Ship software package encryption protection system and method

Abstract

The invention relates to the technical field of software upgrading, and discloses a ship software package encryption protection system and method.The ship software package encryption protection system comprises a key management system, a remote upgrading management platform, a trusted terminal and a ship terminal; the key management system is used for generating a first asymmetric private key and a corresponding first public key; generating a first digital certificate based on the first public key; signing the software package to be transmitted, and encrypting the signed software package to generate an encrypted software package; the trusted terminal is used for transmitting the terminal unique identifier and the corresponding timestamp, receiving and verifying the effective duration of the second digital certificate, and verifying the position watermark and timeliness of the first digital certificate; the ship end is used for generating a ship end private key; constructing a risk assessment model; and executing a grading response strategy based on the risk assessment result in the upgrading process. On the basis of an asymmetric key system, encryption protection is carried out on a software package in combination with ship dynamic state and network state information, and confidentiality, integrity and controllability of the software package in the transmission and upgrading process are guaranteed.

Description

Technical Field

[0001] This invention relates to the field of software upgrade technology, and more specifically to a system and method for encrypting and protecting ship software packages. Background Technology

[0002] With the rapid development of ship networking technology, the intelligence and networking capabilities of ship equipment have significantly improved, and the scale of equipment has grown exponentially. Data types have expanded from traditional simple sensor signals to sensitive information such as files, software packages, videos, and control commands. Remote software package upgrades, as a core means of iterating ship equipment functions, are directly related to the stable operation of critical modules such as ship control and navigation systems.

[0003] Existing technologies, such as invention patent 202411901601.X, propose a system and method for encrypting and protecting ship software packages. This method involves issuing digital certificates to a remote upgrade server through a certificate authority and encrypting the software packages using a symmetric key algorithm. However, this approach has the following limitations: First, the symmetric key algorithm requires both communicating parties to use the same key, and key distribution relies on an additional secure channel. The openness of network transmission in remote ship upgrade scenarios makes it easy for the key to be intercepted by a man-in-the-middle, leading to the risk of key leakage. Second, the security of symmetric encryption is highly dependent on the key itself; if the key is leaked, the ciphertext can be completely decrypted, failing to guarantee the confidentiality and integrity of the software packages. Summary of the Invention

[0004] To overcome the aforementioned technical problems in the prior art, embodiments of the present invention provide a system and method for encrypting and protecting ship software packages. Based on an asymmetric key system and combined with ship dynamic status and network status information, the software packages are encrypted and protected, which improves the security of key distribution, enhances the dynamic adaptability of the software package encryption strategy, and greatly ensures the confidentiality, integrity, and controllability of the upgrade operation of the software packages during transmission and upgrade.

[0005] On one hand, the present invention provides a system for encrypting and protecting ship software packages. This system includes a key management system, a remote upgrade management platform, a trusted terminal, and a ship terminal. The remote upgrade management platform is connected to the intranet of the key management system and to the external network of the ship terminal. The trusted terminal is connected to the external network of the key management system and to the ship terminal bus. The key management system is used to: acquire a unique ship identifier, ship status information, and network status information; generate a first asymmetric private key and a corresponding first public key based on the unique ship identifier, the ship status information, and the network status information; generate a first digital certificate based on the first public key, the first digital certificate embedding a location watermark formed by real-time ship latitude and longitude encryption; acquire dynamic risk assessment information of sea conditions; sign the software package to be transmitted based on the first asymmetric private key; encrypt the signed software package based on the first public key and the dynamic risk assessment information to generate an encrypted software package; transmit the encrypted software package to the ship terminal through the remote upgrade platform; and transmit the first digital certificate to the ship terminal through the trusted terminal.

[0006] The trusted terminal is used to: transmit the terminal's unique identifier and corresponding timestamp to the key management system; receive the second digital certificate issued by the key management system and verify the validity period of the second digital certificate based on the ship's location information; and verify the location watermark and timeliness of the first digital certificate.

[0007] The ship-side component is used to: generate a ship-side private key corresponding to the first asymmetric private key; acquire real-time ship attitude, equipment power status, and system load rate; construct a risk assessment model based on real-time network transmission quality, the real-time ship attitude, the equipment power status, and the system load rate; generate an encrypted snapshot file and store it in an independent secure partition before software upgrade; and execute a tiered response strategy based on the risk assessment results during the upgrade process.

[0008] Preferably, the ship status information includes the ship's real-time roll angle and the ship's real-time pitch angle. The step of generating a first asymmetric private key and a corresponding first public key based on the ship's unique identifier, the ship status information, and the network status information includes: generating an initial private key based on the ship's unique identifier, the ship status information, and the ship's navigation trajectory features; generating an additional entropy source based on the ship's real-time roll angle and the ship's real-time pitch angle; generating an intermediate private key based on a derived private key of the initial private key, the ship status information, the additional entropy source, and a pre-stored public key; and generating a first asymmetric private key and a corresponding first public key based on the intermediate private key, the ship status information, and the network status information.

[0009] Preferably, the step of encrypting the signed software package based on the first public key and the dynamic risk assessment information to generate an encrypted software package includes: determining the dynamic risk assessment information based on the ship's real-time attitude, wherein the dynamic risk assessment information includes extreme sea states, complex sea states, and calm sea states; determining the size of the encryption block based on the real-time network transmission quality; determining a corresponding encryption strategy based on the dynamic risk assessment information: if the current sea state is extreme, performing superimposed encryption based on the first public key and a temporary negotiated public key; if the current sea state is complex, encrypting based on the first public key; if the current sea state is calm, determining a low-complexity encryption algorithm, and encrypting based on the first public key and the low-complexity encryption algorithm; and encrypting the signed software package according to the encryption strategy to generate the encrypted software package.

