Logistics transfer field digital twin system data security protection method

Abstract

The application discloses a logistics transfer field digital twin system data security protection method, which comprises the following steps: S1. Constructing sorting isomerism sensitive data in the logistics transfer field digital twin body into a data set and preprocessing to obtain an original data set; S2. End-to-end data encryption is performed on the original data set, and digital signature and key protection are performed; S3. Information exchange and storage between the blockchain logistics transfer field digital twin bodies are constructed, and zero-trust access and data decryption are performed. The application can effectively realize information exchange and storage between the blockchain logistics transfer field digital twins, and encrypt and protect the data.

Description

Technical Field

[0001] This invention relates to the field of logistics, and in particular to a method for data security protection of a digital twin system in a logistics transit hub. Background Technology

[0002] In the current logistics industry, digital twin technology is widely used in intelligent equipment such as logistics transit points and sorting machines. Data generated at the logistics site includes, but is not limited to: User Waybill Numbers (UTNs): involving customer privacy and waybill tracking information; Sorting capacity: reflecting the scheduling and operational performance of logistics transit points; Personnel deployment information: involving on-site staff arrangement and management information; Sorting machine resource information: including the status and operating data of key equipment; Shift sorting performance and sorting time: directly affecting logistics efficiency and scheduling rationality. Traditional centralized security protection schemes for specific links often only focus on data transmission encryption or single-point storage, failing to meet the needs of data consistency, tamper-proofing, and secure traceability across the entire chain (data collection, transmission, storage, and access) and multi-node distributed systems. In recent years, based on mature encryption technologies such as AES-256, SHA-256, ECDSA (based on secp256k1 elliptic curves) and ECIES used in decentralized public blockchains, coupled with distributed storage, consensus mechanisms, and blockchain design, end-to-end security protection can be provided for sensitive data at the logistics site throughout the entire process. Summary of the Invention

[0003] The purpose of this invention is to overcome the shortcomings of the prior art and provide a data security protection method for a digital twin system in a logistics transit center, which can effectively realize information exchange and storage between blockchain logistics transit center digital twins and encrypt and protect the data.

[0004] The objective of this invention is achieved through the following technical solution: a data security protection method for a digital twin system in a logistics transit center, comprising the following steps:

[0005] S1. Construct a dataset from the heterogeneous sensitive data of sorting within the digital twin of the logistics transfer center, and preprocess it to obtain the original dataset. ;

[0006] S2. For the original dataset Perform end-to-end data encryption, and provide digital signatures and key protection;

[0007] S3. Construct information exchange and storage between digital twins in blockchain logistics transit centers, and perform zero-trust access and data decryption.

[0008] The beneficial effects of this invention are as follows: This invention constructs a comprehensive security verification method based on elliptic curve cryptography and proof-of-work mechanism. By introducing a high-quality cryptographic random number generator, modulo operation, SHA-256 hash processing, and dynamic nonce adjustment mechanism into the digital signature and key negotiation process, it achieves real-time secure verification and anti-tampering of digital identity authentication, data transmission, and transaction records. In the signature generation process, a random number generator is used to generate a high-entropy private key and a temporary random number. Simultaneously, elliptic curve scalar multiplication is applied to integrate the private key with a fixed generator, extracting its x-coordinate value and taking the modulo of the elliptic curve order to generate signature parameters. In the shared key negotiation stage, a shared elliptic curve point is obtained through multiplication of the temporary private key and the recipient's public key, and then the SHA-256 hash function is applied to it to generate a fixed-length symmetric key for subsequent communication encryption. Furthermore, in the proof-of-work mechanism, the method continuously adjusts the nonce value, ensuring that the block data, after undergoing SHA-256 hash processing, is securely verified and tamper-proofed. After computation, a specific difficulty target is met, enabling verification of data integrity and real-time tamper-proofing. This method not only significantly improves the security of each stage of signing, key sharing, and proof-of-work, but also effectively reduces the risk of encryption vulnerabilities caused by insufficient randomness through multiple cryptographic operation mechanisms, providing solid and efficient technical support for blockchain security, digital identity authentication, and encrypted communication. Attached Figure Description

[0009] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0010] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings, but the scope of protection of the present invention is not limited to the following description.

