Production data storage and backup method and system for precision hardware quality tracing

Abstract

The invention relates to the technical field of computers, discloses a production data storage and backup method and system for precision hardware quality tracing, and aims to solve the problem of process parameter leakage caused by the fact that a static encryption key is easily attacked by a side channel in the prior art. According to the method, a hardware security module is integrated in production line network switching equipment, a physical unclonable function circuit is utilized, a real-time production count value triggering mechanism is combined, and a one-time session key is dynamically generated; and encrypting production data by using a symmetric encryption algorithm, encrypting a session key by using an asymmetric public key, and transmitting the session key and the production data to a remote server. The system comprises a production takt time monitoring module, a dynamic key generation module, a data batch encryption module, a key packaging transmission module and a data receiving decryption module. According to the invention, physical binding, event-driven rotation and end-to-end secure transmission of the key are realized, and the security and anti-attack capability of data backup are remarkably improved.

Description

Technical Field

[0001] This invention belongs to the field of computer technology, specifically relating to a production data storage and backup method and system for quality traceability of precision hardware parts. Background Technology

[0002] With the intelligent development of the precision hardware manufacturing industry, high-value process data in the production process has become a core asset for enterprises. Currently, encryption backup mechanisms based on the AES-256 algorithm are commonly used, but their keys are usually statically stored in software or general-purpose chips, making them vulnerable to side-channel attacks in complex industrial environments. The measured success rate of such attacks is as high as 15%, leading to the leakage of process parameters.

[0003] Among them, the precision hardware parts quality traceability system requires data to have unique identifiers that are tamper-proof and non-replayable, and must be encrypted and archived in milliseconds. Traditional encryption schemes rely on manual or fixed-cycle key updates, which cannot be dynamically coupled with the actual production cycle. This poses both the risk of long-term key exposure and the potential for increased system overhead due to invalid key updates, making it difficult to meet the real-time security requirements of high-cycle production lines.

[0004] In existing technologies, although some solutions have attempted to introduce Hardware Security Modules (HSMs) to enhance key protection, their deployment is mostly as external devices independent of network switching nodes. This forces data to leave the production line network before entering the HSM for processing, introducing additional latency and compromising the atomicity of the data stream. Furthermore, key generation still relies on pseudo-random number generators, lacking physical anti-cloning properties and failing to fundamentally prevent key replay or cloning attacks. Especially in mass production scenarios for hardware parts, if an attacker intercepts the ciphertext and key for a particular period, they can use replay techniques to forge historical batch data, undermining the authenticity of the entire quality traceability chain.

[0005] Therefore, there is an urgent need for a dynamic encryption backup method that deeply integrates with the physical cycle time of the production line, relies on a hardware-level non-cloning mechanism, and achieves zero-latency key switching, in order to solve the risk of leakage and replay of static keys in the industrial data link. Summary of the Invention

[0006] The technical problem to be solved by this invention is that existing precision hardware production data is encrypted using a static key based on an advanced encryption standard algorithm during storage and backup. This static key remains unchanged in the transmission link for a long time, making it susceptible to side-channel attacks, which leads to the risk of leakage of key process parameters and the inability to fundamentally guarantee data security.

[0007] To address the aforementioned technical problems, this invention provides a production data storage and backup method and system for quality traceability of precision hardware parts. The core technical solution lies in constructing a dynamic key generation and distribution mechanism that is deeply coupled with the physical cycle of production.

[0008] This mechanism is integrated into the hardware security module inside the production line network switching equipment. The hardware security module has a built-in physically unclonable function circuit. By monitoring the production count value of precision hardware parts on the production line in real time, when the count value reaches a preset threshold, the physically unclonable function circuit is automatically triggered to generate a one-time session encryption key that is bound to the hardware microstructure.

[0009] Subsequently, the session key is used to symmetrically encrypt the data of the current production batch, and the session key itself is encrypted and encapsulated using the asymmetric encryption public key pre-installed in the hardware security module.

