Railway freight data security encryption method based on distributed storage

Abstract

The application discloses a railway freight data security encryption method based on distributed storage and relates to the technical field of railway information security. The method comprises the following steps: registering a distributed storage node, collecting railway freight tasks, tracks and node registration data, constructing a distributed storage network based on the node registration data and generating a node list, performing identity authentication and key initialization on the nodes in the node list, verifying the identity when the nodes are accessed, issuing a short-time access token after the verification, generating track interval keys according to the freight track data, using a threshold secret sharing method to fragment the track interval keys, distributing the fragmented track interval keys to multiple nodes and dynamically deriving keys, encrypting the data based on the derived keys by using an improved ECC parallel encryption method combined with Paillier dynamic encryption, and generating encrypted data packets. The application uses track data as a key driver, realizes dynamic hierarchical encryption and collaborative trusted decryption of railway freight task data in a distributed environment, and has the advantages of high security, high efficiency and high reliability.

Description

Technical Field

[0001] This invention relates to the field of railway information security technology, and in particular to a method for secure encryption of railway freight data based on distributed storage. Background Technology

[0002] With the continuous improvement of the digitalization and intelligence level of the railway transportation system, railway freight task management is gradually shifting from the traditional centralized scheduling model to a networked and distributed collaborative model based on information platforms. Existing railway information management systems mostly adopt centralized databases or cloud storage architectures to achieve functions such as task scheduling, transportation tracking, and status visualization. As the railway sector's demands for data security, privacy protection, and cross-node collaborative computing increase, some research has begun to introduce technologies such as distributed ledgers, trusted execution environments, and encrypted data storage to improve the reliability and tamper-proof capabilities of railway freight data under multi-node sharing conditions.

[0003] Existing railway freight data security management solutions still have room for improvement in addressing the dynamic correlation encryption of multi-source trajectory data and task data, as well as the security control of distributed storage. Current encryption storage mechanisms largely rely on static keys or centralized key management, making it difficult to dynamically adjust encryption strategies based on train trajectory changes. This leads to a high risk of key leakage and weak traceability in data access audits. Furthermore, in multi-node distributed architectures, although some systems have attempted to introduce trusted computing technologies such as TEE for decryption verification, collaborative decryption and hierarchical access control still primarily rely on central node scheduling, resulting in concentrated computational load, high access latency, and insufficient reliability of cross-node decryption. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a secure encryption method for railway freight data based on distributed storage, which solves the problems of dynamic encryption, trusted collaborative decryption, and end-to-end traceable storage management of railway freight data in a distributed environment.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] In a first aspect, the present invention provides a method for secure encryption of railway freight data based on distributed storage, comprising,

[0008] Register distributed storage nodes and collect railway freight tasks, trajectories and node registration data. Based on the node registration data, construct a distributed storage network and generate a node list. Authenticate the nodes in the node list and initialize their keys. Verify the identity when nodes access each other and issue a short-term access token after successful verification.

[0009] Based on freight trajectory data, a trajectory interval key is generated. The trajectory interval key is fragmented using a threshold secret sharing method, distributed to multiple nodes, and a key is dynamically derived. Based on the derived key, an improved ECC parallel encryption method combined with Paillier dynamic encryption is used to encrypt the data, generating an encrypted data packet. The encrypted data packet is fragmented and distributed for storage using a load balancing strategy, generating an index table.

[0010] When an access node requests access, the master node schedules TEE nodes to collaboratively decrypt the data according to the index table, generates a decryption result digest, generates a verification digest after successful verification, and returns trusted receipt data to the access node.

[0011] As a preferred embodiment of the railway freight data security encryption method based on distributed storage described in this invention, the step of collecting railway freight task, trajectory, and node registration data, constructing a distributed storage network based on the node registration data, and generating a node list includes the following steps:

[0012] The trajectory acquisition device, edge computing device, and cloud / central server are registered as distributed storage nodes. The collected freight task data includes task information and task sensitivity. The freight trajectory data includes the geographical location parameters and timestamps of the trajectory. The node registration data includes the node's unique identifier, IP address, node public key, node computing resources, node attributes, and node geographical location. The communication priority between nodes is calculated based on the node's geographical location and computing resources. The distributed node discovery protocol is used to complete the identification and handshake between nodes, determine the communication and cooperation relationship between nodes, and summarize all the identification and handshake results between nodes to obtain a node topology mapping table that includes the handshake status, communication delay, and communication priority between nodes.

[0013] Based on the node topology mapping table, data transmission channels are established according to the communication priority between nodes to obtain a distributed storage network. Node identifiers, IP addresses, node public keys, and node types are extracted from the distributed storage network to generate a list of distributed storage network nodes.

[0014] As a preferred embodiment of the railway freight data security encryption method based on distributed storage described in this invention, the step of authenticating and initializing the nodes in the node list includes the following steps:

[0015] The nodes in the distributed storage network node list are authenticated according to the pre-set root trust public key and certificate issuance rules. If the authentication is successful, the node identity is recorded as valid; otherwise, the node is isolated.

