A geological disaster monitoring and early warning network security encryption system

Abstract

The application discloses a geological disaster monitoring and early warning network security encryption system and relates to the technical field of encryption systems.The geological disaster monitoring and early warning network security encryption system comprises a device initialization unit, a data acquisition and encryption unit, a hidden secret key embedding unit, a transmission and verification unit, a decryption and self-destruction mechanism unit and a backup database; a public and private key pair is generated by adopting multi-factor authentication and an SM2 algorithm, a session key is negotiated in combination with a time stamp and a random number, the identity of the device is ensured to be credible and communication is ensured to be safe; data is encrypted in an SM4-CBC mode and an HMAC-SM3 value is generated, the integrity and confidentiality of the data are ensured; a hidden secret key is segmented and embedded in a redundant space, in combination with compression resistance and cutting resistance processing, the attack resistance is improved; large data packets are transmitted in segments through a TLS 1.3 or IPsec encryption channel, each segment is independently encrypted and verified, transmission risks are reduced and abnormalities are quickly located; data packets are automatically destroyed in case of decryption failure, and unauthorized access is prevented.

Description

Technical Field

[0001] The present invention relates to the technical field of encryption systems, and in particular to a security encryption system for a geological disaster monitoring and early warning network. Background Art

[0002] The national geological disaster monitoring network includes the Internet of Things side and the platform side. It collects geological environment data through front-end data acquisition equipment and transmits it to provincial platforms using 4G / satellite and other communication networks. The provincial platforms monitor, analyze, perceive and warn of the data, and transmit the data to the national platform through the data synchronization network. As a first-level platform, the national platform can conduct unified monitoring and management of provincial platforms.

[0003] The comprehensive defense-in-depth system adopts domestically produced, independently controllable network security, cryptography and other technologies and products. By building network security on the IoT side and platform side, and combining security management and operational disposal, it integrates technology and management capabilities to build a complete comprehensive protection system.

[0004] For security reasons, all transmitted data packets need to be encrypted and protected, such as a key encryption and decryption method and storage, application control system, and electronic device disclosed in Publication No. 202310591353.2. The key encryption method includes: setting a communication handshake key; generating a key data stream based on the communication handshake key; creating key loading information; encrypting plaintext data based on the key data stream and the key loading information to obtain key ciphertext data; storing the key ciphertext data in the key storage space; the key decryption method includes: reading key ciphertext data from the key storage space; obtaining the communication handshake key and key loading information during encryption; decrypting the key ciphertext data based on the communication handshake key and the key loading information to obtain key plaintext data. This application encrypts the communication handshake key of network communication and then stores the encrypted key ciphertext data, which can reduce the risk of the communication key being brute-force cracked, thereby improving the security of network communication.

[0005] As shown in the above technology, the existing encryption method is to encrypt through an algorithm and simultaneously generate a secret key. The receiving end needs the secret key to decrypt the encrypted data. However, with only one layer of encryption, when others obtain the data packet, they may use technical means to crack the secret key, which has limited security. For national-level data, data cracking will have a greater impact. Summary of the Invention

[0006] In view of the shortcomings of the existing technology, the present invention provides a geological disaster monitoring and early warning network security encryption system, which solves the problem of limited security of existing encryption methods.

[0007] To achieve the above object, the present application is implemented by the following technical solutions: a geological disaster monitoring and early warning network security encryption system, comprising:

[0008] The device initialization unit: the device completes identity authentication through multi-factor authentication, and generates a public-private key pair using an SM2 algorithm, and the private key is stored in a hardware security module or a trusted execution environment; the platform side and the device negotiate a session key through an SM2 key exchange protocol, and a timestamp and a random number are added in the negotiation process; the business key is transmitted after being encrypted by the SM2 and is attached with a device public key fingerprint;

[0009] The data acquisition and encryption unit: the data is encrypted in an SM4-CBC mode, and an initialization vector is randomly generated and transmitted together with the ciphertext; the HMAC-SM3 value is calculated for the collected data and the device state data;

[0010] The hidden key embedding unit: a hidden key is generated and embedded in different redundant spaces of the data packet in multiple parts; a steganography algorithm is selected according to the type of the data packet, and the data packet is subjected to anti-compression and anti-trimming processing;

[0011] The transmission and verification unit: transmission through a TLS 1.3 or IPsec encrypted channel; large data packets are transmitted in segments, each segment is independently encrypted and verified, and if the verification fails, a log is recorded and an alarm is triggered; authorized users need to be authenticated through multi-factor authentication, and are assigned different permissions according to roles;

[0012] The decryption and self-destruction mechanism unit: the authorized user extracts the hidden key through a special software, and generates a final decryption key through an SM3 hash combined with the session key; if the decryption fails, the data packet is automatically destroyed.

