessary troubles to users. In addition, the existing data self-destruction method may not completely ensure that the data is completely destroyed, and there is a risk of data recovery. Moreover, the existing technology may have self-destruction startup defects, and the data self-destruction terminal may be maliciously started. There is a lack of encryption protection for the startup instructions of the data self-destruction protection terminal. For this reason, we propose an intelligent anti-dismantling alarm and data self-destruction protection terminal equipment system. Summary of the invention

[0004] The object of the present invention is to provide an intelligent anti-disassembly alarm and data self-destruction protection terminal equipment system.

[0005] In order to solve the problems raised in the above background technology, the present invention provides the following technical solutions: an intelligent anti-disassembly alarm and data self-destruction protection terminal device system, the intelligent anti-disassembly alarm and data self-destruction protection terminal device system includes a sensor detection module, an environment perception module, an operation recording module, a data aggregation module, a data analysis module, a risk assessment module, an instruction generation module, an encryption transmission module and a data self-destruction module

[0006] Sensor detection module: used to collect physical status information of terminal devices in real time;

[0007] Environmental perception module: used to monitor the environmental parameters around the terminal device in real time;

[0008] Operation record module: used to record all operation behavior data of the terminal device in detail, including normal operation and abnormal operation data;

[0009] Data aggregation module: collects data from the sensor monitoring module, environment perception module and operation recording module, and organizes and classifies them;

[0010] Data analysis module: responsible for in-depth analysis of aggregated data, including extracting key features and identifying potential abnormal patterns;

[0011] Risk assessment module: Based on the results of data analysis and the preset risk assessment model, the risk coefficient is calculated to determine whether there is a risk of disassembly and intrusion;

[0012] Instruction generation module: generates corresponding control instructions when the risk assessment module determines that there is a risk;

[0013] Encrypted transmission module: encrypts the generated instructions to ensure the security and confidentiality of the instructions during transmission and prevent malicious interception and tampering;

[0014] Data self-destruction module: responsible for ensuring the thoroughness of data self-destruction to prevent data from being recovered.

[0015] As a further solution of the present invention: the sensor detection module includes a vibration sensor, a displacement sensor and an angle sensor. The vibration sensor model is M-A342VD10, which is used to obtain vibration data on the terminal device. The sensitivity can reach 0.01g and the sampling frequency is 10kHz. The collected raw vibration data will first be low-pass filtered to remove the existing high-frequency noise. The displacement sensor model is CHM-M1055-S001-1G01-606, which uses the principle of laser interference and has an optional range of 80mm, 150mm and 300mm. The output forms include 0-5Vdc / +24Vdc±10% and 0-10Vdc / +24Vdc±10%. The sensor detection module uses Kalman filtering to optimally estimate the collected original displacement data, optimizes and corrects the displacement data in real time, and reduces measurement errors. The angle sensor model is ACE-270-1-SV20-V02-CW, which uses magnetoresistive technology. The sensor detection module performs temperature compensation and linear correction on the collected angle data to ensure the accuracy of the measurement results. The sensor detection module transmits the collected vibration, displacement and angle data to the data summary module.

[0016] As a further solution of the present invention: the environmental perception module is provided with a temperature sensor, a humidity sensor and a light sensor. The temperature sensor adopts a PT100 platinum resistance temperature sensor with an accuracy of ±0.1°C. The environmental perception module first converts the analog signal output by the temperature sensor into a digital quantity through an analog-to-digital converter (ADC), and then uses a sliding average filtering algorithm to smooth the converted digital temperature data to reduce the impact of ambient temperature fluctuations on the output data. The humidity sensor adopts a HIH6130 capacitive humidity sensor with an accuracy of ±2%RH. The environmental perception module corrects the collected humidity data through linear compensation and temperature correction technology to avoid the impact of the non-completely linear output form of the capacitive humidity sensor on the measurement results. The light sensor adopts a Vishay VEML6040 silicon photodiode light sensor with a measurement range of 0-100000 lux. The environmental perception module first logarithmically amplifies the output signal, and then converts a large range of light intensity changes into a voltage range that can be processed, and then converts it into a digital quantity through the ADC. The environmental perception module transmits the detected environmental data to the data summary module.

[0017] As a further solution of the present invention: the operation recording module is used to record the operation data of the terminal device, including the user login operation data and the data edited by the device data. For the user login operation data, a dual verification technology based on the challenge-response identity authentication mechanism and the biometric recognition technology is adopted. When the user tries to log in, the system will generate a random challenge value through a pseudo-random number generator (PRNG), and collect the biometric information of the logged-in user at the same time. The user processes the challenge value according to his own secret information (password) and returns the response value. The system also verifies the consistency of the biometrics with the pre-stored information and the correctness of the response value to confirm the user's identity. The operation recording module will record the login Detailed information in the process, including login time, user name, password after multi-hashing, IP address of login source and biometric data collected; for data edited by device data, including read, write and delete operation data of device data, the operation record module will record in detail the type of operation, the specific object (file, database record) targeted by the operation, the operation timestamp accurate to seconds and the final result of the operation (success and failure); the operation record module performs periodic integrity check on the operation record through the SHA-256 hash algorithm to ensure that the data has not been tampered with during storage and transmission; the operation record module interacts with the data aggregation module in real time.

