A data security evidence storage method and system for smart city construction

Abstract

The application relates to the technical field of device management, and discloses a data security evidence storage method and system for smart city construction; the method comprises the following steps: collecting target device running state data, performing encryption preprocessing, constructing a safety data set, identifying data abnormalities, and determining a list of potential incidents with correlations; intelligently grouping devices according to event priorities, generating and dynamically adjusting a resource allocation scheme, automatically acquiring standby resources and expanding configurations when the scheme does not meet the evidence storage requirements; based on the expansion scheme, a path selection model integrating bandwidth and priority constraints is used to calculate and verify the shortest delay data evidence storage path; finally, full-link log recording is performed on the evidence storage process along the path, integrity verification based on a cryptographic hash chain is implemented, and the resource adjustment effect is evaluated based on the verification result to generate a confirmation result; the application improves the timeliness and reliability of device data evidence storage in the complex environment of a smart city.

Description

Technical Field

[0001] This application relates to the field of equipment management technology, and in particular to a data security storage method and system for smart city construction. Background Technology

[0002] With the deepening of smart city construction, various devices such as drainage pumping stations, streetlights, traffic lights, and environmental sensors have been widely connected to the network, enabling real-time monitoring of their operational status. However, a large number of devices may experience data anomalies simultaneously or continuously during operation, leading to sudden events.

[0003] Existing technologies generally suffer from the following shortcomings: First, most solutions focus on anomaly detection and alarms, but lack a systematic guarantee on how to record the detected data with high quality. When multiple devices alarm simultaneously, the system's limited storage, computing, and network bandwidth resources face fierce competition, potentially leading to the loss or incomplete recording of critical data due to insufficient resources. Second, resource allocation strategies are usually static or simple polling, failing to dynamically and intelligently allocate resources to the devices most in need of protection based on the urgency of the event and the business importance of the devices. This results in a dilemma where those that should be protected are not protected, while those that should not be protected occupy resources. Third, the selection of data transmission paths is often based on fixed rules or simple shortest paths, without considering real-time network conditions and device priorities. Under high load, this may lead to a surge in transmission latency, affecting the timeliness of data storage. Finally, existing systems lack transparent and complete records of the decision-making and execution processes regarding why resources are adjusted in this way and which paths data is stored through, making it difficult to trace, audit, and optimize afterwards, thus undermining the credibility of the entire storage chain.

[0004] Therefore, how to build a device data security storage system that can intelligently identify anomalies, dynamically allocate resources on demand, optimize data transmission paths, and ensure traceability throughout the entire process has become a technical challenge that urgently needs to be solved in this field. Application content

[0005] To address the aforementioned technical issues, this application provides a data security evidence storage method and system for smart city construction. This system prioritizes the complete, reliable, and timely recording and evidence storage of abnormal data from high-priority devices when urban monitoring system resources are limited, while ensuring the transparency and auditability of the entire response process.

[0006] Firstly, this application provides a data security storage method for smart city construction, the method comprising:

[0007] Step S1: Obtain the operating status data of the target device, preprocess the operating status data to generate a device operating dataset, identify data anomalies based on the device operating dataset, and determine a list of potential emergencies;

[0008] Step S2: Classify the target devices according to the list of emergencies, identify the target device groups, generate corresponding resource allocation schemes, adjust the resource allocation schemes, and determine whether the adjusted resource allocation schemes meet the data storage requirements.

[0009] Step S3: If the data storage requirements are not met, then acquire backup resources and form an extended resource configuration scheme. Based on the extended resource configuration scheme and the path selection model, generate the shortest delay path for data storage, verify the reliability of the shortest delay path, and generate the final data storage path.

[0010] Step S4: Based on the final data storage path, log the storage process of the target device, judge and verify the integrity of the log records, and generate the final resource adjustment confirmation result based on the verification result.

[0011] Secondly, this application provides a data security storage system for smart city construction, the system comprising:

[0012] The data acquisition module is used to acquire the operating status data of the target device, preprocess the operating status data to generate a device operating dataset, identify data anomalies based on the device operating dataset, and determine a list of potential emergencies.

[0013] The equipment classification module is used to classify the target equipment according to the emergency list, identify the target equipment groups, generate corresponding resource allocation schemes, adjust the resource allocation schemes, and determine whether the adjusted resource allocation schemes meet the data storage requirements.

[0014] The path generation module is used to obtain backup resources and form an extended resource configuration scheme if the data storage requirements are not met. Based on the extended resource configuration scheme and the path selection model, the shortest delay path for data storage is generated, the reliability of the shortest delay path is verified, and the final data storage path is generated.

[0015] The logging module is used to log the evidence storage process of the target device based on the final data evidence storage path, judge and verify the integrity of the log records, and generate the final resource adjustment confirmation result based on the verification result.

[0016] Compared with the prior art, the beneficial effects of this application are at least as follows:

[0017] This application provides a data security storage method and system for smart city construction. First, it collects and encrypts operational status data from target devices to construct a secure dataset. Based on this dataset, it accurately identifies and analyzes correlations to derive a list of potential emergencies, providing a reliable data-driven foundation for subsequent emergency response. Then, it intelligently groups and prioritizes devices according to the urgency and impact of the events, generating and dynamically adjusting a quantitative resource allocation scheme. This scheme can prioritize the storage needs of critical devices under resource constraints and has the adaptive ability to determine whether resources are sufficient.

[0018] Based on this, when resources are insufficient, a backup resource expansion mechanism is automatically triggered. Utilizing a path selection model that integrates bandwidth availability and device group priority constraints, a multi-objective optimization algorithm dynamically solves for the optimal evidence storage path that meets stringent service quality requirements, ensuring low latency and high reliability of data transmission. This path undergoes multi-level stress testing before being put into operation and is continuously monitored during operation. It can automatically switch to the backup path when performance deteriorates, thereby significantly improving the resilience and continuity of the data evidence storage service.

[0019] Finally, by recording the entire evidence storage process in a structured log and implementing integrity verification and closed-loop performance evaluation based on cryptographic hash chains, the auditable, verifiable, and continuous optimization of resource adjustment and path optimization effects are achieved, forming a complete technical closed loop from anomaly detection, intelligent scheduling, reliable transmission to trusted auditing. This method effectively solves the challenge of ensuring that critical operational data can be securely, completely, and timely stored in the event of sudden equipment anomalies, providing strong technical support for the stable operation and efficient maintenance of key smart city infrastructure. Attached Figure Description

[0020] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart of a data security evidence storage method for smart city construction, as described in this application embodiment;

[0022] Figure 2 This is an example diagram illustrating the application of the path selection model in the embodiments of this application;

[0023] Figure 3 This is a quantitative comparison chart of key performance indicators in the embodiments of this application;

[0024] Figure 4This is a schematic diagram of the structure of a data security evidence storage system for smart city construction according to an embodiment of this application. Detailed Implementation

[0025] This application provides a data security storage method and system for smart city construction. The terms "first," "second," "third," "fourth," etc. (if present) in the specification, claims, and accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such use of terms can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. Furthermore, the terms "comprising" or "having" and any variations thereof are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0026] For ease of understanding, the specific process of the embodiments of this application is described below. Please refer to [link / reference]. Figure 1 One embodiment of a data security evidence storage method for smart city construction in this application includes:

[0027] Step S1: Obtain the operating status data of the target device, preprocess the operating status data to generate a device operating dataset, identify data anomalies based on the device operating dataset, and determine a list of potential emergencies.

