Multimodal transport one-order system waybill sensitive data hierarchical encryption and dynamic evaluation method

Abstract

The invention discloses a multimodal transport one-order system waybill sensitive data hierarchical encryption and dynamic evaluation method, and relates to the technical field of logistics information. According to the method, waybill data is divided into high-sensitivity data, medium-sensitivity data and low-sensitivity data according to sensitivity degrees, and differential encryption is performed on different levels of data by adopting an AES-256 algorithm in combination with a dynamic timestamp key, adopting a Blowfish algorithm in combination with a random byte sequence key and adopting an SHA-3 algorithm in combination with a unique salt value; and the encryption strength is quantitatively evaluated through thermodynamic diagram distribution, spectrum uniformity, avalanche effect and other indexes, and the encryption performance is analyzed in combination with an information entropy value and total time consumption. By monitoring the data deviation degree in real time, fine tuning optimization, parameter reset or safety alarm strategies are dynamically triggered, and a lagging interval mechanism is introduced to prevent parameter oscillation. According to the invention, a quantifiable and adaptive integrated solution is provided for privacy protection and system performance balance of multimodal transport one-order system waybills.

Description

Technical Field

[0001] This invention belongs to the field of logistics information technology and relates to a method for hierarchical encryption and dynamic evaluation of sensitive data in multimodal transport single-bill system. Background Technology

[0002] With the continuous development of global trade and the digital transformation of the logistics industry, multimodal transport, as an efficient mode of logistics transportation, is being used more and more widely. Multimodal transport using a single bill of lading refers to using the same bill of lading throughout the entire multimodal transport process, achieving a "one shipment, one bill, one bill to the end" transportation model. While this model improves logistics efficiency, it also brings challenges in data security and privacy protection.

[0003] Multimodal transport waybills contain a large amount of sensitive information, such as shipper identification, cargo value, and transport route. The leakage of this data could lead to serious economic losses and privacy violations. Traditional waybill data protection methods typically employ a uniform encryption strategy, which cannot meet the differentiated protection needs of data with varying levels of sensitivity. This results in either insufficient protection leading to security risks or excessive encryption causing resource waste.

[0004] Existing data encryption technologies, such as AES, Blowfish, and the SHA series of algorithms, each have their own characteristics and are suitable for different scenarios. The AES algorithm offers high security but has high computational complexity, making it suitable for protecting highly sensitive data; the Blowfish algorithm is fast and flexible, suitable for protecting moderately sensitive data; and the SHA series of algorithms are one-way hash functions, suitable for protecting low-sensitivity data that requires integrity verification. However, current technologies have failed to organically combine these encryption algorithms to form a tiered protection scheme tailored to the characteristics of multimodal transport waybill data.

[0005] Furthermore, evaluations of existing encryption schemes largely focus on theoretical security analysis, lacking quantitative assessments of actual encryption effectiveness and dynamic optimization mechanisms. In the ever-changing multimodal transport environment, static encryption schemes struggle to cope with evolving security threats and performance requirements.

[0006] The existing technology has the following drawbacks: Coarse encryption granularity: Existing encryption algorithms do not distinguish between data sensitivity levels, resulting in insufficient protection for highly sensitive data and excessive encryption of low-sensitivity data (industry statistics show that resources are wasted up to 40%).

[0007] The evaluation system is lacking: there is a lack of quantitative analysis tools for encryption strength, making it impossible to verify the randomness (such as entropy value), resistance to attacks (such as avalanche effect), and algorithm efficiency (such as time consumption) of encrypted data.

[0008] Weak key management: Static keys are vulnerable to rainbow table attacks, low-sensitivity data lacks a salt mechanism, and the risk of hash collisions is high (the 2023 Logistics Security Report shows that 42% of data breaches are related to key management deficiencies).

[0009] Static key management makes it vulnerable to targeted attacks; Therefore, there is an urgent need for a hierarchical encryption and dynamic evaluation method for multimodal transport single-bill data, which can implement differentiated protection based on the sensitivity of the data and continuously evaluate and optimize the encryption effect, ensuring data security while taking into account system performance. Summary of the Invention

[0010] To address the aforementioned problems, the technical solution adopted by this invention is: a method for hierarchical encryption and dynamic evaluation of sensitive data in multimodal transport single-document waybills, comprising the following steps: Waybill data sensitivity classification and grading: Multimodal transport single-waybill data is classified into levels according to sensitivity, including high-sensitivity data, medium-sensitivity data, and low-sensitivity data; Encryption of highly sensitive data: A dynamic key is generated by combining the uniqueness of timestamps and the security of the SHA-256 hash algorithm. The highly sensitive data is then encrypted using the AES-256 algorithm. The encryption strength and encryption performance of the dynamic key generated for the highly sensitive data are evaluated. Encryption of moderately sensitive data: The Blowfish algorithm is used to encrypt moderately sensitive data, using a random byte sequence of the corresponding length as the key, and the encryption strength and encryption performance of the dynamic key generated for moderately sensitive data are evaluated. Encryption of low-sensitivity data: The SHA-3 algorithm is used to encrypt low-sensitivity data, and the security is enhanced by combining the uniqueness of the salt value. The encryption strength and encryption performance of the encrypted low-sensitivity data are evaluated. Dynamic evaluation and optimization: Real-time monitoring of the encryption strength and performance indicators of data at each sensitivity level, and dynamic adjustment of encryption parameters for each sensitivity level and optimization of sensitive data at each level based on the evaluation results.

