Communication data security protection method and system based on HSM module

Abstract

The invention discloses a communication data security protection method and system based on an HSM module. Relates to the field of data security transmission, and aims to realize a high-security, high-performance and high-reliability data protection scheme, the method comprises the following steps: S1, an application processor is connected with an HSM module through a system bus, and the HSM module comprises a configuration register, a state register and a data register; s2, loading an SDK (Software Development Kit) by the application processor, wherein the SDK provides an application program interface for interacting with the HSM module; s3, receiving data to be encrypted, and transmitting the data to the HSM module through the API; s4, in the HSM module, initializing a state register, configuring an encryption mode, encrypting the data, and storing the encrypted data in a data register; and S5, the encrypted data is returned through the API. The method is suitable for secure data transmission in the fields of Internet of Things, cloud computing and the like, and an innovative solution is provided for sensitive information protection.

Description

Technical Field

[0001] The present invention relates to the field of communication data security, and in particular to a communication data security protection method and system based on a hardware security module (HSM). Background Art

[0002] With the rapid development of information technology, data security has become one of the major challenges facing society today. As the main means of protecting data security, encryption technology plays a key role in ensuring the privacy, integrity and legal compliance of communication data.

[0003] At present, the mainstream data encryption scheme is mainly based on software implementation, which protects the security of data during transmission and storage by applying various encryption algorithms (such as AES, DES, RSA, etc.). These encryption technologies can not only ensure the privacy of data, but also verify the integrity of data through hash functions and digital signature technologies, providing necessary legal protection for enterprises and individuals.

[0004] However, existing pure software encryption schemes have the following obvious disadvantages: 1. The encryption and decryption process consumes a lot of computing resources, which may cause device performance degradation or increase network latency. For devices or networks with limited resources, this additional burden may bring significant performance and cost issues. 2. The security of encryption technology depends largely on the management and use of keys. The processes such as key generation, distribution, storage and destruction require strict security measures and procedures, otherwise it is easy to cause key leakage, which will cause serious security problems. 3. Although encryption algorithms and protocols have been rigorously tested and verified, there may still be unknown security vulnerabilities and attack risks. With the improvement of computing power and the emergence of new attack methods, some encryption schemes may face the risk of being cracked. 4. The use of encryption technology may increase the complexity and difficulty of user operations, thereby reducing the overall user experience. This is particularly evident in some scenarios where frequent encryption operations are required.

[0005] Faced with these challenges, traditional pure software encryption solutions can no longer meet the growing data security needs, especially in areas with extremely high security requirements such as the Internet of Things, industrial control, and financial transactions. Therefore, the industry urgently needs a new communication data security protection solution that can overcome the above shortcomings and has the characteristics of high security, high performance, high portability, and easy integration. This solution must not only be able to effectively protect data security, but also be able to adapt to different application scenarios and hardware platforms, and be able to flexibly respond to new security threats that may emerge in the future. Summary of the invention

[0006] The present invention solves the problem that communication data security methods are difficult to meet the requirements of high security, high performance, high portability and easy integration, and proposes a communication data security protection method and system based on the HSM module. By integrating encryption operations into the HSM hardware module, the application service component can reduce CPU resource consumption, avoid key leakage and security problems that may be caused by key management and use through software, improve user experience, and make user-side operations seamless; at the same time, the HSM operation is encapsulated as a dynamic library and a standard API interface is provided to decouple it from the application layer, thereby improving the portability and modularity of the system.

[0007] In order to achieve the above object, the present invention adopts the following technical solution: a communication data security protection method based on an HSM module, comprising the following steps: S1, the application processor is connected to the HSM module through the system bus, and the HSM module contains configuration registers, status registers and data registers; S2, the application processor loads the SDK, which provides an application programming interface (API) for interacting with the HSM module, enabling the application layer to call the functions of the HSM module, thus realizing the bridge between the application layer and the HSM hardware. Users can easily call the functions of the HSM without directly operating the hardware; S3, the application processor receives the data to be encrypted from the user or the upper-layer application, and transmits the data to the data register of the HSM module through the API provided by the SDK; S4, in the HSM module, initialize the status register, configure the encryption method, encrypt the data, and store the encrypted data in the data register. The encryption key can be securely stored inside the HSM and not exposed to the external environment; S5 returns encrypted data through the API.