[0018] As a further solution of the present invention: the data summary module is capable of receiving data transmitted by the sensor detection module, the environment perception module and the operation recording module. The data summary module adopts a circular buffer and a priority queue to receive and temporarily store these data. For different types of data, format conversion and unification processing are first performed, and the received data are uniformly converted into digital quantities through an analog-to-digital converter and unified into data units of the same category. Then, according to the timestamp of the data, the bubble sort algorithm is used to sort the data to ensure the accuracy of the time sequence of the data. Then, the data monitored by the sensor is classified according to vibration, displacement and angle data and stored in a B-tree based index file to achieve fast query and retrieval. The environment-perceived temperature, humidity and light data are stored in a Redis key-value pair database for fast reading and updating. The operation record data is stored in a MySQ relational database for associated query and data analysis. The data summary module transmits the summarized data to the data analysis module.

[0019] As a further solution of the present invention: the data analysis module can receive data transmitted by the data aggregation module. The data analysis module first uses a principal component analysis (PCA) method based on statistics to perform dimensionality reduction processing on the sensor monitoring data and the environmental perception data, retains the main characteristic components of the data, and reduces the computational complexity. Then, the processed data is input into CNN for feature learning and pattern recognition. CNN uses a multi-layer convolutional layer and pooling layer structure, which can automatically extract deep-level features in the data and detect deviations from the normal mode. For the operation record data, LSTM is used for sequence analysis to capture the time series characteristics of the operation behavior, including the frequency, sequence and interval of the operation, and can discover abnormal operation behavior patterns. The data analysis module will transmit the analyzed data to the risk assessment module.

[0020] As a further solution of the present invention: the risk assessment module can receive data transmitted by the data analysis module, and calculate the current risk coefficient through the received data. The specific risk coefficient calculation formula is as follows:

[0021]

[0022] Where: R represents the risk factor, x i Represents the key data of the sensor monitoring module, including vibration amplitude, displacement and angle offset value, y i Represents the environmental parameter data obtained by the environmental perception module, including temperature change, humidity change, and light intensity change values. j Represents the relevant data in the operation record module, including the number of abnormal operations, the number of login failures, the frequency of abnormal operations, and the abnormal time value of the operation. kIndicates abnormal data analyzed by the data analysis module, including abnormal fluctuation values ​​of data traffic, deviation of system resource usage, and abnormal deviation values ​​of data access patterns. i , b i 、c j and k represents the weight coefficient set by the manager, n, h, m and l represent x i ,y i 、z j and w k The total amount of corresponding data;

[0023] The risk assessment module is provided with a low risk threshold R min and high risk threshold R max The risk assessment module will calculate the risk coefficient R and the low risk threshold R min and high risk threshold R max Compare and then judge different risk states. The specific comparison categories are as follows:

[0024] When R <R min When the current terminal device is judged to be in a risk-free state;

[0025] When R min ≤R <R max When the current terminal device is judged to be in a low-risk state;

[0026] When R max When ≤R, the current terminal device is judged to be in a high-risk state;

[0027] The risk assessment module transmits the data to the instruction generation module.

[0028] As a further solution of the present invention: the instruction generation module can receive data transmitted by the risk assessment module in real time. When it is determined to be a risk-free state, the instruction generation module does not make any intervention. When it is determined to be a low-risk state, the instruction generation module issues an alarm instruction, issues an early warning through an alarm bell and a warning light, and sends a text message notification to the management personnel, reminding the management personnel to check and verify the security of the terminal device in time. When it is determined to be a high-risk state, a data self-destruction instruction is generated, and the instruction generation module transmits the generated data self-destruction instruction to the encryption transmission module.

[0029] As a further solution of the present invention: the encryption transmission module is capable of receiving the data self-destruction instruction transmitted by the instruction generation module, and the encryption transmission module uses the AES-256 encryption algorithm to encrypt the data self-destruction instruction. During the encryption process, the instruction data is first grouped into 128 bits per group, and then a 256-bit encryption key is used to encrypt the instruction data through multiple rounds of encryption operations (including byte replacement, row shift, column confusion and round key addition). During network transmission, the TCP protocol is used to ensure reliable data transmission. At the same time, a MAC (Message Authentication Code) is calculated for the transmitted data, and a message authentication code is generated using the HMAC-SHA256 algorithm to verify the integrity and authenticity of the data. At the data receiving end, the MAC is first verified. If the verification passes, the corresponding decryption key is used to decrypt the ciphertext to restore the original instruction.

[0030] As a further solution of the present invention: the data self-destruction module is equivalent to the data storage terminal, the data self-destruction module can receive the encrypted data transmitted by the encryption transmission module, the data self-destruction module first verifies the MAC, and if the verification is passed, the corresponding decryption key is used to decrypt the ciphertext to restore the original data self-destruction instruction, and the data self-destruction includes logical destruction and physical destruction;

[0031] For logical destruction, the data self-destruction module will randomly generate data to repeatedly overwrite the original stored data, and insert a large amount of false data to confuse the characteristics of real data. Before destruction, the AES-256 algorithm is used to encrypt the data. The following is an example of the relevant encryption formula:

[0032] In AES-256 encryption, each round of transformations includes byte substitution (SubBytes), row shift (ShiftRows), column confusion (MixColumns) and round key addition (AddRoundKey);

[0033] Byte replacement uses a fixed S-box for replacement, which can be expressed as: B[i] = S[A[i]], where A[i] is the input byte, B[i] is the output byte, and S is a predefined S-box;

[0034] Row shift is to circularly shift each row in the matrix. The 0th row is not shifted, the 1st row is circularly shifted left by 1 byte, the 2nd row is circularly shifted left by 2 bytes, and the 3rd row is circularly shifted left by 3 bytes.

