A system and method for encryption protection of a ship software package

Abstract

The application relates to the technical field of software upgrading, and discloses a system and a method for encrypting and protecting a ship software package, which comprise a key management system, a remote upgrading management platform, a trusted terminal and a ship terminal; the key management system is used for generating a first asymmetric private key and a corresponding first public key; a first digital certificate is generated based on the first public key; a software package to be transmitted is signed, and the signed software package is encrypted to generate an encrypted software package; the trusted terminal is used for transmitting a terminal unique identifier and a corresponding time stamp, receiving and checking a valid time length of a second digital certificate, and verifying a location watermark and timeliness of the first digital certificate; and the ship terminal is used for generating a ship terminal private key, constructing a risk assessment model, and executing a hierarchical response strategy based on a risk assessment result in an upgrading process. The software package is encrypted and protected based on an asymmetric key system and in combination with ship dynamic state and network state information, so that the confidentiality, integrity and controllability of the software package in the transmission and upgrading process are ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of software upgrading, in particular to a system and method for encrypting and protecting a software package of a ship. BACKGROUND

[0002] With the rapid development of ship network connection technology, the intelligence and networking of ship equipment have been significantly improved, the scale of equipment has increased exponentially, and the types of data have expanded from traditional simple sensor signals to sensitive information such as files, software packages, videos, and control instructions. As a core means of function iteration of ship equipment, the security of software package remote upgrading is directly related to the stable operation of key modules such as ship control systems and navigation systems.

[0003] The prior art such as invention patent 202411901601.X proposes a system and method for encrypting and protecting a software package of a ship, which issues a digital certificate to a remote upgrading server through a certificate issuing agency and encrypts the software package using a symmetric key algorithm. However, this scheme has the following limitations: first, the symmetric key algorithm requires both parties to use the same key, and the key distribution needs to rely on an additional secure channel. However, the openness of network transmission in the ship remote upgrading scenario makes it easy for the key to be intercepted by an intermediate person, leading to the risk of key leakage. Second, the security of symmetric encryption ciphertext is highly dependent on the key itself. If the key is leaked, the ciphertext can be completely decrypted, and the confidentiality and integrity of the software package cannot be guaranteed. SUMMARY

[0004] In order to overcome the above technical problems in the prior art, the present application provides a system and method for encrypting and protecting a software package of a ship, which encrypts and protects the software package based on an asymmetric key system and in combination with the dynamic state and network state information of the ship, thereby improving the security of key distribution, enhancing the dynamic adaptability of the software package encryption strategy, and greatly guaranteeing the confidentiality, integrity, and controllability of the software package during transmission and upgrading.

[0005] In one aspect, the present application provides a system for encrypting and protecting a software package of a ship, which comprises a key management system, a remote upgrade management platform, a trusted terminal and a ship terminal; the remote upgrade management platform is connected to the internal network of the key management system and connected to the external network of the ship terminal; the trusted terminal is connected to the external network of the key management system and connected to the bus of the ship terminal; wherein the key management system is configured to: obtain a unique ship identifier, ship state information and network state information; generate a first asymmetric private key and a corresponding first public key based on the unique ship identifier, the ship state information and the network state information; generate a first digital certificate based on the first public key, the first digital certificate being embedded with a position watermark encrypted from real-time latitude and longitude of the ship; obtain dynamic risk assessment information of sailing sea conditions, sign a software package to be transmitted based on the first asymmetric private key, encrypt the signed software package based on the first public key and the dynamic risk assessment information to generate an encrypted software package; and transmit the encrypted software package to the ship terminal through the remote upgrade platform; and transmit the first digital certificate to the ship terminal through the trusted terminal.

[0006] The trusted terminal is configured to: transmit a terminal unique identifier and a corresponding timestamp to the key management system; receive a second digital certificate issued by the key management system, and verify a valid duration of the second digital certificate based on ship position information; and verify the position watermark and the time effectiveness of the first digital certificate.

[0007] The ship terminal is configured to: generate a ship terminal private key corresponding to the first asymmetric private key; obtain real-time ship attitude, device power state and system load rate; construct a risk assessment model based on real-time network transmission quality, real-time ship attitude, device power state and system load rate; generate an encrypted snapshot file before software upgrade and store it in an independent secure partition, and execute a hierarchical response strategy based on the risk assessment result during the upgrade process.

[0008] Preferably, the ship state information comprises a real-time roll angle of the ship and a real-time pitch angle of the ship, and the first asymmetric private key and the corresponding first public key are generated based on the unique ship identifier, the ship state information and the network state information, which comprises: generating an initial private key based on the unique ship identifier, the ship state information and ship sailing trajectory features; generating an additional entropy source based on the real-time roll angle of the ship and the real-time pitch angle of the ship; generating an intermediate private key based on a derived private key of the initial private key, the ship state information, the additional entropy source and a pre-stored public key; and generating the first asymmetric private key and the corresponding first public key based on the intermediate private key, the ship state information and the network state information.

[0009] Preferably, the encryption of the signed software package based on the first public key and the dynamic risk assessment information generates an encrypted software package, comprising: determining the dynamic risk assessment information based on the real-time attitude of the ship, wherein the dynamic risk assessment information comprises extreme sea conditions, complex sea conditions and calm sea conditions; determining the encryption size based on the real-time network transmission quality; determining the corresponding encryption strategy based on the dynamic risk assessment information: if the current is in the extreme sea conditions, performing superimposed encryption based on the first public key and the temporarily negotiated public key; if the current is in the complex sea conditions, performing encryption based on the first public key; if the current is in the calm sea conditions, determining a low-complexity encryption algorithm, and performing encryption based on the first public key and the low-complexity encryption algorithm; and encrypting the signed software package according to the encryption strategy to generate the encrypted software package.