[0011] Furthermore: The process of classifying multimodal transport single-bill data into levels of sensitivity, including high-sensitivity data, medium-sensitivity data, and low-sensitivity data, is as follows: Data identification and extraction: Extract all data fields (such as shipper identity information, cargo value, transportation route, etc.) from the multimodal transport single bill of lading. Sensitivity assessment: For each data field, assess the potential financial loss (quantified) that could result from the leakage of each data field. ) and the degree of reputational damage (quantified as follows) ), through the privacy coefficient formula Calculate the privacy coefficient (where (as a quantification factor for reputational damage costs). Leveling threshold settings: Based on the range of privacy coefficient A, set leveling threshold ranges for high sensitivity, medium sensitivity, and low sensitivity; Data classification: Data with a privacy coefficient A greater than the high sensitivity threshold is classified as high sensitivity data (such as ID card numbers and goods value), data between the medium sensitivity threshold is classified as medium sensitivity data (such as transportation routes), and data less than the low sensitivity threshold is classified as low sensitivity data (such as document formats).

[0012] Furthermore: the process of generating a dynamic key by combining the uniqueness of the timestamp and the security of the SHA-256 hash algorithm, encrypting highly sensitive data using the AES-256 algorithm, and evaluating the encryption strength and performance of the dynamic key generated from the highly sensitive data is as follows: Key generation: A dynamic, highly sensitive key is generated by combining the current timestamp and the SHA-256 hash algorithm. The key generation formula is as follows:

[0013] Here, "||" represents a concatenation operation; the SHA-256 algorithm guarantees the randomness and unpredictability of the key; AES-256 encryption: Performs AES-256 encryption on highly sensitive data using a generated dynamic key; Encryption strength assessment: The encryption strength assessment of dynamic keys generated from highly sensitive data is achieved by calculating the heatmap distribution, spectral uniformity, image complexity, or NSTP value of the encrypted data; Performance evaluation: The evaluation is achieved by recording the total time taken for the encryption process (from key generation to ciphertext output), calculating the information entropy value of the encrypted data (to verify the strength of randomness), and extracting key fingerprint parameters (to verify key consistency).

[0014] Furthermore: The process of encrypting moderately sensitive data using the Blowfish algorithm, employing a random byte sequence of corresponding length as the key, and evaluating the encryption strength and performance of the dynamically generated key for the moderately sensitive data is as follows: Key generation: A random byte sequence of length (128-448 bits) corresponding to the key supported by the Blowfish algorithm is generated using a cryptographically secure random number generator as a random medium-sensitive key; Blowfish Encryption: Performs Blowfish encryption on moderately sensitive data using a generated random key; The encryption strength of dynamic keys generated from medium-sensitivity data is evaluated by constructing a histogram of encrypted byte value distribution and calculating the autocorrelation coefficient. The encryption performance of dynamic keys generated from medium-sensitivity data is evaluated by recording encryption time and total running time, calculating the information entropy value of the encrypted data, and recording the key length.

[0015] Furthermore: The process of encrypting low-sensitivity data using the SHA-3 algorithm, enhancing security by combining it with the uniqueness of the salt value, and evaluating the encryption strength and performance of the encrypted low-sensitivity data is as follows: Salt value generation: A unique salt value is generated for each low-sensitivity data point using the RFC 4122 UUIDv4 standard; SHA-3 encryption: Combine the generated salt value with SHA-3 encryption to encrypt low-sensitivity data and generate a low-sensitivity key; The encryption strength of low-sensitivity data is evaluated by calculating the average avalanche effect and verifying the uniqueness of the salt value. The encryption performance of low-sensitivity data is evaluated by recording the total time and average hash time, and calculating the information entropy value of the encrypted data.

[0016] Furthermore, the steps for real-time monitoring of the encryption strength and performance indicators of data at each sensitivity level, and dynamic adjustment of encryption parameters for each sensitivity level based on the evaluation results, are as follows: Acquisition steps: Obtain the encryption strength and performance metrics of data at each sensitivity level; Threshold comparison: The encryption strength and performance indicators of the acquired data at each sensitivity level are compared with the preset security threshold and performance threshold respectively. If the deviation after comparison does not exceed the limit, the current parameters are maintained. If the deviation after comparison exceeds the limit, the degree of deviation is classified and the operation is triggered according to the classification strategy.

[0017] Parameter adjustment: The encryption parameters, including key length, number of encryption rounds, and salt length, are dynamically adjusted based on the comparison results. The parameter adjustment includes: a lag interval mechanism: if two consecutive deviations have the same direction and the interval is less than T minutes, the second adjustment instruction is ignored to prevent parameter oscillation; Re-encryption: Data affected by each sensitivity level is re-encrypted using adjusted parameters; the re-encryption also includes an emergency response process: after a security alert is triggered, log auditing, manual intervention, and isolation of affected data are performed.

[0018] Furthermore, the optimization of dynamically adjusting encryption parameters for each sensitivity level and sensitive data at each level based on the evaluation results includes the following steps: Load balancing: Dynamically allocates encrypted computing resources based on load; Parallel processing: Enable multi-threaded encryption processing for batch data; Cache optimization: Optimize the caching of encryption keys and parameters.