[0008] In this technical solution, a multi-layer security mechanism based on the HSM module is used to ensure the security and reliability of communication data. First, the data to be encrypted is received through the API interface provided by the SDK to ensure the standardization and consistency of data transmission. Subsequently, the hardware acceleration capability of the HSM module is used to perform data encryption processing, including initializing the status register, configuring encryption parameters, executing the encryption algorithm, and storing the results.

[0009] In the HSM module, the encryption method and related parameters are first set by configuring the register to ensure the controllability and flexibility of the encryption process. Then, the hardware encryption engine is used to efficiently encrypt the input data, which greatly improves the encryption speed and reduces system resource consumption. After the encryption is completed, the encryption result is stored in the data register, and the status register is updated to indicate that the operation is completed.

[0010] Finally, the encrypted data is read through the API interface and returned to the application. Throughout the process, the hardware characteristics of the HSM module ensure the security of the key and the non-tamperability of the encryption process, effectively preventing security threats at the software level. At the same time, the design of the API interface realizes hardware abstraction and improves the portability and ease of use of the system.

[0011] Furthermore, the hardware random number generator in the HSM module generates an encryption key to ensure the randomness of key generation and the efficiency of encryption processing.

[0012] Furthermore, the unified application programming interface of the SDK performs encryption, logging and error handling functions.

[0013] Furthermore, the method also includes decrypting the received encrypted data through the HSM module at the receiving end.

[0014] Furthermore, the encryption method includes but is not limited to RSA and AES encryption algorithms.

[0015] Furthermore, it also includes providing an embedded operating system that integrates a secure boot mechanism and resource isolation technology to provide a running environment for the HSM module and the application layer.

[0016] Furthermore, the security function is executed in an independent user-mode process of the embedded operating system, and the security function is placed in an independent user-mode process to improve the stability and security of the system.

[0017] Furthermore, the method further includes encrypting the data in the HSM module built into the local gateway, and uploading the encrypted data to the cloud server via the Internet.

[0018] The present invention also provides a communication data security protection system based on an HSM module, comprising: an HSM module including a configuration register, a status register and a data register for performing data encryption and decryption; Software Development Kit (SDK), which provides an application programming interface (API) to enable the application layer to call the HSM module; Embedded operating system manages system resources and provides operating environment for HSM modules and application layer; User interface (UI), which provides an operational interface that allows users to initiate encryption and manage data security; Among them, the HSM module supports multiple encryption algorithms, the UI is implemented using Web technology, and the system can automatically encrypt and decrypt data in transmission and prevent data transmission from being interrupted.

[0019] Furthermore, it also includes providing a user interface (UI) through which a user initiates encryption and manages data security.

[0020] Compared with the prior art, the present invention has the following beneficial effects: Data encryption is achieved through hardware security modules, greatly improving security performance; Adopting layered software architecture to decouple application development from underlying implementation, making it easier for system expansion and transplantation; Provide a trusted execution environment to prevent data from being maliciously tampered with and stolen; Supports multiple mainstream encryption algorithms to meet different security requirements; Provides a friendly user interface, supports flexible configuration of encryption policies, and facilitates user operation and management; Realize end-to-end automated encrypted communication, ensure data integrity during transmission, and reduce the burden on users. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 This is a flow chart of communication data security protection based on the HSM module of Example 1.

[0022] Figure 2 This is an architecture diagram of the HSM module data encryption processing of Example 2.

[0023] Figure 3 This is an architecture diagram of the communication data security protection system based on the HSM module of Example 2.

[0024] Figure 4 This is a diagram of communication data security data processing and communication architecture based on the HSM module of Example 2.

[0025] Figure 5 This is a flow chart of the HSM module data encryption process of Example 3. DETAILED DESCRIPTION

[0026] The technical solution of the present invention is further specifically described below through embodiments and in conjunction with the accompanying drawings.

[0027] Embodiment 1: like Figure 1 and 2 FIG. 1 is a flow chart of a HSM module in accordance with an embodiment of the present invention for performing security protection on communication data. As shown in the figure, the flow chart mainly includes the following steps.