[0011] like Figure 1 As shown, a data security protection method for a digital twin system in a logistics transit center includes the following steps:

[0012] S1. Construct a dataset from the sensitive data of the heterogeneous sorting data within the digital twin of the logistics transit center, and preprocess it to obtain the original dataset. ;

[0013] The digital twin system of a logistics transit center includes digital twins of multiple logistics transit centers. Each digital twin of a logistics transit center synchronously accesses the data of that logistics transit center and simulates the operation of the logistics transit center.

[0014] From the digital twin of each logistics transit center, sensitive data on the heterogeneous sorting processes within that center are extracted and constructed into a dataset, thus obtaining the logistics sorting sensitive data set. :

[0015]

[0016] in, For the user's tracking number, This represents the current sorting shift's capacity. Information for sorting personnel arrangement, This refers to the sorting data collected in real time by the current sorting machine. This represents the number of packages sorted in the current shift. Market information for the current shift's sorting;

[0017] Sensitive data set for logistics sorting The system encapsulates sensitive data in JSON format and converts it to binary data using UTF-8 encoding to realize a collection of data for logistics sorting. Preprocessing yields the original dataset. .

[0018] S2. For the original dataset Perform end-to-end data encryption, and provide digital signatures and key protection;

[0019] End-to-end data encryption includes:

[0020] A1. Symmetric Key Generation: Generate a 256-bit symmetric key using a cryptographically secure random generator. and 128-bit initialization vector : ;

[0021] A2. AES-256-CBC Encryption: Encryption of the original data set Encryption is performed as follows:

[0022] First, calculate the fill length. , among which, | | represents the original data set The length in bytes, 16 is a fixed length of 16 bytes;

[0023] Then the data Fill in: Where || represents binary concatenation, i.e., concatenating data... With fill bits padding Concatenate them into a complete encrypted input;

[0024] Finally, after filling... Encryption is performed to obtain ciphertext. ; This refers to performing AES-256-CBC encryption operations;

[0025] A3. Data Integrity Check Value Calculation: Calculate the fixed-length 256-bit data hash value. As an integrity check value, This indicates the use of SHA-256 to encrypt the text. Perform a hash operation.

[0026] Digital signatures and key protection

[0027] Digital signature (ECDSA signature): The digital signature is implemented using the ECDSA algorithm based on the secp256k1 elliptic curve. Specifically, a 256-bit private key is first randomly generated. And calculate the corresponding public key. ,in For generators, curve parameters and order Defined by secp256k1.

[0028] Signature process: For hash values Perform ECDSA signature, and let the random number Selected from and calculate

[0029]

[0030] midpoint Located on an elliptic curve, its coordinates can be represented as and to Mold taking get :

[0031]

[0032] like Then select again. and calculate

[0033]

[0034] like Then select again. The signature result is... .

[0035] Symmetric key Protection (ECIES Implementation): Assuming that an authorized party with access to the digital twin data provides the public key. Encryption is performed using ECIES (Elliptic Curve Integrated Cryptography): First, a temporary elliptic curve key pair is generated. ,in For temporary private keys, Then calculate the shared key. ;use Perform AES-256-CBC encryption to obtain

[0036]

[0037] For shared keys An encrypted 128-bit initialization vector.

[0038] S3. Construct information exchange and storage between digital twins in blockchain logistics transit centers, and perform zero-trust access and data decryption.