[0019] Furthermore, the degree of deviation is determined by the following formula:

[0020] The classification of the degree of deviation includes: When the deviation is ≤10%, fine-tuning optimization is triggered. When 10% < deviation degree ≤ 30%: trigger parameter reset; When the deviation exceeds 30%, a safety alarm is triggered.

[0021] Furthermore, it also includes security auditing steps: Log recording: Detailed records of the time, algorithm used, key fingerprint, and performance metrics for all encryption operations; Anomaly detection: Analyze log data to detect possible abnormal encryption behaviors, including: encryption time deviating from the historical average, abnormal key generation frequency, encrypted data entropy value below the security threshold, and unauthorized algorithm or parameter combination; Security Reports: Regularly generate security audit reports to assess the effectiveness of the overall encryption scheme.

[0022] It also includes data recovery steps: Backup encryption: The encryption keys and key parameters of sensitive data at each level are backed up and encrypted; Recovery Verification: Regularly verify the effectiveness of the data recovery process; Disaster recovery: Securely recover encrypted data in the event of data loss.

[0023] Furthermore, it also includes key management: Key storage: The master key and highly sensitive keys are securely stored using a hardware security module; Key rotation: Periodically rotating various encryption keys from the existing keys, which includes the following steps: High-sensitivity key: The TOTP algorithm is used to generate the verification token for key rotation; the actual generation of the high-sensitivity key is still performed using the SHA256 (timestamp||master key) formula and is strengthened by the KDF function. The rotation of medium-sensitive and low-sensitive keys is based on daily rotation or rotation after processing 1GB of data; A new key is generated through HSM hardware signature verification and key derivation functions. Key destruction: Securely destroy keys that are no longer used after rotation. Key destruction includes the following methods: Software destruction method: Erasure according to NIST SP 800-88 standard; Hardware destruction method: Destroy the storage unit through HSM physical destruction.

[0024] The present invention provides a method for hierarchical encryption and dynamic evaluation of sensitive data in multimodal transport single-document waybills, which has the following advantages: By classifying waybill data according to its sensitivity and adopting differentiated encryption strategies, a reasonable allocation of security protection and computing resources is achieved, avoiding the problems of over-encryption or insufficient protection. By combining timestamps and hash algorithms to generate dynamic keys, the security of highly sensitive data is enhanced, effectively resisting replay attacks and key guessing attacks. Multiple quantitative indicators were used to evaluate encryption strength and performance, providing a scientific basis for optimizing encryption schemes; Through dynamic evaluation and parameter adjustment mechanisms, the encryption scheme can adapt to changing security environments and performance requirements. In response to the characteristics of the single bill of lading system in multimodal transport, a complete bill of lading data security protection solution is provided, which helps to promote the digital transformation of multimodal transport. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is an overall flowchart of the multimodal transport single-document sensitive data hierarchical encryption and dynamic evaluation method according to an embodiment of the present invention; Figure 2 This is a detailed flowchart of the waybill data classification and grading steps in an embodiment of the present invention; Figure 3 This is a detailed flowchart of the high-sensitivity data encryption steps in an embodiment of the present invention; Figure 4 This is a detailed flowchart of the medium-sensitivity data encryption steps in an embodiment of the present invention; Figure 5 This is a detailed flowchart of the low-sensitivity data encryption steps in an embodiment of the present invention; Figure 6 This is a detailed flowchart of the dynamic evaluation and optimization steps in an embodiment of the present invention; Figure 7This is a schematic diagram of the encryption strength evaluation index system according to an embodiment of the present invention; Figure 8 This is a schematic diagram of the encryption performance evaluation index system according to an embodiment of the present invention; Figure 9 This is a schematic diagram of the dynamic parameter adjustment strategy according to an embodiment of the present invention. Detailed Implementation

[0027] It should be noted that, unless otherwise specified, the embodiments and features in the embodiments of the present invention can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and embodiments.

[0028] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The following description of at least one exemplary embodiment is merely illustrative and is in no way intended to limit the present invention or its application or use. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0029] Figure 1 This is an overall flowchart of the multimodal transport single-document sensitive data hierarchical encryption and dynamic evaluation method according to an embodiment of the present invention; A method for hierarchical encryption and dynamic evaluation of sensitive data in multimodal transport single-document waybills includes the following steps: S1: Classification and Grading of Waybill Data Sensitivity: Multimodal transport waybill data is classified into levels according to its sensitivity, including high-sensitivity data, medium-sensitivity data, and low-sensitivity data; S2: Encryption of highly sensitive data: A dynamic key is generated by combining the uniqueness of timestamps and the security of the SHA-256 hash algorithm. The highly sensitive data is then encrypted using the AES-256 algorithm. The encryption strength and encryption performance of the dynamic key generated for the highly sensitive data are evaluated. S3: Medium-Sensitive Data Encryption: The Blowfish algorithm is used to encrypt medium-sensitive data, using a random byte sequence of corresponding length as the key, and the encryption strength and encryption performance of the dynamic key generated for medium-sensitive data are evaluated. S4: Encryption of Low-Sensitivity Data: The SHA-3 algorithm is used to encrypt low-sensitivity data, and the security is enhanced by combining the uniqueness of the salt value. The encryption strength and encryption performance of the encrypted low-sensitivity data are evaluated. S5: Dynamic Evaluation and Optimization: Real-time monitoring of the encryption strength and performance indicators of data at each sensitivity level, and dynamic adjustment of encryption parameters for each sensitivity level and optimization of sensitive data at each level based on the evaluation results.

