Internet of vehicles data classification and level-to-level management and self-adaptive encryption and decryption method and system thereof

Abstract

The invention discloses an Internet of Vehicles data classification and level-to-level management and self-adaptive encryption and decryption method and system. The method comprises the following steps: marking acquired Internet of Vehicles data; presetting different data types, security levels and encryption and decryption strategies for the marked Internet of Vehicles data according to actual demands of the Internet of Vehicles; and adopting a natural language processing model and a random forest model to automatically identify the security level of the Internet of Vehicles data, and encrypting and decrypting the Internet of Vehicles data with different security levels through an encryption and decryption strategy. By adopting the technical scheme of the invention, the data security levels in the Internet of Vehicles can be effectively distinguished, efficient differential encryption and decryption of data of different security levels can be realized, and an Internet of Vehicles system can be helped to effectively manage and protect the data.

Description

Technical Field

[0001] The present invention belongs to the field of vehicle networking security technology, and specifically relates to a vehicle networking data classification and grading management and adaptive encryption and decryption method and system. Background Art

[0002] The Internet of Vehicles refers to connecting cars with other vehicles, infrastructure and cloud services through Internet technology to achieve information exchange and interaction between vehicles and between vehicles and the environment. The core of the Internet of Vehicles system is to efficiently realize information exchange and connection between people, cars, roads and cloud platforms. In this system, the "cloud" is not only a data center and service center, but also plays a key role. It is responsible for providing computing and content services for the Internet of Vehicles. Through in-depth analysis and processing of data, it delivers a number of key services such as traffic management, vehicle information, and collaborative driving to the Internet of Vehicles, thereby significantly improving traffic efficiency and driving safety.

[0003] The application scenarios of the Internet of Vehicles are rich and varied, and are mainly divided into two categories: information services and smart transportation. Information service applications are designed to enhance user experience, including navigation, entertainment, remote diagnosis and rescue, news information, shared travel, and car insurance. Smart transportation applications focus on improving vehicle driving and collaboration capabilities, including autonomous driving, smart distribution, intelligent control of traffic lights, adaptive cruise optimization, and smart parking management. These applications need to collect a large amount of personal information to provide customized services, and use on-board external cameras to collect real-time information outside the vehicle to achieve intelligent collaboration with road infrastructure.

[0004] However, IoV data is dynamic, has a wide span of time and space, is highly localized, highly random, and has a limited life cycle. Due to the large amount of data and real-time updates, it contains a variety of information, some of which may involve national security; others may involve personal privacy, such as information recorded by vehicle trajectory monitoring systems. These centrally stored sensitive information have become the main target of attackers. In order to protect this data, it is necessary to encrypt the data to improve encryption efficiency and data protection effects. Faced with the challenges of IoV data security, existing encryption schemes can no longer meet the needs, and fixed encryption strategies may increase system resource consumption, reduce performance, and increase the risk of hacker attacks. Summary of the invention

[0005] The technical problem to be solved by the present invention is to provide a method and system for classification and hierarchical management of Internet of Vehicles data and adaptive encryption and decryption, so as to realize different encrypted storage of Internet of Vehicles data with different security levels and realize automatic processing of hierarchical classification.

[0006] To achieve the above object, the present invention adopts the following technical solution: A method for classification and hierarchical management of Internet of Vehicles data and adaptive encryption and decryption, comprising: Mark the acquired Internet of Vehicles data; According to the actual needs of the Internet of Vehicles, different data types and security levels, as well as encryption and decryption strategies are preset for the marked Internet of Vehicles data; the data provider uses a hierarchical encryption tree to fill the data to construct an encryption and decryption strategy; The natural language processing model and random forest model are used to automatically identify the security level of Internet of Vehicles data, and encryption and decryption strategies are used to encrypt and decrypt Internet of Vehicles data of different security levels.

[0007] Preferably, encryption and decryption of Internet of Vehicles data at different security levels include: Data Provider Assemble multiple data to be encrypted into a plaintext block, and set the data used to encrypt a plaintext block to , and sorted according to the data security level. The data order after sorting is ; Use padding to combine plaintext blocks into one large plaintext block , and traverses the hierarchical encryption tree to encrypt the data at each layer; Data Provider Ciphertext The Shamir threshold secret sharing algorithm is used to split the data into Block; Builder , and Random Assignment times, among which, The data of each time is different and not 0, recorded as , and finally get Different value, that is ; For each data Each , establish its The corresponding relationship between each data After data segmentation, the segmented data is formed ,in, ; Use BCC20 information segmentation technology to And carry out serial number marking and verification; Cloud server CS1 stores the segmented data together with the corresponding data sequence number and auxiliary serial number Collection, Timestamp and the corresponding summary of the data; cloud server CS2 stores the data The corresponding value Data sequence number of the data and auxiliary serial number Collection, Timestamp ; During data access, the data accessor Send a decryption request to cloud servers CS1 and CS2. CS1 and CS2 verify the validity of the signature information. CS1 obtains the security level of the data based on the data ID. Then CS1 verifies Whether there is access permission; CS1 queries the serial number based on the data ID and auxiliary serial number , according to the serial numbering rules, find the interval where the data is located, and obtain all the corresponding data value( ) and a summary of their corresponding data ;CS1 uses its own private key to sign the corresponding data security level Generate Certificate ; Each and , , Pack, get messages, respectively, returned ; CS2 query corresponding Value and generate certificate ,Will Value and return ; Request a key from the Key Management Center (KMS). After receiving the request, KMS will Find the key set of the corresponding level in the corresponding key set , returning it to ; After obtaining the data and key, select The data is then solved and the original ciphertext is restored by solving the polynomial, and the integrity of the data is verified using the summary; according to the security level of the data, Perform the corresponding decryption operation and finally restore the data.

[0008] Preferably, the data provider Want to transfer data When uploading, the data Marked as a quad : ,in, Represents common attributes of data; Key-value pairs representing data, used to store rules, , A space used to describe the security level of data.