[0010] Preferably, the key management system is further configured to: obtain the unique identifier of the trusted terminal and its corresponding timestamp; compare and verify the unique identifier of the terminal with a pre-stored whitelist; when the verification is successful, generate a second asymmetric private key and a corresponding second public key based on the unique identifier of the terminal and the timestamp; and generate a second digital certificate based on the second public key.

[0011] The second digital certificate is transmitted to the trusted terminal.

[0012] Preferably, transmitting the first digital certificate to the ship via the trusted terminal includes: signing the first digital certificate based on the first asymmetric private key; transmitting the signed first digital certificate to the trusted terminal; the trusted terminal is used to: obtain a second public key from the second digital certificate; verify the signed first digital certificate using the second public key; and, upon successful verification, write the first digital certificate to the secure storage area of ​​the ship via the bus.

[0013] Preferably, the ship-side device is configured to: obtain a first public key from the first digital certificate; decrypt the encrypted software package based on the ship-side private key, wherein the generation algorithm of the ship-side private key is the same as that of the first asymmetric private key; verify the decrypted software package based on the first public key; upon successful verification, generate a system snapshot file for the ship-side device; perform a software upgrade operation based on the decrypted software package; generate a current risk assessment value based on the risk assessment model; and perform security control operations for the software upgrade operation based on the risk assessment value.

[0014] Preferably, the ship terminal is further configured to: after the upgrade is paused, in response to an abnormal recovery command, perform a system recovery operation on the ship terminal based on the system snapshot file, and restart the software upgrade operation; determine whether the upgrade has failed; if so, obtain the upgrade completion rate, and perform a corresponding partial rollback or full rollback based on the upgrade completion rate.

[0015] On the other hand, a method for encrypting and protecting a ship's software package includes: obtaining a unique ship identifier, ship status information, and network status information through a key management system; generating a first asymmetric private key and a corresponding first public key based on the unique ship identifier, the ship status information, and the network status information; generating a first digital certificate based on the first public key, wherein the first digital certificate embeds a location watermark formed by real-time encrypted latitude and longitude of the ship; sending the first digital certificate to the ship via the trusted terminal; obtaining dynamic risk assessment information of the sea state; signing the software package to be transmitted based on the first asymmetric private key; encrypting the signed software package based on the first public key and the dynamic risk assessment information to generate an encrypted software package; and transmitting the encrypted software package to the ship via a remote upgrade platform.

[0016] The trusted terminal transmits its unique identifier and corresponding timestamp to the key management system; receives the second digital certificate issued by the key management system; verifies the validity period of the second digital certificate based on the ship's location information; and verifies the location watermark and timeliness of the first digital certificate.

[0017] A ship-side private key corresponding to the first asymmetric private key is generated at the ship end; real-time ship attitude, equipment power status, and system load rate are obtained; a risk assessment model is constructed based on real-time network transmission quality, the real-time ship attitude, the equipment power status, and the system load rate; an encrypted snapshot file is generated and stored in an independent secure partition before the software upgrade; and a graded response strategy is executed based on the risk assessment results during the upgrade process.

[0018] The present invention has at least the following technical effects through the technical solution provided by the present invention:

[0019] By combining ship dynamic status parameters, network status information, and timestamps to generate asymmetric key pairs, dynamically adjusting encryption strategies, and adopting a dual-channel design, encrypted software packages are transmitted through a remote upgrade management platform, and digital certificates are securely transmitted through trusted terminals. This ultimately achieves high security and dynamic adaptability of software packages during transmission and upgrades.

[0020] Other features and advantages of the embodiments of the present invention will be described in detail in the following detailed description section. Attached Figure Description

[0021] The accompanying drawings are provided to further illustrate embodiments of the present invention and form part of the specification. They are used together with the following detailed description to explain the embodiments of the present invention, but do not constitute a limitation thereof. In the drawings:

[0022] Figure 1 This is a schematic diagram of the structure of a ship software package encryption protection system provided in an embodiment of the present invention. Detailed Implementation

[0023] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit the scope of the present invention.

[0024] In this invention, the terms "system" and "network" are used interchangeably. "Multiple" refers to two or more; therefore, in this invention, "multiple" can also be understood as "at least two." "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. Additionally, the character " / ", unless otherwise specified, generally indicates that the preceding and following related objects have an "or" relationship. Furthermore, it should be understood that in the description of this invention, terms such as "first" and "second" are used only for descriptive purposes and should not be construed as indicating or implying relative importance or order.

[0025] With the rapid development of ship networking technology, the intelligence and networking level of ship equipment are constantly improving. The scale and data types of equipment (including sensitive information such as files, software packages, videos, and control commands) are growing exponentially. Remote software package upgrades are a core means of equipment function iteration, and their security directly affects the stable operation of key modules such as ship control systems and navigation systems. In existing technologies, software package encryption protection mostly adopts symmetric key algorithms, which rely on external networks to distribute keys. However, the openness of network transmission in remote ship upgrade scenarios (such as satellite communication and 4G networks) makes it easy for keys to be intercepted by man-in-the-middle attacks. Moreover, the security of symmetric encryption ciphertext is highly dependent on the key itself, and the keys in existing technologies are mostly generated based on static parameters such as fixed device serial numbers. Once the key is leaked, confidentiality will be completely lost.

