Data security encryption communication system for meteorological station

Abstract

The invention relates to the technical field of wireless communication security, and discloses a meteorological station data security encryption communication system, which comprises a data acquisition area, a data transmission area, a data processing and storage area, an access control area and a security management area, the data acquisition area generates SM3 Hash for each acquisition record and links the SM3 Hash with a preorder record to form a local Hash chain; the data transmission area is provided with a national secret router, and zero-trust communication between equipment is realized based on credible token dynamic networking; the cryptographic router constructs an equipment behavior portrait in real time; a zero-trust access agent is deployed in the access control area, and the safety management area is responsible for token full-life-cycle management and log compression auditing through a CA server. According to the method, the SM3 hash chain is generated through the data acquisition area, chain type integrity self-checking is completed before transmission, full-link zero-trust verification and a burn-after-use mechanism of data from acquisition to transmission are ensured, and eavesdropping, tampering and replay attacks are effectively prevented.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of wireless communication security, in particular to a meteorological station data secure encryption communication system. BACKGROUND

[0002] With the rapid development of wireless communication technology, Internet of Things and big data technology, meteorological monitoring systems have become indispensable infrastructure in the fields of disaster prevention and reduction, agricultural production, climate research and urban management. As a front-end data acquisition node, meteorological stations acquire key meteorological elements such as temperature, humidity, air pressure, wind speed, wind direction and precipitation in real time through various sensors, and transmit the data to the back-end data center for processing, storage and analysis via a communication network, providing core data support for weather forecasting, disaster warning and decision support.

[0003] In the prior art, meteorological station data is usually collected through a communication module with a SIM card, and is sent to the data center in the form of a short message or a data message by means of a mobile cellular network. This scheme is simple in structure and flexible in deployment, and is widely used in various automatic meteorological stations. After being converted into digital data by a sensor, the data is packaged into a fixed format message by a master control unit, and a modem is controlled by an AT instruction to establish a point-to-point or point-to-multipoint connection. The data is transmitted in plaintext or weakly encrypted mode, and is parsed and stored in the database after being received by the data center.

[0004] However, the present inventors have found in the process of implementing the technical solution of the present application that the prior transmission mechanism lacks an end-to-end data integrity protection and trusted identity binding mechanism. The data is not associated in a verifiable chain from the time of collection to the time of transmission. The application layer zero-trust encryption and dynamic authentication are not realized during the transmission process, which leads to the data being vulnerable to man-in-the-middle tampering, fake base station injection or replay attacks. SUMMARY

[0005] To overcome the above problems, the present application provides a meteorological station data secure encryption communication system, which aims to improve the problem that the application layer zero-trust encryption and dynamic authentication are not realized during the transmission process in the prior art, which leads to the data being vulnerable to man-in-the-middle tampering, fake base station injection or replay attacks.

[0006] The present application provides the following technical solution, a meteorological station data secure encryption communication system, comprising a data collection area, a data transmission area, a data processing and storage area, an access control area and a security management area. The data collection area generates an SM3 hash for each collection record and links it with the previous record to form a local hash chain, and completes the chain integrity self-checking before transmission. The data transmission area deploys a national secret router, and realizes zero-trust communication between devices based on a trusted token dynamic network, wherein each device extracts a physical unclonable feature through a PUF to generate a device fingerprint, a CA server periodically issues a short-term token containing an SM2 signature and a device fingerprint, and the token is burned after use; The national secret router constructs a device behavior portrait in real time, detects abnormalities based on an isolated forest algorithm, and automatically performs SM4 key rotation, token revocation, and link speed reduction; The data processing and storage area performs hash chain integrity verification on received data and stores the data by SM4 encryption; The access control area deploys a zero-trust access agent, and the instruction is issued through device token and user biometric feature double-factor verification; The security management area is responsible for token life cycle management by the CA server and realizes log compression and audit.

[0007] Preferably, the data collection area generates an SM3 hash for each collection record and links it with the previous record to form a local hash chain, and the process of completing chain integrity self-checking before transmission includes: Constructing a record structure containing a timestamp, an element value vector, and a previous hash, calculating the SM3 hash value of the current record, storing the local hash chain in sequence, and verifying the hash of each record in sequence before transmission to see if it is equal to the SM3 calculation result of the timestamp, the element value vector, and the previous hash. If all are equal, the chain is complete, otherwise, mark the abnormal record and trigger re-collection.

[0008] Preferably, the process of realizing zero-trust communication between devices based on a trusted token dynamic network in the data transmission area includes: Each device extracts a 128-bit device fingerprint as a hardware identity root through a PUF circuit, the CA server periodically issues a short-term token containing a source device identifier, a destination device identifier, an expiration time, a device fingerprint, and an SM2 signature after initial pairing, the device uses the short-term token to initiate a chain building request to the opposite end, and after exchanging the latest short-term token, calculates a session key and establishes an SM4 encrypted tunnel. Tunnel data packets contain sequence numbers, payloads, and current hash values of local hash chains, and the short-term token is burned after verification.