[0016] The master node is determined based on the identity identifier in the node attributes. Key management policy parameters are preset according to the network topology, security policy and encryption rules of the root of trust. The key management policy parameters are used to initialize the nodes with valid authentication identities. Adjacent nodes initiate an encrypted handshake based on the session key allocated in the initialization phase. After completing identity verification and key confirmation, an encrypted communication channel is established.

[0017] As a preferred embodiment of the railway freight data security encryption method based on distributed storage described in this invention, the following steps are included: verifying identity during inter-node access and issuing a short-term access token after successful verification:

[0018] When an access node issues a cross-node access request, it uses a zero-knowledge proof mechanism for secondary authentication and generates a commitment value based on the Schnorr protocol, which is based on the elliptic curve discrete logarithm problem.

[0019] After receiving the commitment value from the accessing node, the target node generates a challenge value;

[0020] The access node calculates the response value based on the challenge value generated by the target node;

[0021] The target node verifies the response value of the accessing node. If the verification is successful, the target node determines that the accessing node's identity is valid, the access is granted, and a short-term access token is generated.

[0022] As a preferred embodiment of the railway freight data security encryption method based on distributed storage described in this invention, the step of generating a trajectory interval key based on freight trajectory data, fragmenting the trajectory interval key using a threshold secret sharing method, distributing it to multiple nodes, and dynamically deriving keys includes the following steps:

[0023] The process of generating a trajectory interval key based on freight trajectory data, fragmenting the trajectory interval key using a threshold secret sharing method, distributing it to multiple nodes, and dynamically deriving keys includes the following steps:

[0024] Based on the collected trajectory information data, the complete trajectory is divided into continuous trajectory intervals, and a unique trajectory interval root key is generated for each trajectory interval.

[0025] Map the root key of the trajectory interval to a finite field element to obtain the mapping value of the root key. Assign a unique field element in the finite field to each node. Randomly generate polynomial coefficients and construct a secret sharing polynomial. Use the mapping value of the root key as the constant term of the polynomial. Substitute the field elements of each node into the secret sharing polynomial and calculate the sharding value of each node.

[0026] When a node storing a key shard receives a key recovery request, it verifies the requester using a zero-knowledge proof mechanism. If the verification is successful, it agrees to recover the root key. A recovery threshold is set based on the number of nodes storing the key shard. If the number of nodes agreeing to recover the root key is less than the recovery threshold, recovery is not performed. If the number of nodes agreeing to recover the root key is greater than or equal to the recovery threshold, the polynomial is reconstructed in the finite field using Lagrange interpolation to obtain the constant term.

[0027] The root key is recovered by inverse mapping of the obtained constant term. The dynamic identity digest of the node is obtained based on the short-term access token. The derived key is generated by using the dynamic identity digest of the requesting node and the root key.

[0028] The method of encrypting data using a derived key, an improved ECC parallel encryption method combined with Paillier dynamic encryption, to generate an encrypted data packet includes the following steps:

[0029] Based on the derived key, the symmetric key seed, ECC seed and Paillier seed of the freight task are derived respectively using the deterministic key derivation function;

[0030] The symmetric key for the freight task is obtained by using KDF based on the symmetric key seed. The symmetric key is then used to perform authentication symmetric encryption on the freight data to obtain the overall symmetric ciphertext of the freight task.

[0031] Based on the ECC seed, obtain the ECC private key and the corresponding ECC public key, divide the overall symmetric ciphertext into ciphertext blocks of fixed size, assign an independent and unique random factor to each ciphertext block, and use the ECC public key and the random factor to calculate the session key for each ciphertext block. For each ciphertext block, perform ECC encryption using the corresponding session key to obtain a set of ECC encrypted ciphertext blocks.

[0032] Based on the Paillier seed, obtain the Paillier private key and the corresponding Paillier public key. Use XOR to aggregate the random factors generated during the ECC encryption stage to construct dynamic encryption parameters. Based on the dynamic encryption parameters, use the Paillier dynamic encryption algorithm to encrypt the symmetric key of the freight task to obtain the ciphertext of the symmetric key.

[0033] A data integrity verification tag is constructed using the freight mission identifier, a set of ECC encrypted ciphertext blocks, and a symmetric key, and then encapsulated to obtain an encrypted data packet.

[0034] As a preferred embodiment of the railway freight data security encryption method based on distributed storage described in this invention, the step of fragmenting the encrypted data packets and distributing them in conjunction with a load balancing strategy to generate an index table includes the following steps:

[0035] The encrypted data packets are fragmented according to the preset fragmentation strategy to obtain the data fragments of the encrypted data packets. At the same time, the CPU utilization, storage utilization, bandwidth utilization and response latency information of the nodes are collected, and the comprehensive load coefficient of each node is calculated.

[0036] The nodes are sorted from low to high according to their overall load coefficient, and the data is sharded and distributed to the nodes at the top of the sort until the load of each node is balanced.

[0037] Before being written to a node, the assigned data shards undergo a hash calculation for integrity verification. If the verification passes, the data shards are written to the node and redundant copies of the data slices are generated; otherwise, they are not written.