[0013] Preferably, the device initialization unit operation specifically includes:

[0014] S1.1 device initialization:

[0015] Enhanced identity authentication: multi-factor authentication is used to complete device identity authentication;

[0016] Key pair generation: an SM2 algorithm is used to generate a device public-private key pair (PK d , SK d ), and the private key SK d is securely stored in a hardware security module HSM or a trusted execution environment TEE;

[0017] S1.2 key distribution:

[0018] Session key negotiation: the platform side and the device negotiate a session key K s through an SM2 key exchange protocol, and a timestamp T and a random number R are added in the negotiation process to prevent replay attacks;

[0019] Service key encryption transmission: service key K b After transmission by SM2 encryption, the device public key fingerprint H(PK d ) is added during encryption to ensure that the key is bound to the device.

[0020] Preferably, the data collection and encryption unit operation specifically includes:

[0021] S2.1 Collect data confidentiality protection:

[0022] SM4 encryption optimization: encrypt data using SM4-CBC mode, and the initialization vector IV is randomly generated and transmitted together with the ciphertext to prevent the same plaintext from generating the same ciphertext;

[0023] Key dynamic update: session key K s is updated every hour, and the old key is kept for T retain hours for decrypting historical data;

[0024] S2.2 Integrity protection:

[0025] HMAC-SM3 enhancement: calculate the message authentication code HMAC of the collected data and the state data of the device using the HMAC-SM3 algorithm, and the key used when calculating HMAC is the derived value K HMAC of the session key;

[0026] The data packet structure is [IV|SM4 ciphertext|HMAC|hidden key carrier], which is represented as: Packet=[IV|C|HMAC|HiddenKeyCarrier].

[0027] Preferably, the hidden key embedding unit operation specifically includes:

[0028] S3.1 Hidden key generation

[0029] Enhanced randomness: use the device unique identifier, random seed S and current timestamp T to generate hidden key K h through SM3 algorithm;

[0030] Key dispersion storage: hidden key is divided into n parts {K h1 , K h2 , …, K hn}, respectively embedded in different redundant spaces of the data packet;

[0031] S3.2 Information hiding technology:

[0032] Adaptive steganography: select steganography algorithm according to data packet type to ensure that embedding does not affect normal use of data;

[0033] Robustness enhancement: Anti-compression and anti-cropping processing is performed on the data packet embedded with the hidden secret key to prevent data damage from causing the loss of the secret key.

[0034] Preferably, the data packet types are divided into text, image, and video, and the steganography algorithm is represented as:

[0035] (1) For text data packets, a steganography algorithm based on character replacement or format hiding is used; let the original text be T, the embedded information be M, and the embedded text be T':

[0036] T' = EmbedText(T, M);

[0037] where EmbedText is a text embedding function representing the process of embedding information M into text T;

[0038] (2) For image data packets, a steganography algorithm based on pixel value modification or frequency domain transformation is used; let the original image be I, the embedded information be M, and the embedded image be I':

[0039] I' = EmbedImage(I, M);

[0040] where EmbedImage is an image embedding function representing the process of embedding information M into image I;

[0041] The embedding process involves modifying the pixel values:

[0042] I'(x, y) = I(x, y) + Δ(x, y);

[0043] where Δ(x, y) is the pixel value modification calculated based on information M;

[0044] (3) For video data packets, a steganography algorithm based on inter-frame difference or motion vector can be used;

[0045] Let the original video be V, the embedded information be M, and the embedded video be V':

[0046] V' = EmbedVideo(V, M);

[0047] where EmbedVideo is a video embedding function representing the process of embedding information M into video V;

[0048] The embedding process involves modifying the inter-frame difference:

[0049] V'(t) = V(t) + Δ(t);

[0050] Wherein, V(t) is the original video data of the t frame, V'(t) is the modified video data of the t frame, and Δ(t) is the inter-frame difference modification amount calculated according to the information M.

[0051] Preferably, the transmission and verification unit operation specifically includes:

[0052] S4.1 Secure transmission:

[0053] Channel encryption: data packets are transmitted through TLS 1.3 or IPsec encryption, ensuring the security of the transmission process;

[0054] Data segmentation transmission: large data packets are transmitted in segments, each segment is independently encrypted and verified to prevent man-in-the-middle tampering;

[0055] S4.2 Integrity verification:

[0056] Double verification: the platform side first verifies the HMAC, and then verifies the integrity of the hidden secret key carrier;

[0057] Abnormal handling: if the verification fails, log and trigger alarm to notify the administrator to handle;

[0058] S4.3 Authorized user verification:

[0059] Multi-factor authentication: authorized users need to verify their identity through digital certificates, biometric features and dynamic passwords;

[0060] Permission grading: different permissions are assigned according to user roles, such as allowing only certain users to decrypt certain types of data packets.