[0010] Finally, the encrypted data packet is combined with the encrypted session key to form a secure data payload, which is then transmitted to the remote backup server. The remote backup server uses its asymmetric encryption private key to decrypt the session key and then decrypt the production data, thereby realizing dynamic key rotation during the data backup process and eliminating the security risks caused by static key storage and transmission.

[0011] On the one hand, the present invention provides a production data storage and backup method for quality traceability of precision hardware parts, specifically including the following steps: A production cycle monitoring logic is set up in the production line network switching equipment and connected to the production line programmable logic controller or production counting sensor; the production cycle monitoring logic acquires the pulse signal that represents the completion of the production of precision hardware parts in real time, and accumulates and counts the pulse signal to obtain the real-time production count value; Determine whether the real-time production count value has reached a preset production batch count value threshold; when the threshold is reached, the production cycle monitoring logic generates a key update trigger instruction and sends it to the hardware security module built into the network switching device; After receiving the key update trigger command, the hardware security module activates its internal physical non-cloning function circuit; a deterministic stimulus challenge sequence is applied to the physical non-cloning function circuit, and the circuit generates a unique and unpredictable physical response bit stream to the stimulus challenge sequence based on its inherent and random physical microstructure differences. The key derivation unit within the hardware security module performs error correction coding on the physical response bitstream to eliminate bit flipping caused by environmental noise, and then performs an entropy extraction algorithm to convert the processed high-entropy bitstream into a session encryption key with a predetermined length, such as 256 bits. The hardware security module obtains all quality traceability production data corresponding to the current production batch from the production data acquisition terminal. The production data constitutes a data batch to be encrypted. The symmetric encryption engine within the hardware security module employs an Advanced Encryption Standard (AES) algorithm and uses the generated session encryption key to perform encryption operations on batches of data to be encrypted, generating encrypted data blocks and an authentication tag for data integrity verification. The asymmetric encryption engine within the hardware security module reads the pre-configured asymmetric encryption public key from the remote backup server in its internal secure storage area, and uses the public key to encrypt the aforementioned session encryption key, generating an encryption key package. The encrypted data block, authentication tag, and encryption key encapsulation are combined into a composite data packet, and the composite data packet is sent to the remote backup server through the network switching device. After receiving the composite data packet, the remote backup server first uses its locally stored secure asymmetric encryption private key, paired with the asymmetric encryption public key, to decrypt the encryption key package in order to recover the session encryption key. Subsequently, the remote backup server uses the recovered session encryption key and authentication tag to decrypt and verify the integrity of the encrypted data blocks, thereby obtaining the original quality traceability production data and storing it in the backup database.

[0012] Preferably, the physically non-cloning function circuit is a physically non-cloning function circuit based on static random access memory. The application of a deterministic stimulus challenge sequence specifically involves: performing a full-domain power-on operation on the memory cell array of the static random access memory, reading the stable logic state value of each memory cell after power-on, which is not initialized, thereby forming a physical response bit stream.

[0013] Preferably, the error correction coding operation uses the Bose-Hokvan-Hokkun root code algorithm, and the entropy extraction algorithm uses the hash message authentication code key derivation function based on the secure hash algorithm 256.

[0014] Preferably, the symmetric encryption engine uses the Galois counter mode of the Advanced Encryption Standard (AES) algorithm, which generates an authentication tag simultaneously with the encrypted data block. The asymmetric encryption engine uses elliptic curve cryptography.

[0015] Preferably, obtaining all quality traceability production data corresponding to the current production batch specifically includes: the hardware security module requesting all collected and cached production data from the last key update trigger time to the current trigger time from the open platform communication unified architecture protocol to the production line manufacturing execution system.

[0016] Production data includes, but is not limited to: the unique identification code of each hardware component, the temperature curve data of the heat treatment furnace, the machining program code and actual tool path coordinates of the computer numerical control machine tool, the chemical composition concentration of the surface treatment electroplating solution, and the dimensional inspection report generated by the coordinate measuring machine.