[0009] Preferably, the process of constructing a device behavior portrait in real time by the national secret router, detecting abnormalities based on an isolated forest algorithm, and automatically performing SM4 key rotation, token revocation, and link speed reduction includes: Statistical new connection number, concurrent connection number, total traffic, protocol entropy and request interval regularity five behavior characteristics in 60 seconds sliding window, build history normal behavior vector training isolation forest model, calculate the abnormal score of current behavior vector, when the score exceeds the threshold, it is judged to be abnormal, when the abnormal trigger, based on the current session key, the current time and the random number to generate a new SM4 key, the CA server pushes the revocation list containing the abnormal device identifier and the expiration time, and dynamically adjusts the QoS strategy to limit the link to the minimum value.

[0010] Preferably, the process of the data processing and storage area performing hash chain integrity verification on received data and storing with SM4 encryption includes: Reorganize the received records in order, calculate the SM3 hash of each record in turn and compare it with the received hash value, if all are equal, the chain is complete, otherwise discard all records from the abnormal position, encrypt the passed data and data SM3 hash through the central master key, and store the encrypted ciphertext in the distributed cluster and ensure the consistency of multiple copies through the Paxos protocol.

[0011] Preferably, the process of the access control area deploying a zero trust access agent and instructing a double-factor verification process through a device token and user biometric features includes: Before instructing, verify the validity of the device short-term token, and at the same time extract the user's real-time biometric features and calculate the normalized Euclidean distance score with the registered template, when the short-term token is valid and the score is not less than the biometric threshold, the SM4 tunnel is released by the SM4 encryption gateway and the instruction is issued.

[0012] Preferably, the process of the security management area responsible for token life cycle management by the CA server and realizing log compression auditing includes: The CA server maintains a short-term token state machine, including issued, activated, revoked, and expired, and broadcasts a revocation list containing the device identifier, expiration time and CA signature after revocation; After concatenating multiple original logs in chronological order, calculate the SM3 hash, generate a summary log containing the hash, start time, end time and log number, and report to the audit center after adding the CA signature.

[0013] Preferably, the process of the device using a short-term token to initiate a chain building request to the opposite end, and calculating the session key after exchanging the latest short-term token includes: The source device sends a chain building request containing the source short-term token to the destination device, the destination device verifies the source short-term token and returns a response containing the destination short-term token, and both sides calculate the SM3 hash as the session key by concatenating the source short-term token and the destination short-term token and adding a random number.

[0014] Preferably, the process of calculating protocol entropy in a 60-second sliding window includes: The protocol entropy is obtained by calculating the logarithm of the proportion of each type of protocol data packet in the statistical window, and then weighting and summing the logarithm to obtain a negative value, and the protocol types include TCP, UDP, ICMP and others.

[0015] Preferably, the process of extracting real-time biological features of the user and calculating the normalized Euclidean distance score with the registered template comprises: For the MFCC vector of the voiceprint feature extraction, and the minutiae point set of the fingerprint feature extraction, the Euclidean distance between the real-time feature vector and the registered template vector is calculated, and the value obtained by dividing the modulus of the registered template vector is subtracted from 1 to obtain the matching score.

[0016] The present application has the following beneficial effects: 1. The present application generates an SM3 hash chain in the data acquisition area and completes the chain integrity self-checking before transmission, combines the PUF device fingerprint, SM2 signature short-term token and SM4 encryption tunnel of the national secret router deployed in the data transmission area, ensures the zero-trust verification and burn-after-use mechanism of the whole link from data acquisition to transmission, effectively prevents eavesdropping, tampering and replay attacks, and realizes the confidentiality and integrity of meteorological data.

[0017] 2. In the present application, the national secret router constructs a five-element behavior portrait based on the isolation forest algorithm within a 60-second sliding window, and automatically triggers SM4 key rotation, token revocation and link speed reduction when the abnormal score exceeds the threshold, combined with the broadcast of the revocation list of the CA server, to quickly isolate threats and ensure the robustness of the system when facing DDoS, MITM and other attacks.

[0018] 3. In the present application, the access control area zero-trust agent requires two-factor authentication of device short-term token and user biological features, and only releases the matching score standard instruction, and the CA server in the security management area maintains the token state machine and calculates the SM3 hash to generate a signed summary log by concatenating the log, realizes the whole life cycle management and compressed audit, and ensures the trust, controllability and traceability of the instruction issuance and system operation. BRIEF DESCRIPTION OF DRAWINGS

[0019] Figure 1 The figure is a data security interaction link topology diagram of the meteorological station acquisition terminal and the data center of the present application. DETAILED DESCRIPTION

[0020] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings, obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0021] REFERENCE Figure 1In the first embodiment of the present application, the present application provides a meteorological station data security encryption communication system, comprising a data acquisition area, a data transmission area, a data processing and storage area, an access control area and a security management area; The data acquisition area generates an SM3 hash for each acquisition record and links the previous record to form a local hash chain, and performs a chain integrity self-check before transmission; The data transmission area deploys a national secret router, and realizes zero-trust communication between devices based on a trusted token dynamic network, wherein each device generates a device fingerprint by extracting a physically unclonable feature through a PUF, a CA server periodically issues a short-term token containing an SM2 signature and a device fingerprint, and the token is burned after use; The national secret router constructs a device behavior portrait in real time, detects abnormalities based on an isolation forest algorithm, and automatically performs SM4 key rotation, token revocation and link speed reduction; The data processing and storage area performs hash chain integrity verification on the received data and stores them by SM4 encryption; The access control area deploys a zero-trust access agent, and the instruction issuance needs to pass through device token and user biological feature double-factor verification; The security management area is responsible for token life cycle management by the CA server and realizes log compression audit.