[0009] As a preferred method, the hierarchical encryption tree is traversed to encrypt the data at each layer. Specifically, at the first layer, the symmetric encryption algorithm AES is used to encrypt the data to generate a ciphertext. ; In the second layer, the Paillier encryption method is used to encrypt the ciphertext of the first layer and the data of the second layer to obtain the ciphertext and ; In the third layer, the Logistic one-dimensional chaotic map is used to encrypt the third layer data and the first two layers of ciphertext to generate the ciphertext , and ; At the 4th layer, a hash function is used on the 4th layer data and the first 3 layers of ciphertext to generate a summary of each data and ciphertext.

[0010] The present invention also provides a vehicle networking data classification and hierarchical management and adaptive encryption and decryption system, including: A first processing module, used for marking the acquired Internet of Vehicles data; The second processing module is used to preset different data types and security levels, as well as encryption and decryption strategies for the marked Internet of Vehicles data according to the actual needs of the Internet of Vehicles; The third processing module uses natural language processing models and random forest models to automatically identify the security level of Internet of Vehicles data, and encrypts and decrypts Internet of Vehicles data of different security levels through encryption and decryption strategies.

[0011] Preferably, the third processing module comprises: The first processing unit is used to enable the data provider Assemble multiple data to be encrypted into a plaintext block, and set the data used to encrypt a plaintext block to , and sorted according to the data security level. The data order after sorting is ; Use padding to combine plaintext blocks into one large plaintext block , and traverses the hierarchical encryption tree to encrypt the data at each layer; The second processing unit is used to enable the data provider Ciphertext The Shamir threshold secret sharing algorithm is used to split the data into Block; Builder , and Random Assignment times, among which, The data of each time is different and not 0, recorded as , and finally get Different value, that is ; For each data Each , establish its The corresponding relationship between each data After data segmentation, the segmented data is formed ,in, ; Use BCC20 information segmentation technology to And carry out serial number marking and verification; The third processing unit is used to make the cloud server CS1 store the segmented data together with the corresponding data sequence number and auxiliary serial number Collection, Timestamp and the corresponding summary of the data; cloud server CS2 stores the data The corresponding value Data sequence number of the data and auxiliary serial number Collection, Timestamp ; The fourth processing unit is used for, during the data access process, the data accessor Send a decryption request to cloud servers CS1 and CS2. CS1 and CS2 verify the validity of the signature information. CS1 obtains the security level of the data based on the data ID. Then CS1 verifies Whether there is access permission; The fifth processing unit is used to enable CS1 to query the serial number of the data according to its ID and auxiliary serial number , according to the serial numbering rules, find the interval where the data is located, and obtain all the corresponding data value( ) and a summary of their corresponding data ;CS1 uses its own private key to sign the corresponding data security level Generate Certificate ; Each and , , Pack, get messages, respectively, returned ; CS2 query corresponding Value and generate certificate ,Will Value and return ; The sixth processing unit is used to Request a key from the Key Management Center (KMS). After receiving the request, KMS will Find the key set of the corresponding level in the corresponding key set , returning it to ; The seventh processing unit is used to After obtaining the data and key, select The data is then solved and the original ciphertext is restored by solving the polynomial, and the integrity of the data is verified using the summary; according to the security level of the data, Perform the corresponding decryption operation and finally restore the data.

[0012] Preferably, the second processing module is used to enable the data provider Want to transfer data When uploading, the data Marked as a quad : ,in, Represents common attributes of data; Key-value pairs representing data, used to store rules, , A space used to describe the security level of data.

[0013] Preferably, the first processing unit traverses the hierarchical encryption tree and performs encryption processing on the data at each layer, specifically: at the first layer, the symmetric encryption algorithm AES is used to encrypt the data to generate a ciphertext ; In the second layer, the Paillier encryption method is used to encrypt the ciphertext of the first layer and the data of the second layer to obtain the ciphertext and ; In the third layer, the Logistic one-dimensional chaotic map is used to encrypt the third layer data and the first two layers of ciphertext to generate the ciphertext , and ; At the 4th layer, a hash function is used on the 4th layer data and the first 3 layers of ciphertext to generate a summary of each data and ciphertext.

[0014] Compared with the prior art, the present invention has the following advantages and effects: 1) The present invention introduces automated grading technology that can automatically grade data. Pre-trained language models (BERT) are used to process textual descriptions of data attributes. These models improve the recognition accuracy of data features by deeply parsing the semantic relationships of text. Combined with fine-grained named entity recognition technology, specific entities in the data, such as vehicle models and traffic signal status, are accurately identified. In addition, dependency syntactic analysis helps reveal the semantic connections between attribute values ​​and further refines the classification logic. Through the random forest model, the model integrates multiple decision trees to optimize the processing of large amounts of data and improve classification accuracy. This intelligent technology greatly improves the efficiency and accuracy of data security ratings.

[0015] 2) To protect data confidentiality, hierarchical encryption operations are used, especially for sensitive data. Advanced encryption algorithms are used to encrypt data containing sensitive information, reduce encryption calculation overhead, and improve data encryption efficiency and security.

[0016] 3) To ensure data security, multiple encryption and decryption measures are used, and appropriate encryption measures are taken for data of different security levels. At the same time, segmentation technology is used to mark the data sequence number, which helps to better manage and identify data. This comprehensive application of multiple encryption and decryption technologies improves data security and management efficiency, and provides a reliable solution for the security protection of Internet of Vehicles data.