[0026] For the reasons mentioned above, please refer to Figure 1This invention provides a system for encrypting and protecting ship software packages. The system includes a key management system, a remote upgrade management platform, a trusted terminal, and a ship terminal. The remote upgrade management platform is connected to the intranet of the key management system and to the external network of the ship terminal. The trusted terminal is connected to the external network of the key management system and to the bus of the ship terminal. The key management system is used to: acquire a unique ship identifier, ship status information, and network status information; generate a first asymmetric private key and a corresponding first public key based on the unique ship identifier, ship status information, and network status information; generate a first digital certificate based on the first public key, the first digital certificate embedding a location watermark formed by real-time ship latitude and longitude encryption; acquire dynamic risk assessment information of navigation sea conditions; sign the software package to be transmitted based on the first asymmetric private key; and verify the signed software based on the first public key and the dynamic risk assessment information. The process involves: encrypting the package to generate an encrypted software package; transmitting the encrypted software package to the ship via the remote upgrade platform; transmitting the first digital certificate to the ship via the trusted terminal; the trusted terminal being used to: transmit the terminal's unique identifier and corresponding timestamp to the key management system; receive the second digital certificate issued by the key management system and verify the validity period of the second digital certificate based on the ship's location information; verifying the location watermark and timeliness of the first digital certificate; the ship being used to: generate a ship-side private key corresponding to the first asymmetric private key; acquire real-time ship attitude, equipment power status, and system load rate; construct a risk assessment model based on real-time network transmission quality, the real-time ship attitude, the equipment power status, and the system load rate; generate an encrypted snapshot file before the software upgrade and store it in an independent secure partition; and execute a tiered response strategy based on the risk assessment results during the upgrade process.

[0027] In one possible implementation, the key management system includes a key certificate generation agency for generating keys or certificates, a key management agency for key management, a certificate management agency for certificate management, and a security trust center providing a secure interface. The remote upgrade management platform interacts with the key management system by calling the security interface of the security trust center. Specifically, the key certificate generation agency can obtain the ship's unique identifier, ship status information, and network status information; generate a first asymmetric private key and a corresponding first public key based on the ship's unique identifier, ship status information, and network status information, and send the first private key and the first public key to the key management agency for storage; generate a first digital certificate based on the first public key, and send the first digital certificate to the certificate issuing agency for storage; to ensure the reliability of the first digital certificate and improve encryption security, embed a location watermark formed by real-time encrypted latitude and longitude of the ship in the first digital certificate.

[0028] The key management authority can sign the data package to be transmitted based on the first asymmetric private key. During the signing process, it obtains dynamic risk assessment information on the sea conditions and encrypts the signed data package based on the first public key and the dynamic risk assessment information to generate an encrypted data package. It also generates a first digital certificate based on the first public key. The remote upgrade management platform can obtain the encrypted data package from the key management authority and the first digital certificate from the certificate management authority by calling the security interface.

[0029] In one possible implementation, the key management system is deployed at the shipping company, responsible for key and certificate management; the remote upgrade management platform is deployed in the cloud, responsible for software package distribution; and trusted terminals are deployed in restricted areas of the ship. The ship-side terminals include remote upgrade terminals with integrated software SDK1 and other electronic control systems. The remote upgrade terminals have a built-in dedicated security chip (such as an SE chip) for storing keys. Specifically, when the ship needs to upgrade its navigation software, the SDK1 of the remote upgrade terminal triggers a data acquisition and local private key generation process: it acquires the ship's unique identifier, ship status information, and network status information in real time, and generates a ship-side private key based on a preset key generation algorithm (such as the ECC elliptic curve algorithm). This ship-side private key is then securely stored in the ship-side SE chip, ensuring that it is only accessible to the ship. Subsequently, the ship transmits a navigation software upgrade request to the remote upgrade management platform via SDK1. The request includes the ship's unique identifier, ship status information, network status information, and the identifier of the navigation software to be upgraded (such as NAV-2025V2.0). Upon receiving the request, the remote upgrade platform retrieves the latest version of the navigation software package (e.g., NAV-2025V2.0.pkg) from the cloud software package database based on the identifier of the navigation software to be upgraded. It then generates a software package encryption request by combining the latest version of the navigation software package, the ship's unique identifier, network status information, and ship status information. This request is transmitted to the key management system via a dedicated intranet line and the secure interface of the key management system. Upon receiving the encryption request, the key management system generates a first asymmetric private key based on the ship's unique identifier, ship status information, and network status information in the encryption request, using a key generation algorithm consistent with that of the ship. Finally, it derives the corresponding first public key from the first asymmetric private key using a preset asymmetric key generation algorithm, ensuring public and private key matching and consistency between the first asymmetric private key and the ship's private key. Subsequently, the first public key is bound to the ship's unique identifier to generate a first digital certificate conforming to the X.509 standard to ensure the legitimacy and verifiability of the first public key. The first digital certificate, containing the first public key and location watermark, is then securely transmitted to the ship's remote upgrade terminal via a dedicated communication link (such as the ship's CAN bus). The restricted area deployment and authorized access mechanism of the trusted terminal ensures that the certificate is only relayed through legitimate devices. Simultaneously, the key management system uses the first asymmetric private key to digitally sign the navigation software package to be transmitted to ensure that the navigation software package has not been tampered with. The signed software package is then encrypted using the first public key to ensure secure transmission. The encrypted software package is then transmitted to the ship via a cloud communication link (such as satellite communication or 4G network) of the remote upgrade management platform. During the encryption process, to improve encryption security and reduce the difficulty of cracking, dynamic risk assessment information of the navigation sea state is first obtained, such as assessing whether the current navigation is in a dangerous or normal sea state. Encryption is then performed in conjunction with the risk assessment, thereby achieving dynamic encryption and effectively improving encryption security and traceability.