[0010] Preferably, the key management system is further configured to: obtain a terminal unique identifier of the trusted terminal and a corresponding timestamp; compare and verify the terminal unique identifier with a pre-stored whitelist; when the verification is passed, generate a second asymmetric private key and a corresponding second public key based on the terminal unique identifier and the timestamp; and generate a second digital certificate based on the second public key.

[0011] The second digital certificate is transmitted to the trusted terminal.

[0012] Preferably, the first digital certificate is transmitted to the ship end through the trusted terminal, comprising: signing the first digital certificate based on the first asymmetric private key; and transmitting the signed first digital certificate to the trusted terminal; the trusted terminal is configured to: obtain the second public key from the second digital certificate; verify the signed first digital certificate using the second public key; and when the verification is passed, write the first digital certificate to a secure storage area of the ship end through the bus.

[0013] Preferably, the ship end is configured to: obtain the first public key from the first digital certificate; decrypt the encrypted software package based on a ship end private key, wherein the generation algorithm of the ship end private key is the same as that of the first asymmetric private key; verify the decrypted software package based on the first public key; when the verification is passed, generate a system snapshot file for the ship end, perform a software upgrade operation based on the decrypted software package; generate a current risk assessment value based on the risk assessment model; and perform a security control operation for the software upgrade operation based on the risk assessment value.

[0014] Preferably, the ship end is further configured to: after the upgrade is suspended, in response to an exception recovery instruction, perform a system recovery operation on the ship end based on the system snapshot file, restart the software upgrade operation; determine whether the upgrade fails; if so, obtain an upgrade completion degree, and perform a corresponding partial rollback or complete rollback based on the upgrade completion degree.

[0015] In another aspect, a method for encrypting and protecting a ship software package, the method comprising: obtaining a ship unique identifier, ship state information and network state information through a key management system; generating a first asymmetric private key and a corresponding first public key based on the ship unique identifier, the ship state information and the network state information; generating a first digital certificate based on the first public key, the first digital certificate embedding a position watermark formed by encrypting a real-time latitude and longitude of the ship, and sending the first digital certificate to the ship end through the trusted terminal; obtaining dynamic risk assessment information of a sailing sea condition, signing a to-be-transmitted software package based on the first asymmetric private key, encrypting the signed software package based on the first public key and the dynamic risk assessment information to generate an encrypted software package, and transmitting the encrypted software package to the ship end through a remote upgrade platform;

[0016] transmitting a terminal unique identifier and a corresponding timestamp to the key management system through the trusted terminal; receiving a second digital certificate issued by the key management system, and verifying a valid duration of the second digital certificate based on ship position information; verifying the position watermark and timeliness of the first digital certificate;

[0017] generating a ship end private key corresponding to the first asymmetric private key through the ship end; obtaining real-time ship attitude, device power state and system load rate; constructing a risk assessment model based on real-time network transmission quality, the real-time ship attitude, the device power state and the system load rate; generating an encrypted snapshot file before software upgrade and storing it in an independent secure partition, and executing a hierarchical response strategy based on risk assessment results during the upgrade process.

[0018] Through the technical solutions provided by the present application, the present application has at least the following technical effects:

[0019] By combining ship dynamic state parameters, network state information and timestamps to generate an asymmetric key pair, dynamically adjusting the encryption strategy, and using a dual-channel design, the encrypted software package is transmitted through a remote upgrade management platform, and the digital certificate is securely transmitted through the trusted terminal, ultimately achieving high security and dynamic adaptability during the transmission and upgrade of the software package.

[0020] Other features and advantages of the embodiments of the present application will be described in detail in the subsequent specific implementation manner part. BRIEF DESCRIPTION OF DRAWINGS

[0021] The accompanying drawings are included to provide a further understanding of embodiments of the application, and are incorporated in and constitute a part of this specification, illustrate embodiments of the application, and together with the description serve to explain embodiments of the application, but are not intended to limit the embodiments of the application in any manner. In the drawings:

[0022] Figure 1 is a structural schematic diagram of a system for encrypting and protecting a software package of a ship provided by an embodiment of the application. DETAILED DESCRIPTION

[0023] The specific embodiments of the embodiments of the application will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only used to illustrate and explain the embodiments of the application, and are not intended to limit the embodiments of the application.

[0024] The terms "system" and "network" in the embodiments of the application can be used interchangeably. "Multiple" means two or more, and in view of this, "multiple" can also be understood as "at least two" in the embodiments of the application. "And / or" describes the association between the associated objects, which means that there can be three relationships, for example, A and / or B can mean that A exists alone, A and B exist together, and B exists alone. In addition, the character " / ", if not specially stated, generally represents an "or" relationship between the associated objects. In addition, it should be understood that in the description of the embodiments of the application, "first", "second", etc. are only used for the purpose of distinguishing the description, and cannot be understood as indicating or implying relative importance, nor can it be understood as indicating or implying order.

[0025] With the rapid development of ship network connection technology, the degree of intelligence and networking of ship equipment is continuously improved, the scale of equipment and the type of data (covering sensitive information such as files, software packages, videos, and control instructions) are growing exponentially, and remote upgrading of software packages as a core means of device function iteration directly affects the stable operation of key modules such as ship control systems and navigation systems. In the prior art, software package encryption protection is mostly based on symmetric key algorithm, which needs to rely on external network to distribute keys, but the openness of network transmission in the ship remote upgrading scenario (such as satellite communication and 4G network) is easy to lead to the interception of keys by intermediaries; and the security of symmetric encryption ciphertext is highly dependent on the key itself, and the keys in the prior art are mostly generated based on static parameters such as fixed device serial numbers, and once the key is leaked, the confidentiality will be completely lost.