[0028] Step S1: Provide an HSM module, which includes a configuration register, a status register and a data register. The HSM module is an independent hardware security chip with a built-in dedicated encryption operation circuit, which can realize high-speed and low-power cryptographic operations. The HSM is connected to the main control CPU using a bus interface circuit. When the HSM service is needed, the CPU sends instructions and data to the HSM through the bus. After the HSM is executed, the result is returned to the CPU in an encrypted form. To ensure communication security, security isolation measures are also set between the CPU and the HSM, such as a memory protection unit (MPU) and a watchdog timer. The MPU is responsible for isolating the addressing space of the HSM from other parts of the system to prevent unauthorized access; the watchdog timer can monitor the operating status of the HSM. Once an abnormality (such as timeout, error, etc.) occurs, a reset signal is immediately generated to restore the system to its initial security state.

[0029] Step S2: Provide an application programming interface (API) through the software development kit (SDK) so that the application layer can easily call the functions of the HSM module. The SDK adopts a layered architecture design, which is composed of the application layer, framework layer, and driver layer from top to bottom. The layers communicate through a unified interface. The application layer is oriented to the end user and provides functions such as data encryption and key management; the framework layer encapsulates the register operation of the HSM module and provides a unified device access interface; the driver layer directly operates the HSM hardware to complete the underlying services such as encryption and decryption. The layered architecture makes the responsibilities and interfaces between the layers clear, facilitates independent development and testing, and improves the maintainability and portability of the system.

[0030] The SDK also provides a wealth of API functions, covering data encryption, key management, status query and other aspects. Taking data encryption as an example, the SDK provides the following APIs: initializing the HSM module, setting encryption parameters, single-package data encryption, and single-package data decryption. The application only needs to call these API functions and pass in the corresponding parameters to implement data encryption and decryption. The specific implementation details of HSM are transparent to the application.

[0031] Step S3: The application transfers the data to be encrypted to the HSM module through the API. The HSM module first checks whether the current state is idle. If the HSM is executing other tasks, the application needs to wait. When the HSM is idle, the application writes the plaintext data to the HSM data register (TRNG_DATA32) and sets the status register (DMU_HF_CONFIRM0) to "encryption request", indicating that there is a new encryption task.

[0032] Step S4: The HSM module starts to execute the encryption task. First, the HSM reads the configuration register (UCB_HSMCFG) to obtain the parameters of this encryption task, such as the encryption algorithm used (AES / DES / RSA, etc.), key length (128 / 192 / 256 bits), encryption mode (ECB / CBC, etc.), initial vector IV, etc. These parameters can be passed in by the application when calling the encryption API, or they can be pre-burned in the secure storage area of ​​the HSM. The HSM encrypts the plaintext data according to these parameters and writes the encryption result back to the data register. After the encryption is completed, the HSM sets the status register to "encryption completed", indicating that the encryption task has been completed.

[0033] Step S5: The application reads the status register to check whether the encryption task is completed. If the encryption is completed, the application reads the ciphertext data from the data register and returns it to the caller through the API. At this point, the encryption process ends.

[0034] It should be noted that the decryption process is similar to the encryption process, except that in step S4, the HSM performs a decryption operation instead of an encryption operation. At the same time, in order to improve data throughput, the HSM also supports continuous encryption and decryption of multiple packets of data. The application can initiate multiple encryption or decryption requests through the API, and the HSM can pipeline multiple data packets.

[0035] The HSM module of this embodiment stores cryptographic operations and key data in an independent hardware security chip, adopts strict isolation measures, and minimizes the risk of key leakage and data theft. The HSM module also supports a variety of mainstream encryption algorithms and security protocols, which can meet the security requirements of different application scenarios.

[0036] Embodiment 2: Based on Example 1, the above-mentioned communication data security protection system based on the HSM module is described in more detail.

[0037] like Figure 4 As shown. The local system communicates with the cloud server through the Internet. The gateway has a built-in HSM module, which is responsible for encrypting the data uploaded to the cloud and decrypting the data downloaded from the cloud. The gateway is also connected to data collection devices such as sensors, which can collect environmental data and encapsulate it in formats such as JSON.

[0038] The local gateway runs a data collection agent program, which communicates with the sensor through serial ports, USB and other interfaces, and periodically reads the sensor's measurement data. The agent program calls the API interface provided by the SDK and uses the device key preset in the HSM module to encrypt the collected JSON data with AES to ensure that the data will not be sniffed or tampered with. The encrypted data is uploaded to the cloud through secure channels such as HTTPS.