[0030] This invention employs an asymmetric key mode, where the ship's terminal and the key management system locally generate private keys and store them in corresponding security chips. During software upgrades, the key management system generates a public key based on the private key and only transmits a digital certificate containing the public key through a trusted terminal, without transmitting the private key. Compared to traditional symmetric encryption, which relies on open networks for key transmission and is easily intercepted, and relies solely on static device serial numbers to generate keys, this significantly reduces the risk of key leakage and enhances key unpredictability.

[0031] Key generation algorithms include hash algorithms and basic key derivation functions. After obtaining information such as the ship's unique identifier, ship status information, and network status information, a key can be generated based on these algorithms. For example, the ship's unique identifier, partial ship speed, available bandwidth, and a minute-level timestamp can be concatenated and a hash function can be used to calculate the private key. However, keys obtained using this method have significant shortcomings: they rely only on partial state parameters and do not comprehensively incorporate multi-dimensional ship status information such as heading angle and latitude / longitude, as well as network status information such as network latency and bit error rate. This results in low correlation between the key and the actual ship operation scenario, easily leading to key duplication within the same time period. Therefore, this invention proposes a multi-level architecture key generation algorithm.

[0032] In this embodiment of the invention, the ship status information includes the ship's real-time roll angle and the ship's real-time pitch angle. The step of generating a first asymmetric private key and a corresponding first public key based on the ship status information and the network status information includes: generating an initial private key based on the ship's unique identifier, the ship status information, and the ship's navigation trajectory characteristics; generating an intermediate private key based on a derived private key of the initial private key, the ship status information, and a pre-stored public key; and generating a first asymmetric private key and a corresponding first public key based on the intermediate private key, the ship status information, and the network status information.

[0033] In one possible implementation, the ship status information includes one or more of rudder angle, speed, latitude and longitude, wave height, wind speed, real-time ship roll angle, and real-time ship pitch angle. The network status information includes one or more of available bandwidth, bit error rate, and network latency. In a specific implementation, an initial private key is first generated. For example, the ship's navigation trajectory is characterized by a latitude and longitude sequence hash value. By further adding the latitude and longitude sequence hash value when generating the initial private key, the anti-counterfeiting performance of the private key can be improved, enhancing its privacy and the difficulty of cracking. Then, an additional entropy source is generated based on the ship's real-time roll angle and real-time pitch angle. In the subsequent generation of the intermediate private key, not only is the derived private key based on the initial private key, the ship status information, and the pre-stored public key generated, but the ship's real-time roll and pitch angle data are further introduced as an additional entropy source during the intermediate private key generation process. This effectively improves the unpredictability of the key and significantly reduces the risk of the key being brute-forced or mathematically analyzed. Then, based on the intermediate private key, the ship status information, and the network status information, a first asymmetric private key is generated, represented as: K. data =HKDF(K scss ,info=f(B,D,Pe),salt=g(S,t)), where K data Let f be the first asymmetric private key, B be the available bandwidth, D be the network latency, Pe be the bit error rate, f be the network parameter encoding function, and g be the salt generation function.

[0034] More specifically, the lowest 4 noise bits are extracted from the raw ADC sampled values ​​of each sensor in S (e.g., the 16-bit sampled value of the airspeed sensor), and the noise bits of all sensors are concatenated into a 256-bit binary string; then XORed with the SHA-256 hash values ​​of HWID and t to generate the PUF output. HKDF-SHA384 is selected as the key derivation function, and the timestamp corresponding to the sensor acquisition and the pre-stored salt value are input into HKDF-SHA384 to generate the HKDF output. The PUF output is XORed with the KDF output to obtain K. dev From K dev Derived elliptic curve private key, obtained d ship The platform public key and ship state vector are input into ECDH, and the SHA-256 hash of S is used as an additional entropy source to participate in ECDH negotiation to obtain K. scss The available bandwidth, network latency, and bit error rate are encoded into strings. The ship status information is combined with the timestamp to generate the corresponding salt value. Finally, the final K is generated based on the derived function. data .

[0035] The multi-level architecture key generation algorithm provided in this invention provides keys at different levels that can be used in various scenarios such as data encryption and encrypted sessions. The multi-level private key generation algorithm proposed in this invention comprehensively integrates multi-dimensional ship status information such as speed, heading angle, latitude and longitude, wave height, and wind speed, as well as network status information such as available bandwidth, bit error rate, and network latency. It combines multiple mechanisms, including binding inherent ship hardware characteristics to a physically unclonable function, dynamically updating the key derivation function by fusing timestamps and pre-stored salt values, introducing ship status hashes as an additional entropy source to enhance randomness through ECDH negotiation, and adapting HKDF derivation to real-time scenarios by combining network parameter encoding and dynamic salt values. This effectively solves the problems of low scenario relevance and key duplication risk caused by incomplete parameters in traditional algorithms.