[0035] Column confusion is achieved through matrix multiplication and can be expressed as:

[0036]

[0037] Round key addition is to perform bit-by-bit XOR of the round key and the intermediate state: Where A[i] is the intermediate state byte, K[i] is the round key byte, and C[i] is the XOR result;

[0038] For physical destruction, strong magnetic field demagnetization technology is used to generate a strong magnetic field at the data storage terminal, which completely disrupts the arrangement of the magnetic particles in the storage medium, causing the originally stored data information to be completely lost, thereby preventing the data from being recovered from a physical level.

[0039] By adopting the above technical solution, compared with the prior art, the beneficial effects of the present invention are:

[0040] 1. The present invention uses a variety of high-precision sensors combined with an environmental perception module to comprehensively and accurately collect the physical state of the device and the surrounding environment information. At the same time, the operation recording module records all the operation behaviors of the device in detail, and the data analysis module uses advanced algorithms to conduct in-depth analysis of these data. The risk assessment module can calculate the risk coefficient based on the comprehensive data, so as to analyze the current state of the terminal device based on the risk coefficient, effectively avoiding misjudging normal operations or environmental changes as disassembly or intrusion behaviors, significantly reducing the false alarm rate, and reducing unnecessary troubles caused to users by false alarms;

[0041] 2. The present invention adopts a combination of logical destruction and physical destruction through a data self-destruction module. In terms of logical destruction, the original stored data is repeatedly overwritten by randomly generated data, and a large amount of false data is inserted to confuse the characteristics of real data. At the same time, the AES-256 algorithm is used to encrypt the data before destruction, which greatly increases the difficulty of data recovery. In terms of physical destruction, the strong magnetic field demagnetization technology is used to completely arrange and disrupt the magnetic particles in the storage medium, so that the data information is completely lost, ensuring that the data is completely destroyed from a physical level. With the blessing of this double-layer destruction, the risk of data recovery can be effectively avoided, and the security of data storage is greatly improved;

[0042] 3. The present invention uses the AES-256 encryption algorithm to encrypt the data self-destruction instruction through the encryption transmission module, uses the TCP protocol to ensure reliable data transmission during network transmission, and generates a message verification code through the HMAC-SHA256 algorithm to perform MAC calculation to verify the integrity and authenticity of the data. For the data receiving end of the data self-destruction module, only after passing the MAC verification, the corresponding decryption key is used to decrypt the ciphertext and restore the original instruction. This encrypted transmission method effectively prevents the data from being maliciously intercepted, tampered with or damaged during transmission, and ensures the security and confidentiality of the data. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 Schematic diagram of the system flow in an embodiment of the present invention. DETAILED DESCRIPTION

[0044] The specific embodiments of the present invention will be further described below in conjunction with the accompanying drawings. It should be noted that the description of these embodiments is used to help understand the present invention, but does not constitute a limitation of the present invention.

[0045] In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0046] Please refer to the attached Figure 1 The present invention discloses an intelligent anti-disassembly alarm and data self-destruction protection terminal device system, which includes a sensor detection module, an environment perception module, an operation recording module, a data aggregation module, a data analysis module, a risk assessment module, an instruction generation module, an encryption transmission module and a data self-destruction module.

[0047] Sensor detection module: used to collect physical status information of terminal equipment in real time;

[0048] Environmental perception module: used to monitor the environmental parameters around the terminal device in real time;

[0049] Operation record module: used to record all operation behavior data of the terminal device in detail, including normal operation and abnormal operation data;

[0050] Data aggregation module: collects data from the sensor monitoring module, environment perception module and operation recording module, and organizes and classifies them;

[0051] Data analysis module: responsible for in-depth analysis of the aggregated data, including extracting key features and identifying potential abnormal patterns;

[0052] Risk assessment module: Based on the results of data analysis and the preset risk assessment model, the risk coefficient is calculated to determine whether there is a risk of disassembly and intrusion;

[0053] Instruction generation module: generates corresponding control instructions when the risk assessment module determines that there is a risk;

[0054] Encrypted transmission module: encrypts the generated instructions to ensure the security and confidentiality of the instructions during transmission and prevent malicious interception and tampering;

[0055] Data self-destruction module: responsible for ensuring the thoroughness of data self-destruction to prevent data from being recovered.

[0056] In one embodiment of the present invention: the sensor detection module includes a vibration sensor, a displacement sensor and an angle sensor. The vibration sensor model is M-A342VD10, which is used to obtain vibration data on the terminal device. The sensitivity can reach 0.01g and the sampling frequency is 10kHz. The collected raw vibration data will first be low-pass filtered to remove the existing high-frequency noise. The displacement sensor model is CHM-M1055-S001-1G01-606, which uses the principle of laser interference. The range is optional, including 80mm, 150mm and 300mm, and the output form includes 0 -5Vdc / +24Vdc±10% and 0-10Vdc / +24Vdc±10%. The sensor detection module uses Kalman filtering to optimally estimate the collected original displacement data, optimizes and corrects the displacement data in real time to reduce measurement errors. The angle sensor model is ACE-270-1-SV20-V02-CW, which uses magnetoresistive technology. The sensor detection module performs temperature compensation and linear correction on the collected angle data to ensure the accuracy of the measurement results. The sensor detection module transmits the collected vibration, displacement and angle data to the data summary module.