[0017] On the other hand, the present invention provides a production data storage and backup system for quality traceability of precision hardware parts, comprising: The production cycle monitoring module is connected to the signal output port of the production line counting sensor or programmable logic controller to receive the off-line signal of precision hardware parts. It has a counting register and a threshold comparator inside, which outputs a key update trigger signal when the cumulative production quantity reaches the preset batch threshold. The dynamic key generation module is physically integrated into the production line network switching equipment and electrically connected to the signal output terminal of the production cycle monitoring module. The dynamic key generation module has a physically unclonable function circuit and a key derivation unit embedded inside. In response to the key update trigger signal, the dynamic key generation module drives the physically unclonable function circuit to generate a unique physical response, and the key derivation unit processes the physical response into a session encryption key that meets the predetermined cryptographic strength. The data batch encryption module is also integrated into the network switching equipment and works in conjunction with the dynamic key generation module. The data batch encryption module is used to obtain the quality traceability data associated with the current production batch and call a hardware symmetric encryption engine to encrypt the quality traceability data using the session encryption key provided by the dynamic key generation module. The key encapsulation transmission module, also integrated into the network switching equipment, has a built-in hardware asymmetric encryption engine and a secure storage area storing the asymmetric encryption public key of the remote backup server. The key encapsulation transmission module is used to encrypt the session encryption key with the public key to form a key encapsulation body, and then package the key encapsulation body with the encrypted data generated by the data batch encryption module and send it out through the network interface. The data receiving and decryption module is deployed on a remote backup server. The data receiving and decryption module includes a key store that securely stores asymmetric encryption private keys and a data processing logic. The data processing logic is used to receive the packaged data. First, it calls the private key to decrypt the key package to obtain the session encryption key. Then, it uses the session encryption key to decrypt the original quality traceability data and complete the data entry operation.

[0018] Preferably, the physically unclonable function circuit in the dynamic key generation module is specifically implemented as a physically unclonable function circuit of a ring oscillator array. The key derivation unit generates a physical response bit stream by measuring the sign bit of the frequency difference between each pair of ring oscillators in the array.

[0019] Preferably, the system also includes a data aggregation and caching unit deployed on the edge computing node of the production line. The data aggregation and caching unit is responsible for collecting heterogeneous data from various sensors and controllers on the production line in real time, associating and formatting it according to the unique identification code of the hardware parts, and temporarily caching it in production batches. When the data batch encryption module requests data, the data aggregation and caching unit sends a complete, structured data batch block to the data batch encryption module.

[0020] Preferably, a secure communication channel is established between the key encapsulation and transmission module and the data receiving and decryption module through a transport layer security protocol. The composite data packet is transmitted within this secure communication channel, providing link-layer protection for data transmission. The key encapsulation operation is an application-layer secondary encryption operation in addition to the encryption within the channel, ensuring end-to-end security of the key itself.

[0021] In summary, this application includes at least one of the following beneficial technical effects: 1. This invention utilizes the microscopic physical characteristics of hardware as the entropy source of the key. The generated key is uniquely bound to a specific physical chip and cannot be copied or extracted digitally, fundamentally eliminating the risk of key theft and leakage. Compared with traditional digital keys stored in memory or flash memory, its security level has been qualitatively improved.

[0022] 2. This invention strictly binds the lifecycle of the key to the production cycle of the physical product. Upon completion of each batch of products, the old key is destroyed and a completely new, unrelated key is generated. This mechanism ensures that even if an attacker captures encrypted data for a specific period, they cannot decrypt historical or future data using a single, compromised key. This achieves both forward and backward security, effectively countering the data analysis time window upon which side-channel attacks rely.

[0023] 3. This invention employs a hybrid encryption scheme combining symmetric and asymmetric encryption. The session key itself is rigorously protected by the asymmetric public key during transmission, and only a legitimate backup server holding the corresponding private key can decrypt and use the key. This scheme ensures that even in complex industrial network environments, sensitive production process data is under strong encryption protection throughout the entire transmission link from the production line to the backup end.