[0026] Based on the above reasons, please refer to Figure 1The application provides a ship software package encryption protection system, which comprises a key management system, a remote upgrade management platform, a trusted terminal and a ship terminal; the remote upgrade management platform is connected with an intranet of the key management system and an extranet of the ship terminal; the trusted terminal is connected with an extranet of the key management system and a bus of the ship terminal; wherein the key management system is used for obtaining a ship unique identifier, ship state information and network state information; generating a first asymmetric private key and a corresponding first public key based on the ship unique identifier, the ship state information and the network state information; generating a first digital certificate based on the first public key, the first digital certificate being embedded with a position watermark formed by encrypting real-time latitude and longitude of the ship; obtaining dynamic risk assessment information of a sailing sea state, signing a software package to be transmitted based on the first asymmetric private key, encrypting the signed software package based on the first public key and the dynamic risk assessment information to generate an encrypted software package; transmitting the encrypted software package to the ship terminal through the remote upgrade platform; and transmitting the first digital certificate to the ship terminal through the trusted terminal; the trusted terminal is used for transmitting a terminal unique identifier and a corresponding time stamp to the key management system, receiving a second digital certificate issued by the key management system, checking a valid time length of the second digital certificate based on ship position information, verifying the position watermark and time effectiveness of the first digital certificate; and the ship terminal is used for generating a ship terminal private key corresponding to the first asymmetric private key, obtaining real-time ship attitude, device power state and system load rate, constructing a risk assessment model based on real-time network transmission quality, the real-time ship attitude, the device power state and the system load rate, generating an encrypted snapshot file before software upgrade and storing the encrypted snapshot file in an independent secure partition, and executing a hierarchical response strategy based on a risk assessment result during the upgrade process.

[0027] In a possible implementation, the key management system comprises a key certificate generation agency for generating keys or certificates, a key management agency for key management, a certificate management agency for certificate management and a security trust center for providing a security interface, the remote upgrade management platform interacts with the key management system by calling the security interface of the security trust center, specifically, the key certificate generation agency can obtain a ship unique identifier, ship state information and network state information; generate a first asymmetric private key and a corresponding first public key based on the ship unique identifier, the ship state information and the network state information, and send the first private key and the first public key to the key management agency for storage; generate a first digital certificate based on the first public key, and send the first digital certificate to the certificate issuing agency for storage; in order to ensure the reliability of the first digital certificate and improve the encryption security, a position watermark formed by encrypting real-time latitude and longitude of the ship is embedded in the first digital certificate.

[0028] The key management institution can sign the software package to be transmitted based on the first asymmetric private key, obtain dynamic risk assessment information of the sailing sea state in the signing process, encrypt the signed software package based on the first public key and the dynamic risk assessment information to generate an encrypted software package, and generate a first digital certificate based on the first public key. The remote upgrade management platform can obtain the encrypted software package from the key management institution and the first digital certificate from the certificate management institution by calling a secure interface.

[0029] In a possible implementation, the key management system is deployed in a ship company and is responsible for key and certificate management, etc.; the remote upgrade management platform is deployed in the cloud and is responsible for software package distribution; and the trusted terminal is deployed in a restricted area of the ship, and the ship end includes a remote upgrade terminal integrated with a software SDK1 and other electric control systems, and the remote upgrade terminal is internally provided with a special security chip (such as an SE chip) for storing a key. Specifically, when the ship needs to upgrade navigation software, the SDK1 of the remote upgrade terminal triggers a data collection and local private key generation process: real-time acquisition of a ship unique identifier, ship state information, network state information, and generation of a ship end private key based on a preset key generation algorithm (such as an ECC elliptic curve algorithm), and secure storage of the ship end private key in the SE chip of the ship end to ensure that the ship end private key is only accessed by the ship end. Subsequently, the ship end transmits a navigation software upgrade request to the remote upgrade management platform through the SDK1, and the request content includes the ship unique identifier, the ship state information, the network state information, and the identifier of the navigation software to be upgraded (such as NAV-2025V2.0). After receiving the request, the remote upgrade platform retrieves the latest version of the navigation software package (such as NAV-2025V2.0.pkg) from the cloud software package database according to the identifier of the navigation software to be upgraded, generates a software package encryption request in combination with the latest version of the navigation software package, the ship unique identifier, the network state information, and the ship state information, and transmits the software package encryption request to the key management system through an intranet private line and a security interface of the key management system. After receiving the software package encryption request, the key management system generates a first asymmetric private key based on the ship unique identifier, the ship state information, and the network state information in the software package encryption request through the same key generation algorithm as the ship end, derives a corresponding first public key from the first asymmetric private key based on a preset asymmetric key generation algorithm, ensures that the public and private keys match, and ensures that the first asymmetric private key is consistent with the ship end private key. Subsequently, the first public key is bound with the ship unique identifier to generate a first digital certificate conforming to the X.509 standard to ensure the legality and verifiability of the first public key; and the first digital certificate containing the first public key and a location watermark is securely transmitted to the ship end remote upgrade terminal through a special communication link (such as a shipboard CAN bus) of the trusted terminal, and the restricted area deployment and authorized access mechanism of the trusted terminal ensure that the certificate is only relayed by a legal device; meanwhile, the key management system uses the first asymmetric private key to digitally sign the navigation software package to be transmitted to ensure that the navigation software package has not been tampered with, and uses the first public key to encrypt the signed software package to ensure transmission security, generates an encrypted software package, and transmits the encrypted software package to the ship end through a cloud communication link (such as satellite communication or a 4G network) of the remote upgrade management platform. In the encryption process, in order to improve encryption security and reduce the difficulty of cracking, dynamic risk assessment information of the sailing sea conditions is first acquired, such as whether the current sailing belongs to a dangerous sea state or a normal sea state, and encryption is performed in combination with the risk assessment, thereby realizing dynamic encryption and effectively improving encryption security and encryption traceability.