[0036] After the key management system generates the first asymmetric private key, the software package can be encrypted using the first asymmetric private key. For example, the software package can be encrypted using a preset encryption algorithm. The preset encryption algorithm is generally fixed to a certain type. However, encrypting the software package with a fixed encryption algorithm has problems with insufficient encryption efficiency and scenario adaptability: in low-bandwidth scenarios, high-complexity algorithms are prone to excessive encryption latency, while in high-bandwidth scenarios, low-strength algorithms are vulnerable to being cracked. In addition, during encryption, the size of the encryption block may be fragmented or redundantly calculated due to network fluctuations, affecting the software package transmission efficiency and upgrade success rate.

[0037] In this embodiment of the invention, the step of encrypting the signed software package based on the first public key and the dynamic risk assessment information to generate an encrypted software package involves: determining the dynamic risk assessment information based on the ship's real-time attitude, the dynamic risk assessment information including extreme sea states, complex sea states, and calm sea states; determining the encryption block size based on the real-time network transmission quality; determining a corresponding encryption strategy based on the dynamic risk assessment information: if the current sea state is extreme, performing superimposed encryption based on the first public key and a temporary negotiated public key; if the current sea state is complex, encrypting based on the first public key; if the current sea state is calm, determining a low-complexity encryption algorithm, and encrypting based on the first public key and the low-complexity encryption algorithm; and encrypting the signed software package according to the encryption strategy to generate the encrypted software package.

[0038] In one possible implementation, the dynamic risk assessment information is first determined based on the ship's real-time attitude. For example, when the roll angle is ≥15° and the pitch angle is ≥10°, it is determined to be extreme sea state; when the roll angle is 5°-15° and the pitch angle is 3°-10°, it is determined to be complex sea state; and when the roll angle is <5° and the pitch angle is <3°, it is determined to be calm sea state. On the other hand, the size of the encryption block is determined based on the real-time network transmission quality. For example, when the packet loss rate is <1% and the jitter value is <50ms, a 4096-byte encryption block is used; when the packet loss rate is 1%-5% and the jitter value is 50ms-100ms, a 1024-byte encryption block is used; and when the packet loss rate is >5% and the jitter value is >100ms, a 256-byte encryption block is used.

[0039] In practical applications, the conventional method is to directly execute the corresponding encryption operation using the first public key and the encryption block. However, this method is relatively rigid and has shortcomings such as insufficient protection in extreme scenarios and security redundancy in normal scenarios. Therefore, to solve the above technical problems, an adaptive security enhancement strategy is adopted. Specifically, when the ship is in extreme sea states (roll angle ≥15° / pitch angle ≥10°), the ship's attitude fluctuates violently, which can easily lead to equipment vibration and abnormal sensor data. At the same time, network transmission may be affected by sea waves, resulting in packet loss and a sharp increase in latency, significantly increasing the risk of software packages being tampered with or intercepted. In this case, dual public key superposition encryption of "first public key + temporary negotiated public key" is enabled. Through the collaborative protection of two layers of asymmetric encryption, the encryption strength of the software package is increased to more than twice that of the basic scenario. Even if an attacker cracks one layer of public key, they still need to break through the second encryption barrier, which greatly reduces the risk of core data leakage and solves the defect of the original solution that "fixed encryption strength cannot cope with extreme risks". When the ship is in complex sea conditions, single-pass encryption with the first key is sufficient. This ensures basic security while avoiding the computational resource consumption associated with dual public-key encryption, thus adapting to the limited computing power of embedded shipboard devices (such as navigation terminals). In calm sea conditions, the complexity of the encryption algorithm can be reduced. For example, RSA-2048 can be downgraded to RSA-1024, or a lightweight ECC-256 algorithm can be used. This can shorten encryption time by 30%-50% and reduce network bandwidth usage, adapting to the "rapid upgrade" requirements of short-distance coastal voyages and avoiding the problem of "over-encryption leading to wasted efficiency." Finally, the key management system divides the signed software package into blocks of a predetermined encryption size. Each block is then encrypted using the selected target encryption algorithm combined with the first public key to obtain the encrypted software package.

[0040] This invention, through the design of dynamically selecting encryption algorithms and encryption block sizes, adapts the encryption process to the actual operating environment of ships, ensuring that the encryption algorithm balances speed and security in different scenarios, avoiding the inefficiency or high risk of fixed algorithms; it reduces retransmission overhead under low bandwidth and computational redundancy under high bandwidth, improving transmission efficiency; and combined with the asymmetric encryption characteristics of the first public key, it strengthens the confidentiality of software package transmission, effectively improving the reliability and practicality of encryption protection.

[0041] To enhance the security of the software package and prevent tampering, it is necessary to sign the package using a first asymmetric private key before encryption. This signature facilitates subsequent verification of the package's legitimacy and integrity. However, the ship only stores its private key and not the first public key used for verification. Therefore, a digital certificate carrying the public key information needs to be distributed to the ship via a key management system so that the ship can access the public key information in the digital certificate. However, existing methods use a simple chain architecture of "certificate authority-server-terminal," which uses the same link as the software package distribution to transmit the digital certificate, leading to issues such as certificate tampering. To address this, one possible implementation uses a dual-channel mechanism: the encrypted software package is distributed through a remote upgrade management platform, and the digital certificate is distributed through a trusted terminal. However, this approach still has some problems. The trusted terminal, as an intermediate transmission node, is not included in security verification and is at risk of being impersonated by unauthorized devices, affecting the security of digital certificate transmission.

