Geological data access control method and system based on information encryption

Abstract

The invention relates to the technical field of information security and encryption technologies, in particular to a geological data access control method and system based on information encryption, and the system comprises a data collection module, a data classification module, a data encryption module, an identity verification and authority management module, a data access control module and an access recording and auditing module. The data acquisition module is used for acquiring geological data; the data classification module is used for classifying the geological data according to different attributes of the data; the data encryption module is used for performing encryption processing on the classified data by using AES and HSM; the identity authentication and authority management module is used for performing multi-factor identity authentication when a user logs in, distributing different data access authorities according to user roles, and retrieving and providing a corresponding encryption key according to the user authorities after the user passes the authentication; the data access control module is used for checking user authority when a user requests to access geological data, determining whether the user has the authority to access the requested data, and distributing a corresponding encryption key for the user according to the authority; after the user uses the distributed encryption key to decrypt the data, the decrypted plaintext data is provided for the user; and the access recording and auditing module is used for recording the access behavior of the user.

Description

Technical Field

[0001] The invention relates to the technical field of information security and encryption technology, and in particular to a geological data access control method and system based on information encryption. Background Art

[0002] With the development of geological survey and modeling technology, the secure storage and access control of geological data have become important issues. Traditional geological data management systems usually have the risk of data leakage and it is difficult to ensure the integrity and security of data. In the prior art, although there are some encryption and access control methods, most of them are complex and inefficient, and it is difficult to meet the needs of modern geological data management. The information disclosed in this background technology section is only intended to deepen the understanding of the overall background technology of the present invention, and should not be regarded as an admission or in any form of implication that the information constitutes prior art known to those skilled in the art. Summary of the invention

[0003] The purpose of the present invention is to provide a geological data access control method and system based on information encryption to solve the technical problems existing in the prior art.

[0004] In order to achieve the above object, the present invention adopts the following technical solutions: In a first aspect, the present invention provides a geological data access control method based on information encryption, which comprises the following steps: S1. Data encryption processing, including: S11, obtaining geological data; S12. Data classification: Classify geological data according to different attributes of the data; S13, data encryption: use AES and HSM to encrypt the classified data; S2, Authentication and Authorization, including: S21. Multi-factor authentication: Users are required to undergo multi-factor authentication when accessing the system; S22. Permission management: The system assigns different data access permissions based on user roles; S23, key acquisition: after the user passes the verification, the system retrieves the corresponding encryption key according to the user's authority; S3, data access control, including: S31, access request processing: the user selects the type of data to be accessed in the system; the system checks the user's authority to determine whether the user has the right to access the requested data; the system assigns the corresponding encryption key to the user according to the authority; S32, data decryption: the user uses the allocated encryption key to decrypt the data and obtain the required geological data; S33, Data provision and secure access: The system provides the decrypted plaintext data to the user, and the provided data is recorded as an access event to ensure transparency of use; S34, access records: record the user's access behavior and achieve traceability of access records.

[0005] Preferably, in step S1: S11. Obtain geological data, including: Collecting geological data from geological exploration projects, the geological data including borehole data, geological profile data, soil sample data and groundwater level data; S12, data classification: classify the geological data according to different attributes of the data, and generate classification attribute information including: soil composition data, geological layer data and groundwater level data; The soil composition data includes the chemical composition and physical properties of the soil; The geological stratum data include rock types and stratum information of different strata; The groundwater level data include water level height and water quality parameters; S13. Data encryption: Use AES and HSM to encrypt the classified data.

