Meteorological observation data hybrid encryption method and device based on polling key, and medium

Abstract

The invention provides a meteorological observation data hybrid encryption method and device based on a polling key, and a medium, and the method comprises the steps: carrying out the correlation analysis of a timeliness evaluation index and the geographic coordinate information of a meteorological observation device, determining a grade division threshold value, and dividing the meteorological observation data into key sensitive data and common non-sensitive data; the method comprises the following steps: extracting unique identity identification information of meteorological observation equipment and acquisition timestamp information of meteorological observation data, generating an initial encryption master key, and performing iterative transformation processing on the initial encryption master key to generate a polling sub-key sequence; and the key sensitive data and the common non-sensitive data are respectively processed to obtain a key data encryption result and a common data encryption result, the key data encryption result and the common data encryption result are respectively associated and bound with the Hash verification values of the corresponding target polling sub-keys, associated data pairs of the encrypted data and the Hash verification values are generated, and a composite encrypted data packet is generated after standardization. According to the invention, the reliability of encrypted data management is improved.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method, device and medium for hybrid encryption of meteorological observation data based on polling keys. Background Technology

[0002] Meteorological observation data serves as the foundational data source for applications such as weather forecasting and disaster early warning; its security directly impacts the reliability and accuracy of meteorological services. Currently, common meteorological observation data encryption techniques typically employ fixed encryption algorithms for uniform data encryption. Symmetric encryption algorithms, due to their high encryption efficiency, are widely used for batch data encryption, while asymmetric encryption algorithms, due to their high security, are often used for critical data encryption. Key management generally involves pre-setting static keys or periodically updating random keys to control the encryption process. However, meteorological observation data exhibits significant spatiotemporal characteristics; data collected from different regions and at different times possess varying application value and sensitivity. Existing encryption methods fail to fully consider these spatiotemporal dynamics, leading to a mismatch between encryption strategies and the actual sensitivity of the data. Therefore, how to more effectively encrypt meteorological observation data has become a research hotspot in the field of meteorological data security. Summary of the Invention

[0003] In view of this, the present invention provides a method, device, and medium for hybrid encryption of meteorological observation data based on a polling key. The technical solution of the embodiments of the present invention is implemented as follows:

[0004] On one hand, embodiments of the present invention provide a hybrid encryption method for meteorological observation data based on polling keys. The method includes: generating a timeliness assessment index for meteorological observation data by combining the geographic coordinate information of the meteorological observation equipment and the collection time information of the meteorological observation data; performing correlation analysis between the timeliness assessment index and the geographic coordinate information of the meteorological observation equipment to determine a sensitivity level classification threshold for the meteorological observation data; classifying the meteorological observation data into key sensitive data and ordinary non-sensitive data based on the sensitivity level classification threshold; extracting the unique identification information of the meteorological observation equipment and the collection timestamp information of the meteorological observation data; generating an initial encryption master key based on the unique identification information and the collection timestamp information; performing iterative transformation processing on the initial encryption master key to generate a polling subkey sequence with time series correlation; and selecting from the polling subkey sequence for the key sensitive data. The target polling subkey corresponding to the current encryption time is XORed with a preset asymmetric encryption public key to generate a composite encryption key. Based on this composite encryption key, the critical sensitive data is subjected to asymmetric encryption to obtain the critical data encryption result. For the ordinary non-sensitive data, the target polling subkey corresponding to the current encryption time is selected from the polling subkey sequence. This target polling subkey is used as the input key for a symmetric encryption algorithm to perform symmetric encryption on the ordinary non-sensitive data to obtain the ordinary data encryption result. The critical data encryption result and the ordinary data encryption result are respectively associated with the hash checksum of the corresponding target polling subkey to generate an associated data pair of encrypted data and hash checksum. The associated data pair is then format-standardized to generate a composite encrypted data packet of meteorological observation data containing data type identifiers.

[0005] On the other hand, embodiments of the present invention provide a computer device including a memory and a processor, wherein the memory stores a computer program that can run on the processor, and the processor executes the program to implement the steps in the above-described method.

[0006] Furthermore, embodiments of the present invention also provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the methods described above.

[0007] This invention generates a timeliness assessment index by combining the geographic coordinates of meteorological observation equipment with the acquisition time information of meteorological observation data. This achieves a quantitative correlation between the effective duration of meteorological data in the time dimension and the regional correlation characteristics in the spatial dimension, thus deeply coupling the sensitivity level classification with the spatiotemporal dynamic characteristics of meteorological data. An initial encryption master key is generated by extracting the unique identification information of the equipment and the acquisition timestamp information. Through iterative transformation, a polling subkey sequence with time-series correlation is generated, enhancing the strong correlation between the key and the equipment identity and acquisition time. Simultaneously, the dynamic changes and time correlation of the subkeys in the sequence effectively reduce the risk of key leakage. A hierarchical strategy of asymmetric encryption with composite encryption keys and symmetric encryption with polling subkeys is adopted for the classified critical sensitive data and ordinary non-sensitive data, respectively. This achieves synergistic optimization of encryption security and efficiency, providing higher security for highly sensitive data while maintaining encryption efficiency for low-sensitivity data. By associating and binding the encryption result with the hash verification value of the corresponding polling subkey and generating a composite encrypted data packet containing data type identifiers, the matching of encrypted data and keys and the integrity during transmission and storage are ensured, improving the reliability of encrypted data management. Attached Figure Description

[0008] Figure 1 This is a schematic diagram illustrating the implementation process of a hybrid encryption method for meteorological observation data based on a polling key, provided in an embodiment of the present invention.

[0009] Figure 2 This is a schematic diagram of the hardware entity of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0010] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein is for descriptive purposes only and is not intended to limit the scope of the invention.

[0011] This invention provides a hybrid encryption method for meteorological observation data based on a polling key, which can be executed by a processor of a computer device. The computer device can refer to a server, laptop, tablet, desktop computer, or other device with data processing capabilities.

[0012] Figure 1 This is a schematic diagram illustrating the implementation process of a hybrid encryption method for meteorological observation data based on a polling key, as provided in an embodiment of the present invention. Figure 1 As shown, the method includes: Step S100: Combining the geographic coordinate information of the meteorological observation equipment and the collection time information of the meteorological observation data, generate a timeliness assessment index for the meteorological observation data. The timeliness assessment index is used to characterize the effective duration of the meteorological observation data in the time dimension and the regional correlation characteristics in the spatial dimension.

[0013] The geographic coordinates of meteorological observation equipment accurately pinpoint its location; this set of latitude and longitude data uniquely identifies its spatial location. The data acquisition time information records the specific moment the data was generated, reflecting its temporal attribute and serving as a marker on the timeline. The timeliness assessment index is an indicator that comprehensively considers the spatiotemporal characteristics of meteorological observation data. In the time dimension, it reflects the length of time from data generation to loss of validity, i.e., the effective lifespan; in the spatial dimension, it reflects the close connection between the data and a specific geographical region, i.e., regional correlation characteristics. By combining geographic coordinate information and acquisition time information to generate this index, the value and usability of meteorological observation data can be assessed more comprehensively and accurately.

[0014] In one implementation, step S100 may specifically include the following steps S110 to S160: Step S110: Extract the longitude and latitude coordinates from the geographic coordinate information of the meteorological observation equipment, query the preset regional meteorological element gradient table, and obtain the meridional meteorological element gradient values ​​of the region corresponding to the longitude coordinates and the latitudinal meteorological element gradient values ​​of the region corresponding to the latitude coordinates. The meteorological element gradient values ​​are used to characterize the rate of change of meteorological parameters within a unit distance.

[0015] The geographic coordinate information includes longitude and latitude coordinates. Longitude coordinates indicate the device's position in the east-west direction, while latitude coordinates indicate its position in the north-south direction. The pre-defined regional meteorological element gradient table is a table constructed after extensive data collection and analysis. It is divided according to different longitude and latitude regions, storing the corresponding longitude and latitudinal meteorological element gradient values ​​for each region. The longitude gradient values ​​reflect the changes in meteorological parameters (such as temperature, air pressure, and humidity) per unit distance along the longitude direction; the latitudinal gradient values ​​reflect the corresponding changes along the latitude direction. Extracting longitude and latitude coordinate values ​​can be achieved by parsing the geographic coordinate information, for example, using string splitting or data structure extraction methods. When querying the regional meteorological element gradient table, the extracted longitude and latitude coordinate values ​​can be used as query conditions to match and search within the table to obtain the corresponding gradient values.

[0016] Step S120: Read the acquisition time information of meteorological observation data, parse it into time components of multiple time granularities, input the time components into the time series decomposition module to obtain the time trend term, periodic term and random disturbance term, extract the slope value of the trend term as the time trend parameter, a positive time trend parameter indicates that the data increases with time, and a negative time trend parameter indicates that it decreases.

[0017] Meteorological observation data collection time information is recorded in formats such as timestamps or date-time strings. To analyze the temporal characteristics of the data more deeply, it needs to be parsed into time components with multiple time granularities, such as year, month, day, hour, minute, and second. This parsing process can be achieved through time processing functions or regular expressions, performing corresponding splitting operations based on the specific format of the collected time information. The time series decomposition module is specifically designed for processing time series data, decomposing the input time components. For example, it consists of a data preprocessing unit, a model selection unit, a trend term extraction unit, a period term extraction unit, and a random disturbance term calculation unit.

[0018] The data preprocessing unit performs preliminary processing on the input time components, such as noise removal and missing value imputation. For missing time components, linear interpolation can be used. Linear interpolation is based on data values ​​at adjacent time points, assuming that the time components change linearly between adjacent points, and estimates the value of the missing points through calculation. For noisy data, the moving average filtering method is used. This method selects a certain length of time window, calculates the average value of the time components within the window to replace the original values, reduces the impact of noise, and makes the data smoother. The model selection unit selects a suitable decomposition model from additive and multiplicative models based on the characteristics of the meteorological observation data. The additive model assumes that the time series is the result of the linear addition of the trend term, periodic term, and random disturbance term; the multiplicative model assumes that they are multiplicative. If the periodic fluctuation amplitude of the data is relatively stable and does not change with the time trend, the additive model is selected; if the periodic fluctuation amplitude increases or decreases with the time trend, the multiplicative model can more accurately fit the data.

[0019] The trend extraction unit processes the time series after selecting a model to extract the trend term. Taking the additive model as an example, the moving average method is used. This method sets a fixed-length time window, slides the window point by point on the time series, and calculates the average value of the time components within the window as the estimated value of the trend term corresponding to the center point of the window. As the window slides, the trend term of the entire time series is obtained. The periodicity extraction unit uses autocorrelation analysis to determine the periodicity of the data. Autocorrelation analysis calculates the correlation between the time series and its own series lagged by several periods. The autocorrelation coefficient at different lag orders reflects the similarity of the time series at different time intervals. When the autocorrelation coefficient shows obvious peaks at certain lag orders, these lag orders correspond to the periodicity of the data. Based on the determined periodicity, the time series after removing the trend term is processed to extract the periodicity term. The random disturbance term calculation unit obtains the random disturbance term through mathematical operations. After obtaining the trend term and periodicity term, the trend term and periodicity term are subtracted from the original time components in turn, and the difference obtained is the random disturbance term. The random disturbance term reflects random changes in a time series that cannot be explained by trends and periods, and may be caused by factors such as sudden meteorological events and measurement errors.

