Railway vehicle operation intelligent mobile terminal safety protection system

Abstract

The invention relates to a railway vehicle operation intelligent mobile terminal security protection system, which comprises a security chip integrated in an intelligent mobile terminal and used for executing data encryption, decryption and tamper-proof detection inside and outside the intelligent mobile terminal, and the security chip performs data encryption and decryption operation by adopting a national password standard algorithm; the data encryption module is used for encrypting all data in the transmission process of the intelligent mobile terminal through the security chip; the identity authentication module is used for performing bidirectional identity authentication on two communication parties before the intelligent mobile terminal communicates with external equipment or a system; and the anti-tamper detection module is connected between the security chip and the intelligent mobile terminal, and is used for automatically triggering a protection mechanism by the security chip when the intelligent mobile terminal detects physical tampering, clearing all sensitive data and locking the equipment. The system is based on the security protection capability of the national secret security chip, the security performance of the intelligent mobile terminal is comprehensively improved, and the security of data and communication is guaranteed.

Description

Technical Field

[0001] The present invention relates to the technical field of intelligent mobile terminals for railway locomotive and vehicle operations, and in particular to a safety protection system for intelligent mobile terminals for railway locomotive and vehicle operations. Background Art

[0002] With the development of the railway transportation industry, intelligent mobile terminals for railway vehicle operations are widely used in the management and dispatching of railway vehicles. Intelligent mobile terminals for railway vehicle operations play an important role in railway vehicle operations with their portability, anti-interference, real-time, functional integration, safety and reliability. They are an important force in promoting the modernization of the railway transportation industry and have brought more efficient, safer and smarter solutions to railway vehicle operations. The terminal integrates multiple functions such as barcode scanning, RFID identification, GPS positioning and wireless communication. However, since these functions involve the transmission of a large amount of sensitive data, there are greater security risks. The traditional security protection technology of intelligent mobile terminals for railway vehicle operations is relatively single in terms of data encryption, identity authentication and anti-tampering, and cannot provide comprehensive security protection. Therefore, it needs to be improved. Summary of the invention

[0003] Based on this, it is necessary to provide a railway locomotive operation intelligent mobile terminal security protection system to address the problem that the traditional railway locomotive operation intelligent mobile terminal security protection technology has relatively single functions in data encryption, identity authentication and anti-tampering, and cannot provide comprehensive security protection.

[0004] The present invention provides a railway vehicle operation intelligent mobile terminal safety protection system, comprising: A security chip, integrated in the smart mobile terminal, is used to perform data encryption, decryption and anti-tampering detection inside and outside the smart mobile terminal. The security chip uses the national cryptographic standard algorithm to perform data encryption and decryption operations; A data encryption module is used to encrypt all data during transmission of the smart mobile terminal through a security chip, wherein the data during transmission includes barcode scanning results, RFID identification information, GPS positioning data and wireless communication data; An identity authentication module, used to perform two-way identity authentication on both communicating parties before the smart mobile terminal communicates with an external device or system; The anti-tampering detection module is connected between the security chip and the smart mobile terminal, and is used to automatically trigger the protection mechanism of the security chip, clear all sensitive data and lock the device when the smart mobile terminal detects physical tampering.

[0005] In one of the embodiments, the security chip is connected to the smart mobile terminal via a hardware interface, and the security chip generates a key for encryption and decryption operations.

[0006] In one of the embodiments, the system further includes a business management platform and a unified management and control platform, the key is securely generated and distributed through the business management platform, and the key is transmitted through the unified management and control platform.

[0007] In one of the embodiments, the unified management and control platform uses a digital envelope to securely transmit the key.

[0008] In one of the embodiments, the smart mobile terminal constructs an identity authentication request by calling the SDK of the security chip, and the business management platform verifies the signature data, and returns the identity authentication result after successful verification.

[0009] In one of the embodiments, the identity authentication module uses the national secret algorithm SM2 and the public key infrastructure to perform two-way identity authentication on the communicating parties.

[0010] In one of the embodiments, the identity authentication module uses biometric technology to perform two-way identity authentication on both communicating parties, and the biometric technology includes fingerprint recognition or facial recognition, or the identity authentication module uses a certificateless method for authentication.

[0011] In one of the embodiments, the system supports the trusted computing architecture and uses domestic information technology software and hardware products.