[0038] Finally, a distributed storage index table is generated on the master node.

[0039] As a preferred embodiment of the railway freight data security encryption method based on distributed storage described in this invention, when the access node requests access, the master control node schedules TEE nodes to collaboratively decrypt according to the index table and generates a decryption result digest, including the following steps:

[0040] When an access node issues an access request, the master node verifies the access permission based on the short-term access token, locates the storage node position of all data fragments corresponding to the encrypted data packet based on the distributed storage index table, and recovers the encrypted data packet.

[0041] The master node initiates a range key recovery request to the node storing the key fragments, and collects the key fragments returned by the fragment nodes verified by zero-knowledge proof. When the number of collected key fragments reaches the recovery threshold, the master node recovers the root key of the trajectory range in a secure environment using Lagrange interpolation, and derives the derived key of the access node based on the dynamic identity digest of the requesting node. The derived key is then used to obtain the Paillier private key, ECC private key, and symmetric key.

[0042] The master node schedules multiple TEE nodes to form a collaborative decryption domain based on the number of ECC encrypted ciphertext blocks and the available resources of the TEE nodes, and allocates the corresponding ECC encrypted ciphertext blocks, Paillier private key, ECC private key and symmetric key ciphertext to each TEE node.

[0043] Each TEE node executes the following sequentially in the isolated execution environment: decrypting the ciphertext of the symmetric key using the Paillier private key to recover the symmetric key; decrypting the ECC-encrypted ciphertext block using the ECC private key to obtain the symmetric ciphertext corresponding to the ciphertext block; and decrypting the symmetric ciphertext using the recovered symmetric key to obtain the plaintext data corresponding to the ciphertext block.

[0044] The master node collects the plaintext data returned by all TEE nodes, and reassembles the plaintext data returned by each TEE node in sequence according to the sequence number of the ECC ciphertext block to generate the completed freight task plaintext data, and generates the decryption result digest of the collaborative decryption domain.

[0045] As a preferred embodiment of the railway freight data security encryption method based on distributed storage described in this invention, the step of generating a verification digest and returning trusted receipt data to the access node after successful verification includes the following steps:

[0046] The master node verifies the integrity of the decryption result digest based on the data integrity verification tag generated when the encrypted data packet is encapsulated. It also calls the short-term access token to match and verify the access session identifier and access permission information. After the verification is successful, the master node generates trusted decryption receipt data and verification digest in the trusted execution environment. The data includes the access node identifier, the request encrypted data packet identifier, the decryption result digest data, and the timestamp. The plaintext data of the freight task is sent to the access node as trusted decryption receipt data. At the same time, the verification digest is written into the track encryption time chain.

[0047] In a second aspect, the present invention provides a computer device including a memory and a processor, wherein the memory stores a computer program, wherein when the computer program is executed by the processor, it implements any step of the railway freight data security encryption method based on distributed storage as described in the first aspect of the present invention.

[0048] Thirdly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the railway freight data security encryption method based on distributed storage as described in the first aspect of the present invention.

[0049] The beneficial effects of this invention are as follows: By generating trajectory interval keys based on trajectory information and implementing hierarchical encryption on railway freight task data, a dynamic correlation between data encryption strength and freight trajectory status is achieved, improving the security and anti-tampering capability of data during transmission and storage; by constructing a multi-node collaborative decryption domain through a trusted execution environment scheduled by the master control node, trusted collaborative decryption and result digest verification of data in a distributed environment are realized, ensuring the verifiability of the decryption process and the traceability of access behavior, achieving high-security storage and trusted access management of railway freight data throughout its entire lifecycle, and improving the security and trustworthiness level and operational efficiency of the railway information system. Attached Figure Description

[0050] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0051] Figure 1 This is a flowchart of a method for secure encryption of railway freight data based on distributed storage.

[0052] Figure 2 The flowchart for building a distributed storage network and initializing it is as follows.

[0053] Figure 3 This is a flowchart of the data access and decryption process. Detailed Implementation

[0054] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0055] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0056] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0057] Reference Figures 1-3 This is one embodiment of the present invention, which provides a method for secure encryption of railway freight data based on distributed storage, comprising the following steps:

[0058] Register distributed storage nodes and collect railway freight task, trajectory and node registration data. Based on the node registration data, construct a distributed storage network and generate a node list. Authenticate the nodes in the node list and initialize keys. Verify identity when nodes access each other and issue short-term access tokens after successful verification.

[0059] Specifically, trajectory acquisition devices, edge computing devices, and cloud / central servers are registered as distributed storage nodes. The collected freight task data includes task information and task sensitivity, and the freight trajectory data includes the geographical location parameters and timestamps of the trajectory. The node registration data includes the node's unique identifier, IP address, node public key, node computing resources, node attributes, and node geographical location. The communication priority between nodes is calculated based on the node's geographical location and computing resources. A distributed node discovery protocol is used to complete the identification and handshake between nodes, determine the communication and cooperation relationship between nodes, and summarize all the identification and handshake results between nodes to obtain a node topology mapping table that includes the handshake status, communication delay, and communication priority between nodes.