[0028] The step S1, determining the potential emergency event list, includes: S11: acquiring the real-time data stream and historical data archive records of the target device as operational status data, performing preliminary cleaning of the operational status data, and encrypting the cleaned data for evidence storage. The encrypted real-time data stream and historical data archive records are then integrated into a device operational dataset; S12: real-time monitoring of the data flow in the device operational dataset. When the data flow exceeds a dynamic threshold, a data surge alarm is triggered, generating alarm information containing the abnormal time point and device identifier; S13: based on the alarm information, candidate sudden data surge events with continuous abnormal characteristics are selected from all alarm events. These candidate sudden data surge events are classified in multiple dimensions, and the classified events are integrated into a preliminary emergency event list in chronological order; S14: performing inter-event correlation analysis on the preliminary emergency event list. Based on the correlation analysis results, isolated events are eliminated, and related event groups are confirmed to form the final emergency event list.

[0029] Specifically, the target equipment in this application is illustrated using key equipment for maintaining the normal operation of urban public services and infrastructure as examples, such as submersible pumps and level sensors in drainage pumping stations, LED streetlights and brightness regulators in road lighting systems, traffic light controllers and flow monitoring cameras in traffic management systems, and pressure regulating valves and water quality monitoring probes in water supply networks. The target equipment includes, but is not limited to, municipal equipment. First, step S11 is executed: operating parameters are continuously collected through sensor networks deployed on various target equipment, such as level sensors and current transformers in pumping stations, illuminance sensors and power metering modules in streetlights, forming a real-time data stream. For example, for urban drainage pumping stations, the real-time data stream includes the water level depth of the collection tank collected per second by the level sensor, the effective value of the three-phase current of the submersible pump motor collected every 100 milliseconds by the current transformer, and the outlet pressure value collected per second by the pressure transmitter; for smart streetlights, the real-time data stream includes the ambient light illuminance value collected per minute by the illuminance sensor, the real-time power value collected every 15 seconds by the power metering module, and the switch status signal. Meanwhile, corresponding historical data archives are extracted from the historical database of the equipment management information system to provide a dynamic baseline for anomaly detection in real-time data. These archives are structured time-series data sets, also organized by equipment. For example, for a drainage pumping station, its historical data archives may include: the historical curve of the average outlet pressure of the pumping station at 5-minute intervals over the past 24 hours; the typical range of motor current values ​​for the same time period each day, such as the evening peak, over the past week; and static parameters such as the rated current and upper limit of safe operating pressure of the pump recorded in the equipment file. For smart streetlights, their historical archives may include: the average hourly power consumption record for the location at night, such as from 20:00 to 06:00 the next day, over the past week; and the preset on / off schedule based on season and weather. The real-time data stream and the historical data archives together constitute the original operating status data, which is the basis for all subsequent analyses. However, this data usually contains invalid or erroneous values ​​due to sensor noise, momentary communication interruptions, etc. Therefore, the real-time data stream first undergoes preliminary cleaning, such as applying a threshold filtering method based on historical normal value ranges to remove data points that clearly exceed physically reasonable ranges, such as pump current instantaneously dropping to zero or abnormally surging, ensuring the validity and reliability of the input data. Subsequently, to meet data security requirements, the cleaned data undergoes encryption processing for evidence storage. This processing employs a combination of standard encryption and digital signature technologies: the AES-128 symmetric encryption algorithm is used to encrypt the data itself to ensure confidentiality; simultaneously, the SHA-256 hash algorithm is used to calculate a unique digest of the data, and this digest is encrypted using the system private key via the RSA algorithm to generate a digital signature, ensuring data integrity and non-repudiation.After encryption is completed, the processed real-time data stream and historical data archive records are aligned and integrated according to a unified timestamp and device identifier to form a structured device operation dataset. This dataset will serve as a unified and secure data foundation for subsequent anomaly detection.

[0030] Based on the construction of a high-quality dataset, step S12 is executed: identifying data anomalies based on the device operation dataset. Specifically, the data flow in the device operation dataset is monitored in real time. Data flow refers to the number of status data packets or the total amount of data reported by the device per unit time, representing the "activity level" or "degree of drastic change in status" of the device. An abnormal surge in this data flow is often a significant sign of sudden equipment failure or external shock. A dynamic threshold is set for each type of device. This threshold is not a fixed value, but is based on the normal flow level in its historical data archive records, and is dynamically adjusted by an algorithm in combination with the device operation stage and external environmental factors such as weather warnings. When the data flow of a device is detected to continuously exceed its current dynamic threshold within a short time window, a data surge alarm is immediately triggered, and a structured alarm message is generated, which accurately records the time point of the anomaly and the device's unique identifier. However, a single instantaneous alarm may be an occasional interference. Therefore, step S13 is executed: intelligent filtering is performed based on alarm information accumulated over a period of time, such as the past 10 minutes, to extract candidate events with continuous abnormal characteristics, such as a pump station whose flow exceeds the standard for multiple consecutive sampling cycles and the degree of exceedance shows an upward trend. These candidate events are then categorized in multiple dimensions. First, based on the functional roles of the associated equipment, they are automatically classified into predefined equipment types such as drainage equipment, lighting equipment, or traffic equipment. Then, the degree of anomaly for each event is quantified and graded: the deviation rate of the average data traffic during its duration relative to the historical average traffic of the same period for that equipment is calculated using the following formula: This process yields a dimensionless index that objectively reflects the magnitude of the anomaly. Based on a preset threshold, this deviation value is mapped to a level label of "slight" (deviation value < 0.5), "moderate" (0.5 ≤ deviation value < 1.0), or "severe" (deviation value ≥ 1.0). Finally, all events with completed type and level labels are integrated in chronological order of occurrence to form a structured preliminary list of emergencies. This list provides a standard input with both classification dimensions and quantitative intensity for subsequent correlation analysis.

[0031] To avoid overreacting to isolated or sporadic events, step S14 is performed last: an inter-event correlation analysis is conducted on the preliminary list to identify and confirm related event groups with inherent connections, while filtering out isolated, accidental events. Specifically, the correlation analysis is based on two core dimensions: spatial proximity and temporal correlation. In the spatial dimension, proximity is determined by combining the geographical location of the equipment with the municipal network topology, such as drainage pipe networks and power lines. For example, the Pearson correlation coefficient between the time series of abnormal events from multiple pumping stations located upstream and downstream of the same drainage pipeline is calculated. If the coefficient is greater than a preset threshold, such as 0.7, they are considered highly correlated and constitute a related event group. In the time dimension, the analysis examines the time sequence and evolution pattern of abnormal events. Continuing with the drainage scenario mentioned above, it not only checks whether the anomalies occur within similar time periods, such as a 30-minute time window, but more importantly, it analyzes whether the initial time sequence and intensity evolution trend of the anomalies conform to the propagation law of the same physical event. If the abnormal flow at pump station A starts earliest, followed by anomalies at pump stations B and C in sequence, and the anomaly intensity, such as the percentage of flow exceeding the standard, also shows a similar transmission or amplification trend, this provides a crucial basis for determining that they belong to the same related event group. Time series similarity algorithms, such as Dynamic Time Warping (DTW) or cross-correlation analysis, are used to quantitatively compare the time series curves of the events and calculate the time correlation score. Individual events that have no significant statistical correlation with other events in both the spatiotemporal dimensions are judged as isolated events and removed from the final list. Through this analysis, the final list of emergencies focuses on related event groups with a risk of spread, providing a reliable basis for accurately identifying target equipment groups and optimizing emergency resource allocation in subsequent steps.