[0057] In one embodiment of the present invention: the environment perception module is provided with a temperature sensor, a humidity sensor and a light sensor. The temperature sensor adopts a PT100 platinum resistance temperature sensor with an accuracy of ±0.1°C. The environment perception module first converts the analog signal output by the temperature sensor into a digital quantity through an analog-to-digital converter (ADC), and then uses a sliding average filtering algorithm to smooth the converted digital temperature data to reduce the impact of ambient temperature fluctuations on the output data. The humidity sensor adopts a HIH6130 capacitive humidity sensor with an accuracy of ±2%RH. The environment perception module corrects the collected humidity data through linear compensation and temperature correction technology to avoid the impact of the non-completely linear output form of the capacitive humidity sensor on the measurement results. The light sensor adopts a Vishay VEML6040 silicon photodiode light sensor with a measurement range of 0-100000 lux. The environment perception module first logarithmically amplifies the output signal, and then converts a large range of light intensity changes into a voltage range that can be processed, and then converts it into a digital quantity through the ADC. The environment perception module transmits the detected environmental data to the data aggregation module.

[0058] In one embodiment of the present invention: the operation recording module is used to record the operation data of the terminal device, including the user login operation data and the data edited by the device data. For the user login operation data, a dual verification technology based on the challenge-response identity authentication mechanism and the biometric recognition technology is adopted. When the user tries to log in, the system will generate a random challenge value through a pseudo-random number generator (PRNG) and collect the biometric information of the logged-in user. The user processes the challenge value according to his own secret information (password) and returns a response value. The system also verifies the consistency of the biometrics with the pre-stored information and the correctness of the response value to confirm the user's identity. The operation recording module will record the login The detailed information during the login process includes the login time, user name, password after multiple hash processing, IP address of the login source, and biometric data. For the data edited by the device data, including the read, write and delete operation data of the device data, the operation record module will record in detail the type of operation, the specific object (file, database record) targeted by the operation, the operation timestamp accurate to the second level, and the final result of the operation (success and failure). The operation record module uses the SHA-256 hash algorithm to perform periodic integrity verification on the operation records to ensure that the data has not been tampered with during storage and transmission. The operation record module interacts with the data aggregation module in real time.

[0059] In one embodiment of the present invention: the data aggregation module is capable of receiving data transmitted by the sensor detection module, the environment perception module and the operation recording module. The data aggregation module uses a circular buffer and a priority queue to receive and temporarily store these data. For different types of data, format conversion and unification processing are first performed, and the received data is uniformly converted into digital quantities through an analog-to-digital converter and unified into data units of the same category. Then, according to the timestamp of the data, the bubble sort algorithm is used to sort the data to ensure the accuracy of the time sequence of the data. Then, the data monitored by the sensor is classified according to vibration, displacement and angle data and stored in a B-tree-based index file to achieve fast query and retrieval. The environment-perceived temperature, humidity and light data are stored in a Redis key-value pair database for fast reading and updating. The operation record data is stored in a MySQ relational database for associated query and data analysis. The data aggregation module transmits the aggregated data to the data analysis module.

[0060] In one embodiment of the present invention: the data analysis module can receive data transmitted by the data aggregation module. The data analysis module first uses the principal component analysis (PCA) method based on statistics to perform dimensionality reduction processing on the sensor monitoring data and the environmental perception data, retains the main characteristic components of the data, and reduces the computational complexity. Then, the processed data is input into CNN for feature learning and pattern recognition. CNN uses a multi-layer convolutional layer and pooling layer structure, which can automatically extract deep-level features in the data and detect deviations from the normal mode. For the operation record data, LSTM is used for sequence analysis to capture the time series characteristics of the operation behavior, including the frequency, sequence and interval of the operation, and can detect abnormal operation behavior patterns. The data analysis module will transmit the analyzed data to the risk assessment module.

[0061] In one embodiment of the present invention, the risk assessment module can receive data transmitted by the data analysis module and calculate the current risk factor through the received data. The specific risk factor calculation formula is as follows:

[0062]

[0063] Where: R represents the risk factor, x i Represents the key data of the sensor monitoring module, including vibration amplitude, displacement and angle offset value, y i Represents the environmental parameter data obtained by the environmental perception module, including temperature change, humidity change, and light intensity change values. j Represents the relevant data in the operation record module, including the number of abnormal operations, the number of login failures, the frequency of abnormal operations, and the abnormal time value of the operation. k Indicates abnormal data analyzed by the data analysis module, including abnormal fluctuation values ​​of data traffic, deviation of system resource usage, and abnormal deviation values ​​of data access patterns. i , b i 、c j and k represents the weight coefficient set by the manager, n, h, m and l represent x i ,y i 、z j and w k The total amount of corresponding data;

[0064] The risk assessment module is set with a low risk threshold R min and high risk threshold R max The risk assessment module will compare the calculated risk factor R with the low risk threshold R min and high risk threshold R max Compare and then judge different risk states. The specific comparison categories are as follows:

[0065] When R <R min When the current terminal device is judged to be in a risk-free state;

[0066] When R min ≤R <R max When the current terminal device is judged to be in a low-risk state;

[0067] When R max When ≤R, the current terminal device is judged to be in a high-risk state;

[0068] The risk assessment module transmits the data to the instruction generation module.

[0069] In one embodiment of the present invention: the instruction generation module can receive data transmitted by the risk assessment module in real time. When it is determined to be a risk-free state, the instruction generation module does not make any intervention. When it is determined to be a low-risk state, the instruction generation module issues an alarm instruction, issues an early warning through an alarm bell and a warning light, and sends a text message notification to the management personnel, reminding the management personnel to check and verify the security of the terminal device in time. When it is determined to be a high-risk state, a data self-destruction instruction is generated, and the instruction generation module will transmit the generated data self-destruction instruction to the encryption transmission module.