[0030] The embodiment of the present application generates the private key locally by the ship end and the key management system and stores it in the corresponding secure chip by using the asymmetric key mode. When the software is upgraded, the key management system generates the public key based on the private key and only transmits the digital certificate containing the public key through the trusted terminal, without transmitting the private key. Compared with the traditional symmetric encryption mode which relies on the open network to transmit the key and only relies on the static device serial number to generate the key, the key leakage risk is significantly reduced, and the key unpredictability is enhanced.

[0031] The key generation algorithm includes a hash algorithm and a basic key derivation function. After obtaining the ship unique identifier, the ship state information, the network state information and the like, the key can be generated based on the above algorithm. For example, the ship unique identifier, part of the ship speed, the available bandwidth and the minute-level timestamp are spliced, and the private key is calculated by a hash function. The key obtained by this method has a significant deficiency: only relying on one-sided state parameters, without fully considering the multi-dimensional ship state information such as the heading angle, latitude and longitude, and the network state information such as network delay and bit error rate, resulting in low correlation between the key and the actual running scene of the ship, which is easy to cause the key to be repeated in the same time period. Therefore, the embodiment of the present application proposes a multi-level architecture key generation algorithm.

[0032] In the embodiment of the present application, the ship state information includes a real-time roll angle of the ship and a real-time pitch angle of the ship, and the first asymmetric private key and the corresponding first public key are generated based on the ship state information and the network state information. The method comprises the following steps: generating an initial private key based on the ship unique identifier, the ship state information and the ship navigation track feature; generating an intermediate private key based on the derived private key of the initial private key, the ship state information and the pre-stored public key; and generating a first asymmetric private key and a corresponding first public key based on the intermediate private key, the ship state information and the network state information.

[0033] In one possible implementation, the ship status information includes one or more of rudder angle, speed, latitude and longitude, wave height, wind speed, real-time ship roll angle, and real-time ship pitch angle. The network status information includes one or more of available bandwidth, bit error rate, and network latency. In a specific implementation, an initial private key is first generated. For example, the ship's navigation trajectory is characterized by a latitude and longitude sequence hash value. By further adding the latitude and longitude sequence hash value when generating the initial private key, the anti-counterfeiting performance of the private key can be improved, enhancing its privacy and the difficulty of cracking. Then, an additional entropy source is generated based on the ship's real-time roll angle and real-time pitch angle. In the subsequent generation of the intermediate private key, not only is the derived private key based on the initial private key, the ship status information, and the pre-stored public key generated, but the ship's real-time roll and pitch angle data are further introduced as an additional entropy source during the intermediate private key generation process. This effectively improves the unpredictability of the key and significantly reduces the risk of the key being brute-forced or mathematically analyzed. Then, based on the intermediate private key, the ship status information, and the network status information, a first asymmetric private key is generated, represented as: K. data =HKDF(K scss ,info=f(B,D,Pe),salt=g(S,t)), where K data Let f be the first asymmetric private key, B be the available bandwidth, D be the network latency, Pe be the bit error rate, f be the network parameter encoding function, and g be the salt generation function.

[0034] More specifically, the lowest 4 noise bits are extracted from the raw ADC sampled values ​​of each sensor in S (e.g., the 16-bit sampled value of the airspeed sensor), and the noise bits of all sensors are concatenated into a 256-bit binary string; then XORed with the SHA-256 hash values ​​of HWID and t to generate the PUF output. HKDF-SHA384 is selected as the key derivation function, and the timestamp corresponding to the sensor acquisition and the pre-stored salt value are input into HKDF-SHA384 to generate the HKDF output. The PUF output is XORed with the KDF output to obtain K. dev From K dev Derived elliptic curve private key, obtained d ship The platform public key and ship state vector are input into ECDH, and the SHA-256 hash of S is used as an additional entropy source to participate in ECDH negotiation to obtain K. scss The available bandwidth, network latency, and bit error rate are encoded into strings. The ship status information is combined with the timestamp to generate the corresponding salt value. Finally, the final K is generated based on the derived function. data .

[0035] The different level keys of the multi-level architecture key generation algorithm provided by the embodiment of the application can be used in various scenes such as data encryption and encrypted sessions. The multi-level private key generation algorithm proposed by the embodiment of the application effectively solves the problems of low scene correlation and key repetition risk of traditional algorithms caused by one-sided parameters by comprehensively integrating multi-dimensional ship state information such as speed, heading angle, latitude, longitude, wave height, wind speed, and network state information such as available bandwidth, bit error rate, and network delay, combining a physical unclonable function to bind the inherent characteristics of ship hardware, a key derivation function to integrate a timestamp and a pre-stored salt value for dynamic updating, an ECDH negotiation to introduce ship state hash as an additional entropy source to enhance randomness, and an HKDF derivation combined with network parameter encoding and dynamic salt value to adapt to real-time scenarios.

