Geological disaster monitoring and early warning network security encryption system

Abstract

The invention discloses a geological disaster monitoring and early warning network security encryption system, and relates to the technical field of encryption systems. The geological disaster monitoring and early warning network security encryption system comprises an equipment initialization unit, a data acquisition and encryption unit, a hidden key embedding unit, a transmission and verification unit, a decryption and self-destruction mechanism unit and a backup database. A public and private key pair is generated by adopting multi-factor authentication and an SM2 algorithm, and a session key is negotiated in combination with a timestamp and a random number, so that equipment identity credibility and communication security are ensured; the SM4-CBC mode is used for encrypting data and generating an HMAC-SM3 value, so that the integrity and confidentiality of the data are guaranteed; the hidden secret key is embedded into the redundant space in a segmented manner, and the anti-attack capability is improved by combining anti-compression and anti-cutting processing; a big data packet is transmitted in a segmented manner through a TLS 1.3 or IPsec encryption channel, and each segment is independently encrypted and verified, so that the transmission risk is reduced, and the abnormality is quickly positioned; and when decryption fails, the data packet is automatically destroyed to prevent unauthorized access.

Description

Technical Field

[0001] The present invention relates to the technical field of encryption systems, and in particular to a security encryption system for a geological disaster monitoring and early warning network. Background Art

[0002] The national geological disaster monitoring network includes the Internet of Things side and the platform side. It collects geological environment data through front-end data acquisition equipment and transmits it to provincial platforms using 4G / satellite and other communication networks. The provincial platforms monitor, analyze, perceive and warn of the data, and transmit the data to the national platform through the data synchronization network. As a first-level platform, the national platform can conduct unified monitoring and management of provincial platforms.

[0003] The comprehensive defense-in-depth system adopts domestically produced, independently controllable network security, cryptography and other technologies and products. By building network security on the IoT side and platform side, and combining security management and operational disposal, it integrates technology and management capabilities to build a complete comprehensive protection system.

[0004] For security reasons, all transmitted data packets need to be encrypted and protected, such as a key encryption and decryption method and storage, application control system, and electronic device disclosed in Publication No. 202310591353.2. The key encryption method includes: setting a communication handshake key; generating a key data stream based on the communication handshake key; creating key loading information; encrypting plaintext data based on the key data stream and the key loading information to obtain key ciphertext data; storing the key ciphertext data in the key storage space; the key decryption method includes: reading key ciphertext data from the key storage space; obtaining the communication handshake key and key loading information at the time of encryption; decrypting the key ciphertext data based on the communication handshake key and the key loading information to obtain key plaintext data. This application encrypts the communication handshake key of network communication and then stores the encrypted key ciphertext data, which can reduce the risk of the communication key being brute-force cracked, thereby improving the security of network communication.

[0005] As shown in the above technology, the existing encryption method is to encrypt through an algorithm and simultaneously generate a secret key. The receiving end needs the secret key to decrypt the encrypted data. However, with only one layer of encryption, when others obtain the data packet, they may use technical means to crack the secret key, which has limited security. For national-level data, data cracking will have a greater impact. Summary of the Invention

[0006] In view of the shortcomings of the existing technology, the present invention provides a geological disaster monitoring and early warning network security encryption system, which solves the problem of limited security of existing encryption methods.

[0007] To achieve the above objectives, the present invention is implemented through the following technical solutions: a geological disaster monitoring and early warning network security encryption system, comprising: Device initialization unit: The device completes identity authentication through multi-factor authentication. The device uses the SM2 algorithm to generate a public-private key pair. The private key is stored in the hardware security module or trusted execution environment. The platform and the device negotiate the session key through the SM2 key exchange protocol, adding a timestamp and random number to the negotiation process. The business key is transmitted after being encrypted using SM2 and attached with the device's public key fingerprint. Data collection and encryption unit: encrypts data using SM4-CBC mode, randomly generates an initialization vector and transmits it together with the ciphertext; calculates the HMAC-SM3 value for the collected data and device status data; Hidden key embedding unit: Generates a hidden key and divides it into multiple parts and embeds them into different redundant spaces of the data packet; selects a steganographic algorithm based on the data packet type, and performs compression and cropping resistance on the data packet; Transmission and Verification Unit: Transmitted via TLS 1.3 or IPsec encrypted channels; large data packets are transmitted in segments, each segment is independently encrypted and verified, and any verification failure is logged and an alarm is triggered; authorized users must undergo multi-factor authentication and have different permissions assigned based on their roles; Decryption and self-destruction mechanism unit: Authorized users extract the hidden key through dedicated software, and combine it with the session key to generate the final decryption key through SM3 hash; if decryption fails, the data packet is automatically destroyed.