[0022] Specifically, the meteorological station terminal is located in the data acquisition area, and an SM4 encryption tunnel is established with the national secret router on the data center side through the national secret router. The national secret router on the data center side is connected with the national secret encryption gateway, and the national secret encryption gateway is connected with the data processing and storage area. The CA server is deployed in the security management area and communicates with the national secret routers on both sides through a dedicated line. The zero-trust access agent is integrated in the national secret encryption gateway.

[0023] The system workflow is as follows: the meteorological station sensor outputs an analog signal at a preset frequency, and the main control unit generates an acquisition record after completing analog-to-digital conversion. Each acquisition record contains a timestamp Element value vector And the previous hash The current hash is calculated by the SM3 algorithm Form a local hash chain. Before transmission, perform chain integrity self-checking, and send it through the national secret router after verification.

[0024] Before the national secret router receives the data, the terminal device generates a 128-bit device fingerprint through the PUF circuit The CA server issues a short-term token based on the device fingerprint The token contains the source device identifier Destination device identifier Expiration time Device fingerprint And SM2 signature Distributed by SM4 encryption. The terminal uses a short-term token to establish an SM4 encryption tunnel with the opposite router. The session key is generated by , where is a random number.

[0025] The data packet is transmitted in the tunnel, and the format is:

[0026] where Seq is the sequence number, is the collection record, is the current hash chain node value. The national secret router counts five behavior characteristics in a 60-second sliding window, including the number of new connections concurrent connections total traffic protocol entropy and request interval regularity The protocol entropy calculation formula is , where is the proportion of the type of protocol data packet, is the number of protocol types.

[0027] The router trains an isolation forest model based on the historical behavior vector to calculate the anomaly score of the current behavior vector . When exceeds the threshold , SM4 key rotation is performed, and the new key is generated by , and the abnormal device token is revoked and the link is limited.

[0028] After the data center receives the data, it reorganizes the records in order and verifies the integrity of the hash chain. When is consistent with the received value , the chain is complete. The data that passes the verification is SM4 encrypted with the center master key , and the ciphertext is stored in the distributed cluster.

[0029] When the instruction is issued, the zero-trust access agent verifies the validity of the device short-term token and calculates the user biometric matching score. For voiceprint, extract the MFCC vector; for fingerprint, extract the minutiae point set. The matching score only when the token is valid and , the instruction is issued through the SM4 tunnel.

[0030] The server maintains a token state machine, including issued, activated, revoked, and expired. After revocation, a revocation list is generated and broadcast. After concatenating multiple logs, the SM3 hash is calculated to generate a digest log​ Additional Signatures are archived after signing.

[0031] The above process constitutes a complete closed-loop interaction. Data is protected by local hash chain, trusted token dynamic networking and abnormal behavior portrait from collection to storage. The system realizes device identity trust, transmission channel trust and running state trust through physically unclonable features, short-term tokens and behavior detection.

[0032] Further, the data collection area generates an SM3 hash for each collection record and links it with the previous record to form a local hash chain. The process of completing chain integrity self-checking before transmission includes: Construct a record structure containing a timestamp, an element value vector and a previous hash, calculate the SM3 hash value of the current record, store the local hash chain in sequence, and verify the hash of each record before transmission. If all are equal, the chain is complete, otherwise mark the abnormal record and trigger re-collection.

[0033] Specifically, the data collection area includes temperature sensors, humidity sensors, barometric pressure sensors, wind speed sensors, wind direction sensors and precipitation sensors. The temperature sensor uses a PT100 platinum resistor. The humidity sensor uses a capacitive film, the barometric pressure sensor uses a silicon piezoresistive type, the wind speed sensor uses a three-cup type, the wind direction sensor uses a wind vane encoder with a measurement range of 0° to 359°, and the precipitation sensor uses a tipping bucket type.

[0034] Each sensor outputs an analog voltage signal, which is converted to a digital quantity by a 24-bit A / D converter. The converted digital quantity represents the original value of the first element in the first sampling.

[0035] The main control unit is based on an ARM Cortex-M7 processor with a running frequency of 600MHz and an integrated hardware SM3 accelerator. The processor reads assembles an element value vector timestamp generated by the built-in real-time clock based on UTC time.

[0036] Record structure is defined as a fixed-length byte array: the first 8 bytes are the timestamp (uint64), the next 48 bytes are the element value vector (6 uint64), and the last 32 bytes are the previous hash (256 bits), with a total length of 88 bytes. When the initial record is generated, the previous hash Fill in 32 bytes of all zeros.

[0037] The SM3 hash calculation process is as follows: the first 56 bytes of are concatenated with to form an 88-byte input. The input is padded to the SM3 standard requirement: append 1 bit of 1, then fill 0 to the length modulo 512 remainder 448, and then append 64 bits of the original length. After padding, the data is fed into the SM3 compression function, and a 256-bit hash value is output. .