[0020] Step S130: Calculate the sum of squares of the gradient values ​​of meridional meteorological elements and the gradient values ​​of zonal meteorological elements, take the square root to obtain the spatial gradient modulus, divide the spatial gradient modulus by the preset spatial reference gradient value to obtain the normalized spatial gradient index. The larger the normalized spatial gradient index, the more drastic the spatial variation of meteorological parameters.

[0021] Meridional and zonal meteorological gradient values ​​describe the rates of change of meteorological parameters along the longitude and latitude directions, respectively. The spatial gradient modulus, obtained by calculating the sum of their squares and taking the square root, comprehensively considers the changes in meteorological parameters in both directions, reflecting the overall spatial variation of meteorological parameters. A preset spatial baseline gradient value, derived from statistical analysis of extensive meteorological data, is used to normalize the spatial gradient modulus. Normalization aims to eliminate differences in the magnitude of meteorological gradient values ​​across different regions, allowing for a fair comparison of the spatial variations of meteorological parameters in different areas. A larger normalized spatial gradient index indicates more drastic spatial variation of meteorological parameters in that region, meaning greater spatial differences in meteorological conditions. For example, in mountainous areas or at the boundary between ocean and land, the spatial variation of meteorological parameters is usually more drastic, and the normalized spatial gradient index may be higher; while in plains areas, the spatial variation of meteorological parameters is relatively smaller, and the normalized spatial gradient index may be lower.

[0022] Step S140: Calculate the ratio of the absolute value of the time trend parameter to the slope of the preset time base to obtain the time trend coefficient. The larger the time trend coefficient, the more significant the time evolution characteristics of the data.

[0023] The time trend parameter is the slope value of the trend term extracted from the time series decomposition module, reflecting the changing trend of meteorological observation data over time. The preset time baseline slope is a pre-defined reference slope value, obtained through statistical analysis of historical meteorological data, used to standardize the time trend parameter. The time trend coefficient is obtained by calculating the ratio of the absolute value of the time trend parameter to the preset time baseline slope. This coefficient eliminates the magnitude differences in time trend parameters between different datasets, allowing for comparison of the temporal evolution characteristics of different meteorological observation data. A larger time trend coefficient indicates a more significant evolution of the meteorological observation data over time, meaning the rate of change of the data is greater relative to the preset baseline slope. For example, during certain special meteorological events, such as typhoons and rainstorms, the temporal evolution characteristics of meteorological observation data will be very significant, and the time trend coefficient may be large; while during periods of relatively stable weather, the temporal evolution characteristics of the data are relatively weak, and the time trend coefficient may be small.

[0024] Step S150: The normalized spatial gradient index and the time trend coefficient are weighted and summed, with the weight coefficients being the spatial weight and the time weight, respectively. The sum of the two is a preset fixed value, generating a spatiotemporal correlation index. The spatiotemporal correlation index is used to characterize the comprehensive correlation strength of meteorological data in the spatiotemporal dimension.

[0025] The normalized spatial gradient index reflects the spatial variation of meteorological parameters, while the temporal trend coefficient reflects the temporal evolution of meteorological observation data. To comprehensively consider the spatiotemporal characteristics of meteorological data, these two indicators need to be weighted and summed. Spatial and temporal weights represent the importance of spatial and temporal factors in the comprehensive evaluation, respectively, and their sum is a preset fixed value. This ensures that the total contribution of spatial and temporal factors is fixed when calculating the spatiotemporal correlation index. By adjusting the magnitude of the spatial and temporal weights, the influence of spatial and temporal factors can be flexibly balanced according to different application scenarios and needs. The spatiotemporal correlation index is a comprehensive indicator that can more comprehensively reflect the comprehensive correlation strength of meteorological data in the spatiotemporal dimension. When the spatiotemporal correlation index is large, it indicates that the meteorological data is closely correlated in space and time, and the spatiotemporal characteristics of the data have a significant impact on its value and usability; when the spatiotemporal correlation index is small, it indicates that the spatiotemporal correlation of the data is relatively weak. For example, when issuing meteorological disaster warnings, more attention should be paid to meteorological data with larger spatiotemporal correlation indices, because these data better reflect the occurrence and development trends of meteorological disasters.

[0026] Step S160: Normalize the spatiotemporal correlation index to obtain the timeliness assessment index of meteorological observation data. The value of the timeliness assessment index is positively correlated with the spatiotemporal correlation strength of meteorological data. The larger the value, the stronger the correlation characteristics of the data in the spatiotemporal dimension and the shorter the effective existence period.

[0027] The spatiotemporal correlation index is an indicator that integrates the spatial and temporal characteristics of meteorological data, but its value range may vary depending on different calculation methods and data sources. To facilitate comparison and application, the spatiotemporal correlation index needs to be normalized. Normalization maps the spatiotemporal correlation index to a defined interval, making the timeliness assessment indices of different meteorological observation data comparable. The value of the timeliness assessment index is positively correlated with the strength of the spatiotemporal correlation of meteorological data, meaning that the closer the spatial and temporal correlation of meteorological data, the larger the timeliness assessment index. At the same time, a larger value also indicates a shorter effective lifespan of the data, because data with strong spatiotemporal correlation are often more sensitive to changes in time and space, and their effectiveness decreases rapidly with these changes. For example, in weather forecasting, for meteorological data with high spatiotemporal correlation, such as meteorological observation data near typhoon landfall, the timeliness assessment index will be large because the effective lifespan of this data is short and requires timely processing and application. By normalizing the spatiotemporal correlation index to obtain the timeliness assessment index, the timeliness of meteorological observation data can be assessed more accurately.

[0028] Step S200: Perform correlation analysis between the timeliness assessment index and the geographic coordinate information of meteorological observation equipment to determine the sensitivity level classification threshold of meteorological observation data, and classify meteorological observation data into key sensitive data and ordinary non-sensitive data based on the sensitivity level classification threshold.

[0029] In one implementation, step S200 may specifically include the following steps S210 to S260: Step S210: Obtain the administrative division code from the geographic coordinate information of the meteorological observation equipment, query the preset administrative division sensitivity coefficient table, and obtain the basic sensitivity coefficient corresponding to the administrative division code. The basic sensitivity coefficient is preset according to the importance of the region.

[0030] The geographic coordinate information of meteorological observation equipment includes administrative division codes. These codes uniquely identify different administrative regions and accurately reflect the administrative region where the equipment is located. A pre-defined administrative division sensitivity coefficient table is set based on regional importance, storing the basic sensitivity coefficients corresponding to each administrative division code. The assessment of regional importance considers various factors, such as population density, economic development level, and distribution of important infrastructure. The basic sensitivity coefficient is a fundamental indicator for measuring the sensitivity of meteorological data in that administrative region; a higher coefficient indicates greater sensitivity. Obtaining the administrative division code involves parsing the geographic coordinate information and combining it with Geographic Information System (GIS) data to determine the administrative region code where the equipment is located. When querying the administrative division sensitivity coefficient table, the administrative division code is used as the search condition to find the corresponding basic sensitivity coefficient in the table. This query operation can be performed using database query functions or data structure search algorithms.

[0031] Step S220: Read the real-time weather warning signal level of the current meteorological observation area, and convert the warning signal level into a warning impact coefficient. The warning impact coefficient is positively correlated with the warning level, and the higher the level, the larger the coefficient.

[0032] The real-time weather warning signal level for the current meteorological observation area is issued by the meteorological department based on real-time weather conditions, reflecting the degree of meteorological disaster risk currently faced by the area. Warning signal levels are typically divided into different grades, such as blue, yellow, orange, and red, with higher levels indicating greater severity and impact of the meteorological disaster. To incorporate warning signal levels into sensitivity classification, they need to be converted into warning impact coefficients. The warning impact coefficient is a value positively correlated with the warning level; the higher the level, the greater the impact coefficient. This conversion can be achieved through pre-defined conversion rules, such as establishing a mapping table between warning levels and warning impact coefficients, and looking up the corresponding coefficient in the table based on the real-time read warning signal level. The process of reading real-time weather warning signal levels can be achieved through data interaction with the meteorological department's warning information dissemination system to obtain the latest warning level information.

[0033] Step S230: Calculate the product of the timeliness assessment index and the basic sensitivity coefficient to obtain the first sensitivity feature value. The first sensitivity feature value reflects the spatiotemporal sensitivity characteristics of the data itself.

[0034] The timeliness assessment index integrates the spatiotemporal correlation characteristics and effective lifespan of meteorological observation data, while the basic sensitivity coefficient reflects the sensitivity of the administrative region where the meteorological observation equipment is located. The first sensitivity characteristic value is obtained by calculating the product of the two, which comprehensively considers the spatiotemporal characteristics and regional sensitivity of the data. The first sensitivity characteristic value reflects the spatiotemporal sensitivity of the meteorological observation data itself, taking into account both the changes in the data in time and space and the importance of the data collection area. For example, for meteorological observation data located in an important administrative region and with a high timeliness assessment index, its first sensitivity characteristic value will be relatively large, indicating that the data has high spatiotemporal sensitivity.

[0035] Step S240: Multiply the first sensitive feature value with the early warning impact coefficient to obtain the second sensitive feature value. The second sensitive feature value comprehensively considers the enhancing effect of real-time meteorological risk on data sensitivity.

[0036] The first sensitivity eigenvalue already considers the spatiotemporal characteristics and regional sensitivity of meteorological observation data, but it does not yet account for the impact of real-time meteorological disaster risk. The warning impact coefficient reflects the degree of real-time meteorological disaster risk currently faced by the meteorological observation area. Multiplying the first sensitivity eigenvalue by the warning impact coefficient yields the second sensitivity eigenvalue, which comprehensively considers the enhancing effect of real-time meteorological risk on data sensitivity. When the real-time meteorological disaster risk is high, the warning impact coefficient is large, and the second sensitivity eigenvalue will also increase accordingly, indicating that the sensitivity of meteorological observation data is further enhanced by real-time meteorological risk. For example, during a typhoon, the warning impact coefficient will be very large; even if the first sensitivity eigenvalue was not originally very high, the second sensitivity eigenvalue will increase significantly. By calculating the second sensitivity eigenvalue, the sensitivity of meteorological observation data under real-time meteorological risk can be assessed more accurately.

[0037] Step S250: Obtain the second sensitive feature value of meteorological observation data in the same area within the past preset time period, construct the feature value sequence, calculate the dynamic standard deviation of the feature value sequence using the sliding window method, and use the preset multiple of the dynamic standard deviation as the dynamic adjustment amount of the sensitivity level classification threshold.