[0060] Based on the node topology mapping table, data transmission channels are established according to the communication priority between nodes to obtain a distributed storage network. Node identifiers, IP addresses, node public keys, and node types are extracted from the distributed storage network to generate a list of distributed storage network nodes.

[0061] By collecting railway freight task data, trajectory information data, and node registration data, and combining node geographical location and computing resources to calculate communication priorities, efficient and reliable connection relationships between nodes were established. A distributed node discovery protocol was used to complete node identification and handshake, generating a node topology mapping table, enabling self-organization and dynamic perception of network nodes. Finally, based on the topology and communication priorities, data transmission channels were established and a distributed storage network node list was generated, achieving efficient transmission and optimized resource allocation of railway freight data in a multi-node environment, and improving the scalability and communication reliability of the distributed storage system.

[0062] Furthermore, the nodes in the distributed storage network node list are authenticated according to the pre-set root trust public key and certificate issuance rules. If the authentication is successful, the node's identity is recorded as valid; otherwise, the node is isolated.

[0063] The master node is determined based on the identity identifier in the node attributes. Key management policy parameters are preset according to the network topology, security policy and encryption rules of the root of trust. The key management policy parameters are used to initialize the nodes with valid authentication identities. Adjacent nodes initiate an encrypted handshake based on the session key allocated in the initialization phase. After completing identity verification and key confirmation, an encrypted communication channel is established.

[0064] By authenticating the nodes of the distributed storage network using a pre-set root trusted public key and certificate issuance rules, the legitimacy of node identities is reliably verified, ensuring the reliability of the network access node sources. Then, by selecting a master node and pre-setting key management policy parameters based on the network topology and security policy, initialization and session key generation are performed on each node, enabling adjacent nodes to complete encrypted handshakes and establish secure communication channels. This achieves dual security protection for node identities and communication links in the distributed network, ultimately improving the confidentiality and anti-counterfeiting properties of railway freight data during transmission and interaction.

[0065] Furthermore, when an accessing node issues a cross-node access request, it uses a zero-knowledge proof mechanism for secondary authentication and generates a commitment value based on the Schnorr protocol, which addresses the elliptic curve discrete logarithm problem. The formula is as follows:

[0066] ;

[0067] in, The commitment value generated for the access node, The temporary random number selected for the access node. It is the base point of the elliptic curve.

[0068] After receiving the commitment value from the accessing node, the target node generates a challenge value using the following formula:

[0069] ;

[0070] in, The challenge value generated for the target node. For hash functions, The public key of the sending node, This is the access timestamp.

[0071] The access node calculates the response value based on the challenge value generated by the target node, using the following formula:

[0072] ;

[0073] in, The response value calculated for the access node. This is the private key of the sending node.

[0074] The target node verifies the response value from the accessing node using the following formula:

[0075] ;

[0076] If the equation holds true, the target node determines that the accessing node's identity is valid, access is granted, and a short-term access token is generated. The formula is:

[0077] ;

[0078] in, For the generated short-term access token, This serves as the identifier for the accessed node. This serves as the identifier for the target node. The validity period of the short-term access token.

[0079] By employing the interactive steps of the access node generating a commitment value based on the Schnorr protocol of the elliptic curve discrete logarithm problem, the target node generating a challenge value, and the access node calculating a response value, zero-knowledge verification of the access node's identity is achieved without exposing the private key, ensuring the security and unforgeability of the identity authentication process. When the target node verifies the response value, it generates a short-term access token, realizing dynamic authorization and time-limited control of access permissions, thereby improving the security and trustworthiness of node access in the distributed network and the ability to prevent replay attacks.

[0080] Based on freight trajectory data, a trajectory interval key is generated. The trajectory interval key is fragmented using a threshold secret sharing method, distributed to multiple nodes, and a key is dynamically derived. Based on the derived key, an improved ECC parallel encryption method combined with Paillier dynamic encryption is used to encrypt the data, generating an encrypted data packet. The encrypted data packet is fragmented and distributed for storage using a load balancing strategy, and an index table is generated.

[0081] Specifically, based on the collected trajectory information data, the complete trajectory is divided into continuous trajectory intervals, and a unique trajectory interval root key is generated for each trajectory interval, using the following formula:

[0082] ;

[0083] in, For range index, For the first The root key for each trajectory interval For node indexing, The identifier of the node responsible for encryption. For the first Geographical location feature parameters of each trajectory interval.

[0084] Mapping the root key of the trajectory interval to elements of a finite field yields the mapped value of the root key, as shown in the formula:

[0085] ;

[0086] in, For the root key mapping value mapped to a finite field, This is a mapping function used to convert the binary representation of the root key of the trajectory interval into a big-endian integer representation. For modulo operator, The modulus to be set.

[0087] Assign a unique field element from a finite field to each node, randomly generate polynomial coefficients, and construct a secret-sharing polynomial, as follows:

[0088] ;

[0089] in, For the polynomial used in piecewise operations, The coefficients of the polynomial, Each independent variable corresponds to a node. For coefficient index, For all operations to be performed modulo It is carried out in a finite field.