[0008] Preferably, the device initialization unit operation specifically includes: S1.1 Device initialization: Enhanced identity authentication: Use multi-factor authentication to complete device identity authentication; Key pair generation: Use SM2 algorithm to generate device public and private key pair (PK d , SK d ), private key SK d Securely stored in a hardware security module (HSM) or a trusted execution environment (TEE); S1.2 Key Distribution: Session key negotiation: The platform and the device negotiate the session key K through the SM2 key exchange protocol. s ,The negotiation process adds a timestamp T and a random number R to prevent replay attacks; Business key encrypted transmission: business key K b After transmission through SM2 encryption, the device public key fingerprint H(PK d ) to ensure the key is bound to the device.

[0009] Preferably, the data collection and encryption unit operations specifically include: S2.1 Confidentiality protection of collected data: SM4 encryption optimization: SM4-CBC mode is used to encrypt data. The initialization vector IV is randomly generated and transmitted together with the ciphertext to prevent the same plaintext from generating the same ciphertext. Key dynamic update: session key K s Updated every hour, old keys are retained for T retain hours are used to decrypt historical data; S2.2 Integrity Protection: HMAC-SM3 enhancement: The HMAC-SM3 algorithm is used to calculate the message authentication code HMAC for the collected data and device status data. The key used in calculating HMAC is the derived value K of the session key. HMAC ; The data packet structure is [IV|SM4 ciphertext|HMAC|hidden key carrier], expressed as: Packet=[IV|C|HMAC|HiddenKeyCarrier].

[0010] Preferably, the hidden key embedding unit operation specifically includes: S3.1 Hidden key generation Enhanced randomness: Use the device unique identifier, random seed S and current timestamp T to generate the hidden key K through the SM3 algorithm h ; Key decentralized storage: The hidden key is divided into n parts {K h1 , K h2 ,…,K hn}, respectively embedded into different redundant spaces of the data packet; S3.2 Information hiding technology: Adaptive steganography: Select the steganographic algorithm according to the data packet type to ensure that the embedding does not affect the normal use of the data; Enhanced robustness: Data packets embedded with hidden keys are made resistant to compression and cropping to prevent key loss due to data corruption.

[0011] Preferably, the data packet types are divided into text, image and video, and the steganographic algorithm is expressed as: (1) For text data packets, a steganographic algorithm based on character replacement or format hiding is used; let the original text be T, the embedded information be M, and the embedded text be T′: T′=EmbedText(T,M); Among them, EmbedText is a text embedding function, which represents the process of embedding information M into text T; (2) For image data packets, a steganographic algorithm based on pixel value modification or frequency domain transformation is used; let the original image be I, the embedded information be M, and the embedded image be I′: I′=EmbedImage(I,M); Among them, EmbedImage is an image embedding function, which represents the process of embedding information M into image I; The embedding process involves the modification of pixel values: I′(x,y)=I(x,y)+Δ(x,y); Where Δ(x, y) is the pixel value modification amount calculated based on the information M; (3) For video data packets, steganographic algorithms based on inter-frame differences or motion vectors can be used; Let the original video be V, the embedded information be M, and the embedded video be V′: V′=EmbedVideo(V,M); Among them, EmbedVideo is a video embedding function, which represents the process of embedding information M into video V; The embedding process involves the modification of the differences between frames: V′(t)=V(t)+Δ(t); Where V(t) is the original video data of the t-th frame, V′(t) is the modified video data of the t-th frame, and Δ(t) is the inter-frame difference modification amount calculated based on the information M.

[0012] Preferably, the transmission and verification unit transmission and verification unit operations specifically include: S4.1 Secure Transmission: Channel encryption: Data packets are transmitted via TLS 1.3 or IPsec encryption to ensure the security of the transmission process; Data segment transmission: Large data packets are transmitted in segments, and each segment is independently encrypted and verified to prevent tampering by middlemen; S4.2 Integrity Verification: Double verification: The platform first verifies the HMAC and then verifies the integrity of the hidden key carrier; Exception handling: If verification fails, logs are recorded and an alarm is triggered to notify the administrator to handle the issue; S4.3 Authorized User Verification: Multi-factor authentication: Authorized users must authenticate their identities using digital certificates, biometrics, and dynamic passwords; Permission grading: Different permissions are assigned based on user roles, such as allowing only specific users to decrypt specific types of data packets.