[0039] Building information exchange and storage between digital twins in blockchain logistics transit centers

[0040] Information exchange Includes the following fields: encrypted data ciphertext Its corresponding hash value Digital signature Encrypted symmetric key information Encrypted initialization vector (For AES-256-CBC decryption of data) ), and transaction generation timestamps That is to be

[0041] Distributed storage: Considering the capacity of each data component collected by the digital twin in actual logistics transit hubs, the data... Perform block storage: For each Calculate hash value and in pairs Calculate the merge hash, recursively until a single root hash is generated. ;

[0042] The Merkle root hash is generated by constructing a Merkle tree to recursively merge and calculate the hashes of data blocks pairwise. ; The input is the hash value of a set of data blocks. The process is as follows: combine the hash values ​​in pairs, calculate their hash, and continuously merge them upwards until only one hash value remains, which is the MR root.

[0043] Block structure and consensus:

[0044] Block Structure and Consensus: A block is constructed for each digital twin of a logistics transit center to store the information of that digital twin, and the blocks form a blockchain;

[0045] Set up blocks It is a block structure operating within a private blockchain of a logistics network under construction. Each logistics transit point's digital twin can act as a node in the blockchain network. Nodes are deployed at each transit point using the Quorum open-source platform, forming an access-controlled consortium blockchain. Each node is responsible for generating, broadcasting, verifying, and storing blocks. Block Deployed in a private blockchain / structure, each logistics transit point's digital twin node acts as a blockchain participant, responsible for block generation, consensus, and storage.

[0046] For each block Includes a block header and a list of transactions; the block header includes the hash of the previous block. The Merkle root of the current block timestamp The transaction list stores the information exchanged between the digital twins of the block. The Nonce (Number used once) is a non-repeating random number, typically added as a variable parameter to the data during each computation to change the hash result. ;

[0047] Zero Trust Access and Data Decryption

[0048] Access Request Model and Risk Assessment: Access requests to data in a digital twin system for logistics transit hubs are defined as vectors.

[0049]

[0050] in, For the requester's identity (user or device ID). For the requested data resources (such as sorting machine status, shift records). This is contextual information (such as the environment of sorting equipment and the geographical location of the transfer station). Let the requested time be used. Based on this, define the risk assessment function:

[0051]

[0052] And set a safety threshold Used to determine whether to authorize the current access (access is not allowed if the threshold is below).

[0053] And set a safety threshold Used to determine whether to authorize the current access; access is not allowed if the threshold is below. ~ Preset weights;

[0054] Identity risk function The calculation method is as follows:

[0055]

[0056] in, For user levels, administrators =0, Visitors =1; For account activity, activity =0, abnormal access. =1; This indicates an abnormal access frequency. , , Preset weights;

[0057] Abnormal access refers to an account that has not made any accesses in the past 20 records; otherwise, it is considered active.

[0058] Resource access risk functions The calculation method is as follows:

[0059]

[0060] in, For the sensitivity level of resources, publicly available data =0, sensitive information =1, This indicates whether each resource needs to be accessed frequently. =0, frequent access is not required. =1, , The preset weight; whether frequent access is required means that if the average number of resource accesses per unit time in history is greater than the preset value, frequent access is required, otherwise frequent access is not required. This parameter is dynamically adjusted periodically.

[0061] Context access functions The calculation method is as follows:

[0062]

[0063] in, Geographic location risk score, visits within the same province =0, access from outside the province =1, To verify device trustworthiness, register the device. =0, Unknown device =1, Preset weights;

[0064] Time risk function The calculation method is as follows:

[0065]

[0066] in, This is during normal peak access times. This is the attenuation coefficient.

[0067] Authorization and decryption process:

[0068] After the access request passes the risk assessment, the authorized visitor obtains the key protection information stored in the blockchain transaction. ;

[0069] Use your own private key Decrypt the ECIES encrypted key information ; Indicates decryption; ( ) indicates the use of The algorithm performs the decryption;

[0070] Utilize the obtained ,and Encrypted data stored Perform AES-256-CBC decryption to recover plaintext sorting data. :

[0071]

[0072] in, This indicates that AES-256-CBC decryption is being performed;

[0073] Theoretically it should be equal to However, since the data may be tampered with or transmitted incorrectly, verification is also required. The integrity of the data is verified as follows:

[0074] For ciphertext Recalculate = SHA256( );Will With on-chain storage Comparison: If == This indicates the data is complete and the decryption is reliable; if ≠ Data may have been tampered with or transmitted incorrectly. Access will be denied and an audit log will be logged.