[0006] Preferably, in step S13, the encryption process using AES includes: Key generation: Generate a 192-bit random key using a secure random number generator; use a secure random number generator (CSPRNG) to ensure the unpredictability of the key. The generated key will be encrypted and stored in the HSM key management system to prevent unauthorized access; Data Blocking: Divide the data to be encrypted into blocks of fixed size (usually 192 bits) to adapt to the AES encryption algorithm; The encryption process includes: Step 1: key expansion; the 192-bit key is used to generate a set of round keys (key schedule) through the key expansion algorithm for each round of encryption operations; Step 2: initial round; the data block is transformed in the initial round, including byte substitution and row shift operations in the initial round; Step 3: main round; 12 rounds of main round transformations are performed, each round includes byte substitution, row shift, column mixing and key addition operations; Step 4: final round; the last round of transformation without column mixing is performed; Ciphertext generation: After encryption, the ciphertext data block is output and stored together with the data block index and timestamp to ensure data integrity and traceability; Key management: The generated keys (such as K1, K2, K3) are encrypted and stored in a dedicated key management system. The system uses a hardware security module (HSM)-based solution to ensure the security of the key access process.

[0007] Preferably, in step S13, the HSM usage includes: Key generation and storage: HSM is used to generate AES encryption keys and store them in encrypted form to prevent unauthorized access. The key generation process is performed inside the HSM, using its built-in hardware random number generator to ensure the randomness and security of the key. Key access control: HSM uses access control lists (ACLs) and user role management to ensure that only authorized users and applications can access keys. Each key generation, access, and use is recorded in the HSM log, providing a complete audit trail. Key backup and recovery: HSM supports key backup and recovery functions. Key backup is performed on physically isolated secure media and requires multiple authentications for recovery. By supporting multiple backup strategies, HSM ensures the key's ability to recover in the event of hardware failure.

[0008] Preferably, in step S13, Perform AES encryption on soil composition data to generate encryption key K1; Perform AES encryption on the geological layer data to generate encryption key K2; The groundwater level data is encrypted using AES to generate the encryption key K3.

[0009] Preferably, in step S2: S21. Multi-factor authentication: Users are required to undergo multi-factor authentication when accessing the system, including: When a user logs into the system, password verification is first performed; After the password verification is passed, biometric verification is performed; After the biometric verification is passed, a temporary access token is generated to authorize the user to access the corresponding data; S22. Permission management: The system assigns different data access permissions based on user roles; Among them, administrators have full access rights and can read and modify all data; Among them, geological engineers have access to data relevant to exploration and analysis; Among them, ordinary users are limited to viewing public information or low-sensitivity data; S23, key acquisition: After the user passes the verification, the system retrieves and provides the corresponding encryption key according to the user's authority; when the user requests to access specific data, the system provides the corresponding encryption key.

[0010] Preferably, in step S3: S31, access request processing: the user selects the type of data to be accessed in the system; the system checks the user's authority to determine whether the user has the right to access the requested data; the system assigns the corresponding encryption key to the user according to the authority; S32, data decryption: the user uses the assigned encryption key to decrypt the data to obtain the required geological data; the decryption process includes: the user downloads the encrypted geological data block from the system; uses the obtained AES key to decrypt, and restores the plaintext data according to the reverse process of encryption; S33, Data provision and secure access: The system provides the decrypted plaintext data to the user, and the provided data is recorded as an access event to ensure transparency of use; S34, access records: record the user's access behavior and realize the traceability of access records; The system records each user's access operation, including access time, user identity, accessed data type and decryption key.

[0011] The log information is stored in a secure log system for subsequent security audits and access tracing; Among them, through log analysis, the system access activities are monitored in real time, abnormal behaviors are detected and responded to in a timely manner.

[0012] Preferably, in step S32, the AES decryption process includes: Initial preparation: Divide the encrypted data block into 192-bit blocks in preparation for decryption; confirm the integrity and validity of the decryption key; Decryption rounds: Inverse key addition: First, perform the inverse key addition operation to XOR the last round key with the ciphertext block; Inverse column mixing: In each inverse operation, apply the inverse column mixing operation to restore the data structure; Inverse row shift: In each inverse operation, perform an inverse shift operation on the data row; Inverse byte substitution: Replace the byte with the original value through the inverse S-box; Round loop: Repeat the above inverse operations until the original plaintext data block is restored; Data integrity verification: Use the built-in message authentication code (MAC) to verify the integrity of the decrypted data; once the verification is successful, it is confirmed that the data has not been tampered with and is ready for analysis.