[0024] 4. The entire key generation, encryption, encapsulation, and rotation process of this invention is automatically executed by the hardware security module without human intervention, reducing security vulnerabilities introduced by human error. Furthermore, due to the instantaneous and one-time nature of the key, the system has natural immunity to common network attacks such as replay attacks, significantly enhancing the robustness and reliability of the entire quality traceability data backup system. Attached Figure Description

[0025] Figure 1This is a schematic diagram of the overall technical solution architecture of the present invention.

[0026] Figure 2 This is a schematic diagram of the framework of the dynamic key generation and distribution mechanism in this invention.

[0027] Figure 3 This is a schematic diagram illustrating the collaborative operation of production line-side data encryption and remote backup server decryption in this invention. Detailed Implementation

[0028] To further illustrate the technical means and effects adopted by the present invention in order to achieve the intended purpose, the following detailed description is provided in conjunction with the accompanying drawings and preferred embodiments, based on specific implementation methods of the present invention.

[0029] Reference Figures 1 to 3 As shown, this invention provides a production data storage and backup method and system for quality traceability of precision hardware parts. Its core lies in constructing a dynamic key generation and distribution mechanism that is deeply coupled with the physical cycle of production, so as to solve the technical problem that traditional static key encryption is vulnerable to side-channel attacks in the industrial data backup link, leading to the leakage of key process parameters.

[0030] A production data storage and backup method for quality traceability of precision hardware parts begins by setting up a production cycle monitoring logic in the production line network switching equipment, which is connected to the production line programmable logic controller or production counting sensor.

[0031] The production cycle monitoring logic receives pulse signals in real time through hardware signal lines, which represent the completion of the production of precision hardware parts. Each pulse corresponds to the unloading action of one hardware part.

[0032] The production cycle monitoring logic contains a 32-bit unsigned integer counter register, which is used to accumulate and count pulse signals to obtain a real-time production count value. The initial value of the counter register is zero. Whenever a valid falling edge or rising edge trigger signal is received, the count value is automatically incremented by one. This counting process is implemented by hardware logic gate circuits to ensure the atomicity and uninterruptibility of the counting operation and avoid count loss due to software scheduling delays or interruptions.

[0033] Meanwhile, the production cycle monitoring logic has a built-in threshold comparator. Its input is connected to the output of the counter register and a preset production batch count value threshold storage unit. The threshold storage unit is written by the manufacturing execution system through the security configuration interface during the system initialization phase. The typical value is 100, 500 or 1000. The specific value is dynamically set according to the production line cycle rate, data generation density and security policy level.

[0034] When the real-time production count value equals the preset threshold, the threshold comparator outputs a high-level signal. The high-level signal is the key update trigger instruction, which is sent to the hardware security module built into the network switching device via the internal bus.

[0035] Upon receiving the key update trigger command, the hardware security module immediately activates its internally integrated physical non-cloning function circuit. The physical non-cloning function circuit is a type of physical non-cloning function circuit based on static random access memory, and its core consists of a 64×64-bit static random access memory storage cell array.

[0036] Under normal operating conditions, the memory cell array is in a power-off or low-power hold-up state. Upon receiving an activation command, the power management unit of the hardware security module applies a full-domain power-on operation to the memory cell array, that is, pulling all bit lines and word lines of the array to the standard operating voltage within nanoseconds. Due to the unavoidable slight differences in transistor threshold voltages during manufacturing, each memory cell will spontaneously stabilize to a defined logic state after power-on. This state is highly repeatable during multiple power-on cycles, but exhibits a completely random distribution across different chips.

[0037] The hardware security module's read controller then performs a full-domain read operation on the entire memory cell array to obtain the initial stable logic state value of each memory cell, totaling 4096 bits, which constitutes the original physical response bit stream. The bit stream directly reflects the differences in physical microstructure introduced during chip manufacturing and has uniqueness, unpredictability, and non-cloning properties.