[0030] Steps S1 / S2 / S3 / S4 / S5 are executed sequentially; or step S1 is executed first, then S2 / S3 / S4 are executed in parallel, and then step S5 is executed. like Figure 2 As shown, the process of classifying multimodal transport single-bill data into levels of sensitivity, including high-sensitivity data, medium-sensitivity data, and low-sensitivity data, is as follows: S11: Data Identification and Extraction: Extract all data fields from the multimodal transport single-document waybill; all data fields include, but are not limited to, shipper's name, contact information, ID number, cargo value, origin of transport, transit node, destination, current logistics status, and document format; these fields constitute the complete dataset of the waybill, providing a foundation for subsequent classification and grading.

[0031] S12: Sensitivity Assessment: For each data field, assess the potential financial loss (quantified) that could result from a data field breach. ) and the degree of reputational damage (quantified as follows) ), through the privacy coefficient formula Calculate the privacy coefficient (where (as a quantification factor for reputational damage costs). The privacy factor is calculated using the following formula:

[0032] in, Privacy factor for the data field. As a cost quantification factor for reputational damage, As for the degree of reputational damage, This formula comprehensively considers various losses that may be caused by data breaches, providing a quantitative basis for data classification.

[0033] S13: Classification Threshold Setting: Based on the range of the privacy coefficient A, set classification threshold ranges for high sensitivity, medium sensitivity, and low sensitivity; the threshold setting needs to take into account various factors such as industry standards, legal and regulatory requirements, and actual business needs.

[0034] S14: Data Classification: Data with a privacy coefficient A greater than the high sensitivity threshold is classified as high sensitivity data (such as ID card numbers and goods value), data between the medium sensitivity threshold is classified as medium sensitivity data (such as transportation routes), and data less than the low sensitivity threshold is classified as low sensitivity data (such as document formats).

[0035] High-sensitivity data includes cargo owner identity information and cargo owner value data; medium-sensitivity data includes transportation routes and transportation node data; and low-sensitivity data includes logistics status and document format data. like Figure 3 As shown, the encryption steps for highly sensitive data are as follows: The process of generating a dynamic key by combining the uniqueness of the timestamp and the security of the SHA-256 hash algorithm, encrypting the highly sensitive data using the AES-256 algorithm, and evaluating the encryption strength and performance of the generated dynamic key is as follows: S21: Key Generation: Generate a dynamic, highly sensitive key by combining the current timestamp and the SHA-256 hash algorithm. The key generation formula is as follows:

[0036] Here, "||" represents a concatenation operation; the SHA-256 algorithm guarantees the randomness and unpredictability of the key; S22: AES-256 Encryption: Performs AES-256 encryption on highly sensitive data using a generated dynamic key; AES-256 is a widely recognized symmetric encryption algorithm with high security strength, suitable for protecting the most critical data.

[0037] S23: The encryption strength evaluation of the dynamic key generated for highly sensitive data is achieved by calculating the heatmap distribution, spectral uniformity, image complexity, or NSTP value of the encrypted data; these indicators evaluate the encryption effect from different perspectives to ensure that the encrypted data has sufficient randomness and unpredictability.

[0038] S24: Performance evaluation of dynamic keys generated from highly sensitive data (from key generation to ciphertext output): This is achieved by recording the total time spent in the encryption process, calculating the information entropy value of the encrypted data (verifying the strength of randomness), and extracting key fingerprint parameters (verifying key consistency). These performance metrics reflect the efficiency and practicality of the encryption scheme.

[0039] like Figure 4 The diagram illustrates the encryption steps for medium-sensitivity data. The process involves using the Blowfish algorithm to encrypt the medium-sensitivity data, employing a random byte sequence of corresponding length as the key, and evaluating the encryption strength and performance of the dynamically generated key for the medium-sensitivity data as follows: S31: Key generation: A random byte sequence of the corresponding length (128-448 bits) is generated by a cryptographically secure random number generator as the random sensitive key for the Blowfish algorithm; the random byte sequence is generated by a cryptographically secure pseudo-random number generator to ensure the randomness of the key.

[0040] S32: Blowfish Encryption: Performs Blowfish encryption on moderately sensitive data using a generated random key; the Blowfish algorithm strikes a good balance between security and performance, making it suitable for protecting moderately sensitive data.

[0041] S33: The encryption strength of dynamic keys generated from medium-sensitivity data is evaluated by constructing a histogram of encrypted byte value distribution and calculating the autocorrelation coefficient; these indicators evaluate the statistical characteristics of encrypted data to ensure that there are no obvious patterns or rules to follow.

[0042] S34: The encryption performance of dynamically generated keys for medium-sensitivity data is evaluated by recording encryption time and total runtime, calculating the information entropy value of the encrypted data, and recording the key length. These metrics help optimize the performance of the encryption scheme.

[0043] like Figure 5 The diagram illustrates the steps for encrypting low-sensitivity data. The process involves using the SHA-3 algorithm to encrypt the low-sensitivity data, enhancing security by combining this with the uniqueness of the salt value, and evaluating the encryption strength and performance of the encrypted low-sensitivity data. S41: Salt generation: A unique salt value is generated for each low-sensitivity data using the RFC 4122 UUIDv4 standard; the salt value increases the randomness of the hash input, effectively preventing rainbow table attacks.