[0039] After receiving the data, the cloud server can store it in the database or trigger subsequent applications such as big data analysis. To protect statically stored data, the server also deploys a matching HSM module and uses storage keys to encrypt important data. The key itself is protected by the secure storage provided by the HSM, forming a complete key management system. In a multi-tenant scenario, the cloud service adopts a microservice architecture and virtualization technology to support the isolation of different user data.

[0040] To facilitate users to access cloud data, the system also provides supporting mobile apps and web pages. Users can view device status, analyze historical data, and remotely control devices through a friendly visual interface. The system uses the OAuth2 authentication system and supports both local and third-party account logins, ensuring secure and controllable access. The mobile and web terminals communicate with the backend service through the API gateway, which integrates reverse proxy, traffic control, circuit breaker and current limiting functions to improve the availability and elasticity of the system.

[0041] This embodiment demonstrates an end-to-cloud integrated security solution that comprehensively covers key links such as communication, storage, and access. This solution provides important security guarantees for the digital transformation of industries such as industry, energy, and transportation, and has broad application prospects.

[0042] The HSM-based communication data security protection method and system provided by the present invention realizes security protection of the entire life cycle of data through software and hardware collaborative design. By sinking the encryption operation to the HSM hardware, the data is always in an encrypted state, eliminating the risk of software attacks such as memory data theft; at the same time, by encapsulating HSM operations through portable dynamic libraries and combining standardized API interfaces, the system has good compatibility and scalability. Compared with traditional software encryption solutions, the present invention has obvious advantages in security, performance, reliability, ease of use, etc., and represents the technical development direction in the field of data security.

[0043] Embodiment 3: Example 3 Based on Example 2, Figure 1, a communication data security protection method based on an HSM module is proposed. This method is more specific than Example 1 and is a specific implementation method of steps S1 to S5 of Example 1.

[0044] like Figure 3 As shown, this system adopts a vertically layered and horizontally partitioned architecture design, which includes the field device layer, edge gateway layer, AP encapsulation layer and cloud-received data layer from bottom to top.

[0045] Device collection: On-site devices collect various types of raw data (such as sensor sampling, device status, etc.), call the HSM's encryption and signature API, use the device key to encrypt the data and calculate the signature, and package it into a secure data frame, which is sent to the nearest edge gateway through the bus.

[0046] Edge processing: The gateway receives data frames from the bus and calls the HSM's decryption and signature verification API in batches to obtain trusted plaintext data. Then, the gateway filters, cleans, and aggregates the data according to preset rules, and calls the HSM's encryption API to use the session key to re-encrypt the resulting plaintext, and finally securely uploads it to the AP through the MQTT over TLS channel.

[0047] Data access: AP obtains the data published by the gateway from the MQTT Broker, first calls HSM to decrypt the plain text, then classifies the data according to metadata features (such as device ID, business type), and writes it to the corresponding message queue. Then, AP processes each message queue in batches, calls the KMS of the business system to obtain the business key, re-encrypts the data through HSM, and finally distributes it to the target system through APIs such as socket or restful.

[0048] Business applications: The cloud-based time series library, big data platform, MES and other systems continuously collect industrial data by connecting to the southbound interface of the AP. Each system can choose to call its own HSM card to decrypt data in real time or in batches according to the needs of the scenario and write it to the storage. When using the data, the system only needs to query and analyze the plaintext data. The encryption and decryption of the data is transparently completed by the HSM, and the developers do not need to be aware of it.

[0049] The field equipment layer consists of various intelligent terminals distributed in the industrial field, such as sensors, controllers, actuators, intelligent meters, etc. Each terminal device has a built-in customized lightweight HSM security chip, which is responsible for encrypting, signing, authenticating and other security processing of the business data collected or received by the device.

[0050] Specifically, the device HSM uses a high-performance, low-power ARM Cortex-M series microcontroller, equipped with an independent hardware encryption engine and secure storage unit. The encryption engine supports symmetric encryption algorithms such as AES and SM4 and hash algorithms such as SHA256 and SM3, with a computing speed of more than 100Mbps. Secure storage uses multiple independent SPI Flashes with a capacity ranging from 32KB to 1MB, which are used to store sensitive data such as device ID, keys, configuration parameters, etc., and have power-off protection and anti-tampering functions.