[0013] In a second aspect, the present invention provides a geological data access control system based on information encryption, which includes: a data acquisition module, a data classification module, a data encryption module, an identity authentication and authority management module, a data access control module and an access record and audit module; the data acquisition module is used to acquire geological data; the data classification module is used to classify geological data according to different attributes of the data; the data encryption module is used to encrypt the classified data using AES and HSM; the identity authentication and authority management module is used to perform multi-factor identity authentication when a user logs in, assign different data access rights according to the user role, and retrieve and provide corresponding encryption keys according to the user authority after the user is verified; the data access control module is used to check the user authority when the user requests to access geological data, determine whether the user has the right to access the requested data, and assign corresponding encryption keys to the user according to the authority; after the user uses the assigned encryption key to decrypt the data, the decrypted plaintext data is provided to the user; the access record and audit module is used to record the user's access behavior.

[0014] By adopting the above technical solution, the present invention has the following beneficial effects: The present invention provides a geological data access control method and system based on information encryption, which utilizes advanced encryption technology and multi-factor authentication mechanism to achieve secure storage and access control of geological data, thereby reducing the risk of data leakage and improving the security and reliability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0016] Figure 1 A schematic diagram of the overall architecture of a geological data access control system based on information encryption provided by an embodiment of the present invention; Figure 2 A data encryption flow chart provided for an embodiment of the present invention; Figure 3 Flow chart of identity authentication and rights management provided by an embodiment of the present invention; Figure 4 A data access control flow chart provided for an embodiment of the present invention. DETAILED DESCRIPTION

[0017] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0018] The specific implementation of the present invention is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the present invention, and is not used to limit the present invention. Example

[0019] Combination Figures 1 to 4 As shown, this embodiment provides a geological data access control method based on information encryption, which includes the following steps: S1. Data encryption processing, including: S11, obtaining geological data; Collecting geological data from geological exploration projects, the geological data including borehole data, geological profile data, soil sample data and groundwater level data; The collected data is transmitted in real time by wire or wireless means before being transferred to the data processing system to ensure the timeliness and integrity of the data.

[0020] S12. Data classification: The geological data is classified according to different attributes of the data for targeted encryption, such as soil composition, geological layer, groundwater level, etc. The generated classification attribute information includes: soil composition data, geological layer data and groundwater level data; The soil composition data includes the chemical composition and physical properties of the soil; The geological stratum data include rock types and stratum information of different strata; The groundwater level data include water level height and water quality parameters; S13. Data encryption: The classified data is encrypted using AES (Advanced Encryption Standard) and HSM (Hardware Security Module); preferably, a 192-bit encryption key is selected to balance security and performance.

[0021] Preferably, in step S13, the encryption process using AES includes: Key generation: Generate a 192-bit random key using a secure random number generator; use a secure random number generator (CSPRNG) to ensure the unpredictability of the key. The generated key will be encrypted and stored in the HSM key management system to prevent unauthorized access; Data Blocking: Divide the data to be encrypted into blocks of fixed size (usually 192 bits) to adapt to the AES encryption algorithm; The encryption process includes: Step 1: key expansion; the 192-bit key is used to generate a set of round keys (key schedule) through the key expansion algorithm for each round of encryption operations; Step 2: initial round; the data block is transformed in the initial round, including byte substitution and row shift operations in the initial round; Step 3: main round; 12 rounds of main round transformations are performed, each round includes byte substitution, row shift, column mixing and key addition operations; Step 4: final round; the last round of transformation without column mixing is performed; Ciphertext generation: After encryption, the ciphertext data block is output and stored together with the data block index and timestamp to ensure data integrity and traceability; Key management: The generated keys (such as K1, K2, K3) are encrypted and stored in a dedicated key management system. The system uses a hardware security module (HSM)-based solution to ensure the security of the key access process.