[0038] Obtaining the second sensitive characteristic value of meteorological observation data from the same region within a preset time period is for the purpose of analyzing the historical changes in the sensitivity of meteorological data in that region. The preset time period can be set according to actual needs, such as one week or one month. Constructing the characteristic value sequence involves arranging the obtained second sensitive characteristic values ​​into a sequence in chronological order for subsequent statistical analysis. The sliding window method is a commonly used time series analysis method, which calculates the statistical characteristics of the data within the window by sliding a fixed-size window across the characteristic value sequence. In this step, the sliding window method is used to calculate the dynamic standard deviation of the characteristic value sequence, which reflects the fluctuation of the second sensitive characteristic value over time. Using a preset multiple of the dynamic standard deviation as the dynamic adjustment amount for the sensitivity level classification threshold is to dynamically adjust the sensitivity level classification threshold according to the historical fluctuations in meteorological data sensitivity. When the dynamic standard deviation is large, it indicates that the fluctuation of the second sensitive characteristic value is large, and the adjustment amount of the sensitivity level classification threshold needs to be appropriately increased to accommodate this fluctuation; conversely, the adjustment amount should be decreased. For example, if the sensitivity of meteorological data in a region has fluctuated significantly over a period of time, the dynamic standard deviation will be large. In this case, a large multiple of the dynamic standard deviation can be used as an adjustment factor, allowing the sensitivity level classification threshold to adapt more flexibly to data changes. By calculating the dynamic adjustment factor, the sensitivity level classification threshold can be made more reasonable and accurate, improving the effectiveness of data sensitivity level classification.

[0039] Step S260: Add the second sensitive feature value to the dynamic adjustment amount of the sensitivity level classification threshold to obtain the final sensitivity level classification threshold. When the second sensitive feature value of the meteorological observation data is greater than the sensitivity level classification threshold, it is determined to be key sensitive data; otherwise, it is ordinary non-sensitive data.

[0040] The final sensitivity level classification threshold is obtained by adding the second sensitivity feature value to the dynamic adjustment amount of the sensitivity level classification threshold. This threshold comprehensively considers the spatiotemporal characteristics of meteorological observation data, regional sensitivity, real-time meteorological risks, and historical data fluctuations. When the second sensitivity feature value of meteorological observation data is greater than the final sensitivity level classification threshold, it indicates that the data has high sensitivity and is classified as critical sensitive data; otherwise, it is classified as ordinary non-sensitive data. Critical sensitive data usually contains information that has a significant impact on weather forecasting and disaster early warning, requiring a higher level of security protection; ordinary non-sensitive data, on the other hand, has relatively lower security requirements.

[0041] Step S300: Extract the unique identification information of the meteorological observation equipment and the collection timestamp information of the meteorological observation data. Generate an initial encryption master key based on the unique identification information and the collection timestamp information. Iteratively transform the initial encryption master key through a preset key derivation algorithm to generate a polling subkey sequence with time series correlation.

[0042] As one implementation method, in step S300, the unique identification information of the meteorological observation equipment and the collection timestamp information of the meteorological observation data are extracted, and an initial encryption master key is generated based on the unique identification information and the collection timestamp information. Specifically, this may include the following steps S310~S360: Step S310: Read the unique identification information from the meteorological observation equipment. The unique identification information is a fixed-length binary sequence written when the equipment leaves the factory, which contains multiple identification fields related to the equipment's identity.

[0043] The unique identification information of meteorological observation equipment is written at the factory and is a fixed-length binary sequence. This sequence contains multiple identification fields related to the equipment's identity, such as the equipment model, production batch, and serial number. These identification fields together constitute the unique identification of the equipment, ensuring that each piece of equipment is unique. The process of reading the unique identification information from the meteorological observation equipment can be achieved through data interaction with the equipment via its communication interface. For example, a command to read the identification information can be sent to the equipment via serial communication or network communication, and the equipment will return the unique identification information upon receiving the command.

[0044] Step S320: Parse the unique identification information, extract the serial number related fields, convert the serial number related fields into decimal values, and use them as the device serial number value.

[0045] Parsing unique identification information involves splitting the read binary sequence according to a predefined format and extracting the serial number-related fields. These fields are the part of the unique identification information used to identify the device's serial number, and may be fixed-length binary subsequences. Converting these fields to decimal values ​​facilitates subsequent processing and calculations. This conversion can be achieved using binary-to-decimal conversion algorithms, such as weighted bitwise summation. Each bit in the binary sequence is multiplied by its corresponding weight, and then all the results are summed to obtain the decimal device serial number value. For example, if the serial number-related field is an 8-bit binary sequence "10101010", the conversion algorithm calculates its decimal value to be 170, which is then used as the device serial number.

[0046] Step S330: Read the collection timestamp information of meteorological observation data, convert it into a timestamp value in a preset time format, and use it as the data collection timestamp value.

[0047] The timestamp information of meteorological observation data records the specific time when the data was collected. This timestamp may exist in different formats, such as timestamp strings or date / time objects. To facilitate subsequent processing and calculations, it can be converted into a timestamp value in a preset time format. The preset time format can be a unified time representation method, such as the number of seconds or milliseconds calculated from a fixed point in time. The conversion process can be implemented using time processing functions or date / time libraries, performing the appropriate conversion operation based on the specific format of the collected timestamp information. For example, if the collected timestamp information is a date / time string "2025-11-21 12:00:00", a time processing function can be used to convert it into the number of milliseconds calculated from a fixed point in time, which can then be used as the data collection timestamp value.

[0048] Step S340: Obtain the real-time operating status parameters of the meteorological observation equipment, including the equipment operating voltage value and the internal temperature value. Calculate the percentage deviation between the voltage value and the standard voltage value as the voltage deviation rate, and calculate the deviation between the temperature value and the standard temperature value as the temperature deviation value.

[0049] The real-time operating status parameters of meteorological observation equipment reflect its current working status. The equipment's operating voltage and internal temperature are two crucial operating parameters; their normal ranges are essential for stable operation and accurate data acquisition. Standard voltage and temperature values ​​are reference values ​​for the normal operating voltage and temperature range specified in the equipment's design. Calculating the percentage deviation of the voltage value from the standard voltage value measures the degree of deviation from the operating voltage. This is obtained by dividing the voltage deviation by the standard voltage value and then multiplying by 100%. Calculating the deviation of the temperature value from the standard temperature value helps understand the difference between the internal temperature and the normal operating temperature. The process of acquiring the equipment's operating voltage and internal temperature values ​​involves real-time measurement using the equipment's sensors, followed by transmitting the measured data to the data processing module.

[0050] Step S350: Concatenate the device serial number, data acquisition timestamp, voltage deviation rate, and temperature deviation into a string, perform a preset hash operation on the string, and generate a hash value of fixed length.

[0051] The device serial number, data acquisition timestamp, voltage deviation rate, and temperature deviation are concatenated into a string to combine these different types of information into a unified string. This concatenation process is achieved through string concatenation, where each value is converted into a string and then joined together sequentially. The default hash operation is an algorithm that converts input data of arbitrary length into a fixed-length hash value; hash algorithms such as MD5, SHA-1, and SHA-256 are used. The concatenated string is hashed to generate a fixed-length hash value. Hash values ​​are unique and deterministic; the same input data will produce the same hash value, and different input data will produce different hash values. Through hash operations, various pieces of device information can be converted into a fixed-length hash value, providing a compact and representative intermediate result for key generation.

[0052] Step S360: Extract the first half of the hash value as the core part of the initial encryption master key, and perform a circular right shift operation on the core part by a preset number of bits to obtain the initial encryption master key, which is a fixed-length binary sequence.

[0053] Extracting the first half of the hash value as the core of the initial encryption master key is to select a representative portion of the hash value as the basis for the key. The circular right shift operation is a bitwise shift operation on a binary sequence, which shifts the core binary sequence to the right by a predetermined number of bits, rearranging each bit according to a specific rule. This operation increases the randomness and complexity of the key. The initial encryption master key is a fixed-length binary sequence obtained by circularly shifting the first half of the hash value to the right. For example, if the hash value is a 256-bit binary sequence, the first 128 bits are extracted as the core, and then this 128-bit core is circularly shifted right by 8 bits to obtain a new 128-bit binary sequence, which is used as the initial encryption master key. Through truncation and circular right shift operations, an initial encryption master key with a certain degree of randomness and complexity can be generated from the hash value, providing a foundation for subsequent key derivation and encryption processing.

[0054] In one implementation, step S300 involves iteratively transforming the initial encryption master key using a preset key derivation algorithm to generate a polling subkey sequence with time-series correlation. Specifically, this may include the following steps S370~S3120: Step S370: Set the number of iterations for key derivation to a value corresponding to the sampling frequency of the meteorological observation equipment, obtain the current system timestamp, calculate the difference between the system timestamp and the data acquisition timestamp, use it as the time difference value, divide the time difference value by a preset time unit to obtain the time window parameter, and the time window parameter is used to characterize the time interval characteristics of the current encryption process.

[0055] The number of key derivation iterations corresponds to the sampling frequency of the meteorological observation equipment. This is to determine the number of key derivations based on the equipment's sampling frequency, ensuring that the generated subkey matches the data acquisition frequency. The current system timestamp records the current time, while the data acquisition timestamp records the time when the meteorological observation data was collected. The difference between the system timestamp and the data acquisition timestamp is calculated to obtain the time difference value, which reflects the time elapsed from data acquisition to the current moment. Dividing the time difference value by a preset time unit yields the time window parameter, which can be seconds, minutes, hours, etc. The time window parameter characterizes the time interval characteristics of the current encryption process, dividing time into different intervals so that the subkeys generated in different time intervals have certain differences.

[0056] Step S380: Use the initial encryption master key as the input key for the first round of iteration, perform a preset hash operation on the input key to generate a fixed-length intermediate key, and extract the first half of the intermediate key as the first round sub-key.

[0057] The initial encryption master key is used as the input key for the first round of iterations because it forms the foundation of the entire key derivation process. A pre-defined hash operation is performed on the input key; the hash algorithm can be one of the previously mentioned MD5, SHA-1, SHA-256, etc. This hash operation converts the input key into a fixed-length intermediate key. The purpose of the hash operation is to increase the randomness and complexity of the key, ensuring that the generated intermediate key has different characteristics from the input key. The first half of the intermediate key is truncated and used as the first-round subkey to select a representative portion of the intermediate key. For example, if the initial encryption master key is a 128-bit binary sequence, performing a SHA-256 hash operation yields a 256-bit intermediate key; the first 128 bits of this intermediate key are then used as the first-round subkey. In this way, starting from the initial encryption master key, through hash operations and truncation, the first-round subkey is generated, laying the foundation for subsequent iterative derivation processes.

[0058] Step S390: Extract the clock deviation value of the meteorological observation equipment. The clock deviation value is the difference between the real-time clock of the equipment and the standard time. Divide the clock deviation value by the preset time unit to obtain the normalized clock deviation parameter. Summate the normalized clock deviation parameter with the time window parameter to obtain the comprehensive time offset value. Convert the comprehensive time offset value into a fixed-length binary number as the iterative offset parameter. The iterative offset parameter is dynamically adjusted according to the time window parameter.