[0017] 4) The present invention uses data segmentation technology to cut data into small blocks for transmission, which improves fault tolerance, transmission efficiency and security. Traditional methods will cause overall transmission failure if data is lost, but the present invention can maintain integrity by retransmitting some data blocks. In addition, small block transmission reduces delays and costs, and improves the reliability and stability of data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0019] Figure 1 It is a schematic diagram of the entity structure of the vehicle networking data classification and hierarchical management and adaptive encryption and decryption method of the present invention; Figure 2 It is a flow chart of the method for classification and hierarchical management of Internet of Vehicles data and adaptive encryption and decryption of the present invention; Figure 3 It is a schematic diagram of security level identification; Figure 4 It is a schematic diagram of a hierarchical encryption tree; Figure 5 It is a schematic diagram of segmentation technology. DETAILED DESCRIPTION

[0020] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0022] Embodiment 1: The embodiment of the present invention provides a method for classification and hierarchical management of Internet of Vehicles data and adaptive encryption and decryption to address the urgent need for data security protection in the current Internet of Vehicles system. The Internet of Vehicles system consists of three levels: cloud-pipe-end. Starting from the "end" layer, data acquisition in the vehicle network comes from various types of sensing roadside units, mobile hardware devices, and intelligent networked vehicles. These devices are responsible for performing the tasks of data acquisition and sensing vehicle status. The "pipe" layer is responsible for data transmission. As a channel connecting the cloud and the end, communication technology is used to realize communication between vehicles and various networks. The cloud platform provides Internet of Vehicles management and information services, and screens, analyzes, and stores uploaded data. The embodiment of the present invention aims to protect data security, better meet the needs of the Internet of Vehicles system, improve system performance, reduce security risks, and provide reliable protection for Internet of Vehicles application services.

[0023] Corresponding to the architecture of the Internet of Vehicles system, the embodiment of the present invention includes five entities, such as Figure 1 As shown, they are the key management center, central node, cloud server, Internet of Vehicles data provider, and data accessor.

[0024] 1) Key Management Service (KMS): It is a fully trusted key management center used to generate signature keys required by Internet of Vehicles data providers and manage the keys.

[0025] 2) Hub Node (HN): The present invention assumes that the HN is honest and trustworthy. It is responsible for classifying and grading the data using natural language processing features.

[0026] 3) Cloud Servers (CSs): They are responsible for storing encrypted data. CSs contain the encrypted data and the data encoding sequence. There are two cloud servers, CS1 and CS2, and the security assumption is that the two cloud servers will not collude with each other.

[0027] 4) IoV Data Providers (DPs): Data providers in the system, including vehicle and monitoring providers. DPs collect and generate various IoV data and upload them to the system for processing and storage. These data may include population, road, weather, traffic behavior, etc.

[0028] 5) Data Accessors (DAs): Data accessors in the system.

[0029] The relevant definitions involved in the present invention are described as follows: Definition 1. Index value According to the general requirements of intelligent connected vehicle data, 11 indicators, including individual legitimate interests, organizational legitimate interests, public interests, economic operation, social stability, national security, business development, technological progress, economic benefits, cost investment, and irreplaceability, are selected as the data features of random forest to build the model. For each indicator, set its value ,in The value range is {0, 1, 2, 3}, Set to 4. , it means that the indicator value is the highest.

[0030] Definition 2: Data security level In order to avoid inadequate encryption of high-security data or over-encryption of low-security data, it is necessary to classify the security level of Internet of Vehicles data. After the classification is completed, different encryption measures are taken for data of different levels. . For level I, For level II, Grade III, It is level IV, and level I, level II, level III and level IV represent extremely important, high, medium and low respectively.

[0031] Table 1 is a data classification table, which shows the classification factors and data levels. It can be seen that the data security level directly affects the degree of damage that may be caused by the data after being attacked. Once high-security level data is attacked, it may bring serious consequences and needs to be encrypted and protected first; low-security level data has a lower risk of being attacked, and low-level encryption can be considered. Data of different security levels require corresponding security protection strategies to ensure the data security and stability of the Internet of Vehicles system.

[0032] Table 1 like Figure 2 As shown, an embodiment of the present invention provides a method for classification and hierarchical management of Internet of Vehicles data and adaptive encryption and decryption, which marks the acquired Internet of Vehicles data; presets different data types and security levels, as well as encryption and decryption strategies for the marked Internet of Vehicles data according to the actual needs of the Internet of Vehicles; uses a natural language processing model and a random forest model to automatically identify the security level of Internet of Vehicles data, and encrypts and decrypts Internet of Vehicles data of different security levels through encryption and decryption strategies, including: Step S1: System initialization S101, the key management center KMS is initialized.

[0033] Enter security parameters , initialize the ECC cryptosystem and select a large prime number Finite field of order , and define an elliptic curve on it ,exist Select an order , the generator is The additive group , and then use random numbers As its private key, and calculate the public key In addition, KMS selects two public hash functions , , exposing the public parameters of the two hash functions and ECC.

[0034] S102, central node HN, data provider , Data Requester Register with the cloud server CSs.

[0035] HN sends a registration request to KMS through a secure channel. After receiving the request, KMS selects a random number for it. , and calculate the public key , the public-private key pair is transmitted through a secure channel Return to HN.

[0036] A registration request is sent to KMS through a secure channel. After receiving the request, KMS selects a random number for it. , and calculate the public key , the public-private key pair is transmitted through a secure channel Return to .

[0037] A registration request is sent to KMS through a secure channel. After receiving the request, KMS selects a random number for it. , and calculate the public key , the public-private key pair is transmitted through a secure channel Return to .

[0038] CS1 sends a registration request to KMS through a secure channel. After receiving the request, KMS selects a random number for it. , and calculate the public key , the public-private key pair is transmitted through a secure channel Return to CS1.

[0039] CS2 sends a registration request to KMS through a secure channel. After receiving the request, KMS selects a random number for it. , and calculate the public key , the public-private key pair is transmitted through a secure channel Return to CS2.

[0040] S103. Data Provider Get the key.

[0041] Generate request information ,in, The timestamp generated for the request, Send the request information via a secure channel Send to KMS.