[0022] Wherein, preferably, in step S13, Perform AES encryption on soil composition data to generate encryption key K1; Perform AES encryption on the geological layer data to generate encryption key K2; The groundwater level data is encrypted using AES to generate the encryption key K3.

[0023] Wherein, preferably, in step S13, the HSM usage includes: Key generation and storage: HSM is used to generate AES encryption keys and store them in encrypted form to prevent unauthorized access. The key generation process is performed inside the HSM, using its built-in hardware random number generator to ensure the randomness and security of the key. Key access control: HSM uses access control lists (ACLs) and user role management to ensure that only authorized users and applications can access keys. Each key generation, access, and use is recorded in the HSM log, providing a complete audit trail. Key backup and recovery: HSM supports key backup and recovery functions. Key backup is performed on physically isolated secure media and requires multiple authentications for recovery. By supporting multiple backup strategies, HSM ensures the key's ability to recover in the event of hardware failure.

[0024] S2, Authentication and Authorization, including: S21. Multi-factor authentication: Users are required to undergo multi-factor authentication when accessing the system; specifically, they must: Step 1: Password Verification: The user enters his personal password through the secure input interface.

[0025] The system hashes the password and compares it with the password hash stored in the database.

[0026] If the match is successful, proceed to the next step of verification; otherwise, access is denied and the login attempt is recorded.

[0027] Step 2: Biometric Verification (Fingerprint Recognition): Users are required to verify their identity via a fingerprint reader.

[0028] Fingerprint data is collected through the sensor and compared with the pre-stored encrypted fingerprint template.

[0029] Upon successful authentication, the system logs a successful authentication event.

[0030] Step 3: Temporary access token generation: The system generates a temporary time-based access token (TOTP) and sends it to the user's registered device.

[0031] The user enters the token to complete the final verification step.

[0032] After successfully generating and entering a token, the user gains temporary access with the corresponding permissions.

[0033] S22. Permission management: The system assigns different data access permissions based on user roles; Among them, administrators have full access rights and can read and modify all data; Among them, geological engineers have access to data relevant to exploration and analysis, such as geological formations and groundwater levels; Among them, ordinary users are limited to viewing public information or low-sensitivity data; S23, key acquisition: After the user passes the verification, the system retrieves the corresponding encryption key according to the user's authority; when the user requests to access specific data, the system provides the corresponding encryption key.

[0034] S3, data access control, including: S31, access request processing: the user selects the type of data to be accessed in the system; the system checks the user's authority to determine whether the user has the right to access the requested data; the system assigns the corresponding encryption key to the user according to the authority; S32, data decryption: the user uses the assigned encryption key to decrypt the data to obtain the required geological data; the decryption process includes: the user downloads the encrypted geological data block from the system; uses the obtained AES key to decrypt, and restores the plaintext data according to the reverse process of encryption; Preferably, in step S32, the AES decryption process includes: Initial preparation: Divide the encrypted data block into 192-bit blocks in preparation for decryption; confirm the integrity and validity of the decryption key; Decryption rounds: Inverse key addition: First, perform the inverse key addition operation to XOR the last round key with the ciphertext block; Inverse column mixing: In each inverse operation, apply the inverse column mixing operation to restore the data structure; Inverse row shift: In each inverse operation, perform an inverse shift operation on the data row; Inverse byte substitution: Replace the byte with the original value through the inverse S-box; Round loop: Repeat the above inverse operations until the original plaintext data block is restored; Data integrity verification: Use the built-in message authentication code (MAC) to verify the integrity of the decrypted data; once the verification is successful, it is confirmed that the data has not been tampered with and is ready for analysis.

[0035] S33, Data provision and secure access: The system provides the decrypted plaintext data to the user, and the provided data is recorded as an access event to ensure transparency of use; S34, access records: record the user's access behavior and achieve traceability of access records.