[0038] The main control unit maintains a ring buffer with a capacity of 1024 records, which is stored in a ferroelectric memory FRAM. The records are written in order, and the write pointer is circular. When writing , the local hash chain storage block is also stored in the adjacent 32-byte area.

[0039] Before transmission, the main control unit reads the sequence of records to be sent from the buffer and their corresponding hash chain integrity self-checking starts from : read (all zeros), calculate and compare the results with the stored . If they are equal, continue to calculate and compare with the stored . Perform this step by step until .

[0040] If all comparisons are equal, mark the entire sequence as complete and enter the transmission queue. If the th record fails to compare, mark to as an abnormal sequence. The main control unit sends a reacquisition command to the corresponding sensor to reacquire the element values at to time, generating a new record sequence to replace the abnormal part. The new sequence recalculates the hash chain and is inserted into the original position in the buffer.

[0041] The local storage adopts a first-in, first-out strategy. When the buffer is full, the write pointer covers the earliest record, and the record is checked to see if it has been transmitted. If it has not been transmitted, the transmission process is forcibly triggered. After transmission confirmation, the corresponding storage block is released. Abnormal records do not enter the transmission queue and are directly triggered for reacquisition.

[0042] The element value vector is checked for range before storage. The temperature value is limited to -5000 to , humidity value is limited to 0-10000, air pressure value is limited to 5000-11000, wind speed value is limited to 0-6000, and precipitation cumulative value is limited to 0-65535. Values outside the range are marked as invalid, triggering a sensor self-check signal.

[0043] Further, the process of implementing zero-trust communication between devices based on dynamic networking of trusted tokens in the data transmission area includes: Each device extracts a 128-bit device fingerprint as a hardware identity root through a PUF circuit. The CA server periodically issues a short-term token containing the source device identifier, the destination device identifier, the expiration time, the device fingerprint, and an SM2 signature after initial pairing. The device initiates a chain establishment request to the opposite end using the short-term token. After exchanging the latest short-term token, both parties calculate the session key and establish an SM4 encryption tunnel. The tunnel data packet contains the sequence number, payload, and current hash value of the local hash chain. The short-term token is verified and then destroyed; The process of using a short-term token to initiate a chain establishment request to the opposite end and calculating a session key after exchanging the latest short-term token includes: The source device sends a chain establishment request containing the source short-term token to the destination device. The destination device verifies the source short-term token and returns a response containing the destination short-term token. Both parties calculate the SM3 hash as the session key by concatenating the source short-term token and the destination short-term token and adding a random number.

[0044] Specifically, the data transmission area includes a national secret router on the meteorological station side and a national secret router on the data center side, which are connected through a dedicated line or a LoRa link. The national secret router is based on the NP+ASIC architecture. The router is equipped with a PUF module, uses an SRAM startup noise extraction mechanism, and the PUF circuit is composed of 1024 SRAM units. After power-on, the 0 / 1 state of each unit after stabilization is read as the original response.

[0045] The PUF fingerprint extraction process is as follows: after the router is powered on, the PUF module performs 128 times of excitation response collection, and each excitation is an 8-bit address Read the corresponding SRAM unit state Collect 128 groups The input error correction encoder uses BCH(255,128) code to correct 1-bit flip, and the output is a 128-bit stable device fingerprint The corrected fingerprint is stored in the read-only firmware area of the router and is not lost during power failure.

[0046] In the initial pairing stage, the router on the meteorological station side submits the device fingerprint and the device identifier (64-bit derivative) to the server through a secure channel. The CA server maintains a device fingerprint database and verifies the uniqueness before injecting the trusted root public key. After pairing is complete, The server initiates a periodic issuance of tokens.

[0047] Short-term tokens The structure is a fixed 160 bytes: the first 8 bytes are the source device identifier. (uint64), the last 8 bytes are the destination device identifier. (uint64), last 8 bytes expiration time (uint64, UTC milliseconds), last 16 bytes device fingerprint (128 bits), last 96 bytes SM2 signature (use private key Perform an SM2 signature on the first 64 bytes. The plaintext tokens are then concatenated with the current session key. (128-bit SM4) encryption to generate ciphertext.

[0048] The CA server pushes information to the weather station's router via a dedicated management channel. The router receives and uses it. Decryption, obtain After decryption, perform SM2 signature verification: extract the first 64 bytes of plaintext, calculate... Visa verification passed and If the token is valid, it will be stored in the token cache area, which has a capacity of 32 tokens and is sorted by expiration time.

[0049] The connection request is initiated by the router on the weather station side. The router retrieves the latest valid token from its cache. Generate 32-bit random numbers Constructing a chain establishment request packet: The first 4 bytes are the protocol identifier (0xA1B2C3D4) Last 4 bytes serial number The last 160 bytes Ciphertext, last 32 bytes The request packet is sent to the data center-side router via the underlying link.

[0050] After receiving the request packet, the data center-side router parses it. Ciphertext, using local Decrypt and verify the signature. Once verification is successful, extract the data. Check for consistency with the database. Also check... Not expired. After successful verification, the router retrieves its latest token. Generate 32-bit random numbers Constructing the response packet: The first 4 bytes are the protocol identifier, and the last 4 bytes are the original... The last 160 bytes Ciphertext, last 32 bytes The response packet is sent back.