[0013] Preferably, the decryption and self-destruction mechanism unit operations specifically include: S5.1 Decryption process: Hidden key extraction: Authorized users can extract the hidden key through dedicated software. The extraction process requires verification of user identity and permissions. Key combination: Combine the surface SM4 key and the hidden secret key to generate the final decryption key K through SM3 hash f ; Decryption operation: Use the final decryption key K f Decrypt SM4 ciphertext to obtain original data; S5.2 Self-destruction mechanism: Intelligent self-destruction: If decryption fails, the data packet is automatically destroyed; Audit logs: All decryption attempts are recorded, including time, user, IP address, and results, to facilitate post-audit.

[0014] Preferably, a backup database is also included, by setting up a backup storage space on the platform side to back up the received data packets, and the backup data packets are encrypted and stored using different keys; after the original data packet is successfully decrypted, the copy in the backup space is automatically deleted; if the decryption fails, the backup data packet is extracted for decryption again.

[0015] Preferably, the operations of backing up the database specifically include: S6.1 Automatic Backup: Incremental backup: The platform sets up backup storage space, and the data packets received by the platform are automatically backed up; Backup encryption: The backup data package is stored using SM4 encryption, and the encryption key K b Different from the main data package, increasing security; S6.2 Backup Destruction: Automatic cleanup: After the original data packet is successfully decrypted, the copy in the backup space is automatically deleted; Retention policy: If decryption fails, the backup data package will be retained until the user manually clears it or the expiration time T set by the system policy expire .

[0016] The present invention provides a security encryption system for a geological disaster monitoring and early warning network. Compared with the existing technology, it has the following advantages: 1. The geological disaster monitoring and early warning network security encryption system uses multi-factor authentication and SM2 algorithm to generate public and private key pairs, and combines timestamps and random numbers to negotiate session keys to ensure the trustworthy identity of the device and secure communication; SM4-CBC mode encrypts data and generates HMAC-SM3 values to ensure data integrity and confidentiality; hidden secret keys are segmented and embedded in redundant space, combined with anti-compression and anti-cropping processing to improve anti-attack capabilities; large data packets are transmitted in segments through TLS 1.3 or IPsec encrypted channels, and each segment is independently encrypted and verified to reduce transmission risks and quickly locate anomalies; data packets are automatically destroyed if decryption fails to prevent unauthorized access; backup databases are encrypted with different keys to ensure data recoverability while avoiding redundant storage risks.

[0017] 2. The geological disaster monitoring and early warning network security encryption system adopts hardware ID and digital certificate multi-factor authentication, combined with the SM2 algorithm to generate the device public and private key pair, and negotiates the session key through timestamp and random number, effectively resisting the risk of replay attack and key leakage; SM4-CBC mode encrypts data, and the HMAC-SM3 algorithm verifies integrity. It adopts the method of inserting a hidden key based on the surface key. Even if it is intercepted and obtained by others, it will only cause the data packet to be automatically destroyed without dedicated extraction software to crack the hidden key. Compared with traditional encryption methods, it is more secure. The hidden key is dispersed and embedded in redundant space and resists compression and cropping, ensuring data confidentiality, integrity and tamper resistance. TLS 1.3 / IPsec encrypted channel and segmented transmission prevent man-in-the-middle attacks, double verification mechanism (HMAC + hidden key carrier) ensures data reliability, and multi-factor authentication and permission classification realize fine-grained access control; incremental backup and independent key encryption strategy take into account data recovery needs and storage security, and automatic cleanup of expired keys reduces redundancy risks.