[0042] KMS received After that, verify the timestamp and generate the symmetric key , used for later symmetric key encryption; randomly select two prime numbers and q , as much as possible to ensure and The lengths of are close or equal (high security), calculate and ,in, Represents the least common multiple; random selection ,satisfy ;make , , the public key is ; The private key is , this set of public and private keys is used as the public and private keys to generate the Paillier key; finally, select an initial value and a system parameter As the key of chaotic encryption, and Finally, KMS sends the message Send via secure channel ,in, Is a unique identifier for this set of keys.

[0043] Step S2: Transmit data tag S201, data type conversion. Because the data type of the Internet of Vehicles contains data such as road images, the image must be converted. The image data format will be converted in the following way: the 0 and 1 bit streams of the digital image are grouped by row, with each group containing a maximum of 94 bits, until all bit sequences are assigned to a group. Each group is then encoded, and the characters from "!" to "~" are assigned values ​​1-94 in sequence, and the space character "space" is assigned a value of 0. In order to encode the 0 and 1 bit streams in the digital image into text form, the character values ​​are mapped using the following formula: .

[0044] If the value of the corresponding column position of the digital image is 0, it is replaced by the character "space"; if it is 1 and the column position If the value is 0, it is replaced with the character "~"; if it is 1 and the column position If the value of is not 0, it is replaced with a character with the corresponding character value. Finally, these characters are connected to form text to represent the encoded digital image.

[0045] S202, data tagging is established. The encryption strategy is data-oriented, and the data to be encrypted is the object of the encryption strategy. In order to encrypt data of different security levels, the encryption and decryption structure is defined according to the security level of the data. Therefore, the data can be mapped to the hierarchical encryption tree according to the security level, considering the encryption and decryption strategy under the hierarchical situation. In order to realize the subsequent data classification function, the data will be marked as follows: When data provider Want to transfer data When uploading, first upload the data Labeled as a quad: ,in, Represents common attributes of data; Represents its key-value pair, used to store rules. , A space used to describe the security level of data. Initialize to , indicating that the security level has not yet been planned. The common attributes represented include data type, data size, data source, data collection time, user type, and data encryption security target, etc. Among them, data types include structured data, such as personnel, vehicles, and road information, and unstructured data, such as road images; data sources include basic data provided by the government, such as population, vehicles, roads, and weather, and also include traffic behavior data collected from vehicles, monitoring equipment, etc.; user types include vehicles, pedestrians, managers, etc. involved in traffic, as well as data analysts such as traffic-related departments and navigation service agencies; the data encryption security target attribute is a textual description of the confidentiality of the data.

[0046] The key-value pairs represented are used to describe each data format: (1) define and analyze the data format and store it as a key-value pair to ensure a clear data structure; (2) establish and analyze the format conversion rules and store them as a key-value pair for subsequent data processing; (3) describe known data types and store them as a key-value pair to ensure the integrity of data information; (4) convert the data format according to the rules and store the conversion results in a key-value pair to meet the data format requirements.

[0047] The security level space is S203. Data Provider Send data tag.

[0048] Label the data Use central node The public key Encryption, generate encrypted data labels , and then use your own private key Signature, get the signed data , then the signed tag Send to HN, where express The timestamp of generation.

[0049] S204: The central node HN receives the data label.

[0050] HN received , first verify the timestamp If the data is invalid, the data is discarded. Otherwise, The public key Verify the correctness of the signature. If the verification passes, Decrypt with your own private key to get the final data label , otherwise the data will be discarded.

[0051] Step S3: Build a random forest model S301. Process the data using a natural language processing model to extract features and index values. In the attributes of Internet of Vehicles data, the encryption target is usually described in words rather than directly giving the specific value of each index. In order to accurately determine the eleven index values ​​in the data set, the processing process of the natural language processing model is as follows: First, apply pre-trained language models (such as BERT) to deeply understand text. These models are pre-trained on a wide range of corpora and can capture the complex relationships between words, phrases, and sentences, effectively identifying and understanding entities and intent in text.

[0052] Secondly, fine-grained named entity recognition (FNER) technology is used to identify specific entities in the text, such as names of people, places, organizations, vehicle models, traffic signal status, weather conditions, etc., to determine the relevant indicator values.

[0053] Furthermore, dependency parsing is used to explore the semantic similarities between attribute values ​​to optimize the understanding and classification of attribute values.

[0054] Finally, combined with entity relationship extraction technology, the relationships between indicators are extracted from the text, such as identifying events and behavior patterns, thereby enriching the dataset information and helping to extract data related to the data security level.

[0055] Through these steps, eleven indicator values ​​of all data are accurately determined. These indicator values ​​are used to evaluate the security level of the data. Their definition is shown in Definition 2, and the detailed definition of the indicators is shown in Definition 1. The random forest model is used to determine the security level. Through the natural language processing model, the security level of the Internet of Vehicles data can be more accurately classified, providing a solid foundation for subsequent adaptive encryption and decryption work.

[0056] S302, data preprocessing. First, the extracted non-numerical features are digitized to construct a standardized feature representation. This step includes using label encoding to convert text and category data into a numerical format that the model can process, ensuring that the data can be effectively used in subsequent analysis.

[0057] S303, decision tree construction. From the Internet of Vehicles dataset Randomly draw with replacement samples, forming a training subset . For a subset , randomly selected without replacement Feature Sets As the decision basis for each node of the decision tree. Starting from the root node, according to Gini Impurity, the decision tree is generated layer by layer. This method improves generalization ability by enhancing randomness and reducing overfitting of the model.

[0058] S304, decision tree pruning. The present invention uses the minimum error pruning (MEP) method to prune the decision tree. Perform pruning operations. Specifically: for each non-leaf node in the tree, calculate the node error , and then the branch error is calculated based on the weighted proportion of training samples each branch has. , then terminate the loop and output the decision tree, otherwise cut off the subtree. The calculation formula is: S305, random forest construction. By repeatedly executing the process of decision tree establishment and pruning Second, generate a decision tree Each tree is built independently, with random features and samples selected to enhance the diversity of the model. These decision trees are combined to form a random forest, which improves the accuracy and robustness of the overall prediction through ensemble learning methods.