[0038] To eliminate bit flipping caused by environmental noise, temperature drift, or power fluctuations, the key derivation unit within the hardware security module first performs error correction coding on the original physical response bitstream. The error correction coding operation employs the Bose-Hokvan-Hokurik code algorithm, specifically the BCH(4096,3840,32) code, which is designed to correct up to 32 random error bits. The error correction process is implemented through a dedicated hardware decoder. This decoder, based on synodal computation and lookup table methods, completes error location and correction within microseconds, outputting a corrected, stable response sequence of 3840 bits.

[0039] Subsequently, the key derivation unit performs an entropy extraction algorithm on the stable response sequence to eliminate any weak biases or correlations that may exist in the physical responses, ensuring the statistical uniformity of the output key. The entropy extraction algorithm employs a hash message authentication code key derivation function based on the secure hash algorithm 256, whose salt value is generated by the unique device identifier of the hardware security module and remains fixed on each call.

[0040] The hash message authentication code key derivation function compresses the 3840-bit input sequence into a precise 256-bit output, which is the session encryption key required for this session. The session encryption key is only valid for this encryption operation and is immediately cleared from the volatile key register of the hardware security module after the operation is completed, without being stored in any non-volatile storage medium.

[0041] While generating the session encryption key, the hardware security module initiates a data request to the production line manufacturing execution system through the open platform communication unified architecture protocol. The target of the data request is all quality traceability production data that has been collected and cached on the production line edge computing nodes from the last key update trigger time to the current trigger time.

[0042] After receiving the request, the Manufacturing Execution System calls its internal data aggregation service to structure and integrate all heterogeneous data associated with the production batch according to the unique identification code of the hardware parts, and encapsulates it into a data batch in a standard format.

[0043] The data batch includes, but is not limited to: Each piece of hardware has a unique identification code, which is burned into the product by a laser marking machine when the product comes off the production line; The temperature curve data of the heat treatment furnace was sampled at a frequency of 10 times / second, recording the temperature changes throughout the entire process from heating, holding to cooling. The machining program code and actual tool path coordinates of the computer numerical control machine tool have a coordinate accuracy at the micrometer level and a sampling period at the millisecond level. The chemical composition concentration of the surface treatment electroplating solution is measured in real time by an online spectrometer, including the molar concentration of main salt, additives and impurity ions; And the dimensional inspection report generated by the coordinate measuring machine, which includes the measured values ​​of key feature dimensions, tolerance zones, and geometric tolerance evaluation results.

[0044] All data is timestamped to the microsecond level and arranged in chronological order.

[0045] After receiving the structured data batch, the hardware security module sends it to the built-in symmetric encryption engine. The symmetric encryption engine uses the Galois counter mode of the Advanced Encryption Standard (AES) algorithm. The Galois counter mode provides confidentiality and generates a 128-bit authentication tag to verify the integrity and authenticity of the data.

[0046] The encryption process uses the previously generated 256-bit session encryption key as the key input and the data batch as the plaintext input. The Galois counter mode combines the counter value with the initialization vector, and after encrypting each data block, it XORs it with the plaintext to finally output the ciphertext data block.

[0047] Meanwhile, the Galois counter mode uses Galois field multiplication to accumulate the ciphertext and additional authentication data to generate a unique authentication tag.

[0048] The entire encryption and authentication process is completed by a dedicated hardware accelerator with a throughput of no less than 100MB / s, ensuring that the normal production line cycle is not affected.

[0049] Meanwhile, the asymmetric encryption engine within the hardware security module reads the pre-configured asymmetric encryption public key from the remote backup server from its internal one-time programmable secure storage area. The asymmetric encryption public key is injected by the backup server through the secure out-of-band channel during the system deployment phase and written after digital signature verification, making it impossible to modify or read subsequently.

[0050] The asymmetric encryption engine employs elliptic curve cryptography, specifically using the 256-bit prime field curve recommended by the Chinese national standard SM2. The engine uses the public key to encrypt the previously generated 256-bit session encryption key, producing an encryption key encapsulation. This encapsulation is 65 bytes long and contains the coordinates of the elliptic curve points and the encrypted key data.