[0070] In one embodiment of the present invention: the encryption transmission module is capable of receiving the data self-destruction instruction transmitted by the instruction generation module, and the encryption transmission module uses the AES-256 encryption algorithm to encrypt the data self-destruction instruction. During the encryption process, the instruction data is first grouped into 128 bits per group, and then a 256-bit encryption key is used to encrypt the instruction data through multiple rounds of encryption operations (including byte replacement, row shift, column confusion and round key addition). During network transmission, the TCP protocol is used to ensure reliable data transmission. At the same time, a MAC (Message Authentication Code) is calculated for the transmitted data, and a message authentication code is generated using the HMAC-SHA256 algorithm to verify the integrity and authenticity of the data. At the data receiving end, the MAC is first verified. If the verification passes, the corresponding decryption key is used to decrypt the ciphertext to restore the original instruction.

[0071] In one embodiment of the present invention: the data self-destruction module is equivalent to the data storage terminal, the data self-destruction module can receive the encrypted data transmitted by the encryption transmission module, the data self-destruction module first verifies the MAC, if the verification is passed, the corresponding decryption key is used to decrypt the ciphertext to restore the original data self-destruction instruction, and the data self-destruction includes logical destruction and physical destruction;

[0072] For logical destruction and data self-destruction modules, data will be randomly generated to repeatedly overwrite the original stored data, and a large amount of false data will be inserted to confuse the characteristics of real data. The AES-256 algorithm will be used to encrypt the data before destruction. The following is an example of the relevant encryption formula:

[0073] In AES-256 encryption, each round of transformations includes byte substitution (SubBytes), row shift (ShiftRows), column confusion (MixColumns) and round key addition (AddRoundKey);

[0074] Byte replacement uses a fixed S-box for replacement, which can be expressed as: B[i] = S[A[i]], where A[i] is the input byte, B[i] is the output byte, and S is a predefined S-box;

[0075] Row shift is to circularly shift each row in the matrix. The 0th row is not shifted, the 1st row is circularly shifted left by 1 byte, the 2nd row is circularly shifted left by 2 bytes, and the 3rd row is circularly shifted left by 3 bytes.

[0076] Column confusion is achieved through matrix multiplication and can be expressed as:

[0077]

[0078] Round key addition is to perform bit-by-bit XOR of the round key and the intermediate state: Where A[i] is the intermediate state byte, K[i] is the round key byte, and C[i] is the XOR result;

[0079] For physical destruction, strong magnetic field demagnetization technology is used to generate a strong magnetic field at the data storage terminal, which completely disrupts the arrangement of the magnetic particles in the storage medium, causing the originally stored data information to be completely lost, thereby preventing the data from being recovered from a physical level.

[0080] Example 1, please refer to the attached Figure 1 For the operation record module, in the actual application process, the operation records need to be classified and indexed. The efficient B+ tree index structure is adopted to realize the rapid retrieval and query of the operation records. When it is necessary to find the operation records within a specific time period or a specific type, the relevant data can be located in a very short time. Then, the operation records are compressed and stored through the LZ4 compression algorithm, which saves storage space without losing data integrity.

[0081] Example 2, please refer to the attached Figure 1,For the thresholds in the risk assessment module, in terms of ,threshold judgment, the initial thresholds are first set based on a large amount of ,historical data and rich industry experience. However, the system does not ,rely on these initial thresholds in a fixed way, but with the continuous ,operation and accumulation of data, an adaptive threshold adjustment algorithm is ,adopted. By conducting in-depth analysis of the collected data, the mean and ,standard deviation are calculated. Based on these statistics, a more reasonable threshold range is ,determined in combination with the concept of confidence interval. When the calculated risk coefficient exceeds the ,maximum upper limit of the threshold, it is decisively ,determined as a high-risk state, which means that the ,equipment may be being disassembled, invaded or other serious ,abnormal conditions.

[0082] Example 3, please refer to the attached Figure 1 For the instruction generation module, in the actual application process, the alarm instructions are described in XML format with clear structure, easy to parse and transmit. The alarm instructions contain rich and detailed risk information, such as precise risk type (clearly distinguishing whether it is disassembly, intrusion or other abnormal operations, etc.), clear risk level (high, medium, low), accurate location of the equipment (located by GPS coordinates or precise network address) and timestamp accurate to milliseconds and other key information. These detailed alarm information can be quickly and accurately conveyed to the relevant monitoring center or user terminal, so that relevant personnel can understand the dangerous condition of the equipment in time and take corresponding emergency measures.

[0083] Specifically, with the help of a variety of high-precision sensors and combined with the environmental perception module, it can comprehensively and accurately collect information on the physical state of the equipment and the surrounding environment. At the same time, the operation record module records all operating behaviors of the equipment in detail, and the data analysis module uses cutting-edge algorithms to conduct in-depth analysis of these data. The risk assessment module can calculate the risk coefficient based on the comprehensive data, and then analyze the current status of the terminal device based on the risk coefficient, effectively avoiding normal operations or environmental changes from being misjudged as disassembly or intrusion behaviors, significantly reducing the probability of false alarms, and greatly reducing the unnecessary troubles caused to users by false alarms.

[0084] Specifically, the data self-destruction module adopts a combination of logical destruction and physical destruction. At the logical destruction level, randomly generated data is used to overwrite the original stored data multiple times, and a large amount of false data is inserted to disrupt the characteristics of the real data. At the same time, the AES-256 algorithm is used to encrypt the data before destruction, which greatly increases the difficulty of data recovery. In terms of physical destruction, strong magnetic field demagnetization technology is used to thoroughly disrupt the arrangement of the magnetic particles in the storage medium, making the data information completely disappear, ensuring that the data is completely destroyed from a physical perspective. With the support of this double destruction, the risk of data recovery can be effectively avoided and the security of data storage can be greatly improved.