[0059] The clock deviation value of meteorological observation equipment reflects the difference between the equipment's real-time clock and standard time. Due to potential clock errors, the displayed time may differ from the standard time. Dividing the clock deviation value by a preset time unit yields a normalized clock deviation parameter. This preset time unit can be the same as the unit used in calculating the time window parameter. The normalized clock deviation parameter converts the clock deviation value into a relative value, facilitating subsequent calculations. Summing the normalized clock deviation parameter with the time window parameter yields a comprehensive time offset value. This comprehensive value takes into account both the equipment clock deviation and the time interval characteristics of the current encryption process. The comprehensive time offset value is converted into a fixed-length binary number as the iterative offset parameter. The iterative offset parameter is dynamically adjusted according to the time window parameter, as the time window parameter changes over time, causing the iterative offset parameter to change accordingly. By calculating the iterative offset parameter, the factors of time and equipment clock deviation can be introduced into the key derivation process, resulting in a more random and time-correlated subkey.

[0060] Step S3100: Perform bitwise XOR operation on the intermediate key and the iteration offset parameter to obtain the offset intermediate key. Use the offset intermediate key as the input key for the next round of iteration. Repeat the hash operation, subkey truncation and XOR operation steps until the preset number of iterations is completed.

[0061] Bitwise XOR is a binary operation that XORs each bit of two binary numbers, assigning 0 to identical bits and 1 to different bits. The intermediate key is XORed with the iteration offset parameter to obtain the offset intermediate key. This process alters the binary sequence of the intermediate key, introducing the influence of the iteration offset parameter and increasing the key's randomness. The offset intermediate key is used as the input key for the next iteration, and the hash operation, subkey truncation, and XOR operation steps are repeated until the preset number of iterations is reached. For example, in the first iteration, the intermediate key is obtained, and it is XORed with the iteration offset parameter to obtain the offset intermediate key. This offset intermediate key is then used as the input key for the second iteration, and a hash operation is performed again to obtain a new intermediate key. The first half is truncated as the second round subkey, and the new iteration offset parameter is calculated, followed by bitwise XOR operation. This process is repeated until the preset number of iterations is reached.

[0062] Step S3110: Obtain the subkeys generated in each iteration, arrange them in the iteration order, and generate an initial round subkey sequence. The sequence contains a number of subkeys equal to the number of iterations, and each subkey corresponds to a sampling time point.

[0063] After completing the key derivation process for a preset number of iterations, the subkeys generated in each iteration are obtained. These subkeys are then arranged in iteration order to generate an initial polling subkey sequence. The number of subkeys in the sequence is equal to the number of iterations, and each subkey corresponds to a specific sampling time point. This correspondence is achieved through time factors introduced during the key derivation process using time window and iteration offset parameters. For example, if the preset number of iterations is 5, and 5 subkeys are generated after 5 iterations, they are arranged in iteration order into a sequence. The first subkey corresponds to the first time interval after data acquisition, the second subkey corresponds to the second time interval, and so on. By generating the initial polling subkey sequence, a set of time-series correlated subkeys can be provided for subsequent data encryption, allowing the encryption process to use different subkeys sequentially according to time order, thus improving the security and flexibility of encryption.

[0064] Step S3120: Calculate the Hamming distance between adjacent subkeys in the initial polling subkey sequence. When the Hamming distance between any adjacent subkey is less than a preset threshold, perform a cyclic left shift operation on the next subkey by a preset number of bits. After adjustment, a polling subkey sequence with time series correlation is obtained.

[0065] Hamming distance is the number of bits that differ between corresponding positions in two equal-length binary sequences. Calculating the Hamming distance between adjacent subkeys in the initial polling subkey sequence measures the degree of difference between them. A preset threshold is a pre-defined value used to determine if the difference between adjacent subkeys is sufficiently large. When the Hamming distance between any two adjacent subkeys is less than the preset threshold, it indicates that the two subkeys are too similar, potentially reducing encryption security. To increase the difference between adjacent subkeys, a cyclic left shift operation is performed on the subsequent subkey by a preset number of bits. The cyclic left shift operation shifts the binary sequence of the subkey to the left by a preset number of bits, rearranging each bit in the sequence according to a certain rule. Through this adjustment, a polling subkey sequence with time-series correlation is obtained. For example, if the initial polling subkey sequence contains two adjacent subkeys "10101010" and "10101011", with a Hamming distance of 1, and assuming a preset threshold of 2, since the Hamming distance is less than the preset threshold, a cyclic left shift operation of 2 bits is performed on the latter subkey "10101011", resulting in "10101110". The Hamming distance between the adjusted subkey and the former subkey increases. By calculating the Hamming distance and performing the cyclic left shift operation, sufficient differences between adjacent subkeys in the polling subkey sequence can be ensured, improving key security and encryption effectiveness.

[0066] Step S400: For critical sensitive data, select the target polling subkey corresponding to the current encryption time from the polling subkey sequence, perform an XOR operation between the target polling subkey and the preset asymmetric encryption public key to generate a composite encryption key, and perform asymmetric encryption processing on the critical sensitive data based on the composite encryption key to obtain the encryption result of the critical data.

[0067] As one implementation method, in step S400, for key sensitive data, a target polling subkey corresponding to the current encryption time is selected from the polling subkey sequence, and the target polling subkey is XORed with a preset asymmetric encryption public key to generate a composite encryption key. Specifically, this may include the following steps S410~S460: Step S410: Obtain the system timestamp of the current encryption time, convert it into a timestamp with a preset time precision, use it as the current encryption time value, and calculate the time difference between the current encryption time value and the data acquisition timestamp value, use it as the encryption time difference.

[0068] The system timestamp at the current encryption moment records the specific time the encryption operation is performed. It may exist in different formats, such as a timestamp string or a date / time object. For easier subsequent processing and calculation, it needs to be converted to a timestamp with a preset time precision, such as seconds or milliseconds. This conversion can be achieved using time processing functions or a date / time library, performing the appropriate conversion operation based on the specific format of the system timestamp. The encryption time difference is obtained by calculating the time difference between the current encryption time value and the data acquisition timestamp value. This difference reflects the time elapsed from data acquisition to the current encryption moment.

[0069] Step S420: Take the modulo of the encryption time difference with the length of the polling subkey sequence to obtain the polling index value, and select the corresponding subkey from the polling subkey sequence according to the polling index value as the candidate polling subkey.

[0070] Taking the modulo of the encryption time difference with the length of the polling subkey sequence maps the encryption time difference to the index range of the polling subkey sequence. The modulo operation ensures that the resulting polling index value is within the valid index range of the polling subkey sequence. Based on the polling index value, the corresponding subkey is selected from the polling subkey sequence as a candidate polling subkey. For example, if the length of the polling subkey sequence is 5 milliseconds and the encryption time difference is 4,200,000 milliseconds, assuming each subkey corresponds to a fixed time interval, taking the modulo of 4,200,000 with 5 yields a polling index value of 2. The subkey with index 2 is then selected from the polling subkey sequence as a candidate polling subkey.

[0071] Step S430: Extract the generation timestamp of the candidate polling subkey, calculate the difference between the generation timestamp and the system timestamp at the current encryption time, and use it as the key validity difference. When the key validity difference is greater than the preset key validity period, select the subkey corresponding to the next index from the polling subkey sequence as the candidate polling subkey, and repeat the verification until a subkey with a validity difference within the valid range is found, which is then used as the target polling subkey.

[0072] The generation timestamp of the candidate polling subkey records the specific time when the subkey was generated. The difference between the generation timestamp and the system timestamp at the current encryption time is calculated to obtain the key validity difference. The key validity difference reflects the time elapsed from the subkey's generation to the current encryption time. The preset key validity period is a pre-defined time length used to determine whether the subkey is still valid. When the key validity difference is greater than the preset key validity period, it means that the subkey has expired and can no longer be used for encryption. To find a valid subkey, the subkey corresponding to the next index in the polling subkey sequence is selected as a candidate polling subkey, and the verification process is repeated until a subkey with a validity difference within the valid range is found, which is then used as the target polling subkey. This verification mechanism ensures that the subkey used is valid, improving encryption security.

[0073] Step S440: Read the preset asymmetric encryption public key, perform a preset hash operation on the public key to generate a fixed-length public key hash value, and extract the first half of the public key hash value as the public key hash truncation value.

[0074] The preset asymmetric encryption public key is a pre-defined public key used in asymmetric encryption algorithms. A preset hash operation is performed on the public key; the preset hash algorithm can be MD5, SHA-1, SHA-256, etc., as mentioned earlier. Through the hash operation, the public key is converted into a fixed-length public key hash value. The purpose of the hash operation is to increase the randomness and complexity of the public key, so that the generated public key hash value has different characteristics from the public key. The first half of the public key hash value is truncated as the public key hash truncation value. For example, if the public key hash value is a 256-bit binary sequence, the first 128 bits are truncated as the public key hash truncation value.

[0075] Step S450: Perform a bitwise XOR operation on the target polling subkey and the public key hash truncation value to obtain a fixed-length intermediate composite key. The result of each bit in the XOR operation is the XOR result of the corresponding bit of the target polling subkey and the corresponding bit of the public key hash truncation value.

[0076] The target round-robin subkey and the public key hash truncation value are XORed bitwise. Bitwise XOR is a binary operation that XORs each bit of two binary sequences, assigning 0 to identical bits and 1 to different bits. This operation combines the target round-robin subkey and the public key hash truncation value into a new binary sequence, i.e., a fixed-length intermediate composite key. By using bitwise XOR, the characteristics of the target round-robin subkey and the public key hash truncation value can be fused to generate a new intermediate composite key, providing a foundation for subsequent key expansion.

[0077] Step S460: Perform key expansion processing on the intermediate composite key, expanding it into a key with the same length as the asymmetric encryption public key through cyclic shift and padding operations, thereby generating a composite encryption key.

[0078] The length of the intermediate composite key may differ from the length of the asymmetric encryption public key. To ensure they are the same length, key expansion is required. Key expansion is achieved through cyclic shift and padding operations. The cyclic shift operation shifts the binary sequence of the intermediate composite key to the left or right by a certain number of bits, while the padding operation adds bits to the end of the sequence, making the sequence length the same as the asymmetric encryption public key. For example, if the intermediate composite key is a 128-bit binary sequence and the asymmetric encryption public key is a 256-bit binary sequence, the intermediate composite key can be expanded to a 256-bit key through cyclic shift and padding operations, generating the composite encryption key. Key expansion ensures that the composite encryption key and the asymmetric encryption public key are the same length, providing a suitable key for subsequent asymmetric encryption processing.

[0079] As one implementation method, in step S400, the key sensitive data is subjected to asymmetric encryption based on the composite encryption key to obtain the key data encryption result, which may specifically include the following steps S470~S4120: Step S470: Convert the key sensitive data into a byte array as the data byte stream to be encrypted. Calculate the length of the data byte stream to be encrypted. When the length is greater than the single encryption limit of the asymmetric encryption algorithm, divide the data byte stream to be encrypted into blocks. The length of each block is a preset proportion of the encryption limit, generating multiple data blocks as a key data block sequence.