[0059] S306, sample classification. From the Internet of Vehicles dataset Separate the untrained data from the training set to form the test set From the test set Extract samples from , and input it into each decision tree of the random forest for classification. The final classification result of each sample is determined by the prediction results of each tree in the forest through majority voting. This process continues until all samples in the test set are classified. At this point, the model training and data classification combining natural language processing and random forest technology have been completed.

[0060] Step S4: The central node HN performs data classification S401, HN division Security level.

[0061] HN calls natural language processing models and random forest classification models, such as Figure 3 As shown, Input into the random forest to obtain the final security level of the data type. The random forest model divides the data into four levels. The purpose of this algorithm is to determine the level of data or data packets. The output result is the security level. , will modify the data tag The value of , the data at this time is marked as: , .

[0062] S402. HN returns a data tag.

[0063] HN will label the data Use the corresponding Encryption to get the encrypted data label , and then use your own private key Sign it and send the message Sent back to the data provider. express The timestamp of generation.

[0064] S403. Data Provider Receive data tags.

[0065] Data Provider receive After that, first verify the timestamp If it is invalid, resend the request message to HN. Otherwise, use the public key of HN Verify the correctness of the signature. If the verification is successful, Decrypt with your own private key to get the final data label Otherwise, resend the request message to HN.

[0066] Step S5: Data provider Using hierarchical encryption tree to fill data S501, assemble plaintext blocks. In order to reduce the computational overhead of encryption and improve the flexibility of data input, Encrypt multiple data at the same time. Data of different security levels are divided into one plaintext block. The block sizes of four security levels, namely, level I, level II, level III and level IV, are set according to the maximum length limit of each field. The ratios of the block sizes of the four levels to the total plaintext blocks are: , , , ,in, . Define the plaintext block as: .

[0067] S502: Fill and sort the plain text in the encryption and decryption work queue. Represents a block, Length Greater than or equal to plaintext block The size of the data in level I. For each plaintext data that enters the queue , the data length is ,set up Indicates the length of data already in the block. , then the block will no longer be added to the data , but use the filling algorithm to fill the block, otherwise, the data Fill in the blocks. After filling one block, continue to fill the next block, and repeat the above steps until all blocks are filled.

[0068] S503, data is established into a hierarchical encryption tree. The data is sequentially added to the encryption and decryption work queue according to level I, level II, level III and level IV. According to the nature of the queue, the order of data out of the queue is level I, level II, level III and level IV. In step S502, a whole plaintext block has been Divided into small pieces, ,like Figure 4 As shown in the figure, a hierarchical encryption tree is constructed by using a hierarchical traversal method. It can be seen that the security level of the encryption tree decreases from top to bottom, showing a layered situation. In practical applications, for different levels, the size of each layer can be adjusted, and the number of layers of hierarchical encrypted data can be increased to correspond to more encryption measures.

[0069] Step S6: Data encryption S601, set the data that can be encrypted by a plaintext block to First, they are sorted according to their data security levels. After sorting, the data order is Use the method in step S502 to fill the plaintext block to obtain a large plaintext block. This enables encryption of messages of any length. Then the hierarchical encryption tree will traverse the data of each layer, and the The data value of a layer is defined as .

[0070] S602, The hierarchical encryption tree first traverses the first layer of data and outputs it, using the symmetric encryption method to encrypt each output data. First, select a symmetric encryption algorithm AES to encrypt the data, and record the algorithm as The data value of layer 1 is defined as , using a symmetric key To encrypt each data in the plaintext file ,Right now , expressed as , generate a ciphertext file . is the complete ciphertext of level I, .

[0071] S603, The hierarchical encryption tree traverses the second layer of data and outputs it, using the Paillier encryption method. Encrypt it. The data value of the second layer is defined as Encrypted separately and all ciphertexts of level I For each data in the second layer , choose a random number , calculate the ciphertext : , because of the homomorphic nature of encryption, each ciphertext in the first layer can be encryption, ,Right now .

[0072] S604, The hierarchical encryption tree traverses the third layer of data and outputs it, and uses the chaotic mapping method to map the third layer of data and the previous ciphertext. The third layer of data value is defined as Specifically, the present invention uses Logistic one-dimensional chaotic mapping to encrypt data. Then, for each data to be processed Use Logistic one-dimensional chaotic mapping to generate the corresponding chaotic sequence ,in Indicates The number of iterations of data, In order to achieve a fully chaotic state, it can be iterated multiple times. Then, the generated chaotic sequence is normalized to The normalized one-dimensional chaotic sequence is converted into the same as the text to be encrypted. The same size of two-dimensional chaotic sequence. Finally, for each data Perform an XOR operation on the two-dimensional chaotic sequence and the ASCII code of the corresponding encrypted text to obtain the encrypted ciphertext The same method is used for the first and second layers of ciphertext and Encrypt, get , The encryption algorithm is denoted as .

[0073] S605, The hierarchical encryption tree traverses the fourth layer of data and outputs it. , using a hash function Generate data Summary , and connect the two together, that is (in, Indicates string concatenation, the same below). For the ciphertext of the first, second, and third layers , , The same method is used to generate its summary. The steps are as follows: For each , make a hash summary ; For each , make a hash summary ; For each , make a hash summary Similarly, concatenate the ciphertext and the summary together, that is, (in ).

[0074] Step S7: Upload data to the cloud server S701, Data Provider The encrypted data is segmented. Let the data processed by step S6 (including the final encrypted data and the fourth layer data) be Then, Shamir threshold secret sharing algorithm is used to divide the data into block data, and agreed that as long as The split data ( ), you can restore the data The specific segmentation algorithm is: First Random Selection -1 random number, record them as Next, construct the function , and Random Assignment times, among which, The data of each time is different and not 0, recorded as , and finally get Different value, that is For each data Each , establish its The corresponding relationship.