[0036] The system records each user's access operation, including access time, user identity, accessed data type and decryption key.

[0037] The log information is stored in a secure log system for subsequent security audits and access tracing; Among them, through log analysis, the system access activities can be monitored in real time, abnormal behaviors can be detected and responded to in a timely manner.

[0038] In summary, the advantages of the present invention are mainly reflected in the following aspects: Technical effects: 1. Data security is significantly improved: The present invention achieves high-strength encryption of geological data by combining the AES advanced encryption standard and the hardware security module (HSM), greatly enhancing the security of the data. The AES algorithm is selected for its high efficiency and strong security. Combined with the 192-bit key generated and managed by the HSM, it ensures that the encryption process is not interfered by the outside world and effectively prevents the risk of data leakage. Compared with traditional software encryption methods, the encryption processing speed of the present invention is faster and the encryption strength is higher, further improving the security of geological data.

[0039] 2. Multi-factor authentication provides higher security: The present invention integrates a multi-factor authentication mechanism, including password verification, fingerprint recognition, facial recognition and other biometric verification. The multi-factor authentication mechanism not only ensures the authenticity of the user's identity, but also provides multiple security guarantees to effectively prevent unauthorized access. Compared with the traditional authentication method that only relies on a single password, the multi-factor authentication mechanism of the present invention greatly improves the security of the system.

[0040] 3. Detailed access records and traceability: The present invention designs a detailed access record function to record the time of each data access, user identity, type of data accessed, decryption key and other information. These records are stored in the log system to achieve traceability and security audit of data access. Through detailed access records, each data access operation can be traced back, which enhances the security and reliability of the system and helps to timely discover and deal with potential security threats.

[0041] Economic effect: 1. Improve geological data management efficiency: The efficient AES encryption algorithm and flexible key management system greatly improve the management efficiency of geological data. Data encryption and decryption are fast, and user authentication and permission management are flexible and convenient, making the storage, transmission and access of geological data more efficient.

[0042] 2. Reduce the risk of data breaches and associated costs: The present invention significantly reduces the risk of geological data leakage through multi-level security measures. Data leakage can bring serious economic losses and legal risks. The present invention effectively prevents data leakage and reduces related costs and risks.

[0043] 3. Support a wide range of engineering applications: The specific application example of the present invention in highway engineering geological survey demonstrates its remarkable effect in actual engineering. Through the safe management and efficient access to geological data, the present invention supports a wide range of engineering applications and improves the management level and data utilization efficiency of geological engineering projects.

[0044] Social impact: 1. Improve geological data security awareness: The present invention improves the security level of geological data management through advanced encryption technology and multi-factor authentication mechanism, and increases the attention paid by users and the industry to data security. A safe and reliable data management system helps to establish and improve the standards and specifications for geological data management.

[0045] 2. Promote technological progress and innovation: The innovation of the present invention in data encryption, identity authentication and authority management has promoted the application and development of information security technology in geological data management. The technical solution of the present invention has promoted the progress and application innovation of information security technology, playing an important demonstration and leading role.

[0046] 3. Enhance public trust and satisfaction: Through an efficient and secure geological data management system, the present invention effectively improves the transparency and reliability of data management, and enhances the public's trust and satisfaction with geological data management. A reliable geological data management system not only ensures the security of data, but also provides better services and support for the public and the industry. Example

[0047] Combination Figures 1 to 4 As shown, the second embodiment provides a geological data access control system based on information encryption on the basis of the first embodiment. The second embodiment includes the technical contents disclosed in the first embodiment, and the technical contents of the second embodiment and the first embodiment are not repeated here. The differences between the second embodiment and the first embodiment are described below.