[0044] S42: SHA-3 Encryption: Combines the generated salt value with SHA-3 encryption to encrypt low-sensitivity data; generates a low-sensitivity key. SHA-3 is the latest secure hash algorithm standard, providing reliable data integrity protection.

[0045] S43: The encryption strength of low-sensitivity data is evaluated by calculating the average avalanche effect and verifying the uniqueness of the salt value; the avalanche effect measures the degree to which a small change in the input leads to a large change in the output, and is an important indicator for evaluating the security of hash algorithms.

[0046] S44: The encryption performance of encrypted low-sensitivity data is evaluated by recording the total time and average hash time, and calculating the information entropy value of the encrypted data. These metrics ensure that the protection of low-sensitivity data will not become a bottleneck in system performance.

[0047] like Figure 6 As shown, the steps for real-time monitoring of the encryption strength and performance indicators of data at each sensitivity level, and dynamic adjustment of encryption parameters for each sensitivity level based on the evaluation results, are as follows: S51: Acquisition Steps: Acquire the encryption strength and performance indicators of data at each sensitivity level; continuously monitor the strength and performance indicators of each encryption level, and the monitoring frequency can be dynamically adjusted according to system load and security requirements.

[0048] S52: Threshold Comparison: The encryption strength and performance indicators of the acquired data at each sensitivity level are compared with preset security and performance thresholds, respectively. Threshold settings need to consider various factors such as business requirements, security standards, and system capabilities. If the deviation after comparison does not exceed the limit, the current parameters are maintained. If the deviation after comparison exceeds the limit, the degree of deviation is classified and an operation is triggered according to the classification strategy. S53: Parameter Adjustment: Dynamically adjust encryption parameters based on comparison results, including key length, number of encryption rounds, and salt length; the parameter adjustment strategy needs to balance security and performance requirements. The parameter adjustment includes: Lag interval mechanism: To prevent frequent adjustments due to short-term data fluctuations, a time window (T=5 minutes) is set. If two consecutive deviations are in the same direction and the interval is less than T, T can be set to 5 minutes, 10 minutes, etc., then the second adjustment instruction is ignored.

[0049] Emergency response procedure: When the deviation exceeds 30%, the system will automatically perform the following operations: S54: Re-encryption: Re-encrypt the affected data at each sensitivity level using adjusted parameters. The scope and timing of re-encryption need to be carefully designed to avoid excessive impact on system performance. The re-encryption also includes an emergency response process: after a security alert is triggered, log auditing, manual intervention, and isolation of the affected data are performed.

[0050] The threshold comparison specifically includes: Deviation calculation: The degree of deviation between the measured value and the preset threshold is calculated using a formula:

[0051] Based on the degree of deviation, the adjustment strategy is divided into three levels: When the deviation is ≤10%, it is judged as a slight fluctuation and fine-tuning optimization is triggered (such as extending the key rotation cycle by 5%). 10% < Deviation level ≤ 30%: Determined as medium risk, triggering parameter reset (regenerating random key or salt value); Deviation > 30%: Determined as a serious threat, triggering a security alarm and initiating emergency procedures.

[0052] Record exception logs and generate audit reports; Notify the security team to intervene manually; Isolate the affected waybill data and suspend related encryption operations.

[0053] like Figure 7 As shown, the encryption strength evaluation index system includes dedicated and general indicators for different encryption levels. The encryption strength evaluation of high-sensitivity data mainly focuses on heatmap distribution, spectral uniformity, image complexity, and NSTP value; the encryption strength evaluation of medium-sensitivity data mainly focuses on the histogram of encrypted byte value distribution and autocorrelation coefficient; and the encryption strength evaluation of low-sensitivity data mainly focuses on the average avalanche effect and salt value uniqueness. Evaluation indicators applicable to all encryption levels include information entropy and key characteristic analysis.

[0054] like Figure 8 As shown, the encryption performance evaluation index system includes time performance indicators and resource consumption indicators. Time performance indicators include total time consumption, encryption time consumption, and average hashing time consumption; resource consumption indicators include CPU utilization, memory usage, and I / O load. Performance evaluation needs to be comprehensively considered in conjunction with the specific hardware environment and business requirements.

[0055] like Figure 9 As shown, the dynamic parameter adjustment strategy takes different adjustment measures based on the degree of deviation between the evaluation result and the preset threshold. For slight deviations, fine-tuning can be performed; for moderate deviations, parameter reset is required; for severe deviations, an alarm is triggered and an emergency response procedure may be initiated. The adjustment strategy needs to set an appropriate hysteresis range to prevent parameter oscillations. Figure 9 The "Lag Range Detection Module" corresponds to the aforementioned lag mechanism, ensuring the stability of the adjustment strategy through periodic reassessment (feedback via dashed arrows). The "Emergency Response Team Notification" module corresponds to the operational procedures after a safety alarm is triggered.

[0056] Furthermore, it also includes security audit steps: Log recording: Detailed records of the time, algorithm used, key fingerprint, and performance metrics for all encryption operations; Anomaly detection: Analyze log data to detect possible abnormal encryption behavior; The abnormal encryption behavior includes: encryption time deviating significantly from the historical average (e.g., more than 3 times the standard deviation). Abnormal key generation frequency (e.g., generating multiple keys in a short period of time); The entropy value of the encrypted data is below the security threshold; Using unauthorized algorithms or parameter combinations.