[0042] In this embodiment of the invention, the key management system is further configured to: obtain the unique identifier of the trusted terminal and its corresponding timestamp; compare and verify the unique identifier of the terminal with a pre-stored whitelist; when the verification is successful, generate a second asymmetric private key and a corresponding second public key based on the unique identifier of the terminal and the timestamp; generate a second digital certificate based on the second public key; and transmit the second digital certificate to the trusted terminal.

[0043] In one possible implementation, the trusted terminal transmits its unique terminal identifier (such as hardware serial number DSN-20250618-001) and current timestamp to the key management system. The key management system performs a hash comparison between the acquired unique terminal identifier and a pre-stored whitelist (for example, hashing DSN-20250618-001 using SHA-256 and matching it with the corresponding hash value in the whitelist) to confirm the legitimacy of the trusted terminal. If the comparison is successful, the key management system uses the unique terminal identifier and current timestamp as an entropy source and calls an elliptic curve algorithm (such as ECDSA secp256r1) to generate a second asymmetric private key and a corresponding second public key. Subsequently, the second public key, the unique terminal identifier, the validity period, and other information are encapsulated into a second digital certificate, and the second digital certificate is transmitted to the trusted terminal.

[0044] This embodiment uses whitelisting technology to verify the trusted terminal, thus ensuring the reliability of the trusted terminal.

[0045] After verifying the reliability of the trusted terminal, the first digital certificate storing the first public key can be transmitted to the trusted terminal. In order to prevent the first digital certificate from being tampered with during the transmission, this embodiment of the invention also signs the first digital certificate with the second public key.

[0046] In this embodiment of the invention, transmitting the first digital certificate to the ship via the trusted terminal includes: signing the first digital certificate based on the first asymmetric private key; transmitting the signed first digital certificate to the trusted terminal; the trusted terminal is used to: obtain a second public key from the second digital certificate; verify the signed first digital certificate using the second public key; and, upon successful verification, write the first digital certificate into the secure storage area of ​​the ship via the bus.

[0047] In one possible implementation, the trusted terminal verifies the signature information corresponding to the first digital certificate using the second public key. If the verification is successful, it indicates that the content of the second digital certificate has not been tampered with and has been legally signed by the key management system. At this time, the trusted terminal can write the second digital certificate into the secure partition of the ship's end memory or an independent secure storage chip via the CAN bus, which greatly improves the security of the second public key.

[0048] It should be noted that, in order to ensure the reliability of the trusted terminal, the trusted terminal is deployed in the restricted area of ​​the ship as a physical isolation node for secure communication, and only authorized personnel are allowed to enter the area.

[0049] This invention addresses the core issue of unsecured terminal verification in existing dual-channel solutions through multiple mechanisms, including whitelist access, dynamic keys, and trusted terminal verification. It ensures the credibility, secure transmission, and traceability of digital certificates in dual-channel scenarios, providing a stable public key trust foundation for subsequent verification of software package legitimacy on the ship side.

[0050] Furthermore, after obtaining the encrypted software package sent by the remote upgrade management platform and the first digital certificate written by the trusted terminal, in this embodiment of the invention, the ship terminal is used to: obtain a first public key from the first digital certificate; decrypt the encrypted software package based on the ship terminal's private key, wherein the generation algorithm of the ship terminal's private key is the same as that of the first asymmetric private key; verify the decrypted software package based on the first public key; when the verification is successful, generate a system snapshot file for the ship terminal; perform a software upgrade operation based on the decrypted software package; generate a current risk assessment value based on the risk assessment model; and perform security control operations for the software upgrade operation based on the risk assessment value.

[0051] In the specific implementation process, after verification, the upgrade is not carried out immediately. Instead, a system snapshot file for the ship is first generated. For example, the system configuration, operating status, and key data are automatically backed up. The snapshot file is generated after encryption using the SM4 algorithm and stored in an independent secure partition. During the upgrade process, the ship's attitude, equipment power status (battery power <30% or power supply fluctuation >5% is considered abnormal), system load rate (load rate >80% is considered high load), and network transmission quality are collected in real time. The risk assessment model is used to calculate the safety value, and the safety control operation for the software upgrade is executed according to the risk assessment value. For example, if the risk assessment value is ≥ a preset threshold (e.g., 80 points), the upgrade is carried out normally; if the risk assessment value is ≤60 points and <80 points, the upgrade is slowed down by 50%; if the risk assessment value is <60 points, the upgrade is suspended and an anomaly log is recorded, and a risk warning is pushed to the ship operation center.

[0052] Existing ship software upgrade processes are generally one-time write-based, without dynamic adjustments based on the ship's real-time status. They force upgrades even when there is a network outage, equipment overheating, or the ship is performing critical operations, often leading to upgrade failures or even equipment damage due to abnormal external environments.

[0053] In this embodiment of the invention, the ship terminal is further configured to: after the upgrade is paused, in response to an abnormal recovery instruction, perform a system recovery operation on the ship terminal based on the system snapshot file, and restart the software upgrade operation; determine whether the upgrade has failed; if so, obtain the upgrade completion rate, and perform a corresponding partial rollback or full rollback based on the upgrade completion rate.