[0032] Step S2: Classify the target devices according to the list of emergencies, identify the target device groups, generate corresponding resource allocation schemes, adjust the resource allocation schemes, and determine whether the adjusted resource allocation schemes meet the data storage requirements.

[0033] Step S2, which identifies target device groups and generates corresponding resource allocation schemes, includes: S21: filtering each event in the emergency event list according to preset emergency response conditions to extract emergency events requiring immediate intervention; S22: performing a comprehensive priority assessment on the extracted emergency events and generating an event priority sequence based on the assessment results; mapping and dividing the associated target devices into corresponding device groups according to the event priority sequence; S23: defining device groups with response priorities higher than a preset threshold as target device groups, and creating a response task list containing the current abnormal status identifier and response requirements for each device within the target device group; S24: estimating the resource requirements of the target device groups based on the response requirements recorded in the response task list, ultimately forming a resource allocation scheme that includes device groups, response task lists, and estimated resource requirements.

[0034] Specifically, after obtaining the list of emergencies, the list is intelligently analyzed to identify target equipment groups that require priority response and generate corresponding resource allocation plans. In practice, S21 is executed first: the emergency list is filtered according to preset emergency response conditions. These conditions are usually defined as the abnormality level of the event reaching the "serious" level or its duration exceeding a preset threshold, such as 5 minutes, thereby initially extracting all emergency events that require immediate intervention. Subsequently, step S22 utilizes a weighted scoring model to comprehensively prioritize these emergency events. This model takes the feature vector of each emergency event as input, calculates its priority score, and transforms the business logic of municipal emergency response into executable mathematical rules. The feature vector mainly includes three quantified dimensions: an event severity score, calculated based on the percentage of equipment data traffic deviating from the historical normal operating baseline (e.g., a 50% exceedance of traffic limits results in 50 points); a potential impact range coefficient, assigned based on the criticality of the event-related equipment in the municipal infrastructure network topology, such as whether it is a core hub and the number of its downstream related equipment (e.g., a critical node coefficient of 1.5, plus a bonus based on the number of downstream equipment according to a preset formula); and a timeliness urgency weight, a dynamic adjustment factor related to the time context (e.g., setting the weight of traffic signal equipment during morning and evening rush hours or drainage equipment during rainstorm warnings to a higher value than normal, such as 1.2 or 1.3). The comprehensive calculation formula for the priority score is as follows: ,in, and This is a preset normalization and amplification coefficient. Through this formula, the model integrates the domain features of the above three dimensions into a single, comparable score. This calculation is performed on all emergency events, and they are sorted in descending order according to the scores, thereby generating a clear sequence of event priorities. This provides a domain-logical and interpretable decision-making basis for the subsequent precise allocation of limited emergency resources to the highest-risk scenarios.

[0035] Next, step S23 is executed: the event priority sequence is mapped to its associated target devices. Devices associated with events whose priority scores are higher than a preset threshold, such as 80, are classified into a high-priority device group; those below this threshold but above another lower threshold are classified into a medium-priority device group; and the rest are classified into a low-priority device group. The high-priority device group is directly defined as the target device group for this emergency response. For example, in a drainage system emergency, if the priority score of the severe blockage event of upstream pump station A is 95, and its directly associated downstream pump stations B and C have a priority score of 85 due to its influence, then devices A, B, and C are classified into the target device group. For each device in this group, the system automatically creates a response task list, which records the current abnormal status of the device, such as "flow surge, current value is 1500 units / second, exceeding the limit by 50%", and clear response requirements, such as "requires additional guarantee of storage write bandwidth of not less than 10MB per second and corresponding data encryption computing resources". Finally, S24 estimates resource requirements based on this response task list. It parses the response requirements declared by each device in the list and quantifies them into specific resource types and quantities. For example, for storage resources, based on the device's abnormal data traffic peak of 1500 units / second and the data type of encrypted structured records, each approximately 1KB, the estimated data volume generated per second can be estimated to be approximately 1.5MB. Combined with the expected duration of the abnormality, such as an estimated 30 minutes, the estimated storage space required by the device in this event can be calculated as: 1.5MB / s × 1800 seconds. The estimated resource requirement is approximately 2.7GB. This calculation is performed on all devices within the target device group and accumulated. At the same time, a certain percentage, such as 20%, is reserved to account for sudden fluctuations in the data flow. Finally, the total estimated resource requirement of the group is obtained. For example, a total of 15GB of high-speed storage space and corresponding network and computing power support are required. The resulting resource allocation scheme includes device grouping, response task list and estimated resource requirement. It clearly indicates the set of target devices that need to be guaranteed and their resource requirement quantitative indicators. It provides a precise and operable decision-making basis for subsequent steps to determine whether the existing resources are sufficient and how to make dynamic adjustments.

[0036] Step S2, determining whether the adjusted resource allocation scheme meets the data storage requirements, includes: determining the priority order of system resource reallocation based on the priority of the target device group; according to the priority order, partially reclaiming the storage resources allocated to non-target device groups and reallocating them to the target device group; dynamically adjusting the monitoring frequency of the real-time data stream to prioritize data acquisition for the target device group; generating an updated resource scheduling scheme based on the resource reallocation results and the monitoring frequency adjustment results; and monitoring and recording the resource occupancy status of each device group under the updated resource scheduling scheme in real time. If the real-time resource occupancy level of the target device group remains below the baseline resource threshold, it is determined that the current resource allocation scheme cannot meet the data storage requirements.

[0037] Specifically, resource reallocation is performed based on the priority order of target device groups. First, according to the event priority of each device within a group, the storage resources allocated to non-target device groups are strategically reclaimed sequentially. For example, their storage bandwidth quotas are reduced proportionally or their non-critical data write tasks are delayed. The reclaimed resources are then reallocated to the target device groups in real time, with the allocation amount positively correlated with their priority order to ensure that the highest-risk devices receive the most adequate resource protection. Simultaneously, the data acquisition frequency is adjusted accordingly. For example, the data acquisition frequency of devices within the target device group is increased from the baseline once per minute to once per second to capture more granular changes in operational status. Correspondingly, the acquisition frequency of non-target device groups is reduced to save system overhead. Based on the results of the above resource reallocation and monitoring frequency adjustment, an updated resource scheduling scheme is generated. This scheme clearly defines the upper limits of computing, storage, and network resource usage for each device in the next stage, as well as its data acquisition behavior parameters.