[0090] Using the mapping value of the root key as the constant term of the polynomial, and substituting the domain elements of each node into the secret sharing polynomial, the sharding value of each node is calculated using the following formula:

[0091] ;

[0092] in, To be assigned to the The sharding value of each node. In order to be with the first The independent variables corresponding to each node.

[0093] When a node storing a key shard receives a key recovery request, it verifies the requester using a zero-knowledge proof mechanism. If the verification is successful, it agrees to recover the root key. A recovery threshold is set based on the number of nodes storing the key shard. If the number of nodes agreeing to recover the root key is less than the recovery threshold, recovery is not performed. If the number of nodes agreeing to recover the root key is greater than or equal to the recovery threshold, the polynomial is reconstructed in the finite field using Lagrange interpolation to obtain the constant term.

[0094] The root key is recovered by inverse mapping of the obtained constant term, and the dynamic identity digest of the node is obtained based on the short-term access token, as shown in the formula:

[0095] ;

[0096] in, For the first Dynamic identity digest of each node, For the first The set of attributes of a node.

[0097] Based on the dynamic identity digest of the requesting node and the root key, a derived key is generated using the following formula:

[0098] ;

[0099] in, For the first Derived keys for each trajectory interval For derived key functions, This serves as a sensitivity indicator for railway freight data.

[0100] By dividing the complete trajectory into continuous trajectory intervals based on trajectory information data and generating a unique trajectory interval key for each interval, dynamic binding between the key and the transportation trajectory is achieved, enabling data encryption to have spatial and temporal correlation. Key sharding is constructed using the principle of polynomial interpolation, ensuring high key security and reliable distributed storage. During key reconstruction, a reconstruction threshold is set and node verification is performed, ensuring that key reconstruction is only triggered when a sufficient number of verification nodes participate, effectively preventing interference from malicious or illegitimate nodes. Derived keys are generated using the reconstructed root key and the dynamic identity digest of the nodes, dynamically allocating time-sensitive keys to each node while ensuring the security of the root key.

[0101] Furthermore, based on the derived key, deterministic key derivation functions are used to derive the symmetric key seed, ECC seed, and Paillier seed for the freight task, respectively.

[0102] The symmetric key for the freight task is obtained by using KDF based on the symmetric key seed. The symmetric key is then used to perform authentication symmetric encryption on the freight data to obtain the overall symmetric ciphertext of the freight task.

[0103] Based on the ECC seed, obtain the ECC private key and the corresponding ECC public key, divide the overall symmetric ciphertext into ciphertext blocks of fixed size, assign an independent and unique random factor to each ciphertext block, and use the ECC public key and the random factor to calculate the session key for each ciphertext block. For each ciphertext block, perform ECC encryption using the corresponding session key to obtain a set of ECC encrypted ciphertext blocks.

[0104] Based on the Paillier seed, obtain the Paillier private key and the corresponding Paillier public key. Use XOR to aggregate the random factors generated during the ECC encryption stage to construct dynamic encryption parameters. Based on the dynamic encryption parameters, use the Paillier dynamic encryption algorithm to encrypt the symmetric key of the freight task to obtain the ciphertext of the symmetric key.

[0105] A data integrity verification tag is constructed using the freight mission identifier, a set of ECC encrypted ciphertext blocks, and a symmetric key, and then encapsulated to obtain an encrypted data packet.

[0106] By using deterministic key derivation functions based on derived keys, symmetric key seeds, ECC seeds, and Paillier seeds for freight tasks are derived respectively, achieving efficient generation and distribution of various keys and ensuring the independence and security of keys. The symmetric key for the freight task is obtained based on the symmetric key seed using KDF, and this symmetric key is used to perform symmetric encryption authentication on freight data, ensuring data confidentiality and integrity and effectively preventing data leakage and tampering. ECC private and public keys are generated based on the ECC seed, and the session key is calculated by assigning independent random factors to each ciphertext block, achieving distributed encryption of ciphertext blocks, enhancing parallel computing efficiency, and improving data resistance to attacks. Paillier private and public keys are generated using the Paillier seed, and dynamic encryption parameters are constructed using aggregated ECC random factors, further strengthening the protection of symmetric keys and improving the flexibility and complexity of encryption.

[0107] Furthermore, encrypted data packets are fragmented based on a fixed byte length to obtain data fragments of the encrypted data packets. Simultaneously, information on node CPU utilization, storage utilization, bandwidth utilization, and response latency is collected, and the overall load factor for each node is calculated using the following formula:

[0108] ;

[0109] in, For the first The load weight of each node. For the first CPU utilization of each node For the first Storage utilization of each node For the first Bandwidth utilization of each node For the first The response latency of each node, , , , These are the weights set for CPU utilization, storage utilization, bandwidth utilization, and response latency, respectively.

[0110] The nodes are sorted from low to high according to their overall load coefficient, and the data is sharded and distributed to the nodes at the top of the sort until the load of each node is balanced.