[0061] Preferably, the decryption and self-destruction mechanism unit operation specifically includes:

[0062] S5.1 Decryption process:

[0063] Hidden secret key extraction: authorized users extract hidden secret keys through special software, and the extraction process needs to verify user identity and permissions;

[0064] Key combination: combine the surface SM4 key and the hidden secret key to generate the final decryption key K f through SM3 hash;

[0065] Decryption operation: use the final decryption key K f to decrypt SM4 ciphertext and obtain the original data;

[0066] S5.2 Self-destruction mechanism:

[0067] Intelligent self-destruction: if decryption fails, the data packet is automatically destroyed;

[0068] Audit record: record all decryption attempts, including time, user, IP address and result, for post-audit.

[0069] Preferably, it also includes a backup database, which backs up the received data packet by setting a backup storage space on the platform side, and the backup data packet is stored by using different keys for encryption; after the original data packet is successfully decrypted, the copy in the backup space is automatically deleted; if decryption fails, the backup data packet is extracted for decryption again.

[0070] Preferably, the operation of the backup database specifically includes:

[0071] S6.1 Automatic backup:

[0072] Incremental backup: the platform side sets a backup storage space, and the data packet received by the platform side is automatically backed up;

[0073] Backup encryption: the backup data packet is stored by using SM4 encryption, and the encryption key K b Different from the main data packet, the security is increased;

[0074] S6.2 Backup destruction:

[0075] Automatic cleaning: after the original data packet is successfully decrypted, the copy in the backup space is automatically deleted;

[0076] Retention policy: if decryption fails, the backup data packet is retained until the user manually cleans it up or the expiration time T set by the system policy expire .

[0077] The application provides a geological disaster monitoring and early warning network security encryption system.

[0078] 1、The geological disaster monitoring and early warning network security encryption system adopts multi-factor authentication and SM2 algorithm to generate a public-private key pair, combines a timestamp and a random number to negotiate a session key, ensures that the device identity is trusted and the communication is safe, encrypts data in SM4-CBC mode and generates an HMAC-SM3 value, guarantees data integrity and confidentiality, hides the secret key and embeds it in a redundant space, combines anti-compression and anti-trimming processing, and improves the anti-attack ability; large data packets are transmitted through TLS 1.3 or IPsec encrypted channels in segments, each segment is independently encrypted and verified, the transmission risk is reduced and the exception is quickly located; the data packet is automatically destroyed if decryption fails, preventing unauthorized access; the backup database is encrypted by using different keys, ensuring data recoverability and avoiding redundant storage risks.

[0079] 2、The geological disaster monitoring and early warning network security encryption system adopts multi-factor authentication of hardware ID and digital certificate, generates a device public and private key pair in combination with an SM2 algorithm, and negotiates a session key through a timestamp and a random number, effectively resisting replay attacks and key leakage risks; SM4-CBC mode encrypts data, an HMAC-SM3 algorithm verifies integrity, and a hidden key is inserted based on a surface key, so that even if the data packet is intercepted and acquired by others, the hidden key cannot be cracked without special extraction software, only the data packet is automatically destroyed, the security is higher than that of a traditional encryption mode, and the hidden key is embedded in a redundant space and resistant to compression and cutting, ensuring data confidentiality, integrity and tamper resistance; TLS 1.3 / IPsec encrypted channels and segmented transmission prevent man-in-the-middle attacks, a double verification mechanism (HMAC+hidden key carrier) ensures data reliability, multi-factor authentication and permission grading realize fine-grained access control; incremental backup and independent key encryption strategy consider data recovery requirements and storage security, and automatic cleaning reduces redundancy risks.

[0080] 3、The geological disaster monitoring and early warning network security encryption system ensures that the hidden information does not affect the normal use of the original data by using character replacement, pixel value modification and interframe difference embedding technologies, and further improves the concealment, which cannot be normally extracted and can only be extracted by using special software; the lowest significant bit replacement (LSB) and discrete cosine transform (DCT) algorithms are used in combination with anti-compression and anti-cutting processing to enhance the robustness of data in transmission; according to the data type, the optimal steganography method is selected to balance the embedding capacity and data distortion, and is suitable for the secret transmission requirements of geological disaster monitoring data in multiple scenes. BRIEF DESCRIPTION OF DRAWINGS

[0081] Fig. 1 The system block diagram of the present application is shown in the figure;

[0082] Fig. 2 The step flowchart of the present application is shown in the figure. DETAILED DESCRIPTION

[0083] The technical solutions in the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor belong to the scope of protection of the present application.