[0018] 3. The geological disaster monitoring and early warning network security encryption system uses technologies such as character replacement, pixel value modification, and inter-frame difference embedding to ensure that hidden information does not affect the normal use of original data, and further improves its concealment. It cannot be extracted normally and can only be extracted using special software; it uses least significant bit replacement (LSB), discrete cosine transform (DCT) and other algorithms, combined with anti-compression and anti-cropping processing to enhance the robustness of data during transmission; it selects the optimal steganography method according to the data type, balances embedding capacity and data distortion, and is suitable for the secret transmission needs of geological disaster monitoring data in multiple scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a system module block diagram of the present invention; Figure 2 It is a schematic diagram of the steps of the present invention. DETAILED DESCRIPTION

[0020] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0021] See Figure 1-Figure 2 , the present invention provides the following three technical solutions: The first implementation method: a geological disaster monitoring and early warning network security encryption system, including: Device initialization unit: The device completes identity authentication through multi-factor authentication. The device uses the SM2 algorithm to generate a public-private key pair. The private key is stored in the hardware security module or trusted execution environment. The platform and the device negotiate the session key through the SM2 key exchange protocol, adding a timestamp and random number to the negotiation process. The business key is transmitted after being encrypted using SM2 and attached with the device's public key fingerprint. Data collection and encryption unit: encrypts data using SM4-CBC mode, randomly generates an initialization vector and transmits it together with the ciphertext; calculates the HMAC-SM3 value for the collected data and device status data; Hidden key embedding unit: Generates a hidden key and divides it into multiple parts and embeds them into different redundant spaces of the data packet; selects a steganographic algorithm based on the data packet type, and performs compression and cropping resistance on the data packet; Transmission and Verification Unit: Transmitted via TLS 1.3 or IPsec encrypted channels; large data packets are transmitted in segments, each segment is independently encrypted and verified, and any verification failure is logged and an alarm is triggered; authorized users must undergo multi-factor authentication and have different permissions assigned based on their roles; Decryption and self-destruction mechanism unit: Authorized users extract the hidden key through dedicated software and combine it with the session key to generate the final decryption key through SM3 hashing; if decryption fails, the data packet is automatically destroyed; Backup database, by setting up backup storage space on the platform side to back up the received data packets, the backup data packets are encrypted and stored using different keys; after the original data packet is successfully decrypted, the copy in the backup space is automatically deleted; if the decryption fails, the backup data packet is extracted for decryption again.

[0022] Multi-factor authentication and the SM2 algorithm are used to generate public-private key pairs, and timestamps and random numbers are combined to negotiate session keys to ensure that the device identity is trustworthy and communications are secure. The SM4-CBC mode encrypts data and generates HMAC-SM3 values to ensure data integrity and confidentiality. Hidden secret keys are segmented and embedded in redundant space, combined with anti-compression and anti-cropping processing to improve anti-attack capabilities. Large data packets are transmitted in segments through TLS1.3 or IPsec encrypted channels, and each segment is independently encrypted and verified to reduce transmission risks and quickly locate anomalies. Data packets are automatically destroyed if decryption fails to prevent unauthorized access. The backup database is encrypted with different keys to ensure data recoverability while avoiding the risk of redundant storage.

[0023] The second embodiment differs from the first embodiment mainly in that: in this embodiment, the device initialization unit operation specifically includes: S1.1 Device initialization: Enhanced identity authentication: Use multi-factor authentication (such as hardware ID + digital certificate) to complete device identity authentication; Authentication formula: AuthResult = Verify(HardwareID, Certificate) where AuthResult∈{True, False}; Key pair generation: Use SM2 algorithm to generate device public and private key pair (PK d , SK d ), private key SK d Securely stored in a hardware security module (HSM) or a trusted execution environment (TEE); S1.2 Key Distribution: Session key negotiation: The platform and the device negotiate the session key K through the SM2 key exchange protocol. s ,The negotiation process adds a timestamp T and a random number R to prevent replay attacks; Negotiation formula: K s =SM2_KeyExchange(SK d , PK p , T, R), where PK p The public key on the platform side; Business key encrypted transmission: business key K b (such as the key corresponding to the device's unique identifier) is encrypted and transmitted through SM2, and the device public key fingerprint H(PK d ) to ensure that the key is bound to the device; Encryption formula: C b =SM2_Encrypt(K b , PK d )andTransmit(C b , H(PKd )); among them, C b Indicates the encrypted business key, H(PK d ) represents the fingerprint of the device public key, and Transmit represents the transmission process.

[0024] Two-factor authentication of hardware ID and digital certificate is used to ensure that the device identity is unique and cannot be forged; timestamp T and random number R are introduced when negotiating the session key based on the SM2 algorithm to effectively resist replay attacks and ensure the security of the key negotiation process; the device public key fingerprint is attached after the business key is encrypted to achieve strong binding between the key and the device to prevent the key from being tampered with or misused.