[0051] The weather station's router receives the response packet and parses it. They then perform the same decryption and signature verification process. After successful verification by both parties, they each calculate their session keys. The source side calculates the SessionKey. -SM3(☑cpm‖Tsrc‖rast Target side calculation Reversing the concatenation order ensures consistency. The session key is 256 bits long; the first 128 bits are used as the SM4 key.

[0052] After the SM4 encrypted tunnel is established, the data packet format is fixed at 88 bytes: the first 4 bytes are the sequence number Seg(uint32). (Incrementing), followed by 80 bytes of ciphertext, and then 4 bytes of checksum. The payload is the collected data. (88 bytes), appending the current hash (32 bytes), total 120 bytes. The first 80 bytes of the input SM4 are truncated before encryption, resulting in a 96-byte ciphertext (including 16 bytes). Add a 4-byte CRC32 checksum. The encrypted packet is...

[0053] Short-term tokens after tunnel construction and Tokens are deleted from the cache to achieve "use and discard" functionality. An aging timer is set in the token cache to automatically remove expired tokens. The session key's validity period is related to the token's validity. Once bound, the tunnel will automatically close after expiration, triggering a new round of chain building.

[0054] Furthermore, the national cryptographic router constructs a real-time device behavior profile, and automatically executes SM4 key rotation, token revocation, and link speed reduction processes after detecting anomalies based on the isolated forest algorithm. Within a 60-second sliding window, the system statistically analyzes five behavioral characteristics: the number of newly established connections, the number of concurrent connections, the total traffic, the protocol entropy, and the regularity of request intervals. It then constructs historical normal behavior vectors to train an isolated forest model and calculates the anomaly score of the current behavior vector. When the score exceeds a threshold, an anomaly is identified. When an anomaly is triggered, a new SM4 key is generated based on the current session key, the current time, and a random number. The CA server pushes a revocation list containing the anomaly device identifier and expiration time, while dynamically adjusting the QoS policy to limit the link rate to the minimum. The process of calculating protocol entropy within a 60-second sliding window includes: The protocol entropy is obtained by calculating the logarithm of each protocol data packet within the statistical window, weighting and summing the logarithms of each protocol, and taking the negative value. The protocol types include TCP, UDP, ICMP, and others.

[0055] Specifically, the national cryptographic router integrates a traffic acquisition module, which implements deep packet parsing based on hardware TCAM and the NetFlow engine. The acquisition module maintains a sliding window counter with 1ms granularity. Each counter uses a 64-bit register with overflow wrap-around. When the window slides, the old 1-second data is shifted out and the new 1-second data is shifted in, and the counter is updated in real time.

[0056] The five-element behavioral characteristics are defined as follows: number of newly established connections. Counts the number of TCP packets within the window where the SYN flag is set and no SYN-ACK is observed. Concurrent connections. This represents the number of active TCP connection entries at the end of the window. The connection table uses a 5-tuple (source IP, source port, destination IP, destination port, protocol) as the key. Total traffic. For all within the window The sum of the packet payload bytes, in bytes.

[0057] Protocol Entropy Statistics are based on protocol fields. Routers parse the P header protocol fields and maintain four types of counters: TCP packet count. Number of UDP packets ICMP packet count Other protocol packets Total number of windows Various proportions in The formula for calculating protocol entropy is: when Time definition The calculation results are stored in 64-bit floating-point format.

[0058] Regularity of request intervals Based on the arrival time sequence of connection establishment request packets. The router records the arrival timestamp ts of each connection establishment request packet. In-window sequence. Sort in ascending order. Calculate the interval between adjacent rows. Calculate the standard deviation Regularity is defined as The larger, The smaller.

[0059] Every 60 seconds, the router generates a behavior vector. Normalize each component to Normalization uses the maximum value from statistics over the past 24 hours. As the denominator, when the current value exceeds Then set to 1 and update Normalized vector

[0060] The isolated forest model consists of 256 itrees, each with a maximum depth of 16. Training set. Includes the past The first day's data was labeled as normalized vectors, totaling 10080. During training, each tree... 512 random samples were taken and recursively segmented to a single point. Segmentation attributes were randomly selected, and segmentation points were uniformly randomized within the attribute value range. Path length. The average path length is the number of edges from the root to a leaf in the tree for each sample. Take the 256-tree mean. Dataset size harmonic number. For the harmonic number approximation Abnormal scores .

[0061] The model is updated offline once per hour, replacing the oldest sample with the latest normal vector within a sliding window. Threshold Fixed at 0.6, score It has been determined to be abnormal.

[0062] When an anomaly is triggered, the router executes a three-level response. First, it generates a 128-bit random number. Current time (UTC milliseconds) Calculate the new session key The first 128 bits. The old tunnel is immediately closed, and the new key is notified to the peer via the management channel.

[0063] Secondly, the router to Server reports abnormal device identifier and current The CA server generates a list of revocation entries. Sign the SM2 list. The list is pushed through the management channel in the form of broadcast frames, and all routers update their local CL cache upon receiving it. The cache capacity is 128 entries; if it exceeds the limit, the oldest entry is overwritten.