[0051] Subsequently, the packet assembly logic of the hardware security module combines the encrypted data block, authentication tag, and encryption key encapsulation body according to a predefined binary protocol format to form a composite data packet.

[0052] The binary protocol format includes a header, data segments, and a checksum. The header identifies the data packet type and version. The data segments sequentially store the encryption key encapsulation body, the authentication tag, and the encrypted data block. The checksum is calculated using a 32-bit cyclic redundancy check algorithm to calculate the entire packet.

[0053] After the composite data packet is constructed, it is sent to the remote backup server via the Gigabit Ethernet interface of the network switching equipment through the industrial Ethernet. During transmission, the composite data packet is further encapsulated within a secure communication channel established by a transport layer security protocol. The secure communication channel uses an independent certificate system for two-way authentication, providing link-layer protection for data transmission. The key encapsulation operation constitutes application-layer secondary encryption in addition to the encryption within the channel, ensuring end-to-end security of the session key.

[0054] The remote backup server is equipped with a data receiving and decryption module that continuously listens on a specified port.

[0055] Upon receiving the composite data packet, the encapsulation of the transport layer security protocol is first stripped, and the integrity of the link layer is verified. Subsequently, the data processing logic extracts the encryption key encapsulation from the composite data packet and calls the asymmetric encryption private key, which is securely stored in the local key store and paired with the aforementioned public key, to retrieve it.

[0056] The asymmetric encryption private key is also based on elliptic curve cryptography and is stored in the server-side hardware security module or trusted platform module. Access requires multi-factor authentication. The decryption engine uses the asymmetric encryption private key to decrypt the encryption key package and recover the original 256-bit session encryption key. If decryption fails or the output is invalid, the composite data packet is discarded and a security event is recorded.

[0057] After successfully recovering the session encryption key, the data processing logic extracts the encrypted data blocks and authentication tags from the composite data packet and calls the symmetric decryption engine. The symmetric decryption engine also uses the Galois counter mode of the Advanced Encryption Standard (AES) algorithm, decrypts the encrypted data blocks using the recovered session encryption key, and simultaneously calculates the authentication tags.

[0058] The calculated tag is compared bit by bit with the received authentication tag. If they are completely consistent, the data is determined to be complete and tamper-proof, and the original quality traceability production data is decrypted. If they are inconsistent, the data is determined to have been damaged or forged during transmission, and the data is rejected from being stored and an alarm is triggered.

[0059] The raw data that passes integrity verification is then parsed into structured records and indexed by the unique identification code of the hardware component. The records are then stored in a dedicated tablespace of the backup database, which employs row-level encryption and access control strategies to ensure the security of static data.

[0060] Throughout the entire method execution process, the system has multiple built-in exception handling mechanisms.

[0061] If the production cycle monitoring logic does not receive a pulse signal within the preset timeout period, it determines that the production line is abnormally shut down, suspends the key update process, and reports the status.

[0062] If the number of erroneous bits in the original response bitstream returned by the physically unclonable function circuit exceeds the error correction capability of the Bose-Hokvan-Hokungen code, a hardware fault is determined, and a backup physically unclonable function circuit is activated or the system switches to a security degradation mode.

[0063] If a data request to the manufacturing execution system times out or returns empty data, log the request and attempt to retry three times. If the request fails, mark the batch of data as missing.

[0064] If the number of decryption failures on the remote backup server exceeds the threshold consecutively, the communication connection with the switching equipment on the production line will be automatically cut off, and the security administrator will be notified to intervene.

[0065] All operation logs are recorded in read-only mode in the tamper-proof log area of ​​the hardware security module for post-event auditing.