[0025] In this embodiment, the data collection and encryption unit operations specifically include: S2.1 Confidentiality protection of collected data: SM4 encryption optimization: SM4-CBC mode is used to encrypt data. The initialization vector IV is randomly generated and transmitted together with the ciphertext to prevent the same plaintext from generating the same ciphertext. Encryption formula: C=SM4_CBC_Encrypt(P, K s ,IV), where P is the plaintext data and C is the ciphertext; Key dynamic update: session key K s Updated every hour, old keys are retained for T retain hours are used to decrypt historical data; S2.2 Integrity Protection: HMAC-SM3 enhancement: The HMAC-SM3 algorithm is used to calculate the message authentication code HMAC for the collected data and device status data. The key used in calculating HMAC is the derived value K of the session key. HMAC ; Derived formula: K HMAC =SM3(K s ‖"HMAC_SALT"); HMAC calculation formula: HMAC=SM3_HMAC(K HMAC , M), where M is the data message; The data packet structure is [IV|SM4 ciphertext|HMAC|hidden key carrier], expressed as: Packet=[IV|C|HMAC|HiddenKeyCarrier].

[0026] The SM4-CBC mode is used to encrypt data, and the initialization vector (IV) is randomly generated. Combined with the dynamically updated session key, it effectively prevents ciphertext duplication attacks and historical data leakage. The message authentication code is calculated using the HMAC-SM3 algorithm, and the key is derived from the session key and salted to ensure data integrity and source credibility. The data packet integrates the IV, ciphertext, HMAC, and hidden key carrier to achieve unified encapsulation of encryption, authentication, and key management, improving transmission reliability and anti-tampering capabilities.

[0027] In this embodiment, the operations of the hidden key embedding unit specifically include: S3.1 Hidden key generation Enhanced randomness: Use the device unique identifier, random seed S and current timestamp T to generate the hidden key K through the SM3 algorithm h ; Generating formula: K h =SM3(HardwareID‖S‖T), where HardwareID represents the device ID; Key decentralized storage: The hidden key is divided into n parts {K h1 , K h2 ,…,K hn}, respectively embedded into different redundant spaces of the data packet; S3.2 Information hiding technology: Adaptive steganography: Selects steganographic algorithms based on data packet type (such as text, image, video, etc.) to ensure that embedding does not affect the normal use of data; Enhanced robustness: Data packets embedded with hidden keys are made resistant to compression and cropping to prevent key loss due to data corruption.

[0028] Hidden keys are generated by combining device ID, random seed, and timestamp to enhance key unpredictability. Key fragments are stored in redundant space in data packets, and steganographic algorithms are selected based on the type, balancing concealment and robustness. Anti-compression and anti-cropping technologies are used to ensure the integrity of the key during transmission.

[0029] In this embodiment, the transmission and verification unit operations specifically include: S4.1 Secure Transmission: Channel encryption: Data packets are transmitted via TLS 1.3 or IPsec encryption to ensure the security of the transmission process; Data segment transmission: Large data packets are transmitted in segments, and each segment is independently encrypted and verified to prevent tampering by middlemen; Segmentation formula: Packeti=[IV i ‖C i ‖HMAC i ‖HiddenKeyCarrier i]fori=1, 2, ..., m; where m represents the number of segments into which the large data packet is divided; S4.2 Integrity Verification: Double verification: The platform first verifies the HMAC and then verifies the integrity of the hidden key carrier (e.g., through redundancy check); Verification formula: VerifyHMAC(HMAC, K HMAC ,M)andVerifyCarrier(HiddenKeyCarrier); Exception handling: If verification fails, logs are recorded and an alarm is triggered to notify the administrator to handle the issue; S4.3 Authorized User Verification: Multi-factor authentication: Authorized users must authenticate using digital certificates, biometrics (such as fingerprints and facial recognition), and dynamic passwords; Authentication formula: UserAuth = VerifyCertificate ∧ VerifyBiometric ∧ VerifyOTP; Permission grading: Different permissions are assigned based on user roles, such as allowing only specific users to decrypt specific types of data packets.