[0064] Finally, router adjustments Policy. The policy table uses the device identifier as the key, and will be updated after an exception. The corresponding entry has a speed limit. Priority reduced to lowest. Speed ​​limit remains in effect until CRL. Expired or received Release command. The original speed will be restored after release.

[0065] The recovery mechanism is as follows: After a faulty device is revoked, the initial pairing process must be re-executed, and a new request must be submitted. fingerprint. After the server verifies the fingerprint change, it issues a new token. The router then clears the corresponding entry in the CRL, and QoS is restored.

[0066] Furthermore, the process by which the data processing and storage area performs hash chain integrity verification on the received data and stores it encrypted with SM4 includes: The received records are reassembled in order. The SM3 hash of each record is calculated and compared with the received hash value. If all are equal, the chain is complete; otherwise, all records from the abnormal position are discarded. The verified data and the data SM3 hash are encrypted with SM4 using the central master key. The encrypted ciphertext is stored in a distributed cluster and the consistency of multiple replicas is guaranteed by the Paxos protocol.

[0067] Specifically, the data processing and storage area is deployed in the data center, consisting of high-performance computing nodes and a Ceph storage cluster. The computing nodes run containerized services, and the images contain SM3 / SM4 libraries and Paxos consistency modules.

[0068] After data packets forwarded by the Chinese cryptographic router arrive at the computing node, they first enter the receive buffer. The buffer is a circular queue with a capacity of 65,536 packets, and each packet has a fixed size of 96 bytes (80 bytes of ciphertext). Byte serial number (Byte checksum + 8 bytes metadata). The metadata includes the source device identifier. and timestamp range

[0069] The decryption process is as follows: The compute node uses the current session key, SessionKey. Perform SM4 decryption on each packet: Output 80 bytes of plaintext. The first 4 bytes of the plaintext are the sequence number. back The payload consists of bytes. The payload structure is as follows: the first 88 bytes are the collected data. The last 32 bytes are the current hash. Total 120 bytes. Before decryption, the data is truncated. Bytes, the rest are discarded.

[0070] Decrypt the package by pressing Sq and Grouping and entering the reassembly queue. The reassembly queue maintains an ordered list of records using the device identifier as the key. When a new packet is received, check if the sequence number (Sq) is consecutive. If an intermediate sequence number is missing, a retransmission request is triggered, and the weather station-side router is notified via the management channel. If the sequence number is consecutive, then... and Add to the end of the list.

[0071] Hash chain integrity verification starts from the head of the list. Read the first record. , It consists of 32 bytes of all zeros. Calculate. Comparison results and reception If they are equal, continue processing. calculate With Receiving Compare. Execute item by item until the end of the list.

[0072] When the The record comparison failed, and the record location is abnormal. The system discarded it. All records up to the end of the list, retained. to As a valid link segment. Discarding the record also generates an exception report, containing... The failure hash value is reported to the security management area. Valid segments are marked as pending storage.

[0073] Central Master Key Generated by the Hardware Security Module (HSM), the system performs overall encryption on the valid chain segment data before encryption. (all (Serialized) Calculate SM3 hash: Encrypted input is The input is padded to the SM4 block boundary (16-byte aligned), and the padding method is as follows: .

[0074] SM4 encryption uses CBC mode, initialization vector The encryption process is performed in blocks: every 28-bit plaintext block is XORed with the previous ciphertext block, and then SM4= is input. The first block is then ANDed with... XOR. Output ciphertext. The length is equal to the length of the plaintext after padding. A 4-byte length field (uit32) is appended to the ciphertext. Before filling (Number of bytes) and 8-byte timestamp Create a storage object.

[0075] Storage objects are written to the distributed cluster via a Ceph client. The cluster consists of two OSD nodes and uses a daily... Erasure coding involves dividing the data into 8 chunks and the verification into 4 chunks. Before writing, the Ceph client divides the stored object into 8 data blocks. Calculate 4 check blocks The segmentation algorithm is based on Reed-Solomon codes.

[0076] Multi-replica consistency is guaranteed by the Paxos protocol. The CephMonitor cluster consists of 5 nodes, forming a Paxos proposer / receiver / learner group. When a write operation is initiated, the master monitor proposes a proposal number. This includes the storage object ID and version number. After at least three Monitors accept the proposal, they submit a write command to the OSD. Upon receiving the command, the OSD performs the local write and returns an ACK upon completion. The primary Monitor collects a majority of ACKs and broadcasts a commit message; the write is complete after all OSDs acknowledge it.

[0077] The metadata of the stored objects is recorded in CephPG (Placement Group). Mapped to the primary OSD. During a query, the client uses the CRUSH algorithm to locate the PG and the primary OSD. Read ciphertext After reading, perform SM4 decryption and verification. Check if the SM3 calculated from the decrypted data matches. If it matches, output... For use by upper-level meteorological analysis systems.

[0078] Abnormal chain segments are handled as follows: A discarded record sequence triggers a retransmission mechanism. The compute node sends a NAK packet containing the missing Sq range to the weather station-side router. The router retrieves the corresponding record from its local hash chain buffer, encapsulates it, and retransmits it through a new tunnel. The maximum number of retransmissions is 3. Exceeding this limit marks the device as untrusted and reports it to the CA server.