[0066] The above method binds key generation to physical production events, utilizes physically unclonable functions to provide a root entropy source, and combines a hybrid encryption architecture with strict data integrity verification to construct a highly secure, highly reliable, and fully automated production data storage and backup link. This link ensures that each batch of data is encrypted with a unique one-time key, the key itself is protected by asymmetric encryption, and its entire lifecycle is automatically managed by hardware. This completely eliminates the security risks associated with static key storage and transmission, effectively resists side-channel attacks and replay attacks, and provides a solid data security guarantee for the quality traceability of precision hardware parts.

[0067] As a necessary support for the above method, the present invention also discloses a production data storage and backup system for quality traceability of precision hardware parts, including a production cycle monitoring module, a dynamic key generation module, a data batch encryption module, a key encapsulation and transmission module, and a data receiving and decryption module.

[0068] The production cycle monitoring module is connected to the signal output port of the production line counting sensor or programmable logic controller. It has an internal counting register and threshold comparator, which are used to output a key update trigger signal when the cumulative production quantity reaches the preset batch threshold.

[0069] The dynamic key generation module is physically integrated into the production line network switching equipment and electrically connected to the production cycle monitoring module. It contains a physically non-clonable function circuit based on static random access memory and a key derivation unit, which is used to generate session encryption keys in response to trigger signals.

[0070] The data batch encryption module is also integrated into the network switching equipment, working in conjunction with the dynamic key generation module to call the hardware symmetric encryption engine to encrypt the quality traceability data.

[0071] The key encapsulation and transmission module has a built-in hardware asymmetric encryption engine and a secure storage area for encrypting session keys and assembling packets for transmission.

[0072] The data receiving and decryption module is deployed on a remote backup server. It includes a private key library and data processing logic, and is used to decrypt the key, decrypt the data and store it in the library.

[0073] The system also includes a data aggregation and caching unit deployed on the edge computing nodes of the production line, which is used to collect, associate and cache heterogeneous production data in real time and provide it to the encryption module in batches. The modules communicate with each other through an internal high-speed bus or a dedicated secure channel to ensure low latency and high security of data flow.

[0074] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention. Therefore, the embodiments should be regarded as exemplary and non-limiting in all respects.

[0075] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment includes only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

Claims

1. A method for storing and backing up production data for quality traceability of precision hardware parts, characterized in that, include: Set up production cycle monitoring logic in the production line network switching equipment to acquire pulse signals in real time and accumulate them to obtain real-time production count values; When the real-time production count reaches the preset production batch count threshold, a key update trigger command is generated and sent to the hardware security module built into the network switching device. After receiving the key update trigger command, the hardware security module activates its internal physical non-cloning function circuit, applies a deterministic stimulus challenge sequence, and obtains the physical response bit stream. Error correction coding and entropy extraction algorithm are performed on the physical response bitstream to generate a session encryption key; Obtain all quality traceability production data corresponding to the current production batch to form a data batch to be encrypted; The session encryption key is used to encrypt the batch of data to be encrypted, generating encrypted data blocks and authentication tags; The session encryption key is encrypted using the asymmetric encryption public key of the remote backup server to generate an encryption key package. The encrypted data block, authentication tag, and encryption key encapsulation are combined into a composite data packet and sent to the remote backup server. The remote backup server uses its asymmetric encryption private key to decrypt the encryption key package to recover the session encryption key; The session encryption key and authentication tag are used to decrypt and verify the integrity of the encrypted data blocks, obtain the original production data, and store it in the backup database.

2. The production data storage and backup method for quality traceability of precision hardware parts according to claim 1, characterized in that, The physically unclonable function circuit is a physically unclonable function circuit based on static random access memory; The specific steps of applying a deterministic stimulus challenge sequence are as follows: perform a full-domain power-on operation on the storage cell array of the static random access memory, read the stable logic state value of each storage cell after power-on without initialization, and form a physical response bit stream.

3. The production data storage and backup method for quality traceability of precision hardware parts according to claim 1, characterized in that, The error correction coding operation uses the Bose-Hokvan-Hokkun root code algorithm, and the entropy extraction algorithm uses the hash message authentication code key derivation function based on the secure hash algorithm 256.