[0038] After the new resource scheduling scheme is put into operation, continuous monitoring of its execution performance is immediately initiated. Monitoring probes deployed on key nodes of the data pipeline collect and record the actual resource occupancy status of each device group, especially the target device group, in real time. Key indicators include actual storage write throughput, data processing queue length, and end-to-end evidence storage latency. This real-time monitoring data is compared with a pre-calculated baseline resource threshold. This baseline threshold is set based on the minimum theoretical resource amount required for the target device group to complete its data integrity, reliability, and timely evidence storage. For example, for a task that requires evidence storage of 10MB of abnormal data per second and must complete encrypted disk write within 2 seconds, its baseline write bandwidth threshold may be set to 12MB / s, taking into account encryption overhead and system overhead. The core of monitoring is not simply observing whether resources are occupied, but judging whether the actual resource supply capacity is consistently lower than the minimum theoretical resource requirement necessary to complete the evidence storage task. If, in multiple consecutive evaluation periods, the actual resource usage level of the target device group, such as the average write bandwidth, is consistently lower than its corresponding baseline resource threshold, it indicates that the maximum resource output that the system can currently provide is lower than the theoretical minimum input requirement to ensure the successful completion of the data evidence storage task. No matter how the internal scheduling algorithm of the system is optimized, its physical resource limit can no longer meet the task requirements, and data backlog, loss, or timeout will become inevitable results. At this time, it is determined that the current resource allocation scheme cannot meet the data evidence storage requirements. This determination indicates that the internal resource optimization means have reached their limit, and it is necessary to trigger the external resource expansion process to fundamentally improve the resource supply capacity, thereby ensuring the achievement of the evidence storage guarantee goal.

[0039] Step S3: If the data storage requirements are not met, then obtain backup resources and form an extended resource configuration scheme. Based on the extended resource configuration scheme and the path selection model, generate the shortest delay path for data storage, verify the reliability of the shortest delay path, and generate the final data storage path.

[0040] Step S3, which involves acquiring backup resources and forming an expanded resource configuration scheme, includes: if the adjusted resource allocation scheme does not meet the data storage requirements, initiating a backup resource acquisition process; verifying the availability of the current resource allocation scheme using data integrity verification technology; filtering out and marking unusable resources based on the verification results; acquiring available storage units from the backup resource pool based on the real-time data storage requirements of the target device group; initializing and configuring the storage units; integrating the acquired storage units into the existing resource configuration; optimizing the usage order of the storage units through a resource allocation algorithm; generating an expanded resource configuration scheme; performing stress testing on the expanded resource configuration scheme to verify its stability; and finally outputting a stable resource configuration scheme.

[0041] Specifically, after determining that the adjusted resource allocation scheme cannot meet the data storage requirements, it is necessary to acquire backup resources and form an expanded resource configuration scheme to fundamentally improve the system's resource supply capacity and meet the data storage and protection needs of critical equipment. In practice, the backup resource acquisition process is automatically triggered first. The system does not blindly introduce new resources; instead, it first uses data integrity verification technology to check the health status of all allocated units in the current resource pool. This verification includes collecting metadata of storage units such as capacity, access time, error count, and logical volume status, and using a cyclic redundancy check algorithm to perform integrity calculations on critical configuration information to identify and mark unavailable resources with potential faults or degraded performance, ensuring that subsequent expansion is based on stable and reliable existing resources. Subsequently, based on the real-time data storage requirements of the target device groups, such as peak data traffic, number of concurrent connections, and required storage capacity, a resource gap analysis is performed. Available storage units compatible with the current system architecture are selected from the pre-verified backup resource pool as needed. These units need to be initialized and configured before being put into use, including detecting and matching their interface protocols, configuring access keys and security policies consistent with the existing encryption storage mechanism, and verifying their compatibility with the existing data pipeline through simulated I / O operations to ensure seamless integration.

[0042] After integrating the initialized new storage units into the existing resource configuration framework, a resource allocation algorithm, such as priority-based weighted round-robin scheduling, is used to globally optimize and sort the write task queues of all available storage units. This ensures that evidence storage data from the highest priority device is always written to the storage unit with the best performance. Finally, to verify the high-load processing capability of the expanded resource configuration scheme, stress testing is conducted: by injecting a load several times the peak data traffic of the simulated target device, the response latency, throughput, and error rate of the entire evidence storage link are continuously monitored to ensure stable operation under extreme pressure, for example, a data write error rate below a preset threshold of 0.1% and no persistent queue backlog. Through the above series of steps, a verified, stable, and reliable expanded resource configuration scheme is finally generated. This scheme significantly improves the overall evidence storage resource supply capacity of the system, laying a solid physical foundation for subsequent intelligent calculation and optimization of the data evidence storage path based on this expanded resource pool.

[0043] In step S3, generating the shortest latency path for data storage based on the extended resource allocation scheme and the path selection model includes: determining the storage nodes and network links participating in data storage according to the extended resource allocation scheme; establishing a path selection model based on the distribution of storage nodes and network topology in the resource allocation scheme, with transmission delay as the optimization objective and path bandwidth availability and device group priority as constraints; solving the path selection model using a multi-objective optimization algorithm, which dynamically updates the weight parameters of each path through real-time collected network status data and adjusts the bandwidth allocation weight and latency tolerance threshold based on the priority of the target device group; and selecting the shortest latency path that meets the current device group's data storage requirements from all candidate paths based on the solution results.

[0044] Specifically, after obtaining a stable and reliable extended resource configuration scheme, the intelligent computing stage of the data storage path is entered. First, the extended resource configuration scheme is analyzed to accurately identify all currently available storage nodes and their interconnected network links. These nodes and links constitute the physical resource map of this path selection. Based on this resource map, a path selection model deeply coupled with the municipal data emergency storage scenario is constructed. This model takes minimizing end-to-end data transmission latency as its core objective and introduces two key constraints: one is the path bandwidth availability constraint, that is, the real-time available bandwidth of any hop link on the path is not less than the peak data traffic demand of the target device group; the other is the device group priority constraint, that is, the maximum tolerable latency of different priority groups is quantified into differentiated hard thresholds, for example, the highest priority group requires ≤50 milliseconds. The solution of the model requires structured multi-dimensional inputs, including: network topology and static attributes extracted from the resource configuration scheme; dynamic network status obtained in real time through monitoring probes; and quantified storage demand vectors derived from the target device groups. The model employs a multi-objective optimization algorithm. During iteration, this algorithm dynamically updates link weights based on real-time network status data and adjusts the optimization bias according to the priority weights of target device groups. Ultimately, the algorithm outputs one or more candidate path schemes that satisfy all business constraints. Based on preset decision rules, such as satisfying all core group constraints, it selects the path with the shortest overall predicted latency as the shortest latency path.