[0057] Security Reports: Regularly generate security audit reports to assess the effectiveness of the overall encryption scheme.

[0058] Periodic trigger: Generated at 00:00 daily or weekly; Event triggered: Automatically generated after 1000 encryption operations; Contents: Encryption strength (heatmap / NSTP value), performance metrics (time consumed / CPU load), and anomaly statistics; Format: JSON structured data + PDF visualization charts.

[0059] Furthermore, it also includes key management steps: Key storage: The master key and high-sensitivity keys are securely stored using a Hardware Security Module (HSM); Key rotation: The existing keys are periodically rotated among various encryption keys. The periodic rotation of various encryption keys includes the following steps: High-sensitivity key: The TOTP algorithm is used to generate the verification token for key rotation; the actual generation of the high-sensitivity key is still performed using the SHA256 (timestamp||master key) formula and is strengthened by the KDF function. The rotation of medium-sensitive and low-sensitive keys is based on daily rotation or rotation after processing 1GB of data; A new key is generated through HSM hardware signature verification and key derivation functions. Key destruction: Key destruction: Securely destroy keys that are no longer used after rotation. Key destruction includes the following methods: Software destruction method: Erasure according to NIST SP 800-88 standard; Hardware destruction method: Destroy the storage unit through HSM physical destruction.

[0060] Audit: Record the destruction time, operator ID, and key SHA-256 fingerprint; Furthermore, it also includes data recovery steps: Backup encryption: The encryption keys and key parameters of sensitive data at each level are backed up and encrypted; Recovery Verification: Regularly verify the effectiveness of the data recovery process; Disaster recovery: Securely recover encrypted data in the event of data loss.

[0061] Furthermore, it also includes performance optimization steps: Load balancing: Encrypted computing resources are dynamically allocated based on the load of the single-document waybill processing system. The principles of dynamic allocation are as follows: Resource monitoring: Real-time collection of CPU utilization (via Prometheus). Dynamic adjustment: When CPU utilization is >80%, the encryption priority of low-sensitivity data is downgraded. When idle resources exceed 30%, enable parallel encryption (number of fragments = number of CPU cores × 2).

[0062] Parallel processing: Enable multi-threaded encryption processing for batch data; Cache optimization: Optimize the caching strategy for encryption keys and parameters; The optimization method employs tiered caching: The master key is stored in the HSM; The dynamic key is stored in memory (accelerated by AES-NI instructions); Pre-generation mechanism: The key for the next cycle is generated 50% of the time in advance (if the cycle is 30 minutes, it is generated 15 minutes in advance).

[0063] The parameter caching strategy is as follows: High-frequency parameter: Redis cache, TTL=5 minutes; Low-frequency parameters: Local memory (LRU eviction, maximum 100 entries); Consistency: Parameters are updated synchronously via Kafka messages when they change.

[0064] A multimodal transport single-bill system for sensitive data, including hierarchical encryption and dynamic evaluation, comprising: Waybill Data Sensitivity Classification and Grading Module: This module is used to classify multimodal transport waybill data according to their sensitivity level, including high-sensitivity data, medium-sensitivity data, and low-sensitivity data. High-sensitivity data encryption module: It is used to generate dynamic keys by combining the uniqueness of timestamps and the security of SHA-256 hash algorithm, encrypt high-sensitivity data using AES-256 algorithm, and evaluate the encryption strength and encryption performance of the dynamic keys generated for high-sensitivity data; Medium-sensitivity data encryption module: Used to encrypt medium-sensitivity data using the Blowfish algorithm, using a random byte sequence of corresponding length as the key, and evaluating the encryption strength and encryption performance of the dynamic key generated for medium-sensitivity data; Low-sensitivity data encryption module: Used to encrypt low-sensitivity data using the SHA-3 algorithm, combined with the uniqueness of the salt value to enhance security, and to evaluate the encryption strength and encryption performance of the encrypted low-sensitivity data; Dynamic evaluation and optimization module: used to monitor the encryption strength and performance indicators of data at each sensitivity level in real time, and dynamically adjust the encryption parameters of each sensitivity level and optimize sensitive data at each level based on the evaluation results; Security Audit Module: The security audit module includes a logging submodule, an anomaly detection submodule, and a security reporting module. The logging submodule is used to record in detail the time, algorithm used, key fingerprint, and performance metrics of all encryption operations; Anomaly detection submodule: used to analyze log data and detect possible abnormal encryption behaviors, including: encryption time deviating from the historical average, abnormal key generation frequency, encrypted data entropy value lower than the security threshold, and unauthorized algorithm or parameter combination; Security Reporting Submodule: Used to periodically generate security audit reports and evaluate the effectiveness of the overall encryption scheme; Data recovery module: The data recovery module includes a backup encryption submodule, a recovery verification submodule, and a disaster recovery submodule. Backup encryption submodule: used to back up and encrypt encryption keys and key parameters of sensitive data at various levels; Recovery Verification Submodule: Used to periodically verify the effectiveness of the data recovery process; Disaster Recovery Submodule: Used to securely recover encrypted data in the event of data loss. Key Management Module: The key management module includes a key storage submodule, a key rotation submodule, and a key destruction submodule; Key storage submodule: Used to securely store the master key and highly sensitive keys using a hardware security module; Key rotation submodule: Used to periodically rotate various encryption keys from existing keys. The periodic rotation of various encryption keys includes the following steps: High-sensitivity key: The TOTP algorithm is used to generate the verification token for key rotation; the actual generation of the high-sensitivity key is still performed using the SHA256 (timestamp||master key) formula and is strengthened by the KDF function. The rotation of medium-sensitive and low-sensitive keys is based on daily rotation or rotation after processing 1GB of data; A new key is generated through HSM hardware signature verification and key derivation functions. Key destruction submodule: Securely destroys keys that are no longer used after rotation. Key destruction includes the following methods: Software destruction method: Erasure according to NIST SP 800-88 standard; Hardware destruction method: Destroy the storage unit through HSM physical destruction.