[0080] Critical and sensitive data may exist in different formats. To encrypt it, it needs to be converted into a byte array as the data stream to be encrypted. The length of the data stream to be encrypted is calculated. Asymmetric encryption algorithms typically have an upper limit on the length of a single encryption operation, i.e., the maximum data length that can be encrypted in one go. When the length of the data stream exceeds this upper limit, it needs to be segmented. The length of each segment is a preset proportion of the encryption upper limit, which can be adjusted according to the actual situation, such as 0.5, 0.8, etc. Through segmentation, the data stream to be encrypted is divided into multiple data blocks, generating a sequence of critical data blocks. For example, if the single encryption upper limit of the asymmetric encryption algorithm is 128 bytes, the length of the data stream to be encrypted is 256 bytes, and the preset proportion is 0.5, the data stream to be encrypted is segmented into blocks, each 128 × 0.5 = 64 bytes long, generating 4 data blocks as the sequence of critical data blocks. Segmentation ensures that the data can be encrypted within the processing capabilities of the asymmetric encryption algorithm.

[0081] Step S480: Fill the data blocks in each key data block sequence. Based on the preset filling standard, add padding bytes to the end of the data block so that the length of the filled data block is an integer multiple of the block length of the asymmetric encryption algorithm, and generate the filled data block.

[0082] Asymmetric encryption algorithms typically require that the length of the data block be an integer multiple of the block length. To meet this requirement, padding is needed for each key data block sequence. Predefined padding standards specify the method and rules for adding padding bytes. Padding bytes are added to the end of the data block so that the length of the padded data block is an integer multiple of the block length required by the asymmetric encryption algorithm.

[0083] Step S490: Initialize the encryption result buffer. The buffer is used to store the encrypted data blocks. The initial state is empty. Set the data block index counter. The initial value is a preset starting value.

[0084] The encryption result buffer is a memory area used to store encrypted data blocks, initially empty. A data block index counter is set, with an initial value of a preset start value, typically 0. The data block index counter records the index position of the currently processed data block. For example, an empty encryption result buffer can be created, with the data block index counter set to 0 initially. Initializing the encryption result buffer and setting the data block index counter provides a storage and indexing foundation for subsequent data encryption processing.

[0085] Step S4100: Read the data block with the counter value from the key data block sequence, input the padded data block and the composite encryption key into the asymmetric encryption algorithm, perform the encryption operation, and generate the encrypted data block.

[0086] The process involves reading data blocks whose indices match the counter values ​​from the key data block sequence. Specifically, it involves selecting the corresponding data block from the key data block sequence based on the data block index counter value. The padded data block and the composite encryption key are then input into an asymmetric encryption algorithm, such as RSA or ECC. Encryption is performed to generate an encrypted data block. For example, if the data block index counter value is 2, the data block with index 2 is read from the key data block sequence, input along with the composite encryption key into an RSA encryption algorithm, and encryption is performed to generate an encrypted data block. In this way, each data block can be encrypted to obtain an encrypted data block.

[0087] Step S4110: Add the encrypted data block to the end of the encryption result buffer, increment the data block index counter by a preset step size, and repeat the steps of reading data blocks, encrypting, and adding until all data blocks have been processed.

[0088] The data block index counter is incremented by a preset step size, typically 1. The steps of reading, encrypting, and adding data blocks are repeated until all data blocks have been processed. For example, after adding an encrypted data block to the end of the encryption result buffer, the data block index counter is incremented from 2 to 3. Then, the data block with index 3 is read from the key data block sequence, encrypted, and added to the end of the buffer. This process is repeated until all data blocks have been processed.

[0089] Step S4120: Concatenate all encrypted data blocks in the encryption result buffer according to the processing order to generate the key data encryption result. The key data encryption result is in byte stream form and contains the encryption information of all key sensitive data.

[0090] The encryption results buffer is filled with all encrypted data blocks in the processing order, concatenating them sequentially to generate the encrypted result of the critical data. This critical data encryption result is a byte stream containing the encrypted information of all critical and sensitive data. For example, if the encryption results buffer contains four encrypted data blocks, they are concatenated in the processing order to generate a continuous byte stream, which serves as the critical data encryption result. Through this concatenation operation, all encrypted data blocks can be combined into a complete encryption result, ensuring the security and integrity of the critical and sensitive data.

[0091] Step S500: For ordinary non-sensitive data, select the target polling subkey corresponding to the current encryption time from the polling subkey sequence, use the target polling subkey as the input key of the symmetric encryption algorithm, and perform symmetric encryption processing on the ordinary non-sensitive data to obtain the ordinary data encryption result.

[0092] In one implementation, step S500 may specifically include the following steps S510 to S560: Step S510: Obtain the system timestamp of the current encryption time, convert it into a timestamp with a preset time precision, use it as the current encryption time value, and calculate the time difference between the current encryption time value and the data acquisition timestamp value, use it as the normal encryption time difference.

[0093] Obtain the system timestamp of the current encryption moment, convert it to a timestamp with a preset time precision, and use it as the current encryption time value. This process is similar to calculating the current encryption time value of critical and sensitive data. Calculate the time difference between the current encryption time value and the data acquisition timestamp value to obtain the ordinary encryption time difference.

[0094] Step S520: Take the modulo of the normal encryption time difference with the length of the polling subkey sequence to obtain the normal polling index value, and select the corresponding subkey from the polling subkey sequence according to the normal polling index value as the normal candidate subkey.

[0095] The normal polling index value is obtained by taking the modulo of the normal encryption time difference with the length of the polling subkey sequence. This process is similar to calculating the polling index value for critical sensitive data. Based on the normal polling index value, the corresponding subkey is selected from the polling subkey sequence as a normal candidate subkey.

[0096] Step S530: Extract the key version number of the ordinary candidate subkey, query the preset key version compatibility list, and verify whether the key version number is within the compatibility range. If it is not compatible, select the subkey corresponding to the next index from the polling subkey sequence as the ordinary candidate subkey, and repeat the verification until a compatible version subkey is found as the ordinary target polling subkey.

[0097] The key version number of a regular candidate subkey records the subkey's version information. A pre-defined key version compatibility list stores all compatible key version numbers. The process involves querying this list to verify if the key version number is within the compatibility range. If incompatible, the next indexed subkey in the polled subkey sequence is selected as the regular candidate subkey, and this verification is repeated until a compatible subkey is found and used as the regular target polled subkey. The key version number of a regular candidate subkey is an identifier assigned during subkey generation to distinguish different versions of the subkey. The pre-defined key version compatibility list is pre-defined based on the update and maintenance needs of the encryption system, specifying which versions of subkeys can be used normally in the current system. Querying this list is achieved by traversing the list elements and comparing them with the extracted key version number. If the key version number of a regular candidate subkey is found to be outside the compatibility range, it means that the subkey may not be compatible with the current encryption system, posing a risk of encryption or decryption failure. In this case, the next indexed subkey in the polled subkey sequence is selected as the new regular candidate subkey, and the key version number extraction and compatibility verification are performed again. This process will be repeated until a subkey with a key version number within the compatible range is found and designated as the normal target polling subkey.

[0098] Step S540: Convert ordinary non-sensitive data into byte array form as ordinary byte stream to be encrypted, calculate the preset check value of the ordinary byte stream to be encrypted as ordinary data check value, append the ordinary data check value to the end of the ordinary byte stream to be encrypted, and generate an extended byte stream to be encrypted.

[0099] Ordinary, non-sensitive data may exist in various data types and formats. To facilitate subsequent encryption processing, it needs to be converted into a byte array to obtain a normal byte stream to be encrypted. A preset checksum is calculated for this normal byte stream. The preset checksum method can be a hash algorithm, cyclic redundancy check (CRC), etc. These methods are used to process the normal byte stream to obtain a fixed-length checksum, which serves as the normal data checksum. The normal data checksum is used to verify the integrity of the data during decryption, ensuring that the data has not been tampered with during transmission or storage. The normal data checksum is appended to the end of the normal byte stream to be encrypted through byte stream concatenation operations, generating an extended byte stream to be encrypted.

[0100] Step S550: Initialize the context environment of the symmetric encryption algorithm, set the encryption mode to the preset block cipher working mode, generate a random fixed-length initial vector, use the ordinary target polling subkey as the encryption key, use the initial vector as the encryption parameter, input the extended byte stream to be encrypted to perform symmetric encryption operation, and generate an encrypted byte stream.

[0101] The context of a symmetric encryption algorithm contains various parameters and state information required for algorithm execution. Initializing this context ensures the algorithm functions correctly. Several preset block cipher modes are available, such as Electronic Codebook (ECB), Cipher Block Chaining (CBC), and Cipher Counter (CTR). The appropriate mode is selected based on the specific application scenario and security requirements. A random, fixed-length initialization vector is generated. This vector increases the randomness and security of the encryption; using different initialization vectors for different encryption operations avoids the problem of identical ciphertext after encrypting the same plaintext. The ordinary target polling subkey is used as the encryption key, and the initialization vector is used as the encryption parameters. These, along with the expanded byte stream to be encrypted, are input into the symmetric encryption algorithm for encryption operations. During the encryption process, the symmetric encryption algorithm processes the expanded byte stream according to the selected mode and encryption key, converting it into ciphertext and generating the encrypted byte stream.

[0102] Step S560: Concatenate the initial vector with the encrypted byte stream, with the initial vector first and the encrypted byte stream second, to generate a normal data encryption result. The normal data encryption result contains the initial vector required for decryption and the encrypted normal non-sensitive data.

[0103] The initialization vector is concatenated with the encrypted byte stream using a concatenation operation, with the initialization vector placed first and the encrypted byte stream last, generating a normal data encryption result. During decryption, the receiver can extract the initialization vector and encrypted byte stream from the normal data encryption result, and use the same symmetric encryption algorithm, a normal target polling subkey, and the initialization vector to perform decryption, recovering the original normal, non-sensitive data. Furthermore, since the normal data encryption result includes a normal data checksum, the integrity of the data can be verified after decryption.

[0104] In one implementation, step S500 may further include the following steps S570~S5120: Step S570: Read the header information of ordinary non-sensitive data. The header information includes the data type identifier, data length and acquisition device number. Separate the header information from the data body and use them as ordinary data header and ordinary data body.

[0105] Ordinary non-sensitive data consists of a header and a data body. The header contains basic descriptive information, such as a data type identifier to distinguish different types of meteorological observation data, a data length indicating the size of the data body, and an acquisition device number identifying the data's source device. Reading the header of ordinary non-sensitive data can be achieved by parsing the data format. Based on a predefined data structure, the header information is located and extracted. Separating the header from the data body is achieved through data segmentation, dividing the ordinary non-sensitive data into a header and a body.

[0106] Step S580: Compress the ordinary data body. Use a preset compression algorithm to convert the ordinary data body into compressed data. Calculate the length ratio of the data body before and after compression. If the ratio is greater than a preset threshold, retain the original data body; otherwise, use the compressed data body as the processed data body.