[0048] The present embodiment provides a geological data access control system based on information encryption, which is used to execute the geological data access control method based on information encryption in the above-mentioned embodiment 1, and specifically includes: a data acquisition module, a data classification module, a data encryption module, an identity authentication and authority management module, a data access control module and an access record and audit module; the data acquisition module is used to acquire geological data; the data classification module is used to classify geological data according to different attributes of the data; the data encryption module is used to encrypt the classified data using AES and HSM; the identity authentication and authority management module is used to perform multi-factor identity authentication when the user logs in, assign different data access rights according to the user role, and retrieve and provide corresponding encryption keys according to the user rights after the user is verified; the data access control module is used to check the user rights when the user requests to access geological data, determine whether the user has the right to access the requested data, and assign corresponding encryption keys to the user according to the rights; after the user uses the assigned encryption key to decrypt the data, the decrypted plaintext data is provided to the user; the access record and audit module is used to record the user's access behavior. Example

[0049] Combination Figures 1 to 4 As shown, this embodiment 3 provides a geological data access control system based on information encryption on the basis of the first and second embodiments, taking highway engineering geological survey as an example: 1) Data collection: Collect geological data for highway surveys, including borehole data, geological profile data, and soil sample data.

[0050] Drilling data includes drilling depth, soil thickness, groundwater level, etc.

[0051] Geological profile data include geological strata, rock types, stratum dip, etc.

[0052] Soil sample data includes soil composition, soil density, water content, etc.

[0053] 2) Data encryption: Use the AES algorithm to encrypt different types of data, generate encryption keys and store them.

[0054] The drilling data is encrypted to generate an encryption key K4.

[0055] The geological profile data is encrypted to generate an encryption key K5.

[0056] The soil sample data is encrypted to generate the encryption key K6.

[0057] The generated encryption keys K4, K5, and K6 are stored in the key management system respectively.

[0058] 3) Access control: When construction personnel need to access geological data, they must first perform multi-factor authentication.

[0059] When construction workers log into the system, they first perform password verification.

[0060] After the password verification is passed, fingerprint recognition or facial recognition is performed.

[0061] After passing multi-factor authentication, the system generates a temporary access token, authorizing construction personnel to access the corresponding data.

[0062] The system retrieves and provides the corresponding encryption key based on its permissions.

[0063] When a construction worker requests access to the drilling data, the system retrieves the encryption key K4.

[0064] Construction workers use key K4 to decrypt the drilling data and obtain detailed information.

[0065] Construction workers use K4 to decrypt the drilling data and obtain decrypted information such as drilling depth, soil thickness and groundwater level.

[0066] The system provides decrypted plaintext data to ensure secure access and use of data.

[0067] 4) Access records: The system records each data access behavior, including access time, user identity, and data type accessed.

[0068] The time, identity and decryption key K4 of each construction worker accessing the drilling data are recorded.

[0069] These records are stored in the log system for subsequent security audits and access tracing.

[0070] In summary, the innovations and advantages of the present invention are: 1. Application of AES advanced encryption standard combined with hardware security module (HSM) in geological data encryption: The present invention uses the AES advanced encryption standard combined with a hardware security module (HSM) to encrypt geological data, greatly improving the security of the data. The AES encryption algorithm encrypts geological data. AES is known for its high efficiency and strong security, and can effectively prevent the risk of data leakage during transmission and storage. HSM is responsible for generating and storing AES encryption keys, and uses its built-in hardware random number generator (HRNG) to ensure the randomness and security of the keys.

[0071] Compared with the traditional soft encryption scheme, the present invention improves the security and reliability of key management through the hardware-level key protection provided by HSM. The use of HSM ensures that the key in the encryption process is not exposed to the external environment, reduces the risk of key leakage, and significantly improves the overall security of geological data. The system has faster encryption processing speed and higher encryption strength, which can not only effectively deal with external attacks, but also meet the requirements of modern geological data management systems for efficiency and security.

[0072] By combining the AES encryption algorithm and HSM technology, the present invention not only realizes strong encryption of geological data, but also significantly improves the confidentiality and integrity of data through a complete key management process and hardware-level security protection. This makes the present invention have significant advantages in preventing data leakage and unauthorized access.