[0085] Specifically, the data self-destruction instruction is encrypted using the AES-256 encryption algorithm through the encryption transmission module, the TCP protocol is used to ensure the reliable transmission of data during network transmission, and the message verification code is generated by the HMAC-SHA256 algorithm for MAC calculation to verify the integrity and authenticity of the data. For the data receiving end of the data self-destruction module, only after passing the MAC verification will the corresponding decryption key be used to decrypt the ciphertext and restore the original instruction. This form of encrypted transmission effectively prevents the data from being maliciously intercepted, tampered with or damaged during transmission, and provides a strong guarantee for the security and confidentiality of the data.

[0086] Working principle:

[0087] First, the sensor detection module and the environment perception module can respectively obtain the physical state of the terminal device and the environmental parameters around the terminal device. For the operation record module, it can record all the operation behavior data of the terminal device in detail, including the user login operation data and the device data editing data. Then, the sensor detection module, the environment perception module and the operation record module can transmit the data therein to the data summary module for summary. The data summary module processes the received data, including the unified format processing, and classifies and sorts the data. Then, the data summary module transmits the data to the data analysis module. The data analysis module extracts features from the data and analyzes various abnormal risks that may exist therein. Then, the data is uniformly transmitted to the risk assessment module. The risk assessment module uses the formula The risk coefficient R of the current device terminal is calculated, and then the low-risk threshold and the high-risk threshold set therein are compared according to the current risk coefficient size, and then the current risk status is judged. When the current risk status is judged to be high risk, a data self-destruction instruction is generated through the instruction generation module, and then the data self-destruction instruction is encrypted using the encryption transmission module using the AES-256 encryption algorithm. Then, through mutual verification with the data self-destruction module, the data self-destruction instruction is transmitted to the data self-destruction module, and then the data self-destruction module starts the self-destruction program, and destroys the data through a dual destruction method combining logical destruction and physical destruction to prevent data from being restored and protect data security. At this point, the entire workflow ends.

[0088] At the same time, the present application uses specific words to describe the embodiments of the present application. For example, "one embodiment", "an embodiment", and / or "some embodiments" refer to a certain feature, structure or characteristic related to at least one embodiment of the present application. Therefore, it should be emphasized and noted that "one embodiment" or "an embodiment" or "an alternative embodiment" mentioned twice or more in different positions in this specification does not necessarily refer to the same embodiment. In addition, certain features, structures or characteristics in one or more embodiments of the present application can be appropriately combined.

[0089] Some aspects of the present application may be performed entirely by hardware, entirely by software (including firmware, resident software, microcode, etc.), or by a combination of hardware and software. The above hardware or software may be referred to as "data blocks", "modules", "engines", "units", "components" or "systems". The processor may be one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DAPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, or combinations thereof. In addition, various aspects of the present application may be expressed as computer products located in one or more computer-readable media, which include computer-readable program codes. For example, computer-readable media may include, but are not limited to, magnetic storage devices (e.g., hard disks, floppy disks, tapes ...), optical disks (e.g., compact disks CDs, digital versatile disks DVDs ...), smart cards, and flash memory devices (e.g., cards, sticks, key drives ...).

[0090] A computer-readable medium may include a propagated data signal containing computer program code, such as in baseband or as part of a carrier wave. The propagated signal may have a variety of manifestations, including electromagnetic, optical, etc., or a suitable combination. A computer-readable medium may be any computer-readable medium other than a computer-readable storage medium, which may be connected to an instruction execution system, device or apparatus to communicate, propagate or transmit a program for use. The program code on the computer-readable medium may be propagated through any suitable medium, including radio, cable, fiber optic cable, radio frequency signal, or similar medium, or a combination of any of the above mediums.

[0091] Similarly, it should be noted that in order to simplify the description disclosed in this application, so as to help understand one or more embodiments of the invention, in the above description of the embodiments of the present application, sometimes multiple features are merged into one embodiment, drawings or descriptions thereof. However, this disclosure method does not mean that the features required by the object of the present application are more than the features mentioned in the claims. In fact, the features of the embodiment are less than all the features of the single embodiment disclosed above. In some embodiments, numbers describing the number of components and attributes are used. It should be understood that such numbers used in the description of the embodiments are modified by the modifiers "approximately", "approximately" or "substantially" in some examples. Unless otherwise specified, "approximately", "approximately" or "substantially" indicate that the number allows a variation of ±20%. Accordingly, in some embodiments, the numerical parameters used in the specification and claims are approximate values, which may change according to the characteristics required by individual embodiments. In some embodiments, the numerical parameters should take into account the specified significant digits and adopt the general method of retaining the digits. Although the numerical domains and parameters used to confirm the breadth of their range in some embodiments of the present application are approximate values, in specific embodiments, such numerical settings are as accurate as possible within the feasible range.

[0092] Although the present invention is disclosed as above in terms of preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art may make possible changes and modifications without departing from the spirit and scope of the present invention. Therefore, any modification, equivalent change and modification made to the above embodiments according to the technical essence of the present invention without departing from the content of the technical solution of the present invention shall fall within the scope of protection defined by the claims of the present invention.