[0084] Referring to Figs. 1-2 The present application provides the following three technical solutions:

[0085] The first embodiment is a geological disaster monitoring and early warning network security encryption system, comprising:

[0086] Device initialization unit: the device completes identity authentication through multi-factor authentication, generates a public-private key pair using the SM2 algorithm, and stores the private key in a hardware security module or a trusted execution environment; the platform side and the device negotiate a session key through the SM2 key exchange protocol, and add a timestamp and a random number during the negotiation process; the business key is transmitted after being encrypted by SM2 and is attached with the device public key fingerprint;

[0087] Data acquisition and encryption unit: encrypt the data using the SM4-CBC mode, randomly generate an initialization vector, and transmit it together with the ciphertext; calculate the HMAC-SM3 value for the collected data and device state data;

[0088] Hidden key embedding unit: generate a hidden key and embed it in different redundant spaces of the data packet; select a steganography algorithm according to the data packet type, and perform anti-compression and anti-trimming processing on the data packet;

[0089] Transmission and verification unit: transmit through a TLS 1.3 or IPsec encrypted channel; segment large data packets for transmission, and independently encrypt and verify each segment. If the verification fails, log the failure and trigger an alarm; authorized users need to perform identity verification through multi-factor authentication, and are assigned different permissions according to their roles;

[0090] Decryption and self-destruction mechanism unit: authorized users extract the hidden key through a dedicated software, and generate a final decryption key through SM3 hashing combined with the session key; if the decryption fails, the data packet is automatically destroyed;

[0091] Backup database: set a backup storage space on the platform side to backup the received data packets, and store the backup data packets using different encryption keys; after the original data packet is successfully decrypted, the copy in the backup space is automatically deleted; if the decryption fails, the backup data packet is extracted for decryption again.

[0092] Multi-factor authentication and SM2 algorithm are used to generate a public-private key pair, and a timestamp and a random number are used to negotiate a session key, ensuring that the device identity is trusted and the communication is secure; SM4-CBC mode is used to encrypt data and generate HMAC-SM3 value, ensuring data integrity and confidentiality; hidden key is segmented and embedded in redundant space, combined with anti-compression and anti-trimming processing, to improve attack resistance; large data packets are transmitted in segments through a TLS 1.3 or IPsec encrypted channel, and each segment is independently encrypted and verified, reducing transmission risk and quickly locating abnormalities; automatically destroy the data packet if decryption fails to prevent unauthorized access; the backup database is encrypted using different keys to ensure data recoverability and avoid redundant storage risks.

[0093] The second embodiment differs from the first embodiment mainly in that in the present embodiment, the device initialization unit operation specifically includes:

[0094] S1.1 Device initialization:

[0095] Enhanced identity authentication: device identity authentication is completed using multi-factor authentication (such as hardware ID + digital certificate);

[0096] Authentication formula: AuthResult = Verify(HardwareID, Certificate) where AuthResult ∈ {True, False};

[0097] Key pair generation: device public and private key pair (PK d , SK d ) is generated using the SM2 algorithm, and the private key SK d is securely stored in the hardware security module HSM or trusted execution environment TEE;

[0098] S1.2 Key distribution:

[0099] Session key negotiation: the platform side and the device negotiate the session key K s through the SM2 key exchange protocol, and the negotiation process adds a timestamp T and a random number R to prevent replay attacks;

[0100] Negotiation formula: K s = SM2_KeyExchange(SK d , PK p , T, R), where PK p is the public key of the platform side;

[0101] Business key encrypted transmission: business key K b (such as the key corresponding to the unique identifier of the device) is transmitted after being encrypted by SM2, and the device public key fingerprint H(PK d ) is attached during encryption to ensure that the key is bound to the device;

[0102] Encryption formula: C b = SM2_Encrypt(K b , PK d ) and Transmit(C b , H(PK d )); where C b represents the encrypted business key, H(PK d ) represents the fingerprint of the device public key, and Transmit represents the transmission process.

[0103] The hardware ID and digital certificate double-factor authentication are adopted to ensure that the device identity is unique and unforgeable; the timestamp T and random number R are introduced when the session key is negotiated based on the SM2 algorithm, so as to effectively resist replay attacks and guarantee the security of the key negotiation process; the device public key fingerprint is attached after the business key is encrypted, so as to realize the strong binding of the key and the device and prevent the key from being tampered with or used fraudulently.