[0075] In summary, this invention achieves end-to-end data encryption protection: sensitive data (such as UTN, sorting capacity, personnel arrangement, shift performance, sorting time, etc.) generated by logistics transfer stations and sorting machines are encrypted end-to-end throughout the entire process of collection, transmission, storage and access, ensuring data confidentiality and integrity.

[0076] Data consistency and tamper-proofing in distributed storage: In a multi-node distributed storage system, encrypted data is stored in blocks. How can distributed consensus and Merkle tree mechanisms be used to ensure data consistency and tamper-proofing, and how can secure traceability be achieved through blockchain log recording?

[0077] Zero Trust Access Control and Dynamic Key Management: In response to the risks of multi-device, cross-platform data access and heterogeneous environments in logistics sites, a zero trust access model is built based on multi-factor dynamic risk assessment. At the same time, a key encryption scheme similar to ECIES is adopted to achieve secure key distribution and management, ensuring that only authorized users can perform data decryption operations.

[0078] Security audit and incident tracing: Blockchain technology is used to record every encryption, key distribution and data access operation, while digital signature and hash technology are combined to achieve security audit and incident accountability.

[0079] The above description represents preferred embodiments of the present invention. It should be understood that the present invention is not limited to the forms disclosed herein and should not be construed as excluding other embodiments. It can be used in other combinations, modifications, and environments, and can be altered within the scope of the concept described herein through the above teachings or related technical or knowledge. Modifications and variations made by those skilled in the art that do not depart from the spirit and scope of the present invention should be within the protection scope of the appended claims.

Claims

1. A logistics transfer field digital twin system data security protection method, characterized in that: Comprising the following steps: S1. Constructing the sensitive data in the logistics transit site digital twin into a data set and preprocessing to obtain an original data set ; S2. End-to-end data encryption is performed on the original data set and digitally signed and key protected; performing end-to-end data encryption on the original data set includes: A1. Symmetric key generation: Generate 256-bit symmetric key using cryptographically secure random generator and 128-bit initialization vector : ; A2. AES-256-CBC encryption: The original data set is encrypted as follows: A2.

1. AES-256-CBC encryption: The original data set is encrypted as follows: First, the padding length is calculated wherein, | denotes the byte length of the original data set 16 is a fixed 16-byte length; Then the data Fill in: Where || represents binary concatenation, i.e., concatenating data... Concatenate with padding bits to form a complete encrypted input; where padding bits refer to... When there are fewer than 16 bits, padding is needed at the positions where data needs to be filled; each padding bit is filled with 0; Finally, the filled-in is encrypted to get the ciphertext ; means to perform an AES-256-CBC encryption operation; A3. Data integrity check value calculation: Calculate a fixed length 256-bit data hash value as an integrity check value, denotes a hash operation on the ciphertext using SHA-256; S3. Constructing information exchange and storage between blockchain logistics transfer station digital twins, and carrying out zero trust access and data decryption, comprising: Access request model and risk assessment: for access request to logistics transfer station digital twin system data, defined as a vector: ； wherein, is a requester identity, is a requested data resource, is context information, is a request time; on the basis of which a risk assessment function is defined: ； and set a safety threshold for determining whether to authorize current access, below the threshold, access is not allowed; a preset weight;​ Identity risk function The calculation is as follows: ； wherein, is a user level, administrator = 0, visitor = 1; is an account activity, active = 0, abnormal access = 1; is an abnormal access frequency, , , is a preset weight; Abnormal access refers to that the account does not appear in the history of 20 times of records, otherwise active; Resource access risk function The calculation is as follows: ； wherein, is a sensitivity level of the resource, public data = 0, sensitive information = 1, indicates whether each resource needs to be frequently accessed, if the resource needs to be frequently accessed = 0, does not need to be frequently accessed = 1, , is a preset weight; if the average number of resource accesses per unit time in the history is greater than a preset value, the resource needs to be frequently accessed, otherwise the resource does not need to be frequently accessed; Context access function The calculation is as follows: ； wherein, geographic location risk score, same province area visit = 0, out-of-province area visit = 1, is a visit device trustworthiness, registered device = 0, unknown device = 1, is a preset weight; Time risk function The calculation is as follows: ； wherein is a normal access peak time, is a decay coefficient; Authorized decryption process: Upon passing the risk assessment, the authorized access is granted access to the key-protected information stored in the blockchain transaction ; using his own private key decrypting the ECIES encrypted key information ; denotes decrypting; () denotes decrypting using algorithm; The obtained , and the stored data ciphertext is decrypted by AES-256-CBC to recover the plaintext sorting data : ； wherein, represents performing an AES-256-CBC decryption operation; At the same time, verify the integrity of ​ On the ciphertext Recalculate ′ = SHA256( ) ; compare ′ with the on-chain stored : if ′ == : the data is complete and the decryption is trusted; if ′ ≠ : the data is tampered or transmission error, refuse access and record the audit log.