[0065] This invention presents a hierarchical encryption and dynamic evaluation method for sensitive data in multimodal transport single-document systems. By classifying document data according to sensitivity and employing differentiated encryption strategies, it achieves both security protection and rational allocation of computing resources. The method combines timestamps and hash algorithms to generate dynamic keys, enhancing the security of highly sensitive data. Multiple quantitative indicators are used to evaluate encryption strength and performance, providing a scientific basis for optimizing the encryption scheme. Through dynamic evaluation and parameter adjustment mechanisms, the encryption scheme can adapt to changing security environments and performance requirements. This method provides a comprehensive, flexible, and efficient security protection solution for multimodal transport single-document data.

[0066] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings, but the present invention is not limited to the described embodiments. For those skilled in the art, various changes, modifications, substitutions, and variations can be made to these embodiments without departing from the principles and spirit of the present invention, and these variations still fall within the protection scope of the present invention.

[0067] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for hierarchical encryption and dynamic evaluation of sensitive data in multimodal transport single-document waybills, characterized in that: Includes the following steps: Waybill data sensitivity classification and grading: Multimodal transport single-waybill data is classified into levels according to sensitivity, including high-sensitivity data, medium-sensitivity data, and low-sensitivity data; Encryption of highly sensitive data: A dynamic key is generated by combining the uniqueness of timestamps and the security of the SHA-256 hash algorithm. The highly sensitive data is then encrypted using the AES-256 algorithm. The encryption strength and encryption performance of the dynamic key generated for the highly sensitive data are evaluated. Encryption of moderately sensitive data: The Blowfish algorithm is used to encrypt moderately sensitive data, using a random byte sequence of the corresponding length as the key, and the encryption strength and encryption performance of the dynamic key generated for moderately sensitive data are evaluated. Encryption of low-sensitivity data: The SHA-3 algorithm is used to encrypt low-sensitivity data, and the security is enhanced by combining the uniqueness of the salt value. The encryption strength and encryption performance of the encrypted low-sensitivity data are evaluated. Dynamic evaluation and optimization: Real-time monitoring of the encryption strength and performance indicators of data at each sensitivity level, and dynamic adjustment of encryption parameters for each sensitivity level and optimization of sensitive data at each level based on the evaluation results.

2. The method for hierarchical encryption and dynamic evaluation of sensitive data in multimodal transport single-document waybills according to claim 1, characterized in that: The process of classifying multimodal transport single-bill data into levels of sensitivity, including high-sensitivity data, medium-sensitivity data, and low-sensitivity data, is as follows: Data identification and extraction: Extract all data fields from the multimodal transport single-document waybill; Sensitivity assessment: For each data field, assess the quantifiable financial loss that could result from the leakage of each data field. The degree of reputational damage is quantified as follows Through the privacy coefficient formula Calculate the privacy factor, where As a quantification factor for the cost of reputational damage; Leveling threshold settings: Based on the range of privacy coefficient A, set leveling threshold ranges for high sensitivity, medium sensitivity, and low sensitivity; Data classification: Data with a privacy coefficient A greater than the high sensitivity threshold is classified as high sensitivity data, data between the medium sensitivity threshold is classified as medium sensitivity data, and data less than the low sensitivity threshold is classified as low sensitivity data.

3. The method for hierarchical encryption and dynamic evaluation of sensitive data in multimodal transport single-document waybills according to claim 1, characterized in that: The process of generating a dynamic key by combining the uniqueness of the timestamp and the security of the SHA-256 hash algorithm, encrypting highly sensitive data using the AES-256 algorithm, and evaluating the encryption strength and performance of the dynamic key generated from the highly sensitive data is as follows: Key generation: A dynamic, highly sensitive key is generated by combining the current timestamp and the SHA-256 hash algorithm. The key generation formula is as follows: Here, "||" represents a concatenation operation; the SHA-256 algorithm guarantees the randomness and unpredictability of the key; AES-256 encryption: Performs AES-256 encryption on highly sensitive data using a generated dynamic key; The encryption strength assessment of dynamic keys generated from highly sensitive data is achieved by calculating the heatmap distribution, spectral uniformity, image complexity, or NSTP value of the encrypted data. Performance evaluation of dynamic keys generated from highly sensitive data is achieved by recording the total time consumed in the encryption process, calculating the information entropy value of the encrypted data, and extracting key fingerprint parameters.