[0012] In one embodiment, the anti-dismantling detection module includes an anti-dismantling switch, which is connected to a security chip and abuts against an inner side of a protective box of a smart mobile terminal. When the smart mobile terminal detects a disassembly action, the anti-dismantling switch triggers the security chip to perform a data destruction operation and lock the device.

[0013] In one of the embodiments, the data encryption module uses the national encryption algorithm SM4 to encrypt data transmission. During the data interaction process, the initiator encrypts the data and the receiver uses a shared symmetric key to decrypt it.

[0014] The above-mentioned railway vehicle operation intelligent mobile terminal security protection system, on the one hand, integrates a security chip and adopts a national secret algorithm to encrypt and decrypt data, ensuring that data in the transmission process will not be illegally intercepted or tampered with, thereby improving the security of data transmission and preventing data leakage and tampering. At the same time, a two-way identity authentication mechanism is used to replace the traditional one-way identity authentication to ensure the legitimacy of the identities of both communicating parties and prevent identity impersonation and illegal access. On the other hand, through the design of the anti-dismantling detection module, once physical damage is detected, the intelligent mobile terminal automatically clears sensitive data and locks the device, thereby improving the physical security of the intelligent mobile terminal and preventing physical attacks, thereby comprehensively improving the security performance of the intelligent mobile terminal and ensuring the security of data and communications. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0016] Figure 1 It is a schematic diagram of the structure of a railway vehicle operation intelligent mobile terminal safety protection system in one embodiment; Figure 2 The figure is a schematic diagram of the identity authentication and encryption / decryption process in one embodiment.

[0017] Reference numerals: 100. Security chip; 200. Data encryption module; 300. Identity authentication module; 400. Anti-tampering detection module; 410. Anti-tampering switch; 500. Business management platform; 600. Unified management and control platform. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0019] It should be noted that when a component is referred to as being "fixed to" or "disposed on" another component, it may be directly on the other component or there may be a central component. When a component is considered to be "connected to" another component, it may be directly connected to the other component or there may be a central component at the same time. The terms "vertical", "horizontal", "upper", "lower", "left", "right" and similar expressions used in the specification of the present invention are for illustrative purposes only and do not represent the only implementation method.

[0020] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0021] In the present invention, unless otherwise clearly specified and limited, a first feature being “above” or “below” a second feature may mean that the first feature is directly in contact with the second feature, or the first feature and the second feature are indirectly in contact through an intermediate medium. Moreover, a first feature being “above”, “above” or “above” a second feature may mean that the first feature is directly above or obliquely above the second feature, or simply means that the first feature is higher in level than the second feature. A first feature being “below”, “below” or “below” a second feature may mean that the first feature is directly below or obliquely below the second feature, or simply means that the first feature is lower in level than the second feature.

[0022] Unless otherwise defined, all technical and scientific terms used in the specification of the present invention have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The term "and / or" used in the specification of the present invention includes any and all combinations of one or more related listed items.

[0023] With the development of the railway transportation industry, intelligent mobile terminals for railway vehicle operations are widely used in the management and dispatching of railway vehicles. Intelligent mobile terminals for railway vehicle operations play an important role in railway vehicle operations with their portability, anti-interference, real-time, functional integration, safety and reliability. They are an important force in promoting the modernization of the railway transportation industry and bring more efficient, safer and smarter solutions to railway vehicle operations. The terminal integrates multiple functions such as barcode scanning, RFID identification, GPS positioning and wireless communication. However, since these functions involve the transmission of a large amount of sensitive data, there are greater security risks.

[0024] Currently, smart mobile terminals on the market usually use software to implement encryption protection, such as using symmetric encryption algorithms such as DES and AES to encrypt data. However, these encryption measures are powerless when facing complex attack methods. The existing technical solutions have the following defects: 1. Insufficient encryption strength: In pure software implementation, key management and storage have certain risks and are vulnerable to side channel attacks (such as electromagnetic leakage, cache attacks) and software vulnerability attacks.

[0025] 2. Single identity authentication: The current intelligent mobile terminals for railway vehicle operations usually use simple usernames and passwords or one-way authentication methods. This method is vulnerable to threats such as man-in-the-middle attacks, identity impersonation and replay attacks. It lacks a two-way authentication mechanism and is difficult to ensure the legitimacy of the identities of both communicating parties.