[0075] S702, data segmentation. The data sequence marking method adopts BCC20 information segmentation technology, such as Figure 5 As shown. Operate each encrypted data and the fourth layer data according to the above algorithm to obtain indivual ( ). Then, in the order of the encrypted data and the fourth layer data, all Write them together and divide them into segments. First, determine the longest data length , let the length of a segment be , and determine the shortest data length , if the shortest data length is less than , then you need to fill the data and then fill it. The second step is to divide each data into Length segment, each to a length , just mark a serial number , define the four blocks as , and let the offset be , each to a length , just mark an auxiliary serial number , defining this part as The space occupied by each data is in the range The serial number content encoding rules are shown in step S704.

[0076] S703, data interval determination. For each data segment , if the space it occupies is satisfy , then there must exist an interval that satisfies or , so the data is marked with a serial number in the interval where it is located; if the space it occupies is satisfy , then there must exist ,have , and there is , At this time, the sequence number of the data is marked in the interval For each piece of data, the last bit is the check bit, and the check value Used to determine the integrity of data. When , it means that the data is complete and there is no need to check the following segments; when , it means that the data is not complete and needs to be extracted from subsequent segments.

[0077] S704, data encoding. For each data segment , it needs to indicate its position in the interval or In this case, you need to use the serial number and auxiliary serial number , the field contents of the sequence number and auxiliary sequence number are: tag body , Data volume , Data security level , data ID and checksum The serial number is unique in the encryption and decryption system. The serial number is associated with the interval in which it is located. The number that indicates the segment code that the data is in. For example, a There are , then The coding mark is 1223, where 1 means it falls completely into The first data in is stored at , 22 means completely within The second data in is stored at , 3 means completely within The third data in is stored in , the amount of data at this time is 3; Used to indicate the amount of data; Used to indicate the security level of the data. ; ID is unique to each data; Used for verification.

[0078] S705, data level acquisition. During the data use process, the data ID needs to be saved separately in an organization with an access control structure. Only personnel who meet the conditions have the authority to obtain the data ID. Decryption requires a separate query of the data security level to correspond to the decryption operation of the decryption tree. Therefore, the function for obtaining the data ID level is recorded as Function. For each data ID, to obtain its level, you only need to query its serial number according to the ID and auxiliary serial number , you can get the data level of the ciphertext .

[0079] S706: The segmented data together with the corresponding data sequence number and auxiliary serial number Collection, Timestamp The corresponding summary of the data is packaged and signed with its own private key and uploaded to CS1. The corresponding value Data sequence number of the data and auxiliary serial number Collection, Timestamp Package it, sign it with your own private key, and upload it to CS2.

[0080] S707, CS1 and CS2 verify the signature and timestamp of the data after receiving the message. If the verification is successful, the message is saved to the cloud and sent to Finally, CS1 and CS2 send the received data and its timestamp respectively. Save together.

[0081] S708, the key management center KMS will each round of keys With data Packed storage. When you want to obtain data When different levels of keys are encrypted, access control measures can be used. For example, attribute encryption methods such as CP-ABE can be used to allow users with corresponding permissions to obtain the corresponding keys.

[0082] Step S8: Data decryption S801, Data Accessor Send decryption requests to cloud servers CS1 and CS2 respectively. The ID that holds the data to be decrypted first uses the public keys of CS1 and CS2 in sequence and Encrypt, then use your own private key Sign and get decryption request , , the decryption request Send to CS1, request Send to CS2.

[0083] S802, cloud servers CS1 and CS2 obtain the level of the ID. CS1 receives the request After that, first timestamp the data Verify, if it is not expired, verify the signature in the request, if the verification passes, use your own private key Decrypt the request and get the data ID. For this ID, use The function obtains the security level of the data .like , it means that the data is located in the first layer of the hierarchical encryption tree, that is, the data is level I. , it means that the data is level II. , it means that the data is at level III. , it means that the data is at level IV. After obtaining the level of the data, CS1 verifies Do you have the authority to obtain such data? If not, refuse to provide Send data, otherwise, continue to step S903. CS2 receives the request After that, the same method is used to check the request, obtain the data level, and judge permissions and determine whether to continue the operation of step S903.

[0084] S803, cloud servers CS1 and CS2 extract the corresponding data. CS1 queries its serial number based on the ciphertext ID and auxiliary serial number , according to the serial numbering rules, find the interval where the data is located, and obtain all the corresponding data value( ) and the summary of its corresponding data. For the sake of convenience, assume that the summary of the corresponding data is CS1 then signs the corresponding data with its own private key. Generate Certificate Finally, each and , , Packaging, and then using the public key of the corresponding data accessor Encrypt, get messages, and then return them separately For CS2, CS2 queries the corresponding Value, then CS2 generates a certificate , using the public key of the data accessor After encryption, Value and return .

[0085] S804, Data Accessor Request a key from the Key Management Center (KMS). After verifying the validity of the received data timestamp, decrypt the data and send the CS1 signed certificate to Take it out and use the public key of KMS Encrypt and then use your own private key After signing, together with your own public key , Use KMS public key Encrypted data Packaging, get request ,in for The timestamp of generation. Will request Sent to KMS. KMS received After that, the access control is also checked. If the verification is successful, KMS Find the corresponding , obtain the corresponding key set, according to the certificate Find the key set of the corresponding level in the corresponding key set ,use After encrypting with the public key , for The generated timestamp is then returned to .

[0086] S805, Data Accessor Recover the original ciphertext . After verifying the validity of the data, select the data obtained from CS1. data, and find the corresponding Here we assume that the selected data is . Substituting these in and solving the polynomial: It can be expressed as a multiplication matrix: In seeking , , , …, after, Construct the primitive polynomial Finally, we can get the data Next, use the summary Verify data integrity.