[0045] In an exemplary application scenario, such as Figure 2The diagram shown is an application example of the path selection model. It illustrates the complete decision-making process of intelligently selecting the shortest evidence storage path for an abnormal drainage pumping station Q in an emergency evidence storage scenario at a city-level municipal data center, based on an expanded resource configuration scheme. The example specifically presents a physical resource map consisting of three storage nodes (Node_A1, Node_B1, Node_C1) distributed in different data centers and their interconnection network links. The diagram clearly marks the static bandwidth limit of each link and the dynamic latency and available bandwidth values ​​obtained from real-time monitoring. The model takes minimizing end-to-end transmission latency as its core optimization objective and imposes two key business constraints: first, the real-time available bandwidth of any hop link on the path must not be lower than the peak data traffic requirement of the target device group, for example, 200MB / s, to ensure the integrity of data evidence storage; second, the total path latency must not exceed the maximum tolerance threshold allowed by the high-priority group, for example, 100ms. Based on real-time collected network status data, the model uses a multi-objective optimization algorithm to calculate and evaluate the real-time performance of all candidate paths from the data source to each storage node. The calculation results show that the path "Q→Node_A1" achieves the shortest transmission latency of 8 milliseconds while meeting all constraints and has a sufficient bandwidth safety margin of 650MB / s. Therefore, it was selected as the shortest evidence storage path. This example verifies that the method can effectively transform specific municipal emergency evidence storage business requirements into computable mathematical model constraints and rely on real-time network status data to drive dynamic optimization and solve the problem, thereby generating an intelligent evidence storage path planning scheme that meets both strict service quality requirements and has optimal transmission efficiency.

[0046] By establishing a dynamic path selection model that aims for minimum latency and strictly incorporates bandwidth and priority constraints, an optimal path that is both timely, reliable, and adaptive can be provided for emergency data storage, thereby significantly improving the timeliness of critical data storage and resource scheduling efficiency.

[0047] The path selection model is solved using a multi-objective optimization algorithm, including: constructing a set of objective functions with minimizing end-to-end transmission delay as the primary objective and maximizing available bandwidth as the secondary objective; assigning differentiated weight coefficients to the secondary objective based on the preset priority level of each device in the target device group; in each path calculation iteration, acquiring the current measured transmission delay and available bandwidth information of each candidate path in real time, and using the measured values ​​as dynamic input to update the objective function; outputting the optimal solution path set that satisfies the constraints by solving the updated objective function; and selecting a path from the optimal solution path set as the shortest delay path based on preset decision rules, wherein the decision rules prioritize ensuring that the delay requirements of high-priority device groups are met.

[0048] Specifically, to achieve intelligent solution of the shortest latency path for data notarization, the multi-objective optimization algorithm is configured as follows: First, a set of objective functions containing two core optimization objectives is constructed. The primary objective function F1 is to minimize the total end-to-end transmission delay T_total, which is quantified as the sum of the transmission delay of all network links on the selected path and the processing delay of each relay node. The secondary objective function F2 is to maximize the available bandwidth B_min of the bottleneck link of the path to improve the robustness of the path. Secondly, the algorithm introduces differentiated weight coefficients α_i for the secondary objective function F2 based on the priority levels preset in the emergency response plan for each device in the target device group, such as "critical," "important," and "general." Here, i is the priority level index. For example, for the "critical" level device group, its α value is assigned a higher value, such as 0.7, to significantly emphasize bandwidth assurance in optimization; for the "general" level group, a lower α value, such as 0.3, is assigned, making the optimization focus more on minimizing latency. This design ensures that the optimization direction is precisely aligned with the business assurance strategy. Taking the emergency evidence storage scenario of a sudden surge in pressure sensor data in the urban core area water supply network as an example, when the critical pressure sensor P1 located at the network hub and several downstream... When ordinary monitoring points trigger abnormal alarms simultaneously, the priority of the critical pressure sensor P1 is marked as "urgent," while the priority of several downstream ordinary monitoring points is marked as "normal." The system needs to select the optimal data storage path to the data center for the data streams of these two groups of devices. For different priority groups, the algorithm assigns differentiated weight coefficients to F2: For the "urgent" group to which P1 belongs, F2 is given a higher weight coefficient, such as α=0.8. This means that during optimization, it will strongly favor the selection of high-bandwidth paths, even if the path has slightly higher latency, to ensure that its massive abnormal data is not lost. For the "normal" group, a lower weight coefficient is assigned, such as α=0.2. During optimization, it focuses more on finding the path with the lowest latency, and its bandwidth requirements are relatively relaxed.

[0049] In each iteration, the algorithm obtains the dynamic performance indicators of each candidate path in real time through the SDN controller, including the current measured transmission delay and available bandwidth information. The current measured transmission delay is measured through active probe packets, and the available bandwidth information is collected through SNMP or NetFlow protocols. For example, there are two candidate paths: path A passes through the metropolitan area backbone network, with a measured delay of 25ms, but the current available bandwidth is only 15Mbps; path B passes through a newly built backup ring network, with a measured delay of 35ms, but the available bandwidth is as high as 100Mbps. The algorithm uses these real-time measured values ​​of 25ms, 15Mbps, 35ms, and 100Mbps as input parameters and updates the corresponding link cost and capacity variables in the objective functions F1 and F2 in real time, so that the path calculation can reflect the instantaneous changes in the network status. Next, under the constraints of bandwidth availability and differentiated latency tolerance thresholds for each priority group, the algorithm solves the updated multi-objective function. It employs a non-dominated sorting genetic algorithm based on an elitist strategy, evolving the path-encoding population through selection, crossover, and mutation operations. After multiple generations of iteration, the algorithm converges and outputs a Pareto optimal solution path set. The Pareto optimal solution path set refers to a set of candidate paths that achieve the best balance between the conflicting objectives of latency and bandwidth, and satisfy all business constraints, namely bandwidth requirements and latency limits. In the emergency evidence storage scenario of a sudden surge in pressure sensor data in the water supply network, the solution set may include schemes such as: {Path A, latency 25ms, bandwidth 15Mbps}, {Path B, latency 35ms, bandwidth 100Mbps}, etc. Subsequently, the preset decision rules are applied: First, the latency requirement of "emergency" level equipment P1 must be ≤50ms and the estimated peak bandwidth requirement is 20Mbps; the bandwidth of path A, i.e., 15Mbps, does not meet the P1 requirement and is therefore eliminated; path B satisfies all hard constraints. Next, among the solutions satisfying the "urgent" group constraints, only path B is available, and the one with the shortest latency is selected. Therefore, path B is determined as the shortest latency path for data flow P1. For data flows with "general" priority, path A may be selected from the remaining resources. This process, through a specific scenario example, clearly demonstrates how the algorithm dynamically balances latency and bandwidth, and strictly outputs differentiated optimal paths based on service priorities. This rule strictly adheres to the scheduling principle of "prioritizing the highest priority services," ensuring that limited network resources are used for the most critical evidence storage tasks.