[0111] Before being written to a node, the assigned data shards undergo a hash calculation for integrity verification. If the verification passes, the data shards are written to the node and redundant copies of the data slices are generated; otherwise, they are not written.

[0112] Finally, a distributed storage index table is generated on the master node, using the following formula:

[0113] ;

[0114] in, It is a distributed storage index table. For encrypted data packet indexing, For data sharding index, For the first The first encrypted data packet Data shards, Data sharding The logo, The check value calculated by hash. Data sharding Redundant copies.

[0115] By fragmenting encrypted data packets based on encryption level and fixed byte length, fine-grained data splitting and structured processing of encrypted content are achieved. Furthermore, by collecting CPU utilization, storage utilization, bandwidth utilization, and response latency information of each node and calculating a comprehensive load coefficient, dynamic evaluation of node operating status is realized, providing a quantitative basis for data allocation. Subsequently, fragments are allocated according to node load coefficients from low to high, and hash integrity checks are performed, achieving balanced data distribution and secure writing across multiple nodes, avoiding node overload and data loss risks. Finally, a distributed storage index table is generated on the master node, enabling unified identification and rapid location of data fragments, improving the security and reliability of distributed storage for railway freight data.

[0116] When an access node requests access, the master node schedules TEE nodes to collaboratively decrypt the data according to the index table, generates a decryption result digest, generates a verification digest after successful verification, and returns trusted receipt data to the access node.

[0117] Specifically, when an access node issues an access request, the master node verifies the access permission based on the short-term access token, locates the storage node position of all data fragments corresponding to the encrypted data packet according to the distributed storage index table, and recovers the encrypted data packet.

[0118] The master node initiates a range key recovery request to the node storing the key fragments, and collects the key fragments returned by the fragment nodes verified by zero-knowledge proof. When the number of collected key fragments reaches the recovery threshold, the master node recovers the root key of the trajectory range in a secure environment using Lagrange interpolation, and derives the derived key of the access node based on the dynamic identity digest of the requesting node. The derived key is then used to obtain the Paillier private key, ECC private key, and symmetric key.

[0119] The master node schedules multiple TEE nodes to form a collaborative decryption domain based on the number of ECC encrypted ciphertext blocks and the available resources of the TEE nodes, and allocates the corresponding ECC encrypted ciphertext blocks, Paillier private key, ECC private key and symmetric key ciphertext to each TEE node.

[0120] Each TEE node executes the following sequentially in the isolated execution environment: decrypting the ciphertext of the symmetric key using the Paillier private key to recover the symmetric key; decrypting the ECC-encrypted ciphertext block using the ECC private key to obtain the symmetric ciphertext corresponding to the ciphertext block; and decrypting the symmetric ciphertext using the recovered symmetric key to obtain the plaintext data corresponding to the ciphertext block.

[0121] The master node collects the plaintext data returned by all TEE nodes, and reassembles the plaintext data returned by each TEE node in sequence according to the sequence number of the ECC ciphertext block to generate the completed freight task plaintext data, and generates the decryption result digest of the collaborative decryption domain.

[0122] By using short-term access tokens to verify access permissions and locating the encrypted data packet position based on a distributed storage index table, accurate recovery of encrypted data packets is achieved, and secure key management is ensured through a range-key recovery mechanism. After collecting sufficient key fragments, the master node recovers the range root key using Lagrange interpolation and derives the derived key for the access node based on the dynamic identity digest, further ensuring the security and controllability of key management. By scheduling multiple TEE nodes to form a collaborative decryption domain, the master node achieves parallel decryption, which not only improves decryption efficiency but also enhances the system's resistance to attacks. Each TEE node performs block decryption based on the ciphertext of the distributed Paillier private key, ECC private key, and symmetric key, ensuring data security in an isolated execution environment. Finally, by reconstructing the plaintext data and generating a decryption result digest, the integrity and correctness of the decryption result are ensured.

[0123] Furthermore, the master node performs integrity verification on the decryption result digest based on the data integrity verification tag generated when the encrypted data packet is encapsulated, and calls the short-term access token to match and verify the access session identifier and access permission information. After the verification is successful, the master node generates trusted decryption receipt data and verification digest in the trusted execution environment, which includes the access node identifier, the request encrypted data packet identifier, the decryption result digest data, and the timestamp. The plaintext data of the freight task is sent to the access node as trusted decryption receipt data, and the verification digest is written into the trajectory encryption time chain.

[0124] By matching and verifying the decryption result digest data using an integrity verification tag and a short-term access token, a trusted association verification between the decryption result and the access request is achieved, ensuring the authenticity of the decryption data source and the legitimacy of the access behavior. After successful verification, the master node generates a trusted decryption receipt containing the access node identifier, data packet identifier, digest data, and timestamp in the trusted execution environment, realizing trusted confirmation of the decryption result and generation of access credentials. At the same time, the verification digest is written into the trajectory encryption time chain, realizing traceable recording and tamper-proof evidence storage of the decryption behavior, ensuring access security and enhancing the credibility of the decryption result.