[0104] In the embodiment, the data acquisition and encryption unit operation specifically includes:

[0105] S2.1 Acquisition of data confidentiality protection:

[0106] SM4 encryption optimization: the SM4-CBC mode is adopted to encrypt data, and the initialization vector IV is randomly generated and transmitted together with the ciphertext to prevent the same plaintext from generating the same ciphertext;

[0107] The encryption formula is C = SM4_CBC_Encrypt (P, K s , IV), wherein P is plaintext data, and C is ciphertext;

[0108] Key dynamic update: the session key K s is updated every hour, and the old key is reserved for T retain hours to decrypt historical data;

[0109] S2.2 Integrity protection:

[0110] HMAC-SM3 enhancement: the message authentication code HMAC of the collected data and the state data of the device is calculated using the HMAC-SM3 algorithm, and the key used when calculating the HMAC is the derived value K HMAC of the session key;

[0111] The derivation formula is K HMAC = SM3 (K s ‖ "HMAC_SALT");

[0112] The HMAC calculation formula is HMAC = SM3_HMAC (K HMAC , M), wherein M is a data message;

[0113] The data packet structure is [IV | SM4 ciphertext | HMAC | hidden key carrier], which is represented as Packet = [IV | C | HMAC | HiddenKeyCarrier].

[0114] SM4-CBC mode is used to encrypt data, an initialization vector IV is randomly generated, and a dynamically updated session key is combined to effectively prevent ciphertext repetition attacks and historical data leakage; the HMAC-SM3 algorithm is used to calculate the message authentication code, the key is derived from the session key and a salt value is added to ensure data integrity and trusted source; the IV, ciphertext, HMAC and hidden key carrier are integrated into the data packet to realize unified packaging of encryption, authentication and key management, and to improve transmission reliability and tamper resistance.

[0115] In this embodiment, the hidden key embedding unit operation specifically includes:

[0116] S3.1 Hidden key generation

[0117] Enhanced randomness: using device unique identifier, random seed S and current timestamp T to generate hidden key K through SM3 algorithm h ;

[0118] Generation formula: K h = SM3(HardwareID‖S‖T), where HardwareID represents device ID;

[0119] Key dispersion storage: hidden key is divided into n parts {K h1 , K h2 , …, K hn}, which are embedded into different redundant spaces of the data packet;

[0120] S3.2 Information hiding technology:

[0121] Adaptive steganography: select steganography algorithm according to data packet type (such as text, image, video, etc.), ensure that the embedded data does not affect normal use;

[0122] Robustness enhancement: anti-compression and anti-cropping processing is performed on the data packet embedded with the hidden key to prevent data damage from causing key loss.

[0123] Combined with device ID, random seed and timestamp to generate hidden key, enhance the unpredictability of the key; key fragments are stored in the redundant space of the data packet, and steganography algorithm is selected according to the type, considering both concealment and robustness; anti-compression and anti-cropping technology ensures the integrity of the key during transmission.

[0124] In this embodiment, the transmission and verification unit operation specifically includes:

[0125] S4.1 Secure transmission:

[0126] Channel encryption: data packets are encrypted and transmitted through TLS 1.3 or IPsec to ensure the security of the transmission process;

[0127] Data segment transmission: Large data packets are transmitted in segments, and each segment is independently encrypted and verified to prevent tampering by middlemen;

[0128] Segmentation formula: Packeti=[IV i ‖C i ‖HMAC i ‖HiddenKeyCarrier i ]fori=1, 2, ..., m; where m represents the number of segments into which the large data packet is divided;

[0129] S4.2 Integrity Verification:

[0130] Double verification: The platform first verifies the HMAC and then verifies the integrity of the hidden key carrier (e.g., through redundancy check);

[0131] Verification formula: VerifyHMAC(HMAC, K HMAC ,M)andVerifyCarrier(HiddenKeyCarrier);

[0132] Exception handling: If verification fails, logs are recorded and an alarm is triggered to notify the administrator to handle the issue;

[0133] S4.3 Authorized User Verification:

[0134] Multi-factor authentication: Authorized users must authenticate using digital certificates, biometrics (such as fingerprints and facial recognition), and dynamic passwords;

[0135] Authentication formula: UserAuth = VerifyCertificate ∧ VerifyBiometric ∧ VerifyOTP;

[0136] Permission grading: Different permissions are assigned based on user roles, such as allowing only specific users to decrypt specific types of data packets.