[0107] Several preset compression algorithms are available, such as lossless compression algorithms (e.g., DEFLATE, LZ77) and lossy compression algorithms (e.g., JPEG, MP3). The appropriate compression algorithm is selected based on the characteristics of ordinary, non-sensitive data and application requirements. The ordinary data volume is compressed, converting it into compressed data. During compression, the algorithm removes redundant information to reduce storage space. The ratio of the data volume length before and after compression is calculated by dividing the length of the compressed data volume by the length of the original data volume. A preset threshold is a pre-defined standard used to determine the effectiveness of compression. If the ratio is greater than the preset threshold, the compression effect is not significant, and the length of the compressed data volume is not significantly reduced; in this case, the original data volume is retained. Otherwise, the compressed data volume is used and designated as the processed data volume.

[0108] Step S590: Concatenate the ordinary data header with the processed data body to generate ordinary data to be encrypted. The format of the ordinary data to be encrypted is a byte stream with the data header first and the data body last.

[0109] The plain data header is concatenated with the processed data body using byte stream concatenation operations, with the header first and the data body last, to generate the plain data to be encrypted. This format conforms to common data storage and transmission standards, facilitating subsequent encryption and data parsing. The plain data to be encrypted contains the processed header and data body, retaining basic descriptive information and actual content, and may have already undergone effective compression to reduce data size.

[0110] Step S5100: Select the ordinary target polling subkey corresponding to the current encryption time from the polling subkey sequence, use the ordinary target polling subkey as the input key of the symmetric encryption algorithm, perform symmetric encryption processing on the ordinary data to be encrypted, and generate an intermediate encryption result.

[0111] The process of selecting the ordinary target polling subkey corresponding to the current encryption time is similar to the steps described above. A suitable subkey is found from the polling subkey sequence based on the ordinary encryption time difference. This subkey is used as the input key for a symmetric encryption algorithm, which can be common symmetric encryption algorithms such as AES or DES. Symmetric encryption is then performed on the ordinary data to be encrypted. During encryption, the symmetric encryption algorithm transforms the ordinary data to be encrypted into ciphertext form based on the selected encryption mode (such as the block cipher working mode mentioned earlier) and the encryption key, generating an intermediate encryption result.

[0112] Step S5110: Extract the encryption state parameters generated during the symmetric encryption process. The state parameters include the number of encryption rounds, key expansion results, etc. Convert the encryption state parameters into a byte array as a state parameter byte stream.

[0113] During symmetric encryption, several parameters related to the encryption state are generated. For example, the encryption round number records the number of rounds the encryption algorithm has executed, and the key expansion result is the result obtained after expanding the encryption key. These encryption state parameters are crucial for state recovery and data verification during decryption. Extracting these parameters can be achieved by accessing the internal state information of the symmetric encryption algorithm; different symmetric encryption algorithms may have different methods for obtaining this information. The encryption state parameters are then converted into byte arrays using data type conversion operations. Finally, these parameters are encoded into a byte stream according to a specific format to obtain the state parameter byte stream.

[0114] Step S5120: Concatenate the intermediate encryption result with the state parameter byte stream, with the intermediate encryption result first and the state parameter byte stream second, to generate a normal data encryption result. The normal data encryption result is used for state recovery and data verification during the decryption process.

[0115] The intermediate encryption result is concatenated with the state parameter byte stream using a byte stream concatenation operation, with the intermediate encryption result placed first and the state parameter byte stream last, generating a normal data encryption result. During decryption, the receiver can extract the intermediate encryption result and the state parameter byte stream from the normal data encryption result. Using the encryption state parameters in the state parameter byte stream, such as the encryption round number and key expansion result, the internal state of the symmetric encryption algorithm can be recovered, ensuring the correctness of the decryption process. Simultaneously, combined with the previously mentioned normal data checksum, the integrity of the decrypted data can be verified, ensuring that the data has not been tampered with during transmission and storage.

[0116] Step S600: Associate and bind the encryption results of key data and ordinary data with the hash verification value of the corresponding target polling subkey to generate an associated data pair of encrypted data and hash verification value. Perform format standardization processing on the associated data pair through variable length encoding rules to generate a composite encrypted data packet of meteorological observation data containing data type identifier.

[0117] As one implementation method, in step S600, the encryption results of key data and ordinary data are respectively associated and bound with the hash verification value of the corresponding target polling subkey to generate an association data pair between encrypted data and hash verification value. Specifically, this may include the following steps S610~S660: Step S610: Extract the target polling subkey used to encrypt key sensitive data, and use it as the key encryption subkey. Perform a preset hash operation on the key encryption subkey to generate a fixed-length key subkey hash value. Convert the key subkey hash value into a fixed-length hexadecimal string, and use it as the key hash string.

[0118] Extract the target polling subkey used to encrypt critical sensitive data. This subkey is selected from the polling subkey sequence in the previous steps and is used to encrypt the critical sensitive data. Perform a preset hash operation on the critical encryption subkey. The preset hash algorithm can be one of the common hash algorithms mentioned earlier. Process the critical encryption subkey using this algorithm to generate a fixed-length critical subkey hash value. The hash value is a binary sequence. For ease of storage and transmission, it is converted into a fixed-length hexadecimal string. The conversion process can be achieved by dividing the binary sequence into groups of 4 bits and converting each group of binary numbers into the corresponding hexadecimal characters, thus obtaining the critical hash string.

[0119] Step S620: Convert the key data encryption result into an encoded string with a preset encoding method as the key encryption encoded string. Add a preset key data separator to the end of the key encryption encoded string, and then concatenate the key hash string to generate a key association string. The format of the key association string is the key encryption encoded string, separator, and key hash string concatenated in sequence.

[0120] The key data encryption result is converted into an encoded string using a preset encoding method, such as Base64 or UTF-8, depending on the specific application requirements. Through encoding, the key data encryption result is converted from a byte stream to a string, resulting in a key encrypted encoded string. A preset key data separator is a predefined special character or string used to distinguish the key encrypted encoded string from the key hash string within the key association string. This separator is added to the end of the key encrypted encoded string, and then the key hash string is concatenated after the separator using string concatenation operations to generate the key association string. This format of key association string clearly contains the key data encryption result and its corresponding hash check value.

[0121] Step S630: Extract the target polling subkey used to encrypt ordinary non-sensitive data, and use it as the ordinary encryption subkey. Perform a preset hash operation on the ordinary encryption subkey to generate a fixed-length ordinary subkey hash value. Convert the ordinary subkey hash value into a fixed-length hexadecimal string and use it as the ordinary hash string.

[0122] Extract the target polling subkey used to encrypt ordinary, non-sensitive data. This subkey was selected from the polling subkey sequence in the previous steps. Perform a pre-defined hash operation on the ordinary encryption subkey using the same hash algorithm as the key encryption subkey to generate a fixed-length ordinary subkey hash value. Convert the ordinary subkey hash value into a fixed-length hexadecimal string using the same conversion method as the key subkey hash value to obtain the ordinary hash string. This allows the ordinary hash string to be easily associated with the ordinary data encryption result.

[0123] Step S640: Convert the ordinary data encryption result into an encoded string with a preset encoding method as an ordinary encryption encoded string. Add a preset ordinary data separator to the end of the ordinary encryption encoded string, and then concatenate it with an ordinary hash string to generate an ordinary associated string. The format of the ordinary associated string is the ordinary encryption encoded string, separator, and ordinary hash string concatenated in sequence.

[0124] The process converts the encrypted ordinary data result into an encoded string using a preset encoding method. This preset encoding method can be the same as the one used when processing the encrypted result of critical data, or it can be adjusted according to the actual situation. Through encoding operations, the encrypted ordinary data result is converted from byte stream format to string format, resulting in an ordinary encrypted encoded string. The preset ordinary data delimiter is a predefined special character or string used to distinguish the ordinary encrypted encoded string from the ordinary hash string within the ordinary associated string. This delimiter is added to the end of the ordinary encrypted encoded string, and then the ordinary hash string is concatenated after the delimiter using string concatenation operations to generate the ordinary associated string. This format of ordinary associated string clearly contains the encrypted ordinary data result and its corresponding hash check value.

[0125] Step S650: Add a key data type identifier prefix to the key association string. This prefix is ​​a preset binary code, which is converted into a hexadecimal string and added to the beginning of the association string to generate a key data association pair.

[0126] The key data type identifier prefix is ​​a pre-defined binary code used to identify that the data contained in the association string is key data. This binary code is converted to a hexadecimal string, similar to the conversion of the hash value to a hexadecimal string. The converted hexadecimal string is then appended to the beginning of the key association string, and the key data association pair is generated through string concatenation.

[0127] Step S660: Add a common data type identifier prefix to the common association string. This prefix is ​​a preset binary code, which is converted into a hexadecimal string and added to the beginning of the association string to generate a common data association pair. The key data association pair and the common data association pair together constitute a set of association data pairs between encrypted data and hash verification value.

[0128] The common data type identifier prefix is ​​a pre-defined binary code used to identify that the data contained in the association string is common data. This binary code is converted to a hexadecimal string, and then the converted hexadecimal string is appended to the beginning of the common association string. This string concatenation operation generates common data association pairs. The critical data association pairs and the common data association pairs together constitute the set of association data pairs between encrypted data and hash check values. This set contains all encrypted meteorological observation data (including critical sensitive data and ordinary non-sensitive data) and their corresponding hash check values, and different types of data are distinguished by the data type identifier prefix.

[0129] As one implementation method, in step S600, the associated data set is format-standardized using variable-length encoding rules to generate a composite encrypted data packet containing data type identifiers for meteorological observation data. Specifically, this may include the following steps S670~S6130: Step S670: Read the key data association pairs and ordinary data association pairs in the association data pair set, and use them as key association pairs and ordinary association pairs respectively. Count the total number of association pairs as the total number of association pairs.

[0130] The process reads key data association pairs and ordinary data association pairs from the association pair set by iterating through the set elements and assigning them to the key association pair and ordinary association pair variables respectively. The total number of association pairs is then calculated by summing the number of key association pairs and ordinary association pairs, which is taken as the total number of association pairs. This total number of association pairs is used to record the number of association pairs in the data packet later, so that the receiver can understand the number of association pairs contained in the data packet during parsing.

[0131] Step S680: Initialize the data packet buffer. The buffer is used to store the standardized data. The initial state is empty. Write the data packet magic number at the beginning of the buffer. The data packet magic number is a preset fixed byte sequence used to identify the data packet type.

[0132] Initialize the data packet buffer, a memory area used to store the formatted data; it is initially empty. The data packet magic number is a preset fixed byte sequence that identifies the composite encrypted data packet of the meteorological observation data, used to quickly identify the type of data packet during data transmission. The data packet magic number is written to the beginning of the buffer through a byte stream write operation, placing the data packet magic number at the beginning of the buffer.

[0133] Step S690: Convert the total number of association pairs into a fixed-byte unsigned integer, write it to the data packet buffer as the association pair quantity field, and then write it to a fixed-byte reserved field with a preset reserved value.

[0134] The total number of association pairs is converted into a fixed-length unsigned integer. The conversion process, based on a preset byte count requirement, converts the total number of association pairs into an unsigned integer of the appropriate length using binary encoding. This is then written to the data packet buffer via byte stream write operations. The converted unsigned integer is written to the buffer as the association pair count field, which records the total number of association pairs. Next, a fixed-length reserved field is written. This reserved field is reserved for future expansion or compatibility considerations, and its value is a preset reserved value. The process of writing the reserved field is also implemented through byte stream write operations, writing the preset reserved value to the buffer in fixed-length bytes. This completes the writing operations for the association pair count field and the reserved field.