[0125] This embodiment also provides a computer device applicable to the railway freight data security encryption method based on distributed storage, comprising: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the railway freight data security encryption method based on distributed storage as proposed in the above embodiment.

[0126] The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0127] This embodiment also provides a storage medium storing a computer program, which, when executed by a processor, implements the railway freight data security encryption method based on distributed storage as proposed in the above embodiments. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0128] In summary, this invention achieves a dynamic correlation between data encryption strength and freight trajectory status by generating trajectory interval keys based on trajectory information and implementing hierarchical encryption of railway freight task data, thereby improving data security and tamper resistance during transmission and storage. Furthermore, by constructing a multi-node collaborative decryption domain through a trusted execution environment scheduled by the master control node, it realizes trusted collaborative decryption and result digest verification in a distributed environment, ensuring the verifiability of the decryption process and the traceability of access behavior. This achieves high-security storage and trusted access management of railway freight data throughout its entire lifecycle, enhancing the security and reliability level and operational efficiency of the railway information system.

[0129] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for secure encryption of railway freight data based on distributed storage, characterized in that: include, Register distributed storage nodes and collect railway freight tasks, trajectories and node registration data. Based on the node registration data, construct a distributed storage network and generate a node list. Authenticate the nodes in the node list and initialize their keys. Verify the identity when nodes access each other and issue a short-term access token after successful verification. Based on freight trajectory data, a trajectory interval key is generated. The trajectory interval key is fragmented using a threshold secret sharing method, distributed to multiple nodes, and a key is dynamically derived. Based on the derived key, an improved ECC parallel encryption method combined with Paillier dynamic encryption is used to encrypt the data and generate an encrypted data packet. Based on the collected trajectory information data, the complete trajectory is divided into continuous trajectory intervals, and a unique trajectory interval root key is generated for each trajectory interval. Map the root key of the trajectory interval to a finite field element to obtain the mapping value of the root key. Assign a unique field element in the finite field to each node. Randomly generate polynomial coefficients and construct a secret sharing polynomial. Use the mapping value of the root key as the constant term of the polynomial. Substitute the field elements of each node into the secret sharing polynomial and calculate the sharding value of each node. When a node storing a key shard receives a key recovery request, it verifies the requester using a zero-knowledge proof mechanism. If the verification is successful, it agrees to recover the root key. A recovery threshold is set based on the number of nodes storing the key shard. If the number of nodes agreeing to recover the root key is less than the recovery threshold, recovery is not performed. If the number of nodes agreeing to recover the root key is greater than or equal to the recovery threshold, the polynomial is reconstructed in the finite field using Lagrange interpolation to obtain the constant term. The root key is recovered by inverse mapping of the obtained constant term. The dynamic identity digest of the node is obtained based on the short-term access token. The derived key is generated by using the dynamic identity digest of the requesting node and the root key. Based on the derived key, the symmetric key seed, ECC seed and Paillier seed of the freight task are derived respectively using the deterministic key derivation function; The symmetric key for the freight task is obtained by using KDF based on the symmetric key seed. The symmetric key is then used to perform authentication symmetric encryption on the freight data to obtain the overall symmetric ciphertext of the freight task. Based on the ECC seed, obtain the ECC private key and the corresponding ECC public key, divide the overall symmetric ciphertext into ciphertext blocks of fixed size, assign an independent and unique random factor to each ciphertext block, and use the ECC public key and the random factor to calculate the session key for each ciphertext block. For each ciphertext block, perform ECC encryption using the corresponding session key to obtain a set of ECC encrypted ciphertext blocks. Based on the Paillier seed, obtain the Paillier private key and the corresponding Paillier public key. Use XOR to aggregate the random factors generated during the ECC encryption stage to construct dynamic encryption parameters. Based on the dynamic encryption parameters, use the Paillier dynamic encryption algorithm to encrypt the symmetric key of the freight task to obtain the ciphertext of the symmetric key. A data integrity verification tag is constructed using the freight mission identifier, a set of ECC encrypted ciphertext blocks, and a symmetric key, and then encapsulated to obtain an encrypted data packet. Encrypted data packets are fragmented and distributed using a load balancing strategy to generate an index table; When an access node requests access, the master node schedules TEE nodes to work together to decrypt the data according to the index table and generate a decryption result digest. When an access node issues an access request, the master node verifies access permissions based on a short-term access token, locates the storage node positions of all data fragments corresponding to the encrypted data packet according to the distributed storage index table, and recovers the encrypted data packet. The master node initiates a range key recovery request to the node storing the key fragments, and collects the key fragments returned by the fragment nodes verified by zero-knowledge proof. When the number of collected key fragments reaches the recovery threshold, the master node recovers the root key of the trajectory range in a secure environment using Lagrange interpolation, and derives the derived key of the access node based on the dynamic identity digest of the requesting node. The derived key is then used to obtain the Paillier private key, ECC private key, and symmetric key. The master node schedules multiple TEE nodes to form a collaborative decryption domain based on the number of ECC encrypted ciphertext blocks and the available resources of the TEE nodes, and allocates the corresponding ECC encrypted ciphertext blocks, Paillier private key, ECC private key and symmetric key ciphertext to each TEE node. Each TEE node executes the following sequentially in the isolated execution environment: decrypting the ciphertext of the symmetric key using the Paillier private key to recover the symmetric key; decrypting the ECC-encrypted ciphertext block using the ECC private key to obtain the symmetric ciphertext corresponding to the ciphertext block; and decrypting the symmetric ciphertext using the recovered symmetric key to obtain the plaintext data corresponding to the ciphertext block. The master node collects the plaintext data returned by all TEE nodes, and reassembles the plaintext data returned by each TEE node in order according to the sequence number of the ECC ciphertext block to generate the completed freight task plaintext data, and generates the decryption result digest of the collaborative decryption domain. Once the verification is successful, a verification summary is generated, and trusted receipt data is returned to the access node.