[0036] After the key management system generates the first asymmetric private key, the software package can be encrypted by the first asymmetric private key, for example, the software package is encrypted by using a preset encryption algorithm, and the preset encryption algorithm is generally fixed as a certain algorithm. However, there are problems of insufficient encryption efficiency and scene adaptability when the software package is encrypted by the fixed certain encryption algorithm: in a low-bandwidth scene, a high-complexity algorithm is easy to cause too long encryption delay, and in a high-bandwidth scene, a low-intensity algorithm faces the risk of cracking; in addition, when encrypting, the size of the encryption block may be fragmented or redundant due to network fluctuations, affecting the software package transmission efficiency and upgrade success rate.

[0037] In the embodiment of the application, the signed software package is encrypted based on the first public key and the dynamic risk assessment information to generate an encrypted software package: the dynamic risk assessment information is determined based on the real-time attitude of the ship, and the dynamic risk assessment information includes extreme sea conditions, complex sea conditions and calm sea conditions; the encryption block size is determined based on the real-time network transmission quality; the corresponding encryption strategy is determined based on the dynamic risk assessment information: if the current is in the extreme sea condition, superposition encryption is performed based on the first public key and the temporary negotiation public key; if the current is in the complex sea condition, encryption is performed based on the first public key; if the current is in the calm sea condition, a low-complexity encryption algorithm is determined, and encryption is performed based on the first public key and the low-complexity encryption algorithm; the signed software package is encrypted according to the encryption strategy to generate the encrypted software package.

[0038] In one possible implementation, the dynamic risk assessment information is first determined according to the real-time attitude of the ship, for example, when the roll angle is ≥15° and the pitch angle is ≥10°, it is determined as an extreme sea condition; when the roll angle is 5°-15° and the pitch angle is 3°-10°, it is determined as a complex sea condition; and when the roll angle is <5° and the pitch angle is <3°, it is determined as a calm sea condition. On the other hand, the encryption block size is determined according to the real-time network transmission quality, for example, when the packet loss rate is <1% and the jitter value is <50ms, a 4096-byte encryption block is used; when the packet loss rate is 1%-5% and the jitter value is 50ms-100ms, a 1024-byte encryption block is used; and when the packet loss rate is >5% and the jitter value is >100ms, a 256-byte encryption block is used.

[0039] In actual application, the conventional method is to directly perform the corresponding encryption operation according to the first public key and the encryption block, however, this method is relatively fixed, and has the defects of insufficient protection in extreme scenarios and security redundancy in normal scenarios. Therefore, in order to solve the above technical problems, an adaptive security enhancement strategy is adopted, specifically, when the ship is in an extreme sea condition (roll angle ≥15° / pitch angle ≥10°), the ship attitude fluctuates violently, which easily leads to device vibration and abnormal sensor data, at the same time, network transmission is disturbed by sea waves, which may cause packet loss and sudden increase in delay, and the risk of software package tampering or interception is significantly increased. At this time, the double public key superposition encryption of “first public key + temporary negotiated public key” is enabled, through the cooperative protection of two layers of asymmetric encryption, the software package encryption strength is increased by more than 2 times of the basic scenario — even if the attacker cracks one of the public keys, it still needs to break through the second layer of encryption barrier, greatly reducing the risk of core data leakage, solving the defect of the original scheme “fixed encryption strength cannot cope with extreme risk”. When the ship is in a complex sea condition, single encryption with the first key can be used, which ensures the basic security while avoiding the consumption of computing resources caused by double public key encryption, adapting to the limited computing power of ship embedded devices (such as navigation terminals); and for calm sea conditions, the encryption algorithm complexity can be reduced, for example, RSA-2048 can be downgraded to RSA-1024, or a lightweight ECC-256 algorithm can be used, the encryption time can be shortened by 30%-50%, and the network transmission bandwidth occupation is also reduced, in order to adapt to the scene demand of “rapid upgrade” in near-sea short-distance navigation, avoiding the problem of “excessive encryption leading to waste of efficiency”. Finally, the key management system divides the signed software package according to the determined encryption block size, and encrypts each data block obtained by each division using the selected target encryption algorithm combined with the first public key, to obtain the encrypted software package.

[0040] The embodiments of the present application adapt the encryption process to the actual running environment of the ship by dynamically selecting the encryption algorithm and the encryption block size, ensure the balance between speed and security of the encryption algorithm in different scenarios, avoid the inefficiency or high risk of fixed algorithm, reduce the retransmission overhead under low bandwidth and the calculation redundancy under high bandwidth, improve the transmission efficiency, strengthen the confidentiality of the software package transmission by combining the asymmetric encryption characteristics of the first public key, and effectively improve the reliability and practicality of the encryption protection.

[0041] In order to improve the security of the software package and avoid tampering of the software package, the software package needs to be signed based on the first asymmetric private key before encryption, so as to verify the legality and integrity of the software package subsequently. However, the ship end only stores the ship end private key and does not store the first public key for signature verification. Therefore, the digital certificate carrying the public key information needs to be distributed to the ship end by the key management system, so that the ship end obtains the public key information in the digital certificate. However, the existing method is a simple chain architecture of "certificate authority-server-terminal", that is, the digital certificate is transported by the same link as the software package, which causes problems such as tampering of the digital certificate. In order to solve this problem, in a possible implementation, a double-channel mechanism is adopted, the encrypted software package is distributed by the remote upgrade management platform, and the digital certificate is distributed by the trusted terminal. However, this method still has some problems. The trusted terminal as an intermediate transmission node is not included in the security verification, and there is a risk of being impersonated by illegal equipment, which affects the security of digital certificate transmission.