[0073] 2. Integration of multi-factor authentication mechanisms: The present invention integrates a multi-factor authentication mechanism, including password verification, fingerprint recognition, facial recognition and other biometric verification. Multi-factor authentication provides multiple security guarantees, ensuring that only users with strict identity verification can access sensitive geological data. Compared with traditional single-factor authentication, multi-factor authentication greatly improves the security of the system.

[0074] 3. Detailed access records and traceability: The present invention designs a detailed access record function to record the time of each data access, user identity, type of data accessed, decryption key and other information. These records are stored in the log system to achieve traceability and security audit of data access. Through detailed access records, each data access operation can be traced back, enhancing the security and reliability of the system.

[0075] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A geological data access control method based on information encryption, characterized in that: The steps include: S1. Data encryption processing, including: S11, obtaining geological data; S12. Data classification: Classify geological data according to different attributes of the data; S13, data encryption: use AES and HSM to encrypt the classified data; S2, Authentication and Authorization, including: S21. Multi-factor authentication: Users are required to undergo multi-factor authentication when accessing the system; S22. Permission management: The system assigns different data access permissions based on user roles; S23, key acquisition: after the user passes the verification, the system retrieves the corresponding encryption key according to the user's authority; S3, data access control, including: S31, access request processing: the user selects the type of data to be accessed in the system; the system checks the user's authority to determine whether the user has the right to access the requested data; the system assigns the corresponding encryption key to the user according to the authority; S32, data decryption: the user uses the allocated encryption key to decrypt the data and obtain the required geological data; S33, Data provision and secure access: The system provides the decrypted plaintext data to the user, and the provided data is recorded as an access event to ensure transparency of use; S34, access records: record the user's access behavior and achieve traceability of access records.

2. The geological data access control method based on information encryption according to claim 1 is characterized in that: In step S1: S11. Obtain geological data, including: Collecting geological data from geological exploration projects, the geological data including borehole data, geological profile data, soil sample data and groundwater level data; S12, data classification: classify the geological data according to different attributes of the data, and generate classification attribute information including: soil composition data, geological layer data and groundwater level data; The soil composition data includes the chemical composition and physical properties of the soil; The geological stratum data include rock types and stratum information of different strata; The groundwater level data include water level height and water quality parameters; S13. Data encryption: Use AES and HSM to encrypt the classified data.

3. The geological data access control method based on information encryption according to claim 2 is characterized in that: In step S13, the encryption process using AES includes: Key generation: Use a secure random number generator to generate a 192-bit random key; the generated key will be encrypted and stored in the HSM key management system; Data segmentation: Divide the data to be encrypted into blocks of fixed size to adapt to the AES encryption algorithm; The encryption process includes: Step 1: key expansion; the 192-bit key is used to generate a set of round keys through the key expansion algorithm for encryption operations in each round; Step 2: initial round; the data block is transformed in the initial round, including byte substitution and row shift operations in the initial round; Step 3: main round; 12 rounds of main round transformation are performed, each round includes byte substitution, row shift, column mixing and key addition operations; Step 4: final round; the last round of transformation without column mixing is performed; Ciphertext generation: After encryption, the ciphertext data block is output and stored together with the data block index and timestamp to ensure data integrity and traceability; Key management: The generated keys are encrypted and stored in a dedicated key management system.

4. The geological data access control method based on information encryption according to claim 2 is characterized in that: In step S13, the HSM usage includes: Key generation and storage: HSM is used to generate AES encryption keys and store them in encrypted form to prevent unauthorized access. The key generation process is performed inside the HSM, using its built-in hardware random number generator to ensure the randomness and security of the key. Key access control: HSM uses access control lists and user role management to ensure that only authorized users and applications can access keys. Each key generation, access, and use is recorded in the HSM log, providing a complete audit trail. Key backup and recovery: HSM supports key backup and recovery functions. Key backup is performed on physically isolated secure media and requires multiple authentications for recovery. By supporting multiple backup strategies, HSM ensures the key's ability to recover in the event of hardware failure.