[0026] 3. Weak anti-tampering capability: Software protection measures in existing technologies mainly rely on operating system-level protection, such as memory protection and process isolation. However, these measures have limited effectiveness in the face of physical attacks (such as hardware debugging and reverse engineering). Lacking effective hardware anti-tampering design, existing terminals are easily disassembled, debugged, and tampered with maliciously, resulting in sensitive information leakage and device function failure.

[0027] In summary, the existing technical solutions have relatively simple functions in data encryption, identity authentication and anti-tampering, and cannot provide comprehensive security protection. These shortcomings make smart mobile terminals have greater security risks when processing sensitive data and key tasks. Therefore, there is an urgent need for a more secure and reliable solution to deal with complex attack methods and ensure the security of data and communications.

[0028] Therefore, the following will combine Figure 1-Figure 2 The invention describes a railway vehicle operation intelligent mobile terminal safety protection system.

[0029] like Figure 1 As shown, in one embodiment, a security protection system for an intelligent mobile terminal for railway vehicle operation includes a security chip 100 , a data encryption module 200 , an identity authentication module 300 and an anti-disassembly detection module 400 .

[0030] The security chip 100 is integrated inside the smart mobile terminal. The security chip 100 is used to perform data encryption, decryption and anti-tampering detection inside and outside the smart mobile terminal. The security chip 100 uses the national cryptographic standard algorithm to perform data encryption and decryption operations.

[0031] The data encryption module 200 is used to encrypt all data during the transmission process of the smart mobile terminal through the security chip 100. The data during the transmission process includes barcode scanning results, RFID identification information, GPS positioning data and wireless communication data.

[0032] It should be noted that the data encryption module 200 uses the national encryption algorithm SM4 to encrypt data transmission. During the data interaction process, the initiator encrypts the data and the receiver uses a shared symmetric key to decrypt it.

[0033] The identity authentication module 300 is used to perform two-way identity authentication on both communicating parties before the smart mobile terminal communicates with an external device or system.

[0034] The tamper-proof detection module 400 is connected between the security chip 100 and the smart mobile terminal, and is used for automatically triggering the protection mechanism of the security chip 100 to clear all sensitive data and lock the device when the smart mobile terminal detects physical tampering.

[0035] It should be noted that the anti-dismantling detection module 400 includes an anti-dismantling switch 410, which is connected to the security chip 100. The anti-dismantling switch 410 abuts against the inner side of the protective box of the smart mobile terminal. When the smart mobile terminal detects a disassembly action, the anti-dismantling switch 410 triggers the security chip 100 to perform a data destruction operation and lock the device.

[0036] The railway vehicle operation intelligent mobile terminal security protection system, on the one hand, integrates the security chip 100 and adopts the national secret algorithm to encrypt and decrypt data, ensuring that the data in the transmission process will not be illegally intercepted or tampered with, thereby improving the security of data transmission and preventing data leakage and tampering. At the same time, a two-way identity authentication mechanism is adopted to replace the traditional one-way identity authentication to ensure the legality of the identities of the communicating parties and prevent identity impersonation and illegal access. On the other hand, through the design of the anti-dismantling detection module 400, once physical damage is detected, the intelligent mobile terminal automatically clears sensitive data and locks the device, thereby improving the physical security of the intelligent mobile terminal and preventing physical attacks, thereby comprehensively improving the security performance of the intelligent mobile terminal and ensuring the security of data and communications.

[0037] In this embodiment, the security chip 100 is connected to the smart mobile terminal via a hardware interface, thereby improving the security of the smart mobile terminal and protecting sensitive data from external threats. The security chip 100 generates keys for encryption and decryption operations.

[0038] Among them, hardware interfaces include SPI (Serial Peripheral Interface), I²C (Inter-Integrated Circuit Interface), USB (Universal Serial Bus), NFC (Near Field Communication), etc.

[0039] The operation flow of encryption and decryption of the security chip 100 is as follows: Key generation: The security chip 100 generates encryption keys and shares necessary encryption information with the smart mobile terminal through a hardware interface.

[0040] Data encryption: The smart mobile terminal sends the data to be encrypted to the security chip 100. The security chip 100 encrypts the data using the key stored internally and returns the encrypted data to the smart mobile terminal.