[0030] Large data packets are segmented and independently encrypted and verified, combined with TLS 1.3 / IPsec channel encryption to prevent man-in-the-middle attacks and data tampering, reducing transmission risks. HMAC verification and hidden key carrier verification ensure data integrity and source credibility, and real-time alarms and logs are recorded in case of anomalies. Multi-factor authentication using digital certificates, biometrics, and dynamic passwords, combined with hierarchical permission management, achieves fine-grained access control and trusted identity verification.

[0031] In this embodiment, the decryption and self-destruction mechanism unit operations specifically include: S5.1 Decryption process: Hidden key extraction: Authorized users can extract the hidden key through dedicated software. The extraction process requires verification of user identity and permissions. Key combination: Combine the surface SM4 key (session key) and the hidden key to generate the final decryption key K through SM3 hash f ; Combination formula: K f =SM3(K s ‖K h ); Decryption operation: Use the final decryption key K f Decrypt SM4 ciphertext to obtain original data; Decryption formula: P=SM4_CBC_Decrypt(C, K f , IV); S5.2 Self-destruction mechanism: Smart self-destruction: If decryption fails (such as hidden key error, timeout or no attempt, or the number of attempts exceeds the threshold N), max ), data packets are automatically destroyed (such as overwriting ciphertext, deleting files); Audit logs: All decryption attempts are recorded, including time, user, IP address, and results, to facilitate post-audit.

[0032] The final key is generated by combining the session key and the hidden key through SM3 hashing to achieve dynamic key enhancement and prevent data cracking caused by the leakage of a single key; the data packet is automatically destroyed when decryption fails to avoid brute force cracking or illegal access, and audit logs are recorded to meet security traceability and compliance requirements; the attempt number threshold limit and timeout mechanism are used to effectively resist brute force cracking and unauthorized operations, ensuring the security of sensitive data throughout its life cycle.

[0033] In this embodiment, the operations of backing up the database specifically include: S6.1 Automatic Backup: Incremental backup: The platform sets up backup storage space, and the data packets received by the platform are automatically backed up; Backup encryption: The backup data package is stored using SM4 encryption, and the encryption key K b Different from the main data package, increasing security; Backup encryption formula: C b =SM4_Encrypt(Packet, K b ); S6.2 Backup Destruction: Automatic cleanup: After the original data packet is successfully decrypted, the copy in the backup space is automatically deleted; Retention policy: If decryption fails, the backup data package will be retained until the user manually clears it or the expiration time T set by the system policy expire (e.g. 7 days).

[0034] An incremental backup strategy is used to automatically store received data packets and encrypt them with an independent key SM4 to avoid backup data risks caused by master key leakage and enhance data redundancy security. The backup copy is automatically deleted after the original data is successfully decrypted to reduce redundant storage. When decryption fails, the backup is retained according to the policy, taking into account data recovery needs and storage cost control. The backup expiration time is set to prevent invalid data from occupying resources for a long time, and manual cleanup is supported to improve the flexibility and compliance of system operation and maintenance.

[0035] The third implementation method differs from the second implementation method in that the data packet types are divided into text, image, and video, and the steganographic algorithm is expressed as: (1) For text data packets, use a steganographic algorithm based on character replacement or format hiding; for example, use spaces, punctuation marks, or invisible characters to embed information; let the original text be T, the embedded information be M, and the embedded text be T′: T′=EmbedText(T,M); Among them, EmbedText is a text embedding function, which represents the process of embedding information M into text T; (2) For image data packets, a steganographic algorithm based on pixel value modification or frequency domain transformation is used; for example, LSB (least significant bit) replacement, DCT (discrete cosine transform) coefficient modification, etc. Let the original image be I, the embedded information be M, and the embedded image be I′: I′=EmbedImage(I,M); Among them, EmbedImage is an image embedding function, which represents the process of embedding information M into image I; The embedding process involves the modification of pixel values: I′(x,y)=I(x,y)+Δ(x,y); Where Δ(x, y) is the pixel value modification amount calculated based on the information M; (3) For video data packets, steganographic algorithms based on inter-frame differences or motion vectors can be used; for example, information can be embedded in the redundant parts of video frames, or in motion vectors: Let the original video be V, the embedded information be M, and the embedded video be V′; V′=EmbedVideo(V,M); Among them, EmbedVideo is a video embedding function, which represents the process of embedding information M into video V; The embedding process involves the modification of the differences between frames: V′(t)=V(t)+Δ(t); Where V(t) is the original video data of the t-th frame, V′(t) is the modified video data of the t-th frame, and Δ(t) is the inter-frame difference modification amount calculated based on the information M.