2. The logistics transfer field digital twin system data security protection method according to claim 1, characterized in that: The step S1 comprises: Suppose that the logistics transfer station digital twin system contains digital twins of multiple logistics transfer stations, and each digital twin of the logistics transfer station synchronously accesses the data of the logistics transfer station and simulates the operation of the logistics transfer station; Sensitive data of the intra-logistics distribution center is obtained from the digital twin of each logistics distribution center, and the sensitive data is structured into a data set to obtain a logistics sorting sensitive data set : ； wherein, is a user waybill number, is a current sort shift capacity value, is a sort staff arrangement information, is a current sort machine real-time collected sort data, is a current shift sort package quantity, is a current shift sort market information; Sensitive data set for logistics sorting The system encapsulates sensitive data in JSON format and converts it to binary data using UTF-8 encoding to realize a collection of data for logistics sorting. Preprocessing yields the original dataset. .

3. The method of claim 1, wherein the method further comprises: In the step S2, the digital signature and key protection comprises: B1, digital signature: ECDSA algorithm based on secp256k1 elliptic curve to realize digital signature: first randomly generate a 256-bit private key and calculate the corresponding public key , wherein is the generating element, denotes the order; B2, signature process: on the hash value The ECDSA signature is performed, letting the random number selected from and calculating the point R: ； wherein the point lies on an elliptic curve whose coordinates are denoted by and is taken modulo gives : ； Mod represents the modulo operation; If then reselect and compute ； If , then reselect ; If , are not all true, then the signature result is ; B3. symmetric key The protection of: assume that the authorized access to digital twin data provider public key , using ECIES encryption: first generate temporary elliptic curve key pair , wherein is the temporary private key, ; then calculate the shared key ; AES-256-CBC encryption with , get: ； a 128-bit initialization vector for encrypting the shared key ​ 4. The method of claim 3, wherein the method further comprises: In the step S3, constructing information exchange and storage between blockchain logistics transfer station digital twins comprises: Set information exchange Contains the following fields: encrypted data ciphertext , its corresponding hash value , digital signature , encrypted symmetric key information , encrypted initialization vector , and transaction generation timestamp , namely ; Distributed storage: considering the volume of each data collected by the digital twin in the actual logistics transfer field, the data is stored in blocks : , for each , calculate the hash value , and combine them two by two , calculate the merged hash, recursively to generate a single root hash ; representing the calculation of the Merkel root; Block structure and consensus: a block for saving the information of each logistics transfer station digital twin is constructed for each logistics transfer station digital twin, and the blocks form a block chain among them; Each block contains a block header and a list of transactions, the block header including a previous block hash , a Merkle root of the current block , a timestamp and a nonce, wherein the nonce represents a proof-of-work value, which is a non-repeating random number; the list of transactions stores information exchange of digital twins in the block .

Images