[0050] Step S3, verifying the reliability of the shortest latency path, includes: conducting multi-level stress tests on the shortest latency path to verify its throughput and latency stability under simulated burst traffic. After passing the stress tests, the shortest latency path is determined as the data storage path and put into operation. At the same time, the operating status of the data storage path is monitored in real time, and the performance indicators of the data storage path are continuously collected and compared with the preset normal operation threshold. When any performance indicator exceeds the corresponding normal operation threshold more times than the preset threshold, it is determined that the reliability of the current data storage path has decreased, and the switching process is automatically triggered to switch the current data stream to the pre-configured and verified backup storage path in real time. The response time is recorded in combination with the abnormal log tracing function, and the path adjustment effect is analyzed based on the response time to output the final data storage path.

[0051] Specifically, taking the shortest latency path selected by the aforementioned multi-objective optimization algorithm using water supply network pressure sensor data, such as "Path B: latency 35ms, bandwidth 100Mbps," as an example, the reliability verification and assurance process is illustrated. First, before Path B officially carries real production traffic, it undergoes multi-level stress testing in an independent test environment. The first level is a baseline load test, continuously injecting a data stream equivalent to the estimated peak traffic of sensor P1 (20Mbps) into Path B for 5 minutes to verify whether its average latency is stable at around 35ms without packet loss. The second level is an overload impact test, simulating a sudden failure scenario, drastically increasing the traffic to 150Mbps within 1 second, reaching 150% of the path's nominal bandwidth, for 10 seconds, to test whether the path's buffer queue management capability and congestion control mechanism would cause high-priority P1 data packets to be dropped or latency to spike above 100ms. Only after this path passes all stress test hurdles, for example, the passing criteria are defined as: in overload testing, the packet loss rate of the P1 data stream is <0.01%, and the latency at the 95th percentile is <80ms, can it be officially deployed as the primary data storage path for P1.

[0052] After the path is put into operation, continuous real-time monitoring is initiated. Monitoring probes are deployed at the inlet, outlet, and key intermediate nodes of path B to collect performance indicators such as end-to-end latency, hop-by-hop latency, bandwidth utilization, and packet loss rate once per second. These real-time data are dynamically compared with preset normal operation thresholds. The thresholds are set according to the service SLA and the path's historical baseline. For example, for the "urgent" flow of P1, the end-to-end latency warning threshold is 45ms, and the critical threshold is 60ms; the bandwidth utilization warning threshold is 85%. Subsequently, a sliding time window, for example, with a length of 10 seconds, and an anomaly counting mechanism are used to determine reliability. If, within the most recent time window, a key performance indicator, such as end-to-end latency, exceeds its warning threshold a preset trigger threshold, for example, 3 times, the path is determined to have "reliability degradation" or "performance deterioration." Once the determination is successful, the automatic switching process is immediately triggered: the control system, such as the SDN controller, sends a flow table update command to the network device, and within a few hundred milliseconds, the data flow of P1 is quickly rerouted from the current primary path B to a pre-configured backup evidence storage path, such as "path C". This path has passed the basic stress test after the model solution and remains ready; after the switch is completed, path C is promoted to the new primary path, and the system continues to monitor it.

[0053] The entire switching event was fully recorded by the anomaly log tracing function, generating a structured log containing: the performance degradation detection timestamp (e.g., "T1"), the specific triggering metrics and values ​​(e.g., "latency exceeded 45ms three times consecutively, reaching a maximum of 52ms"), the switching decision time ("T2"), the switching execution time ("completed 80ms after T2"), and the initial performance of the new path after the switch ("initial latency of path C was 38ms"). Based on this log data, the path adjustment effect was analyzed. The key evaluation metric was the "total response time for fault detection and switching." If this total time was controlled within an acceptable business range (e.g., less than 2 seconds), and the performance of the new path after the switch was stable and met the standards, then path C was confirmed as the current final data storage path, and the routing strategy was updated. Furthermore, the logs and analysis results of this event will be stored in the knowledge base as historical cases for optimizing future threshold settings and switching strategies.

[0054] By implementing multi-level stress testing and continuous monitoring of the selected shortest latency path, and combining it with a sliding window-based anomaly detection and automatic fast switching mechanism, the high reliability and business continuity of the data storage path in a dynamic network environment are ensured, significantly reducing the risk of critical data loss or timeout due to path performance degradation. Figure 3The figure shows the quantitative comparison results of key performance indicators. It illustrates the performance evolution process across five stages, from the initial sudden state to the final stable state. Comparative analysis shows that after adopting the method described in this application, the data storage success rate increased from 85% to 99.5%, an improvement of 14.5 percentage points; the path switching response time was optimized from no backup path to a rapid switching time of within 1.8 seconds; and the resource gap was completely eliminated, achieving complete resource guarantee for data storage of critical equipment. This quantitative comparison result is based on the analysis of complete log records after integrity verification as described in step S4, objectively verifying the significant effect of the method described in this application in improving the timeliness, reliability, and integrity of abnormal data storage for target equipment.

[0055] Step S4: Based on the final data storage path, log the storage process of the target device, judge and verify the integrity of the log records, and generate the final resource adjustment confirmation result based on the verification result.

[0056] Step S4 involves judging and verifying the integrity of log records, including: recording the evidence storage process of all devices through the final data evidence storage path to generate structured logs; annotating the structured log content with abnormal data classification tags; classifying and storing the logs based on the annotation results; judging the integrity of log records to verify whether there is any missing data. If incomplete logs are found, the missing data is obtained through the log tracing mechanism, and the logs after supplementation are verified a second time; analyzing the execution of the resource adjustment process based on the complete log records after supplementation, evaluating whether the data evidence storage process has been improved, and generating the final resource adjustment confirmation result based on the evaluation results.

[0057] Specifically, after the final data storage path is running stably, auditable recording and closed-loop verification of the entire data storage process for the target device are initiated. First, a lightweight log agent is deployed at key nodes along this data storage path. These key nodes include the data acquisition terminal on the device side, the edge encryption gateway for security processing, the network transmission node responsible for routing, and the central storage cluster as the endpoint. Non-intrusive observation of the flowing data packets is performed, generating structured records with precise timestamps, operation types, device identifiers, and data summaries for each data acquisition operation, each round of encryption calculation, each network forwarding hop, and each successful storage write event. All scattered records for the same batch of raw data, such as the operating status data packets generated by a pump station at a specific second, are associated and aggregated through a globally unique storage transaction serial number, forming an indivisible, complete storage process chain log from the data source to the final storage location. This log chain is essentially a digital holographic record of the data storage lifecycle. Subsequently, the log processing engine automatically associates and semantically annotates each log entry in the evidence storage process chain with abnormal data classification tags such as "Equipment Type: Drainage Pumping Station", "Abnormality Level: Severe", and "Associated Event Group: Upstream Blockage Propagation". The annotated logs are then categorized and stored in different specialized log databases based on their business attributes. For example, all logs with the tag "Abnormality Level: Severe" are stored in a high-security "Critical Event Audit Database". This database is configured with stricter data protection strategies such as encrypted storage, access auditing, and higher data retrieval priority, which facilitates rapid and accurate location and source analysis based on business dimensions during post-event audits, fault reviews, or compliance checks.