[0051] After the device is powered on, the MCU loads the HSM firmware and initializes each module. Then, the HSM establishes a communication connection with the device's main control MCU through bus interfaces such as I2C and SPI. The HSM firmware provides a set of standard security APIs for the main control MCU to call, such as genRandomNum (generate random numbers), encrypt (encryption), decrypt (decryption), sign (signature), verify (signature verification), etc.

[0052] When data is generated or received, the device master MCU calls the encrypt and sign functions of the HSM, uses the preset device key (symmetric key or public-private key pair) to encrypt and protect the integrity of sensitive data, and packages the ciphertext data and signature into a secure data frame. The frame structure consists of a frame header (device ID, timestamp, serial number), a ciphertext data body, and a frame footer (signature, CRC check). After packaging, the device MCU sends the secure frame to the nearest edge gateway through field bus interfaces such as RS485 and CAN.

[0053] The edge gateway layer consists of several industrial servers deployed on site, usually using high-performance computing platforms such as x86 and ARM64 and general-purpose operating systems such as Linux and Windows. The main function of the gateway is to achieve data aggregation, transfer and protocol conversion between the device layer and the AP layer.

[0054] Each gateway has 1-2 high-performance PCIe encryption cards built in, providing the full cryptographic computing capabilities of the HSM. The encryption card uses a national secret algorithm chip and a high-performance multi-core processor, which can achieve a data throughput of more than 20Gbps and hundreds of thousands of concurrent signature verifications per second. At the same time, the encryption card also has strict physical security protection and complies with the FIPS140-2Level 3 standard.

[0055] The gateway runs a custom-developed data processing program to access the HSM's cryptographic services through standard interfaces such as PKCS#11 provided by encryption card manufacturers. The program is responsible for the following functions: (1) Receive security frames sent by devices from each connected bus and store them in the message queue; (2) Read security frames in batches from the message queue, call the HSM's decrypt function to decrypt using the device key, and obtain the plaintext data and signature; (3) Call the HSM’s verify function and use the device’s public key to verify the integrity and source authenticity of the plaintext data; (4) Perform pre-processing such as cleaning, normalization, and compression on the plaintext data that has passed the signature verification according to the configured filtering conditions and aggregation strategies; (5) Package the pre-processed plaintext data into a common format such as JSON according to standard IoT protocols such as MQTT; (6) Call the HSM's encrypt function and use the session key issued by the AP layer to encrypt the JSON plaintext to obtain an encrypted data packet; (7) Send the encrypted data packet to the specified AP server through the TLS / SSL secure tunnel.

[0056] In addition, to ensure the stability of data transmission under complex working conditions, the gateway program also implements fault-tolerant mechanisms such as link management, data caching, and breakpoint resumption: Keep heartbeat with the connected bus, monitor link status in real time, and actively reconnect once interruption is detected; A cache partition is created in the local SSD to temporarily store data packets that have not yet received an AP response to prevent data loss. After receiving the ACK confirmation frame from the AP, the corresponding data packet is deleted from the cache partition to release storage space; When the upstream network is blocked or interrupted, newly generated data packets will continue to be written into the cache until the storage is full; After the network is restored, the gateway sends the cached data packets in sequence until the cache is completely exhausted, thus achieving breakpoint resumption.

[0057] The AP encapsulation layer is deployed in a high-availability cluster on the enterprise intranet or public cloud, responsible for connecting industrial data to the enterprise information system. The AP server can use x86 or ARM architecture and install enterprise-level operating systems such as Windows Server and RedHat EnterpriseLinux.

[0058] Each AP node is equipped with 1 to 2 high-performance HSM PCI encryption cards (meeting FIPS140-2 Level 3), providing encryption and decryption capabilities of no less than 10Gbps. To achieve tenant isolation, each tenant / business system applies for an independent HSM partition, with different keys for data protection.

[0059] The AP runs a customized data stream processing engine and calls the key management and cryptographic operation services provided by the HSM through the API interface provided by the encryption card manufacturer. The processing flow of the engine is as follows: (1) AP acts as an MQTT Client, establishes a connection with a designated Broker, and subscribes to receive encrypted data packets sent by all gateways; (2) For the received data packets, call the HSM decrypt interface in sequence, use the corresponding session key to decrypt, and obtain the plaintext JSON data; (3) Based on the metadata such as device ID, timestamp, and business type carried in the JSON, the data is classified and archived, and written into the message queue as a cache; (4) Periodically batch process each message queue, call the HSM's encrypt interface to encrypt using the business key, and package it into a standard format; (5) According to different business queues, the encrypted data is distributed to the corresponding cloud service or internal application system through socket, RESTful interface, etc.