5. The geological data access control method based on information encryption according to claim 1 is characterized in that: In step S13, Perform AES encryption on soil composition data to generate encryption key K1; Perform AES encryption on the geological layer data to generate encryption key K2; The groundwater level data is encrypted using AES to generate the encryption key K3.

6. The geological data access control method based on information encryption according to claim 1 is characterized in that: In step S2: S21. Multi-factor authentication: Users are required to undergo multi-factor authentication when accessing the system, including: When a user logs into the system, password verification is first performed; After the password verification is passed, biometric verification is performed; After the biometric verification is passed, a temporary access token is generated to authorize the user to access the corresponding data; S22. Permission management: The system assigns different data access permissions based on user roles; Among them, administrators have full access rights and can read and modify all data; Among them, geological engineers have access to data relevant to exploration and analysis; Among them, ordinary users are limited to viewing public information or low-sensitivity data; S23, key acquisition: After the user passes the verification, the system retrieves and provides the corresponding encryption key according to the user's authority; when the user requests to access specific data, the system provides the corresponding encryption key.

7. The geological data access control method based on information encryption according to claim 1 is characterized in that: In step S3: S31, access request processing: the user selects the type of data to be accessed in the system; the system checks the user's authority to determine whether the user has the right to access the requested data; the system assigns the corresponding encryption key to the user according to the authority; S32, data decryption: the user uses the assigned encryption key to decrypt the data to obtain the required geological data; the decryption process includes: the user downloads the encrypted geological data block from the system; uses the obtained AES key to decrypt, and restores the plaintext data according to the reverse process of encryption; S33, Data provision and secure access: The system provides the decrypted plaintext data to the user, and the provided data is recorded as an access event to ensure transparency of use; S34, access records: record the user's access behavior and realize the traceability of access records; Among them, the system records each user's access operation, including access time, user identity, accessed data type and decryption key; The log information is stored in a secure log system for subsequent security audits and access tracing; Among them, through log analysis, the system access activities are monitored in real time, abnormal behaviors are detected and responded to in a timely manner.

8. The geological data access control method based on information encryption according to claim 7 is characterized in that: In step S32, the AES decryption process includes: Initial preparation: Divide the encrypted data block into 192-bit blocks in preparation for decryption; confirm the integrity and validity of the decryption key; Decryption rounds: Inverse key addition: First, perform the inverse key addition operation to XOR the last round key with the ciphertext block; Inverse column mixing: In each inverse operation, apply the inverse column mixing operation to restore the data structure; Inverse row shift: In each inverse operation, perform an inverse shift operation on the data row; Inverse byte substitution: Replace the byte with the original value through the inverse S-box; Round loop: Repeat the above inverse operations until the original plaintext data block is restored; Data integrity verification: Use the built-in message authentication code to verify the integrity of the decrypted data; after verification, it is confirmed that the data has not been tampered with and is ready for analysis.

9. A geological data access control system based on information encryption, characterized in that: include: Data collection module, data classification module, data encryption module, identity authentication and authority management module, data access control module and access record and audit module; The data acquisition module is used to acquire geological data; the data classification module is used to classify geological data according to different attributes of the data; the data encryption module is used to encrypt the classified data using AES and HSM; the identity authentication and authority management module is used to perform multi-factor identity authentication when the user logs in, assign different data access rights according to the user role, and retrieve and provide the corresponding encryption key according to the user authority after the user passes the verification; the data access control module is used to check the user authority when the user requests to access geological data, determine whether the user has the right to access the requested data, and assign the corresponding encryption key to the user according to the authority; after the user uses the assigned encryption key to decrypt the data, the decrypted plaintext data is provided to the user; the access record and audit module is used to record the user's access behavior.

Images