[0135] Step S6100: Process each association pair in sequence, read the type identifier prefix of the association pair, determine whether it is critical data or ordinary data, convert the prefix into a fixed-byte type identifier field, and write it into the buffer.

[0136] Each association pair in the association pair set is processed sequentially by iterating through the set elements. The type identifier prefix of the association pair is read; this prefix, added to the beginning of the association string in previous steps, distinguishes between critical and ordinary data. Whether the prefix corresponds to critical or ordinary data is determined through prefix parsing and comparison. The prefix is ​​converted into a fixed-length type identifier field; the conversion process encodes the prefix into a byte sequence of the appropriate length according to a preset byte count requirement. The converted type identifier field is written to the data packet buffer via byte stream writing operations, providing data type identification information for subsequent data parsing.

[0137] Step S6110: Calculate the string length of the current associated pair, convert the string length into a fixed number of unsigned integers, write it into the buffer as the length field, convert the string content of the associated pair into a byte stream, write it into the buffer as the data field.

[0138] The length of the current associated pair is calculated using a string length statistics function to obtain the number of characters in the associated pair string. The string length is then converted to a fixed-length unsigned integer. The conversion process, based on a preset byte count requirement, converts the string length to an unsigned integer of the corresponding length using binary encoding. This unsigned integer is written to a buffer as the length field using byte stream write operations. This length field records the length of the current associated pair string. The string content of the associated pair is then converted to a byte stream using string encoding operations, converting the associated pair string into a byte sequence according to a preset encoding method (e.g., UTF-8). This byte stream is written to a buffer as the data field using byte stream write operations, completing the writing operations for the length and data fields of the associated pair.

[0139] Step S6120: Repeat the processing of each association pair until all association pairs are written to the buffer. Add a preset check value of a fixed number of bytes to the end of the buffer. The check value is obtained by calculating the preset check algorithm of all bytes from the magic number in the buffer to the data field.

[0140] Repeat steps S6100 and S6110, processing each association pair in the association pair set until all association pairs are written to the data packet buffer. Add a fixed-length preset checksum to the end of the buffer. The preset checksum algorithm can be either the previously mentioned hash algorithm or the Cyclic Redundancy Check (CRC) algorithm. This algorithm calculates a fixed-length checksum for all bytes in the data field of the last association pair in the buffer, starting from the magic number. This checksum is added to the end of the buffer in fixed-length byte format through a byte stream write operation. The preset checksum is used to verify the integrity of data packets during data transmission or storage. The receiver can use the same checksum algorithm to calculate the checksum for received data packets and compare it with the extracted checksum to determine if the data packets have been tampered with.

[0141] Step S6130: Concatenate all bytes in the data packet buffer in the order of writing to generate a composite encrypted data packet of meteorological observation data containing data type identifiers. The structure of the data packet is a combination of magic number, quantity field, reserved field, multiple type identifier fields, length field, and data field, with the check value arranged in sequence.

[0142] All bytes in the data packet buffer are concatenated in the order they were written, using byte stream concatenation operations. This sequentially joins the various parts of the buffer (magic number, number of association pairs, reserved fields, type identifier field, length field, data field, and checksum) to generate a composite encrypted data packet containing data type identifiers for meteorological observation data. This data packet has a specific structure: the magic number is at the beginning of the packet, identifying its type; the number field records the total number of association pairs; the reserved fields are reserved for future expansion; combinations of multiple type identifier fields, length fields, and data fields correspond to the information of each association pair, used to distinguish and store different types of data and their length and content; the checksum is at the end of the packet, used to verify its integrity. The entire data packet has a clear structure, facilitating data transmission, storage, and decryption.

[0143] In one implementation, step S6130 may specifically include the following steps S6131 to S6136: Step S6131: Initialize the composite data packet structure, which includes a main header, a data area, and a tail check area.

[0144] The initialization of the composite data packet structure is the logical structure used to organize and manage the various parts of the composite encrypted meteorological observation data packet. This structure consists of three main parts: a main header, a data area, and a tail checksum. The main header stores basic information about the data packet, such as the version number and creation timestamp; the data area stores the encrypted meteorological observation data and its associated information; and the tail checksum stores the checksum of the data packet, used to verify its integrity. The initialization process can be achieved by creating the corresponding data structure object and assigning initial values.

[0145] Step S6132: Write the data packet version number into the main packet header. The version number is a fixed number of bytes and identifies the encryption algorithm version. Write the creation timestamp, which is a fixed number of bytes, to record the time when the data packet was generated. Write the data area offset, which is a fixed number of bytes, to indicate the starting position of the data area in the data packet. Write the total length of the data area, which is a fixed number of bytes, to indicate the number of bytes in the data area.

[0146] The main packet header contains a data packet version number, a fixed-length value that identifies the encryption algorithm version used in the composite encrypted meteorological observation data packet. This write operation is performed via a byte stream, writing the version number in a fixed-length format to the main packet header. Next, a creation timestamp, also a fixed-length timestamp, is written, recording the specific time the data packet was generated. This is achieved by converting the current system time to a fixed-length timestamp format and writing it to the main packet header. Finally, a data area offset, also a fixed-length value, is written, indicating the starting position of the data area within the data packet. This offset is calculated by adding the length of the main packet header portion to the offset. Finally, the total length of the data area, a fixed-length value, is written, indicating the number of bytes in the data area. This total length is calculated by adding the lengths of the data fields in all associated pairs within the data area and writing it to the main packet header.

[0147] Step S6133: Write the key data encrypted data packet units and ordinary data encrypted data packet units after the format standardization process into the data area in sequence. Add a unit separator of a fixed number of bytes between each data packet unit. The separator is used to distinguish different encrypted data units.

[0148] After standardization, key data encrypted data packets and ordinary data encrypted data packets are sequentially written to the data area via byte stream write operations. The data fields of key association pairs and ordinary association pairs in the association pair set are written to the data area in that order. A fixed-length unit separator is added between each data packet. The unit separator is a pre-defined fixed byte sequence used to distinguish different encrypted data packets in the data area. Adding unit separators is also implemented through byte stream write operations; after each data packet is written, the unit separator is written immediately to ensure that each encrypted data packet in the data area can be clearly distinguished.

[0149] Step S6134: Calculate the first check value of all bytes in the data area, write the first check value into the first half of the tail check area as the data area check value; calculate the second check value of all bytes in the main packet header and the data area, write the second check value into the second half of the tail check area as the overall check value.

[0150] Calculate the first checksum for all bytes in the data area using a preset checksum algorithm (such as a hash algorithm or cyclic redundancy check algorithm) to obtain a fixed-length checksum. Write the first checksum to the first half of the tail checksum area through a byte stream write operation. Store the first checksum as the data area checksum in the first half of the tail checksum area to verify the integrity of the data area. Calculate the second checksum for all bytes in the header and data area using the same preset checksum algorithm to obtain another fixed-length checksum. Write the second checksum to the second half of the tail checksum area through a byte stream write operation. Store the second checksum as the overall checksum in the second half of the tail checksum area to verify the integrity of the entire data packet (including the header and data area).

[0151] Step S6135: Serialize the composite data packet structure by converting it into a byte stream in the order of main header, data area, and tail check area to generate the initial composite encrypted data packet.

[0152] The composite data packet structure undergoes serialization, which is the process of converting the various parts of the composite data packet structure (main header, data area, and checksum) into a byte stream according to certain rules. The conversion is performed in the order of main header, data area, and checksum, achieved through byte stream concatenation operations. The byte streams of each part are sequentially joined together to generate the initial composite encrypted data packet. The initial composite encrypted data packet is a complete byte stream, containing encrypted information about meteorological observation data, basic data packet description information, and checksum values.

[0153] Step S6136: Compress the initial composite encrypted data packet using a preset compression algorithm to generate a compressed data packet. If the compressed length is greater than the initial length, retain the initial composite encrypted data packet; otherwise, use the compressed data packet to obtain the final composite encrypted data packet containing the data type identifier of the meteorological observation data.

[0154] The initial composite encrypted data packet is compressed using a preset compression algorithm (such as the lossless compression algorithm mentioned earlier), converting it into a compressed data packet. The length of the compressed data packet is calculated and compared with the length of the initial composite encrypted data packet. If the compressed length is greater than the initial length, it indicates that compression has not reduced the data volume, and the initial composite encrypted data packet is retained; otherwise, the compressed data packet is used and identified as the final composite encrypted data packet containing data type identifiers for meteorological observation data. The final data packet minimizes data storage space while ensuring data integrity and decryptability, facilitating data transmission and storage.

[0155] In one implementation, after step S6130, the following steps S6140 to S6180 may also be included: Step S6140: Read the main header information of the meteorological observation data composite encrypted data packet, extract the data packet version number, compare it with the preset supported version list, and output a version incompatibility prompt message when the version number is not in the list, and terminate subsequent processing.

[0156] The system reads the main header information of the composite encrypted meteorological observation data packet. By parsing the byte stream of the data packet, it locates and extracts the information from the main header. The packet version number is extracted from the main header, which was already written in the previous steps. It is then compared with a pre-defined list of supported versions. This list contains all data packet versions supported by the current system. The comparison is performed by iterating through the list elements and comparing them with the extracted version number. If the data packet version number is not found in the supported version list, it means that the encryption algorithm used by the data packet is incompatible with the current system, posing a risk of incorrect decryption or processing. In this case, a version incompatibility message is output. This message can be displayed through logs, the user interface, etc., informing the user of the data packet version incompatibility. Simultaneously, subsequent processing is terminated to avoid errors or anomalies caused by version incompatibility.

[0157] Step S6150: Extract the creation timestamp from the main packet header, calculate the difference between the creation timestamp and the current system timestamp, and use it as the data packet lifespan. When the lifespan exceeds the preset data packet validity period, output a data packet expiration prompt message and terminate subsequent processing.

[0158] Extract the creation timestamp from the main packet header to obtain the timestamp information recording the data packet generation time. Calculate the difference between the creation timestamp and the current system timestamp (which records the current time). Subtracting the two yields the data packet's lifespan. The preset data packet validity period is a pre-defined time length used to specify the effective usage period of the data packet. When the data packet's lifespan exceeds the preset validity period, it indicates that the data packet has expired, and the data it contains may have lost its timeliness or security. In this case, output a data packet expiration message. This message can be output through log recording, interface display, etc., to inform the user that the data packet has expired. Simultaneously, terminate subsequent processing to prevent the use of expired data packets for decryption or other operations.

[0159] Step S6160: Read the total length and offset of the data area, calculate the theoretical total length of the data packet, compare the theoretical total length with the actual length of the data packet read, and output a length error message if they are inconsistent, and terminate subsequent processing. The total length and offset of the data area are obtained from the main packet header. The total length of the data area indicates the number of bytes in the data area, and the offset of the data area indicates the starting position of the data area in the data packet.