[0036] Through technologies such as character replacement, pixel value modification and inter-frame difference embedding, it is ensured that hidden information does not affect the normal use of original data, and the concealment is further improved. It cannot be extracted normally and can only be extracted using special software; the least significant bit replacement (LSB) and discrete cosine transform (DCT) algorithms are used, combined with anti-compression and anti-cropping processing to enhance the robustness of data in transmission; the optimal steganography method is selected according to the data type, balancing the embedding capacity and data distortion, which is suitable for the secret transmission needs of geological disaster monitoring data in multiple scenarios.

[0037] The process record log is shown in the following table 1: Table 1 Process log record table Meanwhile, the contents not described in detail in this specification belong to the prior art known to those skilled in the art.

[0038] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus.

[0039] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A geological disaster monitoring and early warning network security encryption system, characterized in that: include: Device initialization unit: The device completes identity authentication through multi-factor authentication. The device uses the SM2 algorithm to generate a public-private key pair. The private key is stored in the hardware security module or trusted execution environment. The platform and the device negotiate the session key through the SM2 key exchange protocol, adding a timestamp and random number to the negotiation process; the business key is encrypted through SM2 and transmitted with the device public key fingerprint attached; Data collection and encryption unit: encrypts data using SM4-CBC mode, randomly generates an initialization vector and transmits it together with the ciphertext; calculates the HMAC-SM3 value for the collected data and device status data; Hidden key embedding unit: Generates a hidden key and divides it into multiple parts and embeds them into different redundant spaces of the data packet; selects a steganographic algorithm based on the data packet type, and performs compression and cropping resistance on the data packet; Transmission and verification unit: Transmission through TLS 1.3 or IPsec encrypted channels; Large data packets are transmitted in segments, each segment is independently encrypted and verified. If verification fails, a log is recorded and an alarm is triggered. Authorized users must undergo multi-factor authentication and are assigned different permissions based on their roles. Decryption and self-destruction mechanism unit: Authorized users extract the hidden key through dedicated software, and combine it with the session key to generate the final decryption key through SM3 hashing; If decryption fails, the data packet is automatically destroyed.

2. A geological disaster monitoring and early warning network security encryption system according to claim 1, characterized in that: The device initialization unit operation specifically includes: S1.1 Device initialization: Enhanced identity authentication: Use multi-factor authentication to complete device identity authentication; Key pair generation: Use SM2 algorithm to generate device public and private key pair (PK d , SK d ), private key SK d Securely stored in a hardware security module (HSM) or a trusted execution environment (TEE); S1.2 Key Distribution: Session key negotiation: The platform and the device negotiate the session key K through the SM2 key exchange protocol. s ,The negotiation process adds a timestamp T and a random number R to prevent replay attacks; Business key encrypted transmission: business key K b After transmission through SM2 encryption, the device public key fingerprint H(PK d ) to ensure the key is bound to the device.

3. The security encryption system for geological disaster monitoring and early warning network according to claim 1 is characterized in that: The data collection and encryption unit operations specifically include: S2.1 Confidentiality protection of collected data: SM4 encryption optimization: SM4-CBC mode is used to encrypt data. The initialization vector IV is randomly generated and transmitted together with the ciphertext to prevent the same plaintext from generating the same ciphertext. Key dynamic update: session key K s Updated every hour, old keys are retained for T retain hours are used to decrypt historical data; S2.2 Integrity Protection: HMAC-SM3 enhancement: The HMAC-SM3 algorithm is used to calculate the message authentication code HMAC for the collected data and device status data. The key used in calculating HMAC is the derived value K of the session key. HMAC ; The data packet structure is [IV|SM4 ciphertext|HMAC|hidden key carrier], expressed as: Packet=[IV|C|HMAC|HiddenKeyCarrier].