[0041] Data decryption: When decryption is required, the smart mobile terminal sends the encrypted data to the security chip 100, the security chip 100 uses the key to perform a decryption operation and returns the decrypted data to the smart mobile terminal.

[0042] Key management: The security chip 100 periodically updates the key, or performs key revocation and rotation operations through instructions from the smart mobile terminal to ensure long-term security.

[0043] In this embodiment, the system further includes a business management platform 500 and a unified management and control platform 600 . The keys are securely generated and distributed through the business management platform 500 , and the keys are transmitted through the unified management and control platform 600 .

[0044] It should be noted that the unified management and control platform 600 uses a digital envelope to securely transmit keys.

[0045] In this embodiment, the smart mobile terminal constructs an identity authentication request by calling the SDK (Software Development Kit) of the security chip 100, and the business management platform 500 verifies the signature data and returns the identity authentication result after successful verification.

[0046] See also Figure 2 , the identity authentication and encryption and decryption process is as follows: A certificate application request is initiated at the smart mobile terminal, and the business management platform 500 sends the certificate application request to the unified management and control platform 600 for issuance, and returns the issued certificate to the smart mobile terminal.

[0047] The service management platform 500 applies for identity authentication for the smart mobile terminal and returns authentication parameters to the smart mobile terminal.

[0048] The smart mobile terminal constructs an identity authentication request and sends it to the service management platform 500 , and the service management platform 500 returns the identity authentication result to the smart mobile terminal.

[0049] The smart mobile terminal verifies the terminal identity through the identity authentication result.

[0050] The intelligent mobile terminal performs data encryption processing through the business management platform 500, sends the encrypted data to the business management platform 500, and returns the data after the business management platform 500 decrypts the data.

[0051] In this embodiment, the identity authentication module 300 uses the national secret algorithm SM2 and the public key infrastructure to perform two-way identity authentication on the communicating parties.

[0052] Through national secret algorithms and identity authentication mechanisms, two-way authentication between smart mobile terminals and external devices or systems is achieved to ensure the legitimacy of the identities of both communicating parties.

[0053] In one embodiment, the identity authentication module 300 may also use biometric technology to perform two-way identity authentication on both communicating parties, and the biometric technology includes fingerprint recognition or facial recognition.

[0054] Two-way authentication requires not only the user to verify their identity, but also the other party in the communication (such as a service provider, device, or network) to verify its identity. This ensures that both parties are authenticated and eliminates the possibility of impersonation or deception. In addition, biometric technologies such as fingerprint recognition and facial recognition are unique and difficult to forge, which improves the security and reliability of authentication.

[0055] In one embodiment, the identity authentication module 300 may also use a certificateless method for authentication. Compared with certificate authentication relying on a public key infrastructure, the certificateless authentication method is more flexible, has lower management costs, and can simplify the complex certificate issuance and management process.

[0056] Among them, the main methods of certificateless authentication include: 1. Authentication based on shared keys: This method relies on a pre-shared symmetric key for authentication. Both parties share a key before communication, and use the key to encrypt and decrypt the transmitted data during communication. The specific process includes: Key sharing: Prior to authentication, the communicating parties share a key in a secure manner, which can be achieved through physical exchange or a secure channel (such as encrypted initial communication).

[0057] Data encryption and authentication: In actual communication, both parties use the shared key to encrypt and decrypt the transmitted data to ensure the confidentiality and integrity of the data.

[0058] 2. Authentication based on hash functions (such as HMAC): HMAC (Hash-based Message Authentication Code) is a widely used certificateless authentication method that uses hash functions and shared keys to generate message authentication codes to ensure the authenticity and integrity of messages. The specific process is as follows: Key sharing: The communicating parties share a secret key in advance.

[0059] Authentication code generation: The sender uses the shared key and the message to generate an authentication code using the HMAC algorithm and sends it along with the message.

[0060] Authentication verification: The receiver uses the same shared key to generate an HMAC and compares it with the received authentication code to verify the authenticity of the message and the identity of the sender.

[0061] 3. Authentication based on zero-knowledge proof: Zero-knowledge proof is a cryptographic protocol that allows one party (the prover) to prove its identity or possession of a secret to another party (the verifier) ​​without revealing the specific secret itself. This method can achieve certificateless secure identity authentication. Common applications include anonymous transactions and identity authentication in cryptocurrencies. The specific process includes: Identity information encryption: The prover encrypts his or her own identity information and generates a proof through a complex mathematical algorithm.