[0137] Large data packets are segmented and independently encrypted and verified, combined with TLS 1.3 / IPsec channel encryption to prevent man-in-the-middle attacks and data tampering, reducing transmission risks. HMAC verification and hidden key carrier verification ensure data integrity and source credibility, and real-time alarms and logs are recorded in case of anomalies. Multi-factor authentication using digital certificates, biometrics, and dynamic passwords, combined with hierarchical permission management, achieves fine-grained access control and trusted identity verification.

[0138] In this embodiment, the decryption and self-destruction mechanism unit operations specifically include:

[0139] S5.1 Decryption process:

[0140] Hidden key extraction: authorized users extract hidden keys through special software, and the extraction process needs to verify user identity and authority;

[0141] Key combination: combine the surface SM4 key (session key) and the hidden key to generate the final decryption key K f through SM3 hash

[0142] Combination formula: K f =SM3(K s ‖K h );

[0143] Decryption operation: use the final decryption key K f to decrypt SM4 ciphertext and obtain the original data

[0144] Decryption formula: P=SM4_CBC_Decrypt(C, K f , IV)

[0145] S5.2 Self-destruction mechanism:

[0146] Intelligent self-destruction: if decryption fails (such as hidden key error, timeout not provided or attempt times exceeding threshold N max ), the data packet is automatically destroyed (such as covering the ciphertext, deleting the file)

[0147] Audit record: record all decryption attempts, including time, user, IP address and result, for post-audit

[0148] Combine the session key and hidden key to generate the final key through SM3 hash, realize dynamic key enhancement, prevent single key leakage leading to data cracking; automatically destroy the data packet when decryption fails, avoid brute force cracking or illegal access, record audit log at the same time, meet the requirements of security traceability and compliance; through attempt times threshold limit and timeout mechanism, effectively resist brute force cracking and unauthorized operation, ensure the safety of sensitive data throughout the life cycle

[0149] In this embodiment, the operation of the backup database specifically includes:

[0150] S6.1 Automatic backup:

[0151] Incremental backup: the backup storage space is set on the platform side, and the data packet received by the platform side is automatically backed up

[0152] Backup encryption: backup data packets are stored using SM4 encryption, and the encryption key K b is different from the main data packet to increase security

[0153] Backup encryption formula: C b =SM4_Encrypt(Packet, K b )

[0154] S6.2 Backup destruction:

[0155] Automatic cleaning: after the original data packet is successfully decrypted, the copy in the backup space is automatically deleted;

[0156] Retention policy: if decryption fails, the backup data packet is retained until the user manually cleans it up or the expiration time T set by the system policy expire (7 days).

[0157] Adopting incremental backup strategy to automatically store received data packets and using independent key SM4 encryption can avoid backup data risks caused by key leakage and enhance data redundancy security; after the original data is successfully decrypted, the backup copy is automatically deleted to reduce redundant storage; when decryption fails, backup is retained according to the policy, taking into account data recovery needs and storage cost control; set the backup expiration time to prevent invalid data from occupying resources for a long time, while supporting manual cleaning to improve system operation flexibility and compliance.

[0158] The third embodiment differs from the second embodiment mainly in that the data packet type is divided into text, image and video, and the steganography algorithm is represented as:

[0159] (1) For text data packets, use steganography algorithms based on character replacement or format hiding; for example, use spaces, punctuation marks or invisible characters to embed information; let the original text be T, the embedded information be M, and the embedded text be T':

[0160] T'=EmbedText(T,M);

[0161] Where EmbedText is a text embedding function, representing the process of embedding information M into text T;

[0162] (2) For image data packets, use steganography algorithms based on pixel value modification or frequency domain transformation; for example, LSB (Least Significant Bit) replacement, DCT (Discrete Cosine Transform) coefficient modification, etc.; let the original image be I, the embedded information be M, and the embedded image be I':

[0163] I'=EmbedImage(I,M);

[0164] Where EmbedImage is an image embedding function, representing the process of embedding information M into image I;

[0165] The embedding process involves modifying the pixel value:

[0166] I'(x,y)=I(x,y)+Δ(x,y);

[0167] wherein Δ(x, y) is a pixel value modification quantity calculated according to the information M;

[0168] (3) For video data packets, a steganography algorithm based on inter-frame difference or motion vector can be used; for example, information is embedded in the redundant part of a video frame, or information is embedded in a motion vector:

[0169] Let the original video be V, the embedded information be M, and the embedded video be V';

[0170] V' = EmbedVideo(V, M);

[0171] wherein EmbedVideo is a video embedding function, representing the process of embedding information M into video V.