[0079] Furthermore, a zero-trust access agent is deployed in the access control zone. The process of issuing commands through two-factor authentication using both device tokens and user biometrics includes: Before issuing the instruction, the validity of the device's short-term token is verified. At the same time, the user's real-time biometric features are extracted and the normalized Euclidean distance score is calculated with the registration template. Only when the short-term token is valid and the score is not lower than the biometric threshold, the national cryptographic encryption gateway allows the instruction to be issued through the SM4 tunnel. The process of extracting real-time biometric features from users and calculating normalized Euclidean distance scores with the registration template includes: For voiceprint feature extraction, the MFCC vector is extracted. For fingerprint feature extraction, the minutiae point set is extracted. The Euclidean distance between the real-time feature vector and the registered template vector is calculated. The result is divided by the magnitude of the registered template vector and then 1 minus this value is taken as the matching score.

[0080] Specifically, the access control area includes a zero-trust access proxy server, a national cryptographic encryption gateway, and biometric data collection terminals. The proxy server is based on an x86 architecture and runs a containerized ZTAP service. The national cryptographic encryption gateway is directly connected to the data transmission area router via gigabit Ethernet. The biometric data collection terminals are deployed at operator workstations and support voiceprint microphones and fingerprint scanners.

[0081] Instructions are issued by the operator via... The console initiates the process. The console submits a command packet to the proxy server; the packet structure is: the first 8 bytes are the target device identifier. The last 8 bytes are operator D. The instruction type code is followed by a variable-length instruction payload, then 4 bytes. Upon receiving this, the proxy server first retrieves the latest short-term token for the target device from its local token cache. .

[0082] Token validity verification involves three steps: S1. Check the expiration time This is the server's current UTC millisecond timestamp.

[0083] S2, Use Public Key Perform SM2 verification: Calculate With signature Comparison.

[0084] S3. Query the local CRL cache to confirm. Not on the revocation list. If any step fails, the instruction is rejected and an error code is returned. .

[0085] Biometric verification and token verification are performed in parallel: the operator clicks the authentication button on the console, and the terminal starts data collection. In voiceprint mode, the microphone records 3 seconds of voice. Preprocessing includes a pre-emphasis filter. The system is frame-by-frame, calculating second-order MFCC coefficients for each frame, adding first and second-order differences to obtain a 36-dimensional vector, averaging the frame-level vectors, and outputting a 36-dimensional real-time voiceprint vector. .

[0086] Furthermore, the security management zone, managed by the CA server, includes the following process: token lifecycle management and log compression auditing. The CA server maintains a short-term token state machine, with states including issued, activated, revoked, and expired. After revocation, a revocation list containing the device identifier, expiration time, and CA signature is broadcast. Multiple raw logs are concatenated in chronological order, and an SM3 hash is calculated to generate a summary log containing the hash, start time, end time, and number of log entries. After attaching a CA signature, the summary log is submitted to the audit center.

[0087] Specifically, the security management area is centered around a CA server and adopts a highly available dual-machine hot standby architecture. The two physical servers achieve master-slave switching through a heartbeat line. The CA server is based on an x86 architecture and is equipped with a hardware cryptographic machine as an accelerator for national cryptographic algorithms and a root key storage medium. The root private key is stored in fragments in the HSM and smart key dual backups. Recovery requires presenting both key fragments at the same time.

[0088] Token lifecycle management is driven by a Finite State Machine (FSM). Each short-lived token corresponds to an independent state machine instance. The instance data structure is a 128-byte fixed-length record: the first 8 bytes are the token ID, the next 8 bytes are the source device identifier, the next 8 bytes are the destination device identifier, the next 8 bytes are the issuance timestamp, the next 8 bytes are the expiration timestamp, the next 16 bytes are the device fingerprint, the next 64 bytes are the SM2 signature, the next 4 bytes are the status code, the next 4 bytes are the version number, and the next 4 bytes are reserved. All instances are stored in the high-performance key-value database RocksDB, with the token ID as the key and the value stored after compression. The database enables WAL and snapshot mechanisms.

[0089] Finally, it should be noted that the above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A secure encrypted communication system for meteorological station data, characterized in that, It includes a data acquisition area, a data transmission area, a data processing and storage area, an access control area, and a security management area; The data acquisition area generates an SM3 hash for each acquisition record and links it with the previous record to form a local hash chain, and performs chain integrity self-verification before transmission. The data transmission area is equipped with a national cryptographic router, which realizes zero-trust communication between devices based on trusted token dynamic networking. Each device extracts physical unclonable features through PUF to generate a device fingerprint. The CA server periodically issues short-term tokens containing SM2 signatures and device fingerprints, which are destroyed after use. The national cryptographic router builds a device behavior profile in real time, and automatically performs SM4 key rotation, token revocation and link speed reduction after detecting anomalies based on the isolated forest algorithm. The data processing and storage area performs hash chain integrity verification on the received data and stores it with SM4 encryption. The access control zone deploys a zero-trust access agent, and command issuance requires two-factor authentication using both device tokens and user biometrics. The security management zone is managed by the CA server, which is responsible for the entire lifecycle management of tokens and implements log compression and auditing.