[0054] In one possible implementation, if verification is successful, the ship initiates the software upgrade process, simultaneously acquiring real-time network status information and real-time ship status information, and obtaining real-time ship status information through a sensor or equipment management system. At some point, a fault occurs during the upgrade process, triggering a pause. The system then waits for the fault to be resolved. At another point, the system receives an anomaly recovery command. At this time, it first performs a system recovery operation on the ship based on the system snapshot file to restore it to its normal state before the upgrade, and then restarts the software upgrade operation to ensure the integrity and reliability of the upgrade.

[0055] In another embodiment, if the upgrade fails due to unforeseen circumstances (such as package verification errors or system crashes), to avoid damage to the device, the upgrade completion rate is immediately obtained, and a partial or full rollback is performed based on the completion rate. For example, if the system experiences a minor anomaly (only some modules are not loaded), such as an upgrade completion rate of 90%, a partial rollback is performed. If the system experiences a serious anomaly during the upgrade process (such as the system failing to boot), a full snapshot recovery is performed, and a fault analysis report is generated and uploaded to the key management system after the rollback.

[0056] This invention, through real-time monitoring of network and ship status, dynamically calculates upgrade safety values. When preset risk conditions are triggered or the safety value falls below a threshold, the upgrade is immediately paused and an intelligent response is initiated. This effectively avoids upgrade failures or equipment damage caused by environmental anomalies, significantly improving the safety, reliability, and scenario adaptability of the upgrade process.

[0057] It should be noted that the ship's end includes not only the terminal management system but also other electronic control systems. The process of receiving and verifying software packages is carried out in the terminal management system. When the software package is verified, the terminal management system will execute its own software upgrade process or distribute it to other electronic control systems according to the software package type, so as to facilitate the upgrade of other electronic control systems.

[0058] This invention also provides a method for encrypting and protecting ship software packages. The method includes: obtaining a unique ship identifier, ship status information, and network status information through a key management system; generating a first asymmetric private key and a corresponding first public key based on the unique ship identifier, the ship status information, and the network status information; generating a first digital certificate based on the first public key, wherein the first digital certificate embeds a location watermark formed by real-time encrypted latitude and longitude of the ship; sending the first digital certificate to the ship via the trusted terminal; obtaining dynamic risk assessment information of navigation sea state; signing the software package to be transmitted based on the first asymmetric private key; encrypting the signed software package based on the first public key and the dynamic risk assessment information to generate an encrypted software package; and sending the encrypted software package to the ship. The encrypted software package is transmitted to the ship via a remote upgrade platform; the terminal's unique identifier and corresponding timestamp are transmitted to the key management system via a trusted terminal; a second digital certificate issued by the key management system is received, and the validity period of the second digital certificate is verified based on the ship's position information; the location watermark and timeliness of the first digital certificate are verified; a ship-side private key corresponding to the first asymmetric private key is generated on the ship; real-time ship attitude, equipment power status, and system load rate are obtained; a risk assessment model is constructed based on real-time network transmission quality, the real-time ship attitude, the equipment power status, and the system load rate; an encrypted snapshot file is generated and stored in an independent secure partition before the software upgrade, and a tiered response strategy is executed based on the risk assessment results during the upgrade process.

[0059] It should be understood that the method for encrypting and protecting ship software packages provided in this embodiment of the invention is based on the same inventive concept as the system for encrypting and protecting ship software packages provided in the above embodiments. For more detailed working principles of each step in this embodiment of the invention, please refer to the above embodiments, which will not be repeated in this embodiment of the invention.

[0060] The optional embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the embodiments of the present invention are not limited to the specific details in the above embodiments. Within the scope of the technical concept of the embodiments of the present invention, various simple modifications can be made to the technical solutions of the embodiments of the present invention, and these simple modifications all fall within the protection scope of the embodiments of the present invention.

[0061] It should also be noted that the various specific technical features described in the above embodiments can be combined in any suitable manner without contradiction. To avoid unnecessary repetition, the embodiments of the present invention will not describe the various possible combinations separately.

[0062] Those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. This program is stored in a storage medium and includes several instructions to cause a microcontroller, chip, or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0063] Furthermore, various different implementations of the present invention can be combined arbitrarily, as long as they do not violate the spirit of the present invention, they should also be regarded as the content disclosed in the present invention.

Claims

1. A system for encrypting and protecting shipboard software packages, characterized in that, It includes a key management system, a remote upgrade management platform, a trusted terminal, and a ship terminal; the remote upgrade management platform is connected to the intranet of the key management system and to the external network of the ship terminal; the trusted terminal is connected to the external network of the key management system and to the ship terminal bus; wherein... The key management system is used for: acquiring a unique ship identifier, ship status information, and network status information; generating a first asymmetric private key and a corresponding first public key based on the unique ship identifier, ship status information, and network status information; generating a first digital certificate based on the first public key, wherein the first digital certificate embeds a location watermark formed by real-time encrypted latitude and longitude of the ship; acquiring dynamic risk assessment information of navigation sea conditions; signing the software package to be transmitted based on the first asymmetric private key; encrypting the signed software package based on the first public key and the dynamic risk assessment information to generate an encrypted software package; transmitting the encrypted software package to the ship via the remote upgrade platform; and transmitting the first digital certificate to the ship via the trusted terminal. The trusted terminal is used to: transmit the terminal's unique identifier and corresponding timestamp to the key management system; receive the second digital certificate issued by the key management system and verify the validity period of the second digital certificate based on the ship's location information; and verify the location watermark and timeliness of the first digital certificate. The ship-side component is used to: generate a ship-side private key corresponding to the first asymmetric private key; acquire real-time ship attitude, equipment power status, and system load rate; construct a risk assessment model based on real-time network transmission quality, the real-time ship attitude, the equipment power status, and the system load rate; generate an encrypted snapshot file and store it in an independent secure partition before software upgrade; and execute a tiered response strategy based on the risk assessment results during the upgrade process.