Claims

1. An intelligent anti-tampering alarm and data self-destruction protection terminal equipment system, characterized by: The intelligent anti-disassembly alarm and data self-destruction protection terminal device system includes a sensor detection module, an environment perception module, an operation recording module, a data summary module, a data analysis module, a risk assessment module, an instruction generation module, an encryption transmission module and a data self-destruction module Sensor detection module: used to collect physical status information of terminal devices in real time; Environmental perception module: used to monitor the environmental parameters around the terminal device in real time; Operation record module: used to record all operation behavior data of the terminal device in detail, including normal operation and abnormal operation data; Data aggregation module: collects data from the sensor monitoring module, environment perception module and operation recording module, and organizes and classifies them; Data analysis module: responsible for in-depth analysis of aggregated data, including extracting key features and identifying potential abnormal patterns; Risk assessment module: Based on the results of data analysis and the preset risk assessment model, the risk coefficient is calculated to determine whether there is a risk of disassembly and intrusion; Instruction generation module: generates corresponding control instructions when the risk assessment module determines that there is a risk; Encrypted transmission module: encrypts the generated instructions to ensure the security and confidentiality of the instructions during transmission and prevent malicious interception and tampering; Data self-destruction module: responsible for ensuring the thoroughness of data self-destruction to prevent data from being recovered.

2. According to claim 1, the intelligent anti-disassembly alarm and data self-destruction protection terminal equipment system is characterized by: The sensor detection module includes a vibration sensor, a displacement sensor and an angle sensor. The vibration sensor model is M-A342VD10, which is used to obtain vibration data on the terminal device. The sensitivity can reach 0.01g and the sampling frequency is 10kHz. The collected raw vibration data will first be low-pass filtered to remove the high-frequency noise. The displacement sensor model is CHM-M1055-S001-1G01-606, which uses the principle of laser interference. The range is optional, including 80mm, 150mm and 300mm, and the output form includes 0-5Vdc / +24Vdc±10% and 0-10Vdc / +24Vdc±10%. The sensor detection module uses Kalman filtering to perform optimal estimation on the collected original displacement data, optimizes and corrects the displacement data in real time, and reduces measurement errors. The angle sensor model is ACE-270-1-SV20-V02-CW, which uses magnetoresistive technology. The sensor detection module performs temperature compensation and linear correction on the collected angle data to ensure the accuracy of the measurement results. The sensor detection module transmits the collected vibration, displacement and angle data to the data summary module.

3. According to claim 1, the intelligent anti-disassembly alarm and data self-destruction protection terminal equipment system is characterized by: The environmental perception module is provided with a temperature sensor, a humidity sensor and a light sensor. The temperature sensor adopts a PT100 platinum resistance temperature sensor with an accuracy of ±0.1°C. The environmental perception module first converts the analog signal output by the temperature sensor into a digital quantity through an analog-to-digital converter (ADC), and then uses a sliding average filtering algorithm to smooth the converted digital temperature data to reduce the impact of ambient temperature fluctuations on the output data. The humidity sensor adopts a HIH6130 capacitive humidity sensor with an accuracy of ±2%RH. The environmental perception module corrects the collected humidity data through linear compensation and temperature correction technology to avoid the impact of the non-completely linear output form of the capacitive humidity sensor on the measurement results. The light sensor adopts a Vishay VEML6040 silicon photodiode light sensor with a measurement range of 0-100000 lux. The environmental perception module first logarithmically amplifies the output signal, and then converts a large range of light intensity changes into a voltage range that can be processed, and then converts it into a digital quantity through the ADC. The environmental perception module transmits the detected environmental data to the data summary module.

4. According to claim 1, the intelligent anti-disassembly alarm and data self-destruction protection terminal equipment system is characterized by: The operation record module is used to record the operation data of the terminal device, including the user login operation data and the data edited by the device data. For the data of the user login operation, a dual verification technology based on the challenge-response identity authentication mechanism and the biometric recognition technology is adopted. When the user attempts to log in, the system will generate a random challenge value through a pseudo-random number generator (PRNG), and collect the biometric information of the logged-in user at the same time. The user processes the challenge value according to his own secret information (password) and returns a response value. The system simultaneously verifies the consistency of the biometrics with the pre-stored information and the correctness of the response value to confirm the user's identity. The operation record module will record detailed information during the login process, including the login time, user name, password processed by multiple hashes, and the IP address of the login source and the biometric collection data. For the data edited by the device data, including the reading, writing and deleting operation data of the device data, the operation record module will record in detail the type of operation, the specific object (file, database record) targeted by the operation, the operation timestamp accurate to the second level, and the final result (success and failure) of the operation. The operation record module performs periodic integrity verification on the operation record through the SHA-256 hash algorithm to ensure that the data has not been tampered with during storage and transmission. The operation record module interacts with the data aggregation module in real time.

5. The intelligent anti-disassembly alarm and data self-destruction protection terminal equipment system according to claim 1 is characterized by: The data aggregation module can receive data transmitted by the sensor detection module, the environment perception module and the operation recording module. The data aggregation module adopts a circular buffer and a priority queue to receive and temporarily store these data. For different types of data, format conversion and unification processing are first performed, and the received data is uniformly converted into digital quantities through an analog-to-digital converter and unified into data units of the same category. Then, according to the timestamp of the data, the bubble sort algorithm is used to sort the data to ensure the accuracy of the time sequence of the data. Then, the data monitored by the sensor is classified according to vibration, displacement and angle data and stored in a B-tree-based index file to achieve fast query and retrieval. The temperature, humidity and light data perceived by the environment are stored in the Redis key-value pair database for fast reading and updating. The operation record data is stored in the MySQ relational database for associated query and data analysis. The data aggregation module transmits the aggregated data to the data analysis module.