[0062] Verification process: The verifier checks whether the proof meets the conditions through the verification algorithm, thereby confirming the identity of the prover without obtaining specific identity information.

[0063] 4. Authentication based on blockchain and distributed identity: Distributed identity is a certificate-free identity authentication method based on blockchain technology. Users do not rely on centralized certificate authorities, but manage and verify their identities through distributed ledgers and smart contracts. The specific process is as follows: Identity generation: Users identify themselves by generating a unique distributed identity (usually a cryptographic public-private key pair), which is usually stored on the blockchain and associated with the user's encrypted data.

[0064] Authentication: When performing identity authentication, users can prove that they are the holders of distributed identities through private key signing without the need for traditional certificates and certification authorities.

[0065] It should be noted that the security protection system for intelligent mobile terminals for railway locomotive operations supports the trusted computing architecture. By adopting domestic information technology software and hardware products, the security protection system for intelligent mobile terminals for railway locomotive operations further improves the autonomy, controllability and security of the system.

[0066] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0067] The above-described embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the present invention. It should be pointed out that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the attached claims.

Claims

1. A railway vehicle operation intelligent mobile terminal safety protection system, characterized in that: include: A security chip, integrated in the smart mobile terminal, is used to perform data encryption, decryption and anti-tampering detection inside and outside the smart mobile terminal. The security chip uses the national cryptographic standard algorithm to perform data encryption and decryption operations; A data encryption module is used to encrypt all data during transmission of the smart mobile terminal through a security chip, wherein the data during transmission includes barcode scanning results, RFID identification information, GPS positioning data and wireless communication data; An identity authentication module, used to perform two-way identity authentication on both communicating parties before the smart mobile terminal communicates with an external device or system; The anti-tampering detection module is connected between the security chip and the smart mobile terminal, and is used to automatically trigger the protection mechanism of the security chip, clear all sensitive data and lock the device when the smart mobile terminal detects physical tampering.

2. The railway vehicle operation intelligent mobile terminal safety protection system according to claim 1 is characterized in that: The security chip is connected to the intelligent mobile terminal via a hardware interface, and the security chip generates a key for encryption and decryption operations.

3. The railway vehicle operation intelligent mobile terminal safety protection system according to claim 2 is characterized in that: The system also includes a business management platform and a unified management and control platform. The key is securely generated and distributed through the business management platform, and the key is transmitted through the unified management and control platform.

4. The railway vehicle operation intelligent mobile terminal safety protection system according to claim 3 is characterized in that: The unified management and control platform uses a digital envelope to securely transmit keys.

5. The railway vehicle operation intelligent mobile terminal safety protection system according to claim 3 is characterized in that: The smart mobile terminal constructs an identity authentication request by calling the SDK of the security chip, and the business management platform verifies the signature data, and returns the identity authentication result after successful verification.

6. The railway vehicle operation intelligent mobile terminal safety protection system according to claim 5 is characterized in that: The identity authentication module uses the national secret algorithm SM2 and the public key infrastructure to perform two-way identity authentication on both communicating parties.

7. The railway vehicle operation intelligent mobile terminal safety protection system according to claim 5 is characterized in that: The identity authentication module uses biometric technology to perform two-way identity authentication on both communicating parties, and the biometric technology includes fingerprint recognition or facial recognition, or the identity authentication module uses a certificateless method for authentication.

8. The railway vehicle operation intelligent mobile terminal safety protection system according to claim 7 is characterized in that: The system supports the trusted computing architecture and uses domestic information technology software and hardware products.

9. The railway vehicle operation intelligent mobile terminal safety protection system according to any one of claims 1 to 8, characterized in that: The anti-disassembly detection module includes an anti-disassembly switch, which is connected to the security chip and abuts against the inner side of the smart mobile terminal protection box. When the smart mobile terminal detects a disassembly action, the anti-disassembly switch triggers the security chip to perform a data destruction operation and lock the device.

10. The railway vehicle operation intelligent mobile terminal safety protection system according to claim 9 is characterized in that: The data encryption module uses the national secret algorithm SM4 to encrypt data transmission. During the data interaction process, the initiator encrypts the data and the receiver uses a shared symmetric key to decrypt it.

Images