[0058] To ensure the absolute credibility of audit evidence, a dual verification mechanism is implemented for the integrity of log records. The first layer is a sequential logical continuity verification, automatically verifying whether each evidence preservation process chain possesses a complete sequence of steps: data acquisition, data encryption, network transmission, node processing, data routing, storage writing, and storage confirmation. It also checks whether the timestamps of adjacent steps strictly increase and are reasonably spaced; for example, the start time of an encryption operation should not be earlier than the completion time of its corresponding data packet acquisition. The second layer is a periodic global consistency verification based on a cryptographic hash chain: with a fixed time period, such as every 5 minutes as an audit window, the following operations are automatically performed: calculating the cryptographic hash value (e.g., SHA-256) of the original content of all evidence preservation process chain logs generated within that window, and constructing a Merkle tree. Merkle trees are binary tree data structures built on cryptographic hash functions. They treat all evidence storage process logs generated within each audit window as leaf nodes, calculating and merging hash values ​​layer by layer upwards to generate a unique root hash. For scenarios with massive amounts of evidence storage logs on a target device, Merkle tree technology can efficiently compress the integrity proof of a large amount of data into a single hash value, satisfying the stringent requirements of data immutability and auditability while significantly reducing storage and verification overhead. Subsequently, the Merkle tree root hash value corresponding to that time window is written to a tamper-proof, append-only secure audit chain, such as a blockchain node based on a lightweight consensus mechanism. To proactively probe integrity, the Merkle tree root hash of historical audit windows is periodically recalculated and automatically compared with the corresponding root hash permanently recorded in the secure audit chain. Any inconsistency immediately triggers an alarm.

[0059] If any step of the above dual verification mechanism detects an anomaly, such as a missing step in the logical continuity verification or an inconsistency in the Merkle root hash comparison, the log is determined to be incomplete. The log tracing and supplementation mechanism is immediately and automatically triggered. This mechanism intelligently queries the local circular buffer, persistent cache, or forwarding logs of adjacent nodes in each step of the data pipeline based on the transaction serial number or time window of the missing record, attempting to recover the lost log fragments. All recovered log entries are marked as "tracing and supplementation" and re-participate in the integrity verification process until the log set within that time period can pass the dual verification to form a self-consistent and complete audit record.

[0060] Finally, based on this complete and verified log record, the analysis engine performs a closed-loop performance evaluation. It uses the entire emergency response event, such as the time from the first alarm at a drainage pumping station to the completion of all related data authentication, as the unit of analysis. It extracts a series of key performance indicators from the log: these include response timeliness indicators, such as the time delay from the first abnormal alarm to the successful authentication of the first key data entry; authentication quality indicators, such as the data authentication success rate of target device groups after dynamic resource adjustments, average authentication latency, whether path switching occurred and the switching time; and resource performance indicators, such as the actual usage time and utilization rate of backup resources. These quantitative indicators will be compared and analyzed with the performance baseline during the initial resource shortage period of the event, as well as the service level targets set in this emergency response plan, thereby objectively evaluating whether and to what extent the dynamic resource adjustments and path optimizations improved the data authentication process.

[0061] Based on this assessment, a structured final resource adjustment confirmation result is generated. This result not only includes qualitative conclusions such as "successful," "partially successful requiring optimization," or "failed requiring intervention," but also detailed quantitative evidence and subsequent action instructions. For example, if the conclusion is "successful," the system will automatically release temporarily occupied backup resources and add the successful resource scheduling pattern and performance data to the historical case library for future self-learning and optimization. If the conclusion is "partially successful," the identified optimization points, such as "approximately 200 milliseconds of data buffer latency during path switching," will be transformed into specific strategy optimization suggestions and updated to the system's decision rule base. Thus, the entire process of secure data storage for target devices in response to emergencies completes a closed loop from perception, decision-making, execution to auditing, assessment, and optimization.

[0062] In summary, this application provides a comprehensive, dynamic, and closed-loop method for secure data storage of target devices. Starting from the source, this method accurately identifies a list of potential escalating events by real-time collection, secure encryption, and intelligent anomaly detection of target device operational status data, providing a reliable data-driven starting point for emergency response. Based on this, intelligent priority assessment and target device grouping are performed according to the urgency of the event and the scope of its business impact, generating a quantified resource allocation plan. The core innovation of this method lies in its dynamic adaptive capability: when initial resource scheduling cannot meet the critical data storage requirements, it can automatically trigger the acquisition and expansion of backup resources, and based on the expansion… The subsequent resource allocation utilizes a path selection model that integrates business priority constraints and a multi-objective optimization algorithm to intelligently calculate the optimal evidence storage path that balances low latency, high bandwidth, and SLA requirements. To ensure the continuous reliability of the path, this application designs a multi-level stress test and an automatic switching mechanism based on sliding window monitoring, significantly improving the system's resilience in dynamic network environments. Finally, through full-link auditable log recording of the complete evidence storage process, integrity verification based on cryptographic hash chains, and closed-loop performance evaluation, this application not only achieves traceability and non-repudiation of the evidence storage process but also forms a complete closed loop from problem perception, intelligent decision-making, elastic execution to effect verification and strategy optimization. This methodology effectively solves the challenge of ensuring the secure, complete, and timely evidence storage of abnormal data from critical target equipment in resource-constrained emergency scenarios, providing strong technical support for the stable operation and efficient maintenance of smart city infrastructure.

[0063] The above describes a data security evidence storage method for smart city construction in the embodiments of this application. The following describes a data security evidence storage system for smart city construction in the embodiments of this application. Please refer to [link / reference]. Figure 4 One embodiment of a data security evidence storage system for smart city construction, as described in this application, includes:

[0064] The data acquisition module is used to acquire the operating status data of the target equipment, preprocess the operating status data to generate the equipment operation dataset, identify data anomalies based on the equipment operation dataset, and determine a list of potential emergencies.

[0065] The equipment classification module is used to classify target equipment according to the list of emergencies, identify target equipment groups, generate corresponding resource allocation schemes, adjust resource allocation schemes, and determine whether the adjusted resource allocation schemes meet the data storage requirements.

[0066] The path generation module is used to obtain backup resources and form an extended resource configuration scheme if the data storage requirements are not met. Based on the extended resource configuration scheme and the path selection model, the shortest delay path for data storage is generated, the reliability of the shortest delay path is verified, and the final data storage path is generated.

[0067] The logging module is used to log the evidence storage process of the target device based on the final data evidence storage path, judge and verify the integrity of the log records, and generate the final resource adjustment confirmation result based on the verification result.