[0042] In the embodiments of the present application, the key management system is also used to: obtain a terminal unique identifier of the trusted terminal and a corresponding timestamp; compare and verify the terminal unique identifier with a pre-stored whitelist; when the verification is passed, generate a second asymmetric private key and a corresponding second public key based on the terminal unique identifier and the timestamp; generate a second digital certificate based on the second public key; and transmit the second digital certificate to the trusted terminal.

[0043] In a possible implementation, the trusted terminal transmits its terminal unique identifier (such as hardware serial number DSN-20250618-001) and the current timestamp to the key management system; the key management system performs hash comparison on the obtained trusted terminal unique identifier and the pre-stored whitelist (for example, after performing SHA-256 hash on DSN-20250618-001, match the corresponding hash value in the whitelist), confirms the legality of the trusted terminal; if the comparison is successful, the key management system generates a second asymmetric private key and a corresponding second public key based on the terminal unique identifier and the current timestamp as an entropy source, calls an elliptic curve algorithm (such as ECDSA secp256r1); then, encapsulates the second public key, the terminal unique identifier, the valid time and other information into a second digital certificate, and transmits the second digital certificate to the trusted terminal.

[0044] The embodiment verifies the trusted terminal through the whitelist technology, and guarantees the reliability of the trusted terminal.

[0045] After verifying the reliability of the trusted terminal, the first digital certificate storing the first public key can be transmitted to the trusted terminal, and in order to avoid the first digital certificate being tampered in the transmission process, the first digital certificate is signed by the second public key in the embodiment of the application.

[0046] In the embodiment of the application, the first digital certificate is transmitted to the ship end through the trusted terminal, including: signing the first digital certificate based on the first asymmetric private key; transmitting the signed first digital certificate to the trusted terminal; the trusted terminal is used for: obtaining the second public key from the second digital certificate; verifying the signed first digital certificate by using the second public key; when the verification is passed, the first digital certificate is written into the secure storage area of the ship end through the bus.

[0047] In a possible implementation, the trusted terminal verifies the signature information corresponding to the first digital certificate by using the second public key: if the verification is passed, it indicates that the content of the second digital certificate is not tampered and is signed by the key management system legally, at this time, the trusted terminal can write the second digital certificate into the secure partition of the ship end memory or the independent secure storage chip through the CAN bus, which greatly provides the security of the second public key.

[0048] It should be noted that, in order to guarantee the reliability of the trusted terminal, the trusted terminal is deployed in a restricted area of the ship, as a physically isolated node of secure communication, only authorized personnel are allowed to enter the area.

[0049] The embodiment of the application solves the core problem that the trusted terminal is not securely verified in the existing double-channel scheme through the multiple mechanisms of whitelist access, dynamic key and trusted terminal verification, guarantees the identity trust, transmission security and traceable source of the digital certificate in the double-channel scene, and provides a stable public key trust basis for the ship end to verify the legality of the software package subsequently.

[0050] Further, after obtaining the encrypted software package sent by the remote upgrade management platform and the first digital certificate written by the trusted terminal, in the embodiment of the application, the ship end is used for: obtaining the first public key from the first digital certificate; decrypting the encrypted software package based on the ship end private key, the generation algorithm of the ship end private key being the same as that of the first asymmetric private key; verifying the decrypted software package based on the first public key; when the verification is passed, generating a system snapshot file for the ship end, executing a software upgrade operation based on the decrypted software package; generating a current risk assessment value based on the risk assessment model; and executing a security control operation for the software upgrade operation based on the risk assessment value.

[0051] In the implementation process, after the verification is passed, the upgrade is not immediately performed, but a system snapshot file for the ship end is first generated, for example, the system configuration, running state and key data are automatically backed up, the snapshot file is generated after being encrypted by an SM4 algorithm, and the snapshot file is stored in an independent secure partition. During the upgrade process, the ship attitude, device power state (battery power < 30% or power supply fluctuation > 5% is determined as an abnormality), system load rate (load rate > 80% is determined as high load) and network transmission quality are collected in real time, a safety value is calculated by inputting the risk assessment model, and a safety control operation for the software upgrade operation is performed according to the risk assessment value, for example, when the risk assessment value is greater than or equal to a preset threshold (such as 80 points), the upgrade is normally performed, when the risk assessment value is 60 points and less than 80 points, the upgrade is performed at a speed of 50%, and when the risk assessment value is less than 60 points, the upgrade is suspended and an abnormal log is recorded, and a risk warning is pushed to the ship operation center.

[0052] The existing ship software upgrade process is generally in a one-time write mode, without dynamic adjustment in combination with the real-time state of the ship, and the upgrade is still forced when the network is interrupted, the device is high temperature or the ship is performing a key operation. Abnormal external environment often causes upgrade failure or even device damage.

[0053] In the embodiment of the present application, the ship end is also used to: after the upgrade is suspended, in response to an abnormal recovery instruction, performing a system recovery operation on the ship end based on the system snapshot file, restarting the software upgrade operation; determining whether the upgrade fails; if so, obtaining an upgrade completion degree, and performing corresponding partial rollback or complete rollback based on the upgrade completion degree.