[0172] The embedding process involves modification of inter-frame difference:

[0173] V'(t) = V(t) + Δ(t);

[0174] wherein V(t) is the original video data of the t-th frame, V'(t) is the modified video data of the t-th frame, and Δ(t) is an inter-frame difference modification quantity calculated according to the information M.

[0175] Through character replacement, pixel value modification, and inter-frame difference embedding, etc., it is ensured that the hidden information does not affect the normal use of the original data, and further improves the concealment, which cannot be normally extracted, and can only be extracted using special software; using least significant bit replacement (LSB), discrete cosine transform (DCT), etc., combined with anti-compression, anti-trimming processing, the robustness of data in transmission is enhanced; according to the data type, the optimal steganography method is selected, the embedding capacity and data distortion are balanced, and it is suitable for the secret transmission needs of multi-scene geological disaster monitoring data.

[0176] The process record log is shown in the following Table 1 example:

[0177] Table 1 Process log record table

[0178]

[0179] Meanwhile, the contents not described in detail in the specification all belong to the existing technology known to those skilled in the art.

[0180] It is to be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting; it is not intended to exclude myriad other embodiments of the present application that other inventors can develop based on the same general inventive concepts embodied by the described embodiments. That is, although the present application is described in terms of particular embodiments and illustrative figures, it should be apparent that the scope of the present application is not limited to these specific embodiments.

[0181] While the embodiments of the application have been shown and described herein, it will be understood by those skilled in the art that many changes, modifications, substitutions and alterations to these embodiments can be made without departing from the principles and spirits of the application, and it is intended that the scope of the application be limited solely by the scope of the appended claims and the equivalents thereof.

Claims

1. A geological disaster monitoring and early warning network security encryption system, characterized in that: include: Device initialization unit: The device completes identity authentication through multi-factor authentication. The device uses the SM2 algorithm to generate a public-private key pair. The private key is stored in the hardware security module or trusted execution environment. The platform and the device negotiate the session key through the SM2 key exchange protocol, adding a timestamp and random number to the negotiation process; the business key is encrypted through SM2 and transmitted with the device public key fingerprint attached; Data collection and encryption unit: encrypts data using SM4-CBC mode, randomly generates an initialization vector and transmits it together with the ciphertext; calculates the HMAC-SM3 value for the collected data and device status data; Hidden key embedding unit: Generates a hidden key and embeds it into different redundant spaces of the data packet; selects a steganographic algorithm based on the data packet type and performs compression and clipping resistance on the data packet; the specific operations include: S3.1 Hidden key generation Enhanced randomness: Use the device unique identifier, random seed S and current timestamp T to generate the hidden key K through the SM3 algorithm h ; Key decentralized storage: The hidden key is divided into n parts {K h1 , K h2 ,…,K hn }, respectively embedded into different redundant spaces of the data packet; S3.2 Information hiding technology: Adaptive steganography: Select the steganographic algorithm according to the data packet type to ensure that the embedding does not affect the normal use of the data; Enhanced robustness: Data packets embedded with hidden keys are resistant to compression and cropping to prevent key loss due to data corruption. The data packet types are divided into text, image and video, and the steganographic algorithm is expressed as: (1) For text data packets, a steganographic algorithm based on character replacement or format hiding is used; let the original text be T, the embedded information be M, and the embedded text be T′: T′=EmbedText(T,M); Among them, EmbedText is a text embedding function, which represents the process of embedding information M into text T; (2) For image data packets, a steganographic algorithm based on pixel value modification or frequency domain transformation is used; let the original image be I, the embedded information be M, and the embedded image be I′: I′=EmbedImage(I,M); Among them, EmbedImage is an image embedding function, which represents the process of embedding information M into image I; The embedding process involves the modification of pixel values: I′(x,y)=I(x,y)+Δ(x,y); Where Δ(x, y) is the pixel value modification amount calculated based on the information M; (3) For video data packets, use steganographic algorithms based on inter-frame differences or motion vectors; Let the original video be V, the embedded information be M, and the embedded video be V′: V′=EmbedVideo(V,M); Among them, EmbedVideo is a video embedding function, which represents the process of embedding information M into video V; The embedding process involves the modification of the differences between frames: V′(t)=V(t)+Δ(t); Where V(t) is the original video data of the t-th frame, V′(t) is the modified video data of the t-th frame, and Δ(t) is the inter-frame difference modification amount calculated based on the information M; Transmission and Verification Unit: Transmitted via TLS 1.3 or IPsec encrypted channels; large data packets are transmitted in segments, each segment is independently encrypted and verified, and any verification failure is logged and an alarm is triggered; authorized users must undergo multi-factor authentication and have different permissions assigned based on their roles; Decryption and self-destruction mechanism unit: Authorized users extract the hidden key through dedicated software, and combine it with the session key to generate the final decryption key through SM3 hash; if decryption fails, the data packet is automatically destroyed.