4. The security encryption system for geological disaster monitoring and early warning network according to claim 1 is characterized in that: The operations of the hidden key embedding unit specifically include: S3.1 Hidden key generation Enhanced randomness: Use the device unique identifier, random seed S and current timestamp T to generate the hidden key K through the SM3 algorithm h ; Key decentralized storage: The hidden key is divided into n parts {K h1 , K h2 ,…,K hn }, respectively embedded into different redundant spaces of the data packet; S3.2 Information hiding technology: Adaptive steganography: Select the steganographic algorithm according to the data packet type to ensure that the embedding does not affect the normal use of the data; Enhanced robustness: Data packets embedded with hidden keys are made resistant to compression and cropping to prevent key loss due to data corruption.

5. A geological disaster monitoring and early warning network security encryption system according to claim 4, characterized in that: The data packet types are divided into text, image and video, and the steganographic algorithm is expressed as: (1) For text data packets, a steganographic algorithm based on character replacement or format hiding is used; let the original text be T, the embedded information be M, and the embedded text be T′: T′=EmbedText(T,M); Among them, EmbedText is a text embedding function, which represents the process of embedding information M into text T; (2) For image data packets, a steganographic algorithm based on pixel value modification or frequency domain transformation is used; let the original image be I, the embedded information be M, and the embedded image be I′: I′=EmbedImage(I,M); Among them, EmbedImage is an image embedding function, which represents the process of embedding information M into image I; The embedding process involves the modification of pixel values: I′(x,y)=I(x,y)+Δ(x,y); Where Δ(x, y) is the pixel value modification amount calculated based on the information M; (3) For video data packets, use steganographic algorithms based on inter-frame differences or motion vectors; Let the original video be V, the embedded information be M, and the embedded video be V′: V′=EmbedVideo(V,M); Among them, EmbedVideo is a video embedding function, which represents the process of embedding information M into video V; The embedding process involves the modification of the differences between frames: V′(t)=V(t)+Δ(t); Where V(t) is the original video data of the t-th frame, V′(t) is the modified video data of the t-th frame, and Δ(t) is the inter-frame difference modification amount calculated based on the information M.

6. The security encryption system for geological disaster monitoring and early warning network according to claim 1 is characterized in that: The transmission and verification unit operations specifically include: S4.1 Secure Transmission: Channel encryption: Data packets are transmitted via TLS 1.3 or IPsec encryption to ensure the security of the transmission process; Data segment transmission: Large data packets are transmitted in segments, and each segment is independently encrypted and verified to prevent tampering by middlemen; S4.2 Integrity Verification: Double verification: The platform first verifies the HMAC and then verifies the integrity of the hidden key carrier; Exception handling: If verification fails, logs are recorded and an alarm is triggered to notify the administrator to handle the issue; S4.3 Authorized User Verification: Multi-factor authentication: Authorized users must authenticate their identities using digital certificates, biometrics, and dynamic passwords; Permission grading: Assign different permissions based on user roles.

7. The security encryption system for geological disaster monitoring and early warning network according to claim 1 is characterized in that: The decryption and self-destruction mechanism unit operations specifically include: S5.1 Decryption process: Hidden key extraction: Authorized users can extract the hidden key through dedicated software. The extraction process requires verification of user identity and permissions. Key combination: Combine the surface SM4 key and the hidden secret key to generate the final decryption key K through SM3 hash f ; Decryption operation: Use the final decryption key K f Decrypt SM4 ciphertext to obtain original data; S5.2 Self-destruction mechanism: Intelligent self-destruction: If decryption fails, the data packet is automatically destroyed; Audit logs: All decryption attempts are recorded, including time, user, IP address, and results, to facilitate post-audit.

8. The geological disaster monitoring and early warning network security encryption system according to claim 1 is characterized by: It also includes a backup database, which backs up received data packets by setting a backup storage space on the platform side, and the backup data packets are encrypted and stored using different keys; After the original data packet is successfully decrypted, the copy in the backup space is automatically deleted; If the decryption fails, the backup data package is extracted for decryption again.

9. A geological disaster monitoring and early warning network security encryption system according to claim 8, characterized in that: The operations of backing up the database specifically include: S6.1 Automatic Backup: Incremental backup: The platform sets up backup storage space, and the data packets received by the platform are automatically backed up; Backup encryption: The backup data package is stored using SM4 encryption, and the encryption key K b Different from the main data package, increasing security; S6.2 Backup Destruction: Automatic cleanup: After the original data packet is successfully decrypted, the copy in the backup space is automatically deleted; Retention policy: If decryption fails, the backup data package will be retained until the user manually clears it or the expiration time T set by the system policy expire .

Images