[0087] S806, Data Accessor Decrypt the ciphertext data. The decryption operation of symmetric encryption is , the decryption operation of Paillier encryption is , the decryption operation of chaotic encryption is .in is the symmetric key for symmetric encryption, The corresponding private key encrypted for the paillier, Indicates the ciphertext that needs to be decrypted. Its security level is level I, and the process of decrypting it is: ; Its security level is II, so the process of decryption is: ; Its security level is level III, so the process of decrypting it is as follows ; If the security level is IV, the data will be retrieved directly.

[0088] Embodiment 2: The embodiment of the present invention further provides a vehicle network data classification and hierarchical management and adaptive encryption and decryption system, including: A first processing module, used for marking the acquired Internet of Vehicles data; The second processing module is used to preset different data types and security levels, as well as encryption and decryption strategies for the marked Internet of Vehicles data according to the actual needs of the Internet of Vehicles; The third processing module uses natural language processing models and random forest models to automatically identify the security level of Internet of Vehicles data, and encrypts and decrypts Internet of Vehicles data of different security levels through encryption and decryption strategies.

[0089] As an implementation of the embodiment of the present invention, the third processing module includes: The first processing unit is used to enable the data provider Assemble multiple data to be encrypted into a plaintext block, and set the data used to encrypt a plaintext block to , and sorted according to the data security level. The data order after sorting is ; Use padding to combine plaintext blocks into one large plaintext block , and traverses the hierarchical encryption tree to encrypt the data at each layer; The second processing unit is used to enable the data provider Ciphertext The Shamir threshold secret sharing algorithm is used to split the data into Block; Builder , and Random Assignment times, among which, The data of each time is different and not 0, recorded as , and finally get Different value, that is ; For each data Each , establish its The corresponding relationship between each data After data segmentation, the segmented data is formed ,in, ; Use BCC20 information segmentation technology to And carry out serial number marking and verification; The third processing unit is used to make the cloud server CS1 store the segmented data together with the corresponding data sequence number and auxiliary serial number Collection, Timestamp and the corresponding summary of the data; cloud server CS2 stores the data The corresponding value Data sequence number of the data and auxiliary serial number Collection, Timestamp ; The fourth processing unit is used for, during the data access process, the data accessor Send a decryption request to cloud servers CS1 and CS2. CS1 and CS2 verify the validity of the signature information. CS1 obtains the security level of the data based on the data ID. Then CS1 verifies Whether there is access permission; The fifth processing unit is used to enable CS1 to query the serial number of the data according to its ID and auxiliary serial number , according to the serial numbering rules, find the interval where the data is located, and obtain all the corresponding data value( ) and a summary of their corresponding data ;CS1 uses its own private key to sign the corresponding data security level Generate Certificate ; Each and , , Pack, get messages, respectively, returned ; CS2 query corresponding Value and generate certificate ,Will Value and return ; The sixth processing unit is used to Request a key from the Key Management Center (KMS). After receiving the request, KMS will Find the key set of the corresponding level in the corresponding key set , returning it to ; The seventh processing unit is used to After obtaining the data and key, select The data is then solved and the original ciphertext is restored by solving the polynomial, and the integrity of the data is verified using the summary; according to the security level of the data, Perform the corresponding decryption operation and finally restore the data.

[0090] As an implementation method of the embodiment of the present invention, the second processing module is used to enable the data provider Want to transfer data When uploading, the data Marked as a quad : ,in, Represents common attributes of data; Key-value pairs representing data, used to store rules, , A space used to describe the security level of data.

[0091] As an implementation method of an embodiment of the present invention, the first processing unit traverses the hierarchical encryption tree and encrypts the data at each layer. Specifically, at the first layer, the symmetric encryption algorithm AES is used to encrypt the data to generate a ciphertext. ; In the second layer, the Paillier encryption method is used to encrypt the ciphertext of the first layer and the data of the second layer to obtain the ciphertext and ; In the third layer, the Logistic one-dimensional chaotic map is used to encrypt the third layer data and the first two layers of ciphertext to generate the ciphertext , and ; At the 4th layer, a hash function is used on the 4th layer data and the first 3 layers of ciphertext to generate a summary of each data and ciphertext.

[0092] The embodiments described above are only descriptions of the preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Without departing from the design spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by ordinary technicians in this field should all fall within the protection scope determined by the claims of the present invention.

Claims

1. A method for classification and hierarchical management of Internet of Vehicles data and adaptive encryption and decryption, characterized in that: include: Mark the acquired Internet of Vehicles data; Preset different data types and security levels, as well as encryption and decryption strategies for the marked Internet of Vehicles data according to the actual needs of the Internet of Vehicles; The data provider uses a hierarchical encryption tree to fill the data to build an encryption and decryption strategy; The natural language processing model and random forest model are used to automatically identify the security level of Internet of Vehicles data, and encryption and decryption strategies are used to encrypt and decrypt Internet of Vehicles data of different security levels.