[0068] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0069] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0070] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A data security evidence storage method for smart city construction, characterized in that, The method includes: Step S1: Obtain the operating status data of the target device, preprocess the operating status data to generate a device operating dataset, identify data anomalies based on the device operating dataset, and determine a list of potential emergencies; Step S2: Classify the target devices according to the list of emergencies, identify the target device groups, generate corresponding resource allocation schemes, adjust the resource allocation schemes, and determine whether the adjusted resource allocation schemes meet the data storage requirements. Step S3: If the data storage requirements are not met, then acquire backup resources and form an extended resource configuration scheme. Based on the extended resource configuration scheme and the path selection model, generate the shortest delay path for data storage, verify the reliability of the shortest delay path, and generate the final data storage path. Step S3, which generates the shortest latency path for data storage based on the extended resource configuration scheme and the path selection model, includes: determining the storage nodes and network links participating in data storage according to the extended resource configuration scheme; establishing a path selection model based on the distribution of storage nodes and network topology in the resource configuration scheme, wherein the path selection model takes transmission delay as the optimization objective and introduces path bandwidth availability and device group priority as constraints; solving the path selection model using a multi-objective optimization algorithm, wherein the multi-objective optimization algorithm dynamically updates the weight parameters of each path through real-time collected network status data, and adjusts the bandwidth allocation weight and latency tolerance threshold based on the priority of the target device group; and selecting the shortest latency path that meets the current device group's data storage requirements from all candidate paths based on the solution results. The path selection model is solved using a multi-objective optimization algorithm, including: constructing a set of objective functions with minimizing end-to-end transmission delay as the primary objective and maximizing available bandwidth of the path as the secondary objective; assigning differentiated weight coefficients to the secondary objective based on the preset priority level of each device in the target device group; in each path calculation iteration, acquiring the current measured transmission delay and available bandwidth information of each candidate path in real time, and using the measured values ​​as dynamic input to update the objective functions; outputting a set of optimal solution paths that satisfy the constraints by solving the updated objective functions; and selecting a path from the set of optimal solution paths as the shortest delay path based on preset decision rules, wherein the decision rules prioritize ensuring that the delay requirements of high-priority device groups are met. Step S4: Based on the final data storage path, log the storage process of the target device, judge and verify the integrity of the log records, and generate the final resource adjustment confirmation result based on the verification result.

2. The method according to claim 1, characterized in that, Step S1 identifies a list of potential contingencies, including: S11: Obtain the real-time data stream and historical data archive records of the target device as operating status data, perform preliminary cleaning processing on the operating status data, and perform data encryption processing on the cleaned data for evidence storage, and integrate the encrypted real-time data stream and historical data archive records into a device operating dataset. S12: Monitor the data flow in the device operation dataset in real time. When the data flow exceeds the dynamic threshold, trigger a data surge alarm and generate alarm information containing the abnormal time point and device identifier. S13: Based on the alarm information, candidate sudden data surge events with continuous abnormal characteristics are selected from all alarm events, the candidate sudden data surge events are classified in multiple dimensions, and the classified events are integrated into a preliminary sudden event list in chronological order. S14: Perform an inter-event correlation analysis on the preliminary emergency list. Based on the correlation analysis results, eliminate isolated events and confirm related event groups to form the final emergency list.

3. The method according to claim 1, characterized in that, Step S2 involves identifying the target device group and generating a corresponding resource allocation scheme, including: S21: Filter each event in the emergency event list according to the preset emergency response conditions, and extract the emergency events that require immediate intervention; S22: Perform a comprehensive priority assessment on the extracted emergency events, generate an event priority sequence based on the assessment results, and map and divide the associated target devices into corresponding device groups according to the event priority sequence; S23: Define the device group with a response priority higher than a preset threshold as the target device group, and create a response task list containing the current abnormal status identifier and response requirements for each device in the target device group; S24: Based on the response requirements recorded in the response task list, the resource requirements of the target device group are estimated, and a resource allocation scheme including device groups, response task list and estimated resource requirements is finally formed.

4. The method according to claim 3, characterized in that, Step S2, determining whether the adjusted resource allocation scheme meets the data storage requirements, includes: The priority order of system resource reallocation is determined according to the priority of the target device group. Based on the priority order, the evidence storage resources allocated to non-target device groups are partially reclaimed and reallocated to the target device group. The monitoring frequency of real-time data streams is dynamically adjusted to prioritize data acquisition for target device groups. Based on the resource reallocation results and the monitoring frequency adjustment results, an updated resource scheduling scheme is generated. The resource occupancy status of each device group under the updated resource scheduling scheme is monitored and recorded in real time. If the real-time resource occupancy level of the target device group is continuously lower than the baseline resource threshold, it is determined that the current resource allocation scheme cannot meet the data storage requirements.

5. The method according to claim 1, characterized in that, Step S3 involves acquiring backup resources and forming an expanded resource configuration scheme, including: If the adjusted resource allocation scheme does not meet the data storage requirements, the backup resource acquisition process will be initiated. The availability of the current resource allocation scheme will be verified through data integrity verification technology, and unusable resources will be filtered out and marked based on the verification results. Based on the real-time data storage requirements of the target device group, available storage units are obtained from the backup resource pool, the storage units are initialized and configured, and the obtained storage units are integrated into the existing resource configuration. The usage order of the storage units is optimized through the resource allocation algorithm to generate an extended resource configuration scheme. The extended resource configuration scheme is subjected to stress testing to verify its stability, and finally a stable resource configuration scheme is output.

6. The method according to claim 1, characterized in that, Step S3 verifies the reliability of the shortest delay path, including: Multi-level stress tests are performed on the shortest latency path to verify its throughput and latency stability under simulated burst traffic. After passing the stress tests, the shortest latency path is determined as the data storage path and put into operation. At the same time, the operation status of the data storage path is monitored in real time, and its performance indicators are continuously collected and compared with preset normal operation thresholds. When any performance indicator exceeds the corresponding normal operation threshold more than the preset threshold, it is determined that the reliability of the current data storage path has decreased, and a switching process is automatically triggered to switch the current data stream to a pre-configured and verified backup storage path in real time. The response time is recorded by combining the anomaly log tracing function, and the path adjustment effect is analyzed based on the response time to output the final data storage path.

7. The method according to claim 1, characterized in that, Step S4 involves judging and verifying the integrity of the log records, including: The data storage process for all devices is recorded through the final data storage path to generate structured logs. The structured log content is then annotated with abnormal data classification tags. The logs are categorized and stored based on the annotation results. The completeness of the log records is assessed to verify for missing data. If incomplete logs are found, the missing data is retrieved through a log tracing mechanism, and the supplemented logs are then subjected to secondary verification. Based on the completed supplemented log records, the execution of the resource adjustment process is analyzed to assess whether the data storage process has been improved. Based on the assessment results, a final resource adjustment confirmation result is generated.

8. A data security evidence storage system for smart city construction, used to implement the data security evidence storage method for smart city construction as described in any one of claims 1-7, characterized in that, The system includes: The data acquisition module is used to acquire the operating status data of the target device, preprocess the operating status data to generate a device operating dataset, identify data anomalies based on the device operating dataset, and determine a list of potential emergencies. The equipment classification module is used to classify the target equipment according to the emergency list, identify the target equipment groups, generate corresponding resource allocation schemes, adjust the resource allocation schemes, and determine whether the adjusted resource allocation schemes meet the data storage requirements. The path generation module is used to obtain backup resources and form an extended resource configuration scheme if the data storage requirements are not met. Based on the extended resource configuration scheme and the path selection model, the shortest delay path for data storage is generated, the reliability of the shortest delay path is verified, and the final data storage path is generated. The logging module is used to log the evidence storage process of the target device based on the final data evidence storage path, judge and verify the integrity of the log records, and generate the final resource adjustment confirmation result based on the verification result.

Images