2. The railway freight data security encryption method based on distributed storage as described in claim 1, characterized in that: The process of collecting railway freight task, trajectory, and node registration data, constructing a distributed storage network based on the node registration data, and generating a node list includes the following steps: The trajectory acquisition device, edge computing device, and cloud / central server are registered as distributed storage nodes. The collected freight task data includes task information and task sensitivity. The freight trajectory data includes the geographical location parameters and timestamps of the trajectory. The node registration data includes the node's unique identifier, IP address, node public key, node computing resources, node attributes, and node geographical location. The communication priority between nodes is calculated based on the node's geographical location and computing resources. The distributed node discovery protocol is used to complete the identification and handshake between nodes, determine the communication and cooperation relationship between nodes, and summarize all the identification and handshake results between nodes to obtain a node topology mapping table that includes the handshake status, communication delay, and communication priority between nodes. Based on the node topology mapping table, data transmission channels are established according to the communication priority between nodes to obtain a distributed storage network. Node identifiers, IP addresses, node public keys, and node types are extracted from the distributed storage network to generate a list of distributed storage network nodes.

3. The railway freight data security encryption method based on distributed storage as described in claim 2, characterized in that: The process of authenticating and initializing the keys of nodes in the node list includes the following steps: The nodes in the distributed storage network node list are authenticated according to the pre-set root trust public key and certificate issuance rules. If the authentication is successful, the node identity is recorded as valid; otherwise, the node is isolated. The master node is determined based on the identity identifier in the node attributes. Key management policy parameters are preset according to the network topology, security policy and encryption rules of the root of trust. The key management policy parameters are used to initialize the nodes with valid authentication identities. Adjacent nodes initiate an encrypted handshake based on the session key allocated in the initialization phase. After completing identity verification and key confirmation, an encrypted communication channel is established.

4. The railway freight data security encryption method based on distributed storage as described in claim 3, characterized in that: The process of verifying identity during inter-node access and issuing a short-term access token upon successful verification includes the following steps: When an access node issues a cross-node access request, it uses a zero-knowledge proof mechanism for secondary authentication and generates a commitment value based on the Schnorr protocol, which is based on the elliptic curve discrete logarithm problem. After receiving the commitment value from the accessing node, the target node generates a challenge value; The access node calculates the response value based on the challenge value generated by the target node; The target node verifies the response value of the accessing node. If the verification is successful, the target node determines that the accessing node's identity is valid, the access is granted, and a short-term access token is generated.

5. The railway freight data security encryption method based on distributed storage as described in claim 1, characterized in that: The process of fragmenting encrypted data packets and distributing them using a load balancing strategy to generate an index table includes the following steps: The encrypted data packets are fragmented according to the preset fragmentation strategy to obtain the data fragments of the encrypted data packets. At the same time, the CPU utilization, storage utilization, bandwidth utilization and response latency information of the nodes are collected, and the comprehensive load coefficient of each node is calculated. The nodes are sorted from low to high according to their overall load coefficient, and the data is sharded and distributed to the nodes at the top of the sort until the load of each node is balanced. Before being written to a node, the assigned data shards undergo a hash calculation for integrity verification. If the verification passes, the data shards are written to the node and redundant copies of the data slices are generated; otherwise, they are not written. Finally, a distributed storage index table is generated on the master node.

6. The railway freight data security encryption method based on distributed storage as described in claim 1, characterized in that: After successful verification, a verification summary is generated and trusted receipt data is returned to the access node, including the following steps: The master node verifies the integrity of the decryption result digest based on the data integrity verification tag generated when the encrypted data packet is encapsulated. It also calls the short-term access token to match and verify the access session identifier and access permission information. After the verification is successful, the master node generates trusted decryption receipt data and verification digest in the trusted execution environment. The data includes the access node identifier, the request encrypted data packet identifier, the decryption result digest data, and the timestamp. The plaintext data of the freight task is sent to the access node as trusted decryption receipt data. At the same time, the verification digest is written into the track encryption time chain.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the railway freight data security encryption method based on distributed storage as described in any one of claims 1 to 6.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the railway freight data security encryption method based on distributed storage as described in any one of claims 1 to 6.

Images