2. The method for classification and hierarchical management of Internet of Vehicles data and adaptive encryption and decryption as claimed in claim 1, characterized in that: Encryption and decryption of Internet of Vehicles data at different security levels include: Data Provider Assemble multiple data to be encrypted into a plaintext block, and set the data used to encrypt a plaintext block to , and sorted according to the data security level. The data order after sorting is ; Use padding to combine plaintext blocks into one large plaintext block , and traverses the hierarchical encryption tree to encrypt the data at each layer; Data Provider Ciphertext The Shamir threshold secret sharing algorithm is used to split the data into Block; Builder , and Random Assignment times, among which, The data of each time is different and not 0, recorded as , and finally get Different value, that is ; For each data Each , establish its The corresponding relationship between each data After data segmentation, the segmented data is formed ,in, ; Use BCC20 information segmentation technology to And carry out serial number marking and verification; Cloud server CS1 stores the segmented data together with the corresponding data sequence number and auxiliary serial number Collection, Timestamp and the corresponding summary of the data; cloud server CS2 stores the data The corresponding value Data sequence number of the data and auxiliary serial number Collection, Timestamp ; During data access, the data accessor Send a decryption request to cloud servers CS1 and CS2. CS1 and CS2 verify the validity of the signature information. CS1 obtains the security level of the data based on the data ID. Then CS1 verifies Whether there is access permission; CS1 queries the serial number of the data according to its ID and auxiliary serial number , according to the serial numbering rules, find the interval where the data is located, and obtain all the corresponding data value( ) and a summary of their corresponding data ;CS1 uses its own private key to sign the corresponding data security level Generate Certificate ; Each and , , Pack, get messages, respectively, returned ; CS2 query corresponding Value and generate certificate ,Will Value and return ; Request a key from the Key Management Center (KMS). After receiving the request, KMS will Find the key set of the corresponding level in the corresponding key set , returning it to ; After obtaining the data and key, select The data is then solved and the original ciphertext is restored by solving the polynomial, and the integrity of the data is verified using the summary; according to the security level of the data, Perform the corresponding decryption operation and finally restore the data.

3. The method for classification and hierarchical management of Internet of Vehicles data and adaptive encryption and decryption as claimed in claim 2, characterized in that: Data Provider Want to transfer data When uploading, the data Marked as a quad : ,in, Represents common attributes of data; Key-value pairs representing data, used to store rules, , A space used to describe the security level of data.

4. The method for classification and hierarchical management of Internet of Vehicles data and adaptive encryption and decryption as claimed in claim 3, characterized in that: By traversing the hierarchical encryption tree, the data at each layer is encrypted. Specifically, at the first layer, the symmetric encryption algorithm AES is used to encrypt the data to generate ciphertext. ; In the second layer, the Paillier encryption method is used to encrypt the ciphertext of the first layer and the data of the second layer to obtain the ciphertext and ; In the third layer, the Logistic one-dimensional chaotic map is used to encrypt the third layer data and the first two layers of ciphertext to generate the ciphertext , and ; At the 4th layer, a hash function is used on the 4th layer data and the first 3 layers of ciphertext to generate a summary of each data and ciphertext.

5. A vehicle network data classification and hierarchical management and adaptive encryption and decryption system, characterized in that: include: A first processing module, used for marking the acquired Internet of Vehicles data; The second processing module is used to preset different data types and security levels, as well as encryption and decryption strategies for the marked Internet of Vehicles data according to the actual needs of the Internet of Vehicles; The third processing module uses natural language processing models and random forest models to automatically identify the security level of Internet of Vehicles data, and encrypts and decrypts Internet of Vehicles data of different security levels through encryption and decryption strategies.

6. The vehicle networking data classification and hierarchical management and adaptive encryption and decryption system as claimed in claim 5, characterized in that: The third processing module includes: The first processing unit is used to enable the data provider Assemble multiple data to be encrypted into a plaintext block, and set the data used to encrypt a plaintext block to , and sorted according to the data security level. The data order after sorting is ; Use padding to combine plaintext blocks into one large plaintext block , and traverses the hierarchical encryption tree to encrypt the data at each layer; The second processing unit is used to enable the data provider Ciphertext The Shamir threshold secret sharing algorithm is used to split the data into Block; Builder , and Random Assignment times, among which, The data of each time is different and not 0, recorded as , and finally get Different value, that is ; For each data Each , establish its The corresponding relationship between each data After data segmentation, the segmented data is formed ,in, ; Use BCC20 information segmentation technology to And carry out serial number marking and verification; The third processing unit is used to make the cloud server CS1 store the segmented data together with the corresponding data sequence number and auxiliary serial number Collection, Timestamp and the corresponding summary of the data; cloud server CS2 stores the data The corresponding value Data sequence number of the data and auxiliary serial number Collection, Timestamp ; The fourth processing unit is used for, during the data access process, the data accessor Send a decryption request to cloud servers CS1 and CS2. CS1 and CS2 verify the validity of the signature information. CS1 obtains the security level of the data based on the data ID. Then CS1 verifies Whether there is access permission; The fifth processing unit is used to enable CS1 to query the serial number of the data according to its ID and auxiliary serial number , according to the serial numbering rules, find the interval where the data is located, and obtain all the corresponding data value( ) and a summary of their corresponding data ;CS1 uses its own private key to sign the corresponding data security level Generate Certificate ; Each and , , Pack, get messages, respectively, returned ; CS2 query corresponding Value and generate certificate ,Will Value and return ; The sixth processing unit is used to Request a key from the Key Management Center (KMS). After receiving the request, KMS will Find the key set of the corresponding level in the corresponding key set , returning it to ; The seventh processing unit is used to After obtaining the data and key, select The data is then solved and the original ciphertext is restored by solving the polynomial, and the integrity of the data is verified using the summary; according to the security level of the data, Perform the corresponding decryption operation and finally restore the data.

7. The vehicle networking data classification and hierarchical management and adaptive encryption and decryption system as claimed in claim 6, characterized in that: The second processing module is used to enable the data provider Want to transfer data When uploading, the data Marked as a quad : ,in, Represents common attributes of data; Key-value pairs representing data, used to store rules, , A space used to describe the security level of data.

8. The vehicle networking data classification and hierarchical management and adaptive encryption and decryption system as claimed in claim 7, characterized in that: The first processing unit traverses the hierarchical encryption tree and encrypts the data at each layer. Specifically, at the first layer, the symmetric encryption algorithm AES is used to encrypt the data to generate a ciphertext. ; In the second layer, the Paillier encryption method is used to encrypt the ciphertext of the first layer and the data of the second layer to obtain the ciphertext and ; In the third layer, the Logistic one-dimensional chaotic map is used to encrypt the third layer data and the first two layers of ciphertext to generate the ciphertext , and ; At the 4th layer, a hash function is used on the 4th layer data and the first 3 layers of ciphertext to generate a summary of each data and ciphertext.

Images