2. A geological disaster monitoring and early warning network security encryption system according to claim 1, characterized in that: The device initialization unit operation specifically includes: S1.1 Device initialization: Enhanced identity authentication: Use multi-factor authentication to complete device identity authentication; Key pair generation: Use SM2 algorithm to generate device public and private key pair (PK d , SK d ), private key SK d Securely stored in a hardware security module (HSM) or a trusted execution environment (TEE); S1.2 Key Distribution: Session key negotiation: The platform and the device negotiate the session key K through the SM2 key exchange protocol. s ,The negotiation process adds a timestamp T and a random number R to prevent replay attacks; Business key encrypted transmission: business key K b After transmission through SM2 encryption, the device public key fingerprint H(PK d ) to ensure the key is bound to the device.

3. The security encryption system for geological disaster monitoring and early warning network according to claim 1 is characterized in that: The data collection and encryption unit operations specifically include: S2.1 Confidentiality protection of collected data: SM4 encryption optimization: SM4-CBC mode is used to encrypt data. The initialization vector IV is randomly generated and transmitted together with the ciphertext to prevent the same plaintext from generating the same ciphertext. Key dynamic update: session key K s Updated every hour, old keys are retained for T retain hours are used to decrypt historical data; S2.2 Integrity Protection: HMAC-SM3 enhancement: The HMAC-SM3 algorithm is used to calculate the message authentication code HMAC for the collected data and device status data. The key used in calculating HMAC is the derived value K of the session key. HMAC ; The data packet structure is [IV|SM4 ciphertext|HMAC|hidden key carrier], expressed as: Packet=[IV|C|HMAC|HiddenKeyCarrier].

4. A geological disaster monitoring and early warning network security encryption system according to claim 1, characterized in that: The transmission and verification unit operations specifically include: S4.1 Secure Transmission: Channel encryption: Data packets are transmitted via TLS 1.3 or IPsec encryption to ensure the security of the transmission process; Data segment transmission: Large data packets are transmitted in segments, and each segment is independently encrypted and verified to prevent tampering by middlemen; S4.2 Integrity Verification: Double verification: The platform first verifies the HMAC and then verifies the integrity of the hidden key carrier; Exception handling: If verification fails, logs are recorded and an alarm is triggered to notify the administrator to handle the issue; S4.3 Authorized User Verification: Multi-factor authentication: Authorized users must authenticate their identities using digital certificates, biometrics, and dynamic passwords; Permission grading: Assign different permissions based on user roles.

5. The security encryption system for geological disaster monitoring and early warning network according to claim 1 is characterized in that: The decryption and self-destruction mechanism unit operations specifically include: S5.1 Decryption process: Hidden key extraction: Authorized users can extract the hidden key through dedicated software. The extraction process requires verification of user identity and permissions. Key combination: Combine the surface SM4 key and the hidden secret key to generate the final decryption key K through SM3 hash f ; Decryption operation: Use the final decryption key K f Decrypt SM4 ciphertext to obtain original data; S5.2 Self-destruction mechanism: Intelligent self-destruction: If decryption fails, the data packet is automatically destroyed; Audit logs: All decryption attempts are recorded, including time, user, IP address, and results, to facilitate post-audit.

6. A geological disaster monitoring and early warning network security encryption system according to claim 1, characterized in that: It also includes a backup database, which backs up received data packets by setting a backup storage space on the platform side, and the backup data packets are encrypted and stored using different keys; After the original data packet is successfully decrypted, the copy in the backup space is automatically deleted; If the decryption fails, the backup data package is extracted for decryption again.

7. A geological disaster monitoring and early warning network security encryption system according to claim 6, characterized in that: The operations of backing up the database specifically include: S6.1 Automatic Backup: Incremental backup: The platform sets up backup storage space, and the data packets received by the platform are automatically backed up; Backup encryption: The backup data package is stored using SM4 encryption, and the encryption key K b Different from the main data package, increasing security; S6.2 Backup Destruction: Automatic cleanup: After the original data packet is successfully decrypted, the copy in the backup space is automatically deleted; Retention policy: If decryption fails, the backup data package will be retained until the user manually clears it or the expiration time T set by the system policy expire .

Images