2. The system for encrypting and protecting shipboard software packages according to claim 1, characterized in that, The ship status information includes the ship's real-time roll angle and the ship's real-time pitch angle. The step of generating a first asymmetric private key and a corresponding first public key based on the ship's unique identifier, the ship status information, and the network status information includes: An initial private key is generated based on the ship's unique identifier, the ship's status information, and the ship's navigation trajectory characteristics; An additional entropy source is generated based on the ship's real-time roll angle and the ship's real-time pitch angle. An intermediate private key is generated based on the derived private key of the initial private key, the ship status information, the additional entropy source, and the pre-stored public key; A first asymmetric private key and a corresponding first public key are generated based on the intermediate private key, the ship status information, and the network status information.

3. The system for encrypting and protecting shipboard software packages according to claim 1, characterized in that, The step of encrypting the signed software package based on the first public key and the dynamic risk assessment information to generate an encrypted software package includes: The dynamic risk assessment information is determined based on the ship's real-time attitude, and the dynamic risk assessment information includes extreme sea states, complex sea states, and calm sea states. The size of the encryption block is determined based on the real-time network transmission quality. Based on the dynamic risk assessment information, the corresponding encryption strategy is determined as follows: if the current sea state is extreme, superimposed encryption is performed based on the first public key and the temporary negotiated public key; if the current sea state is complex, encryption is performed based on the first public key; if the current sea state is calm, a low-complexity encryption algorithm is determined, and encryption is performed based on the first public key and the low-complexity encryption algorithm. The signed software package is encrypted according to the encryption strategy to generate an encrypted software package.

4. The system for encrypting and protecting ship software packages according to claim 1, characterized in that, The key management system is also used for: Obtain the unique identifier of the trusted terminal and its corresponding timestamp; The unique identifier of the terminal is compared and verified with the pre-stored whitelist; When the verification is successful, a second asymmetric private key and a corresponding second public key are generated based on the terminal's unique identifier and the timestamp. Generate a second digital certificate based on the second public key; The second digital certificate is transmitted to the trusted terminal.

5. A system for encrypting and protecting shipboard software packages according to claim 4, characterized in that, Transmitting the first digital certificate to the ship via the trusted terminal includes: The first digital certificate is signed based on the first asymmetric private key; The first digital certificate, after being signed, is transmitted to the trusted terminal; The trusted terminal is used for: Obtain the second public key from the second digital certificate; The first digital certificate after signing is verified using the second public key; Upon successful verification, the first digital certificate is written to the secure storage area on the ship via the bus.

6. A system for encrypting and protecting shipboard software packages according to claim 1, characterized in that, The ship end is used for: Obtain the first public key from the first digital certificate; The encrypted software package is decrypted based on the ship's private key, and the algorithm for generating the ship's private key is the same as that for the first asymmetric private key. The decrypted software package is verified based on the first public key; Upon successful verification, a system snapshot file for the ship is generated, and a software upgrade operation is performed based on the decrypted software package. The current risk assessment value is generated based on the aforementioned risk assessment model; Based on the risk assessment value, perform security control operations for the software upgrade operation.

7. A system for encrypting and protecting shipboard software packages according to claim 6, characterized in that, The ship end is also used for: After the upgrade is paused, in response to the abnormal recovery command, a system recovery operation is performed on the ship based on the system snapshot file, and the software upgrade operation is restarted; Determine if the upgrade failed; If so, obtain the upgrade completion rate, and perform a partial or full rollback based on the upgrade completion rate.

8. A method for encrypting and protecting shipboard software packages, characterized in that, include: The unique identifier of the vessel, the vessel status information, and the network status information are obtained through the key management system. A first asymmetric private key and a corresponding first public key are generated based on the ship's unique identifier, the ship's status information, and the network status information. A first digital certificate is generated based on the first public key. The first digital certificate embeds a location watermark formed by real-time encrypted latitude and longitude of the ship. The first digital certificate is sent to the ship through the trusted terminal. The system acquires dynamic risk assessment information on sea conditions, signs the software package to be transmitted based on the first asymmetric private key, encrypts the signed software package based on the first public key and the dynamic risk assessment information to generate an encrypted software package, and transmits the encrypted software package to the ship via a remote upgrade platform. The trusted terminal transmits its unique identifier and corresponding timestamp to the key management system. Receive the second digital certificate issued by the key management system, verify the validity period of the second digital certificate based on the ship's location information; verify the location watermark and timeliness of the first digital certificate. A ship-side private key corresponding to the first asymmetric private key is generated at the ship end. The system acquires real-time ship attitude, equipment power status, and system load rate; constructs a risk assessment model based on real-time network transmission quality, the real-time ship attitude, the equipment power status, and the system load rate; generates encrypted snapshot files and stores them in an independent secure partition before software upgrade; and executes a tiered response strategy based on the risk assessment results during the upgrade process.

9. A processor, characterized in that, Used to run a program, wherein the program is run to perform the method of claim 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method of claim 8.

Images