[0054] In a possible implementation, if the verification is passed, the ship end starts the software upgrade process, simultaneously obtains real-time network state information and real-time ship state information, and obtains the real-time ship state information through a sensor or a device management system. At a moment, a fault occurs during the upgrade process and triggers the upgrade to be suspended, at which time the system waits for the fault to be resolved, at another moment, the system obtains an abnormal recovery instruction, at which time the system recovery operation is first performed on the ship end based on the system snapshot file to restore it to the normal state before the upgrade, and then the software upgrade operation is restarted to ensure the integrity and reliability of the upgrade.

[0055] In another embodiment, the upgrade fails due to an accident (such as a software package verification error, system crash) during the upgrade process, in order to avoid damage to the device, the upgrade completion degree is immediately obtained, and corresponding partial rollback or complete rollback is performed based on the upgrade completion degree. For example, if the system experiences a slight anomaly (only part of the module is not loaded), for example, the upgrade completion degree is 90%, then a partial rollback is performed; if the system experiences a serious anomaly (such as the system cannot start) during the upgrade process, then a complete snapshot recovery is performed, a fault analysis report is generated after rollback, and is uploaded to the key management system.

[0056] The embodiment of the present application can dynamically calculate the upgrade safety value by monitoring the network state and the ship state in real time, and immediately suspend the upgrade and start intelligent response when the preset risk condition is triggered or the safety value is lower than the threshold value, thereby effectively avoiding upgrade failure or device damage caused by environmental anomalies, and significantly improving the safety, reliability and scene adaptability of the upgrade process.

[0057] It should be noted that the ship end includes not only the terminal management system but also other electric control systems, and the software package receiving and verification process is in the terminal management system. When the software package verification is passed, the terminal management system will execute the self software upgrade process according to the software package type or issue it to other electric control systems, so as to realize the upgrade of other electric control systems.

[0058] The embodiment of the present application also provides a ship software package encryption protection method, which comprises the following steps: obtaining a ship unique identifier, ship state information and network state information through a key management system; generating a first asymmetric private key and a corresponding first public key based on the ship unique identifier, the ship state information and the network state information; generating a first digital certificate based on the first public key, the first digital certificate being embedded with a position watermark formed by encrypting the real-time latitude and longitude of the ship, and transmitting the first digital certificate to the ship end through the trusted terminal; obtaining dynamic risk assessment information of the sailing sea conditions, signing a to-be-transmitted software package based on the first asymmetric private key, encrypting the signed software package based on the first public key and the dynamic risk assessment information to generate an encrypted software package, and transmitting the encrypted software package to the ship end through a remote upgrade platform; transmitting a terminal unique identifier and a corresponding time stamp to the key management system through the trusted terminal; receiving a second digital certificate issued by the key management system, and verifying the valid time length of the second digital certificate based on the ship position information; verifying the position watermark and the timeliness of the first digital certificate; generating a ship end private key corresponding to the first asymmetric private key through the ship end; obtaining real-time ship attitude, device power state and system load rate; constructing a risk assessment model based on real-time network transmission quality, real-time ship attitude, device power state and system load rate; generating an encrypted snapshot file before software upgrade and storing it in an independent secure partition, and executing a hierarchical response strategy based on the risk assessment result during the upgrade process.

[0059] It should be understood that the method for encrypting and protecting a ship software package provided by the embodiments of the present application is based on the same inventive concept as the system for encrypting and protecting a ship software package provided by the above embodiments, and the working principle of each step in the embodiments of the present application is described in more detail with reference to the above embodiments, which will not be repeated herein.

[0060] The optional embodiments of the embodiments of the present application are described in detail above in combination with the drawings, but the embodiments of the present application are not limited to the specific details in the above embodiments, and various simple modifications can be made to the technical solutions of the embodiments of the present application within the technical concept of the embodiments of the present application, which all belong to the protection scope of the embodiments of the present application.

[0061] In addition, it should be noted that each specific technical feature described in the above specific embodiments can be combined in any appropriate manner without contradiction. In order to avoid unnecessary repetition, various possible combinations will not be described again in the embodiments of the present application.

[0062] Those skilled in the art can understand that all or part of the steps of the above-mentioned embodiment methods can be completed by programs instructing related hardware. The programs are stored in a storage medium, and include a plurality of instructions for making a single-chip microcomputer, a chip or a processor execute all or part of the steps of the methods described in various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0063] In addition, various different embodiments of the embodiments of the present application can also be combined in any appropriate manner, as long as they do not deviate from the technical concept of the embodiments of the present application, and they should be considered as disclosed by the embodiments of the present application.

Claims

1. A system for encryption protection of a ship software package, characterized in that The system comprises a key management system, a remote upgrade management platform, a trusted terminal and a ship terminal; the remote upgrade management platform is connected with the key management system in a network and connected with the ship terminal in an external network; the trusted terminal is connected with the key management system in an external network and connected with the ship terminal in a bus; wherein, The key management system is used for obtaining a ship unique identifier, ship state information and network state information; generating a first asymmetric private key and a corresponding first public key based on the ship unique identifier, the ship state information and the network state information; generating a first digital certificate based on the first public key, the first digital certificate embedding a position watermark formed by encrypting a ship real-time latitude and longitude; obtaining dynamic risk assessment information of a sailing sea condition, signing a software package to be transmitted based on the first asymmetric private key, encrypting the signed software package based on the first public key and the dynamic risk assessment information to generate an encrypted software package; transmitting the encrypted software package to the ship terminal through the remote upgrade management platform; and transmitting the first digital certificate to the ship terminal through the trusted terminal; The trusted terminal is used for transmitting a terminal unique identifier and a corresponding time stamp to the key management system, receiving a second digital certificate issued by the key management system, and verifying a valid time length of the second digital certificate based on ship position information; and verifying the position watermark and time effectiveness of the first digital certificate; The ship terminal is used for generating a ship terminal private key corresponding to the first asymmetric private key, obtaining a real-time ship attitude, a device power state and a system load rate, constructing a risk assessment model based on a real-time network transmission quality, the real-time ship attitude, the device power state and the system load rate, generating an encrypted snapshot file before software upgrade and storing the encrypted snapshot file in an independent secure partition, and executing a hierarchical response strategy based on a risk assessment result during the upgrade process.