4. The production data storage and backup method for quality traceability of precision hardware parts according to claim 1, characterized in that, The symmetric encryption engine within the hardware security module employs the Galois counter mode of the Advanced Encryption Standard algorithm, which generates authentication tags simultaneously with the generation of encrypted data blocks. The asymmetric encryption engine within the hardware security module reads the asymmetric encryption public key from the remote backup server from its internal secure storage area. This asymmetric encryption engine uses an elliptic curve cryptography algorithm.

5. The production data storage and backup method for quality traceability of precision hardware parts according to claim 1, characterized in that, Obtaining all quality traceability production data corresponding to the current production batch specifically includes: The hardware security module requests all collected and cached production data from the last key update trigger time to the current trigger time from the open platform communication unified architecture protocol. Production data includes a unique identification code for each hardware component, temperature curve data of the heat treatment furnace, machining program code and actual tool path coordinates of the computer numerical control machine tool, chemical composition concentration of the surface treatment electroplating solution, and dimensional inspection report generated by a coordinate measuring machine.

6. The production data storage and backup method for quality traceability of precision hardware parts according to claim 2, characterized in that, The physically unclonable function circuit is a ring oscillator array physically unclonable function circuit; The key derivation unit within the hardware security module generates a physical response bit stream by measuring the sign bit of the frequency difference between each pair of ring oscillators in the array.

7. The production data storage and backup method for quality traceability of precision hardware parts according to claim 1, characterized in that, Also includes: Data aggregation and caching units are deployed at the edge computing nodes of the production line. These units collect heterogeneous data from various sensors and controllers on the production line in real time, associate and format the data according to the unique identification code of the hardware parts, and temporarily cache the data in batches. When the hardware security module requests data, the data aggregation cache unit sends a complete block of structured data to the hardware security module.

8. The production data storage and backup method for quality traceability of precision hardware parts according to claim 1, characterized in that, Composite data packets are transmitted through a secure communication channel established by a transport layer security protocol; the key encapsulation operation is an application layer secondary encryption in addition to the encryption within the secure communication channel, to ensure the end-to-end security of the key itself.

9. A production data storage and backup system for quality traceability of precision hardware parts, characterized in that, include: The production cycle monitoring module is connected to the signal output port of the production line counting sensor or programmable logic controller to receive the off-line signal of precision hardware parts. It has a counting register and a threshold comparator inside, which are used to output a key update trigger signal when the cumulative production quantity reaches the preset batch threshold. The dynamic key generation module is physically integrated into the production line network switching equipment and electrically connected to the signal output terminal of the production cycle monitoring module. The dynamic key generation module has a physically unclonable function circuit and a key derivation unit embedded inside. In response to the key update trigger signal, the dynamic key generation module drives the physically unclonable function circuit to generate a unique physical response, and the key derivation unit processes the physical response into a session encryption key that meets the predetermined cryptographic strength. The data batch encryption module is also integrated into the network switching equipment and works in conjunction with the dynamic key generation module; The data batch encryption module is used to obtain quality traceability data associated with the current production batch and call the hardware symmetric encryption engine to encrypt the quality traceability data using the session encryption key provided by the dynamic key generation module. The key encapsulation and transmission module is also integrated into the network switching equipment. It has a built-in hardware asymmetric encryption engine and a secure storage area that stores the asymmetric encryption public key of the remote backup server. The key encapsulation and transmission module is used to encrypt the session encryption key with the public key to form a key encapsulation body, and then package the key encapsulation body with the encrypted data generated by the data batch encryption module and send it through the network interface. The data receiving and decryption module is deployed on a remote backup server. The data receiving and decryption module includes a key store that securely stores asymmetric encryption private keys and data processing logic. The data processing logic is used to receive the packaged data. First, it calls the private key to decrypt the key package to obtain the session encryption key. Then, it uses the session encryption key to decrypt the original quality traceability data and complete the data entry operation.

Images