4. The method for hierarchical encryption and dynamic evaluation of sensitive data in multimodal transport single-document waybills according to claim 1, characterized in that: The process of encrypting moderately sensitive data using the Blowfish algorithm, employing a random byte sequence of corresponding length as the key, and evaluating the encryption strength and performance of the dynamically generated key for the moderately sensitive data is as follows: Key generation: Generates a random byte sequence of length corresponding to the key supported by the Blowfish algorithm as a random medium-sensitive key; Blowfish Encryption: Performs Blowfish encryption on moderately sensitive data using a generated random key; The encryption strength of dynamic keys generated from medium-sensitivity data is evaluated by constructing a histogram of encrypted byte value distribution and calculating the autocorrelation coefficient. The encryption performance of dynamic keys generated from medium-sensitivity data is evaluated by recording encryption time and total running time, calculating the information entropy value of the encrypted data, and recording the key length.

5. The method for hierarchical encryption and dynamic evaluation of sensitive data in multimodal transport single-document waybills according to claim 1, characterized in that: The process of encrypting low-sensitivity data using the SHA-3 algorithm, enhancing security by combining it with the uniqueness of the salt value, and evaluating the encryption strength and performance of the encrypted low-sensitivity data is as follows: Salt value generation: Generate a unique salt value for each low-sensitivity data point; SHA-3 encryption: Combine the generated salt value with SHA-3 encryption to encrypt low-sensitivity data and generate a low-sensitivity key; The encryption strength of low-sensitivity data is evaluated by calculating the average avalanche effect and verifying the uniqueness of the salt value. The encryption performance of low-sensitivity data is evaluated by recording the total time and average hash time, and calculating the information entropy value of the encrypted data.

6. The method for hierarchical encryption and dynamic evaluation of sensitive data in multimodal transport single-document waybills according to claim 1, characterized in that, The steps involved in real-time monitoring of the encryption strength and performance indicators of data at each sensitivity level, and dynamically adjusting the encryption parameters for each sensitivity level based on the evaluation results, are as follows: Acquisition steps: Obtain the encryption strength and performance metrics of data at each sensitivity level; Threshold comparison: The encryption strength and performance indicators of the acquired data at each sensitivity level are compared with the preset security threshold and performance threshold respectively; if the deviation after comparison does not exceed the limit, the current parameters are maintained; if the deviation after comparison exceeds the limit, the degree of deviation is classified and different operations are triggered according to different degrees of deviation. Parameter adjustment: The encryption parameters, including key length, number of encryption rounds, and salt length, are dynamically adjusted based on the comparison results. The parameter adjustment includes: a lag interval mechanism: if two consecutive deviations have the same direction and the interval is less than T minutes, the second adjustment instruction is ignored to prevent parameter oscillation; Re-encryption: Data affected by each sensitivity level is re-encrypted using adjusted parameters; the re-encryption also includes an emergency response process: after a security alert is triggered, log auditing, manual intervention, and isolation of affected data are performed.

7. The method for hierarchical encryption and dynamic evaluation of sensitive data in multimodal transport single-document waybills according to claim 1, characterized in that: The optimization process, which involves dynamically adjusting the encryption parameters for each sensitivity level and the sensitive data for each level based on the evaluation results, includes the following steps: Load balancing: Dynamically allocates encrypted computing resources based on load; Parallel processing: Parallel encryption processing is used for batch data; Cache optimization: Optimize the caching of encryption keys and parameters.

8. The method for hierarchical encryption and dynamic evaluation of sensitive data in multimodal transport single-document waybills according to claim 6, characterized in that: The degree of deviation is determined by the following formula: The classification of the degree of deviation includes: When the deviation is ≤10%, fine-tuning optimization is triggered. When 10% < deviation degree ≤ 30%: trigger parameter reset; When the deviation exceeds 30%, a safety alarm is triggered.

9. The method for hierarchical encryption and dynamic evaluation of sensitive data in multimodal transport single-document waybills according to any one of claims 1-6, characterized in that, It also includes security auditing steps: Log recording: Detailed records of the time, algorithm used, key fingerprint, and performance metrics for all encryption operations; Anomaly detection: Analyze log data to detect possible abnormal encryption behaviors, including: encryption time deviating from the historical average, abnormal key generation frequency, encrypted data entropy value below the security threshold, and unauthorized algorithm or parameter combination; Security Reports: Regularly generate security audit reports to assess the effectiveness of the overall encryption scheme. It also includes data recovery steps: Backup encryption: The encryption keys and key parameters of sensitive data at each level are backed up and encrypted; Recovery Verification: Regularly verify the effectiveness of the data recovery process; Disaster recovery: Securely recover encrypted data in the event of data loss.

10. The method for hierarchical encryption and dynamic evaluation of sensitive data in multimodal transport single-document waybills according to any one of claims 1-6, characterized in that, It also includes key management: Key storage: The master key and highly sensitive keys are securely stored using a hardware security module; Key rotation: Periodically rotating various encryption keys from the existing keys, which includes the following steps: High-sensitivity key: The TOTP algorithm is used to generate the verification token for key rotation; the actual generation of the high-sensitivity key is still performed using the SHA256 (timestamp||master key) formula and is strengthened by the KDF function. The rotation of medium-sensitive and low-sensitive keys is based on daily rotation or rotation after processing 1GB of data; A new key is generated through HSM hardware signature verification and key derivation functions. Key destruction: Securely destroy keys that are no longer used after rotation. Key destruction includes the following methods: Software destruction method: Erasure according to NIST SP 800-88 standard; Hardware destruction method: Destroy the storage unit through HSM physical destruction.

Images