2. A system for encryption protection of a software package of a ship according to claim 1, characterized in that, The ship state information comprises a ship real-time roll angle and a ship real-time pitch angle, and the first asymmetric private key and the corresponding first public key are generated based on the ship unique identifier, the ship state information and the network state information, which comprises: generating an initial private key based on the ship unique identifier, the ship state information and a ship sailing trajectory feature; generating an additional entropy source based on the ship real-time roll angle and the ship real-time pitch angle; generating an intermediate private key based on a derived private key of the initial private key, the ship state information, the additional entropy source and a pre-stored public key; generating the first asymmetric private key and the corresponding first public key based on the intermediate private key, the ship state information and the network state information.

3. A system for encryption protection of a software package of a ship according to claim 1, characterized in that, The encrypted software package is generated based on the first public key and the dynamic risk assessment information, which comprises: determining the dynamic risk assessment information based on a ship real-time attitude, the dynamic risk assessment information comprising an extreme sea condition, a complex sea condition and a calm sea condition; determining an encrypted fast size based on the real-time network transmission quality; and determining a corresponding encryption strategy based on the dynamic risk assessment information: if the current sea condition is the extreme sea condition, performing superposition encryption based on the first public key and a temporarily negotiated public key; if the current sea condition is the complex sea condition, performing encryption based on the first public key; if the current sea condition is the calm sea condition, determining a low-complexity encryption algorithm, and performing encryption based on the first public key and the low-complexity encryption algorithm; encrypting the signed software package according to the encryption strategy to generate an encrypted software package.

4. The system for encryption protection of a software package of a ship according to claim 1, characterized in that, The key management system is also used for: obtaining a terminal unique identifier of the trusted terminal and a corresponding timestamp; comparing and verifying the terminal unique identifier with a pre-stored whitelist; when the verification is passed, generating a second asymmetric private key and a corresponding second public key based on the terminal unique identifier and the timestamp; generating a second digital certificate based on the second public key; transmitting the second digital certificate to the trusted terminal.

5. A system for encryption protection of a software package of a ship according to claim 4, characterized in that, transmitting the first digital certificate to the ship end through the trusted terminal, including: signing the first digital certificate based on the first asymmetric private key; transmitting the signed first digital certificate to the trusted terminal; The trusted terminal is used for: obtaining the second public key from the second digital certificate; verifying the signed first digital certificate using the second public key; when the verification is passed, writing the first digital certificate to a secure storage area of the ship end through the bus.

6. A system for encryption protection of a software package of a ship according to claim 1, characterized in that, The ship end is used for: obtaining the first public key from the first digital certificate; decrypting the encrypted software package based on a ship end private key, the generation algorithm of the ship end private key being the same as that of the first asymmetric private key; verifying the decrypted software package based on the first public key; when the verification is passed, generating a system snapshot file for the ship end, and performing a software upgrade operation based on the decrypted software package; generating a current risk assessment value based on the risk assessment model; performing a security control operation for the software upgrade operation based on the risk assessment value.

7. A system for encryption protection of a software package of a ship according to claim 6, characterized in that, The ship end is also used for: after the upgrade is paused, in response to an exception recovery instruction, performing a system recovery operation on the ship end based on the system snapshot file, and restarting the software upgrade operation; determining whether the upgrade fails; if so, obtaining an upgrade completion degree, and performing a corresponding partial rollback or complete rollback based on the upgrade completion degree.

8. A method of encryption protection of a ship software package, characterized by including: obtaining a ship unique identifier, ship state information, and network state information through a key management system; generating a first asymmetric private key and a corresponding first public key based on the ship unique identifier, the ship state information, and the network state information; generating a first digital certificate based on the first public key, the first digital certificate embedding a location watermark formed by encrypting a ship real-time latitude and longitude, and transmitting the first digital certificate to the ship end through a trusted terminal; obtaining dynamic risk assessment information of a sailing sea condition, signing a to-be-transmitted software package based on the first asymmetric private key, encrypting the signed software package based on the first public key and the dynamic risk assessment information to generate an encrypted software package, and transmitting the encrypted software package to the ship end through a remote upgrade management platform; Transmitting a terminal unique identifier and a corresponding timestamp to the key management system by the trusted terminal; Receiving a second digital certificate issued by the key management system, verifying a valid time length of the second digital certificate based on ship location information, and verifying the location watermark and time effectiveness of the first digital certificate; Generating a ship terminal private key corresponding to the first asymmetric private key by the ship terminal; Obtaining real-time ship attitude, equipment power state and system load rate, constructing a risk assessment model based on real-time network transmission quality, the real-time ship attitude, the equipment power state and the system load rate, generating an encrypted snapshot file before software upgrading and storing the encrypted snapshot file in an independent secure partition, and executing a hierarchical response strategy based on the risk assessment result during the upgrading process.

9. A processor, comprising: A program for running, wherein the program is used to execute the method of claim 8 when the program is run.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The program is executed by a processor to implement the method of claim 8.

Images