6. The intelligent anti-disassembly alarm and data self-destruction protection terminal equipment system according to claim 1 is characterized by: The data analysis module can receive data transmitted by the data aggregation module. The data analysis module first uses the principal component analysis (PCA) method based on statistics to reduce the dimension of the sensor monitoring data and the environmental perception data, retain the main characteristic components of the data, and reduce the computational complexity. Then, the processed data is input into CNN for feature learning and pattern recognition. CNN uses a multi-layer convolutional layer and pooling layer structure, which can automatically extract deep-level features in the data and detect deviations from the normal mode. For the operation record data, LSTM is used for sequence analysis to capture the time series characteristics of the operation behavior, including the frequency, sequence and interval of the operation, and abnormal operation behavior patterns can be discovered. The data analysis module will transmit the analyzed data to the risk assessment module.

7. The intelligent anti-disassembly alarm and data self-destruction protection terminal equipment system according to claim 1 is characterized by: The risk assessment module can receive data transmitted by the data analysis module and calculate the current risk factor through the received data. The specific risk factor calculation formula is as follows: Where: R represents the risk factor, x i Represents the key data of the sensor monitoring module, including vibration amplitude, displacement and angle offset value, y i Represents the environmental parameter data obtained by the environmental perception module, including temperature change, humidity change, and light intensity change values. j Represents the relevant data in the operation record module, including the number of abnormal operations, the number of login failures, the frequency of abnormal operations, and the abnormal time value of the operation. k Indicates abnormal data analyzed by the data analysis module, including abnormal fluctuation values ​​of data traffic, deviation of system resource usage, and abnormal deviation values ​​of data access patterns. i 、b i 、c j and k represents the weight coefficient set by the manager, n, h, m and l represent x i ,y i 、z j and w k The total amount of corresponding data; The risk assessment module is provided with a low risk threshold R min and high risk threshold R max The risk assessment module will calculate the risk coefficient R and the low risk threshold R min and high risk threshold R max Compare and then judge different risk states. The specific comparison categories are as follows: When R <R min When the current terminal device is judged to be in a risk-free state; When R min ≤R <R max When the current terminal device is judged to be in a low-risk state; When R max When ≤R, the current terminal device is judged to be in a high-risk state; The risk assessment module transmits the data to the instruction generation module.

8. The intelligent anti-disassembly alarm and data self-destruction protection terminal equipment system according to claim 1 is characterized by: The instruction generation module can receive data transmitted by the risk assessment module in real time. When it is determined to be a risk-free state, the instruction generation module does not make any intervention. When it is determined to be a low-risk state, the instruction generation module issues an alarm instruction, issues an early warning through an alarm bell and a warning light, and sends a text message notification to the management personnel to remind the management personnel to check and verify the security of the terminal equipment in time. When it is determined to be a high-risk state, a data self-destruction instruction is generated, and the instruction generation module will transmit the generated data self-destruction instruction to the encryption transmission module.

9. The intelligent anti-disassembly alarm and data self-destruction protection terminal equipment system according to claim 1, characterized in that: The encryption transmission module can receive the data self-destruction instruction transmitted by the instruction generation module. The encryption transmission module uses the AES-256 encryption algorithm to encrypt the data self-destruction instruction. During the encryption process, the instruction data is first grouped into 128 bits per group. Then, a 256-bit encryption key is used to encrypt the instruction data through multiple rounds of encryption operations (including byte replacement, row shift, column confusion and round key addition). During network transmission, the TCP protocol is used to ensure reliable data transmission. At the same time, MAC (Message Authentication Code) calculation is performed on the transmitted data, and a message authentication code is generated using the HMAC-SHA256 algorithm to verify the integrity and authenticity of the data. At the data receiving end, the MAC is first verified. If the verification passes, the ciphertext is decrypted using the corresponding decryption key to restore the original instruction.

10. The intelligent anti-disassembly alarm and data self-destruction protection terminal equipment system according to claim 9, characterized in that: The data self-destruction module is equivalent to a data storage terminal. The data self-destruction module can receive encrypted data transmitted by the encryption transmission module. The data self-destruction module first verifies the MAC. If the verification is successful, the corresponding decryption key is used to decrypt the ciphertext to restore the original data self-destruction instruction. The data self-destruction includes logical destruction and physical destruction. For logical destruction, the data self-destruction module will randomly generate data to repeatedly overwrite the original stored data, and insert a large amount of false data to confuse the characteristics of real data. Before destruction, the AES-256 algorithm is used to encrypt the data. The following is an example of the relevant encryption formula: In AES-256 encryption, each round of transformations includes byte substitution (SubBytes), row shift (ShiftRows), column confusion (MixColumns) and round key addition (AddRoundKey); Byte replacement uses a fixed S-box for replacement, which can be expressed as: B[i] = S[A[i]], where A[i] is the input byte, B[i] is the output byte, and S is a predefined S-box; Row shift is to circularly shift each row in the matrix. The 0th row is not shifted, the 1st row is circularly shifted left by 1 byte, the 2nd row is circularly shifted left by 2 bytes, and the 3rd row is circularly shifted left by 3 bytes. Column confusion is achieved through matrix multiplication and can be expressed as: Round key addition is to perform bit-by-bit XOR of the round key and the intermediate state: Where A[i] is the intermediate state byte, K[i] is the round key byte, and C[i] is the XOR result; For physical destruction, strong magnetic field demagnetization technology is used to generate a strong magnetic field at the data storage terminal, which completely disrupts the arrangement of the magnetic particles in the storage medium, causing the originally stored data information to be completely lost, thereby preventing the data from being recovered from a physical level.

Images