[0060] The engine will also monitor requests from various business systems and start a separate processing channel for data that needs to be pushed in real time. In addition, the engine has built-in high-throughput message queues such as Kafka and RabbitMQ and distributed caches such as Redis and Memcached to ensure that the AP can support high-concurrency processing of industrial big data.

[0061] The data layer received by the cloud generally refers to various data platforms and application systems deployed in public clouds, private clouds or enterprise intranets, such as MES, ERP, SCADA, big data analysis platforms, etc. These systems are adapted to the data flow engine of the AP through standard southbound interfaces to realize the collection of industrial data.

[0062] Taking a typical time series database as an example, the receiving and processing flow of the cloud system is described as follows: (1) The time series database acts as the data subscriber of the AP by subscribing to the corresponding service data queue; (2) After receiving a batch of encrypted data from the queue, the time series database calls the KMS API to obtain the business key (national encryption SM4) and decrypts the plaintext data through the local HSM card; (3) Split the plaintext data according to device ID and timestamp, and write them into different table partitions, such as one independent partition for each device per day; (4) After the data is written, the time series database will automatically create multi-dimensional indexes (such as equipment, time, indicators, etc.) to facilitate subsequent query retrieval; (5) For scenarios with high data computing requirements, the time series library also supports integration with big data processing frameworks such as Spark and Flink to provide more powerful analysis capabilities.

[0063] Thanks to API access adaptation, industrial data can be safely and efficiently shared with other business systems of the enterprise to give full play to the value of data. When using data, each system only needs to maintain its own business key, without paying attention to the original encryption method and storage format of the data, which greatly reduces the complexity of data security protection.

[0064] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc., which contain computer-usable program codes.

Claims

1. A communication data security protection method based on an HSM module, characterized in that: The following steps are involved: S1, the application processor is connected to the HSM module through the system bus, and the HSM module includes a configuration register, a status register and a data register; S2, the application processor loads the SDK, which provides an application program interface for interacting with the HSM module; S3, the application processor receives the data to be encrypted from the user or the upper layer application, and transmits the data to the data register of the HSM module through the API provided by the SDK; S4, initializing the status register of the HSM module, configuring the encryption method, encrypting the data, and storing the encrypted data in the data register; S5, returning the encrypted data through the API.

2. The method according to claim 1, characterized in that It also includes generating an encryption key through a hardware random number generator in the HSM module; the encryption method includes but is not limited to RSA and AES encryption algorithms.

3. The method according to claim 1, characterized in that It also includes performing encryption, logging and error handling functions through the unified application program interface of the SDK.

4. The method according to claim 1, characterized in that It also includes the configuration register selecting a corresponding encryption method to encrypt data; the API interface return value is a character pointer type.

5. The method according to claim 1, characterized in that It also includes executing secure boot and resource isolation through the embedded operating system; and executing security functions in an independent user mode process of the embedded operating system.

6. The method according to claim 3, characterized in that It also includes the application layer developer transferring the encrypted data to be sent into the security system by calling the software interface provided in the SDK.

7. The method according to claim 6, characterized in that It also includes encrypting the data to be encrypted in the HSM module built into the local gateway, and uploading the encrypted data to the cloud server via the Internet.

8. The method according to claim 1, characterized in that The encrypted data is transferred via the configuration register, and after decryption is completed, it is also stored in the data register and returned via the software interface, forming a new encryption control within the communication API of the network socket.

9. A communication data security system adapted to the communication data security method based on the HSM module according to claim 1, characterized in that: include: HSM module, used to perform data encryption and decryption operations; Software development kit, which provides application programming interfaces; Embedded operating system, used to manage system resources, run HSM modules and application layer; User interface, which is used to provide an operating interface and perform encryption and manage data security; The system can automatically encrypt and decrypt data in transmission and prevent data transmission from being interrupted.

10. A communication data security system based on an HSM module according to claim 9, characterized in that: It also includes providing a user interface through which users initiate encryption and manage data security.

Images