2. The weather station data security encryption communication system according to claim 1, characterized in that, The data acquisition area generates an SM3 hash for each acquisition record and links it with the preceding record to form a local hash chain. The process of completing the chain integrity self-verification before transmission includes: Construct a record structure containing timestamp, feature value vector, and preceding hash, calculate the SM3 hash value of the current record, store them in order to form a local hash chain, and verify in order whether the hash of each record is equal to the SM3 calculation result of timestamp, feature value vector, and preceding hash before transmission. If they are all equal, the chain is complete; otherwise, mark the abnormal record and trigger re-collection.

3. The weather station data security encryption communication system according to claim 1, characterized in that, The process of achieving zero-trust communication between devices based on trusted token dynamic networking in the data transmission area includes: Each device extracts a 128-bit device fingerprint through the PUF circuit as its hardware identity root. After initial pairing, the CA server periodically issues short-term tokens containing the source device identifier, destination device identifier, expiration time, device fingerprint, and SM2 signature. The device uses the short-term token to initiate a chain establishment request to the peer. After exchanging the latest short-term tokens, the two parties calculate the session key and establish an SM4 encrypted tunnel. The tunnel data packet contains the sequence number, payload, and the current hash value of the local hash chain. The short-term token is destroyed after successful verification.

4. The weather station data security encryption communication system according to claim 1, characterized in that, The process by which the national cryptographic router constructs a real-time device behavior profile and automatically performs SM4 key rotation, token revocation, and link speed reduction after detecting anomalies based on the isolated forest algorithm includes: Within a 60-second sliding window, five behavioral characteristics—new connection count, concurrent connection count, total traffic, protocol entropy, and request interval regularity—are statistically analyzed. Historical normal behavior vectors are used to train an isolated forest model. An anomaly score is calculated for the current behavior vector. If the score exceeds a threshold, an anomaly is identified. When an anomaly is triggered, a new SM4 key is generated based on the current session key, the current time, and a random number. The CA server pushes a revocation list containing the anomaly device identifier and expiration time. Simultaneously, the QoS policy is dynamically adjusted to limit the link rate to the minimum.

5. A secure encrypted communication system for meteorological station data according to claim 1, characterized in that, The process by which the data processing and storage area performs hash chain integrity verification on the received data and stores it encrypted with SM4 includes: The received records are reassembled in order. The SM3 hash of each record is calculated and compared with the received hash value. If all are equal, the chain is complete; otherwise, all records from the abnormal position are discarded. The verified data and the data SM3 hash are encrypted with SM4 using the central master key. The encrypted ciphertext is stored in a distributed cluster and the consistency of multiple replicas is guaranteed by the Paxos protocol.

6. A secure encrypted communication system for meteorological station data according to claim 1, characterized in that, The access control zone deploys a zero-trust access proxy, and the process of issuing instructions requiring two-factor authentication using both device tokens and user biometrics includes: Before issuing the instruction, the validity of the device's short-term token is verified. At the same time, the user's real-time biometric features are extracted and normalized Euclidean distance scores are calculated with the registration template. When the short-term token is valid and the score is not lower than the biometric threshold, the national cryptographic encryption gateway allows the instruction to be issued through the SM4 tunnel.

7. A secure encrypted communication system for meteorological station data according to claim 1, characterized in that, The security management zone, managed by the CA server, involves the following process: token lifecycle management and log compression auditing. The CA server maintains a short-term token state machine, with states including issued, activated, revoked, and expired. After revocation, a revocation list containing the device identifier, expiration time, and CA signature is broadcast. Multiple raw logs are concatenated in chronological order, and an SM3 hash is calculated to generate a summary log containing the hash, start time, end time, and number of log entries. After attaching a CA signature, the summary log is submitted to the audit center.

8. A secure encrypted communication system for meteorological station data according to claim 3, characterized in that, The device uses a short-term token to initiate a chain establishment request to the peer. The process of calculating the session key after both parties exchange the latest short-term tokens includes: The source device sends a chain establishment request containing a source short-term token to the destination device. After verifying the source short-term token, the destination device returns a response containing the destination short-term token. Both parties concatenate the source short-term token and the destination short-term token and add a random number to calculate the SM3 hash as the session key.

9. A secure encrypted communication system for meteorological station data according to claim 4, characterized in that, The process of calculating protocol entropy within a 60-second sliding window includes: The protocol entropy is obtained by calculating the logarithm of each protocol data packet within the statistical window, weighting and summing the logarithms of each protocol, and taking the negative value. The protocol types include TCP, UDP, ICMP, and others.

10. A secure encrypted communication system for meteorological station data according to claim 6, characterized in that, The process of extracting real-time biometric features of users and calculating normalized Euclidean distance scores with the registration template includes: For voiceprint feature extraction, the MFCC vector is extracted. For fingerprint feature extraction, the minutiae point set is extracted. The Euclidean distance between the real-time feature vector and the registered template vector is calculated. The result is divided by the magnitude of the registered template vector and then 1 minus this value is taken as the matching score.

Images