[0160] The theoretical total length of the data packet is calculated by adding the data area offset, the total data area length, and the length of the tail check area. This theoretical total length is then compared to the actual length of the read data packet, which is obtained by measuring the length of the packet's byte stream. If they do not match, it indicates an abnormal data packet length, possibly due to tampering or corruption during transmission. In this case, a length error message is output, which can be logged, displayed on the user interface, or otherwise, informing the user of the abnormal data packet length. Simultaneously, subsequent processing is terminated to avoid further processing of the abnormally long data packet.

[0161] Step S6170: Extract the first check value of the tail check area, recalculate the first check value of all bytes in the data area, compare it with the extracted check value, and output a data area corruption prompt message if they are inconsistent, and terminate subsequent processing.

[0162] Extract the first checksum from the tail checksum area, and retrieve the stored data area checksum from the tail checksum area. Recalculate the first checksum for all bytes in the data area using the same preset checksum algorithm as before, resulting in a new checksum. Compare the recalculated checksum with the extracted checksum. If they do not match, it indicates that the data in the data area may have been tampered with or corrupted during transmission, causing the checksum mismatch. In this case, output a data area corruption warning message. This message can be displayed through logs, user interface, etc., informing the user of the data area corruption. Simultaneously, terminate subsequent processing steps to prevent decryption or other operations on the corrupted data area.

[0163] Step S6180: Extract the second check value of the tail check area, recalculate the second check value of all bytes in the main header and data area, compare it with the extracted check value, and output a data packet tampering prompt message if they are inconsistent, and terminate subsequent processing; when all checks pass, output a data packet verification pass message.

[0164] Extract the second checksum from the tail checksum area and obtain the stored overall checksum from it. Recalculate the second checksum for all bytes in the main header and data area using the same preset checksum algorithm as before, resulting in a new checksum. Compare the recalculated checksum with the extracted checksum. If they do not match, it indicates that the entire data packet may have been tampered with during transmission, posing a data security risk. In this case, output a data packet tampering warning message, which can be displayed through logs or a user interface to inform the user that the data packet has been tampered with. Simultaneously, terminate subsequent processing to avoid using the tampered data packet. When all checks (version number comparison, lifetime check, length comparison, data area check, and overall check) pass, it indicates that the data packet is version compatible, not expired, has a normal length, and the data area is undamaged and untampered with. Output a data packet verification pass message, which can be displayed through logs or a user interface to inform the user that the data packet verification has passed.

[0165] This invention provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements some or all of the steps in the above-described method. The computer-readable storage medium can be transient or non-transient.

[0166] This invention provides a computer program including computer-readable code, wherein when the computer-readable code is executed in a computer device, a processor in the computer device performs some or all of the steps in the above-described method.

[0167] Figure 2 A hardware entity diagram of a computer device provided in an embodiment of the present invention, such as... Figure 2 As shown, the hardware entity of the computer device 1000 includes a processor 1001 and a memory 1002, wherein the memory 1002 stores a computer program that can run on the processor 1001, and the processor 1001 executes the program to implement the steps in the method of any of the above embodiments.

Claims

1. A hybrid encryption method for meteorological observation data based on polling keys, characterized in that, The method includes: By combining the geographic coordinates of meteorological observation equipment with the time of meteorological observation data collection, a timeliness assessment index for meteorological observation data is generated. The timeliness assessment index is correlated with the geographic coordinate information of the meteorological observation equipment to determine the sensitivity level classification threshold of the meteorological observation data. Based on the sensitivity level classification threshold, the meteorological observation data is divided into key sensitive data and ordinary non-sensitive data. Extract the unique identification information of the meteorological observation equipment and the collection timestamp information of the meteorological observation data. Generate an initial encryption master key based on the unique identification information and the collection timestamp information. Perform iterative transformation processing on the initial encryption master key to generate a polling subkey sequence with time series correlation. For the critical sensitive data, a target polling subkey corresponding to the current encryption time is selected from the polling subkey sequence. The target polling subkey is XORed with a preset asymmetric encryption public key to generate a composite encryption key. The critical sensitive data is then subjected to asymmetric encryption based on the composite encryption key to obtain the encryption result of the critical data. For the ordinary non-sensitive data, a target polling subkey corresponding to the current encryption time is selected from the polling subkey sequence. The target polling subkey is used as the input key of the symmetric encryption algorithm to perform symmetric encryption processing on the ordinary non-sensitive data to obtain the ordinary data encryption result. The encryption results of the key data and the encryption results of the ordinary data are respectively associated and bound with the hash verification value of the corresponding target polling subkey to generate an associated data pair of encrypted data and hash verification value. The associated data pair is then processed to standardize the format to generate a composite encrypted data packet of meteorological observation data containing data type identifier.

2. The method according to claim 1, characterized in that, The process involves extracting the unique identification information of the meteorological observation equipment and the collection timestamp information of the meteorological observation data, and generating an initial encryption master key based on the unique identification information and the collection timestamp information, including: Read the unique identification information from the meteorological observation equipment. The unique identification information is a fixed-length binary sequence written when the equipment leaves the factory. The unique identification information is parsed, the serial number-related fields are extracted, and the serial number-related fields are converted into decimal values ​​as the device serial number value; Read the collection timestamp information of meteorological observation data, convert it into a timestamp value in a preset time format, and use it as the data collection timestamp value; Acquire real-time operating status parameters of meteorological observation equipment, including equipment operating voltage and internal temperature; calculate the percentage deviation of the voltage value from the standard voltage value as the voltage deviation rate; and calculate the deviation of the temperature value from the standard temperature value as the temperature deviation value. The device serial number, the data acquisition timestamp, the voltage deviation rate, and the temperature deviation are concatenated into a string, and a preset hash operation is performed on the string to generate a hash value of fixed length. The first half of the hash value is taken as the core part of the initial encryption master key. The core part is then cyclically shifted right by a preset number of bits to obtain the initial encryption master key, which is a fixed-length binary sequence.

3. The method according to claim 2, characterized in that, The iterative transformation process of the initial encryption master key to generate a polling subkey sequence with time-series correlation includes: The key derivation iteration number is set to a value corresponding to the sampling frequency of the meteorological observation equipment. The current system timestamp is obtained, and the difference between the system timestamp and the data acquisition timestamp is calculated as the time difference value. The time difference value is divided by a preset time unit to obtain the time window parameter. The time window parameter is used to characterize the time interval characteristics of the current encryption process. The initial encryption master key is used as the input key for the first round of iterations. A preset hash operation is performed on the input key to generate a fixed-length intermediate key. The first half of the intermediate key is then used as the first round sub-key. The clock deviation value of the meteorological observation equipment is extracted. The clock deviation value is the difference between the real-time clock of the equipment and the standard time. The clock deviation value is divided by the preset time unit to obtain the normalized clock deviation parameter. The normalized clock deviation parameter is summed with the time window parameter to obtain the comprehensive time offset value. The comprehensive time offset value is converted into a fixed-length binary number as the iterative offset parameter. The intermediate key is XORed with the iterative offset parameter to obtain the offset intermediate key. The offset intermediate key is used as the input key for the next round of iteration. The hash operation, subkey truncation and XOR processing steps are repeated until the preset number of iterations is completed. Obtain the subkeys generated in each iteration, arrange them in the iteration order, and generate an initial round subkey sequence. The sequence contains a number of subkeys equal to the number of iterations, and each subkey corresponds to a sampling time point. Calculate the Hamming distance between adjacent subkeys in the initial polling subkey sequence. When the Hamming distance between any adjacent subkey is less than a preset threshold, perform a cyclic left shift operation of a preset number of bits on the next subkey. After adjustment, a polling subkey sequence with time series correlation is obtained.

4. The method according to claim 3, characterized in that, For the critical sensitive data, a target polling subkey corresponding to the current encryption time is selected from the polling subkey sequence. The target polling subkey is then XORed with a preset asymmetric encryption public key to generate a composite encryption key, including: Obtain the system timestamp of the current encryption time, convert it into a timestamp with a preset time precision, and use it as the current encryption time value. Calculate the time difference between the current encryption time value and the data acquisition timestamp value, and use it as the encryption time difference. The encryption time difference is moduloed by the length of the polling subkey sequence to obtain the polling index value. The corresponding subkey is selected from the polling subkey sequence according to the polling index value as a candidate polling subkey. Extract the generation timestamp of the candidate polling subkey, calculate the difference between the generation timestamp and the system timestamp at the current encryption time, and use it as the key validity difference. When the key validity difference is greater than the preset key validity period, select the subkey corresponding to the next index from the polling subkey sequence as the candidate polling subkey, and repeat the verification until a subkey with a validity difference within the valid range is found, which is then used as the target polling subkey. Read the preset asymmetric encryption public key, perform a preset hash operation on the public key to generate a fixed-length public key hash value, and extract the first half of the public key hash value as the public key hash truncation value; Perform a bitwise XOR operation between the target polling subkey and the public key hash truncation value to obtain a fixed-length intermediate composite key. The result of each bit in the XOR operation is the XOR result of the corresponding bit of the target polling subkey and the corresponding bit of the public key hash truncation value. The intermediate composite key is expanded by cyclic shifting and padding operations to a length consistent with the asymmetric encryption public key, thus generating a composite encryption key.

5. The method according to claim 4, characterized in that, The process of performing asymmetric encryption on the critical sensitive data based on the composite encryption key to obtain the encrypted result of the critical data includes: The key sensitive data is converted into a byte array as a byte stream to be encrypted. The length of the byte stream to be encrypted is calculated. When the length is greater than the single encryption limit of the asymmetric encryption algorithm, the byte stream to be encrypted is divided into blocks. The length of each block is a preset proportion of the encryption limit, generating multiple data blocks as a key data block sequence. The data blocks in each key data block sequence are padded. Based on the preset padding standard, padding bytes are added to the end of the data block so that the length of the padded data block is an integer multiple of the block length of the asymmetric encryption algorithm, and the padded data block is generated. Initialize the encryption result buffer, which is used to store the encrypted data blocks. The buffer is initially empty. Set the data block index counter, with the initial value being a preset starting value. Read the data block indexed by the counter value from the key data block sequence, input the padded data block and the composite encryption key into the asymmetric encryption algorithm, perform encryption operation, and generate encrypted data block; The encrypted data block is added to the end of the encryption result buffer, and the data block index counter is incremented by a preset step size. The steps of reading data blocks, encrypting, and adding are repeated until all data blocks are processed. All encrypted data blocks in the encryption result buffer are concatenated in the processing order to generate a key data encryption result. The key data encryption result is in byte stream form and contains the encryption information of all key and sensitive data.

6. The method according to claim 1, characterized in that, For the ordinary, non-sensitive data, a target polling subkey corresponding to the current encryption time is selected from the polling subkey sequence. This target polling subkey is then used as the input key for a symmetric encryption algorithm to perform symmetric encryption on the ordinary, non-sensitive data, resulting in an encrypted ordinary data result. This includes: Obtain the system timestamp of the current encryption time, convert it into a timestamp with a preset time precision, and use it as the current encryption time value. Calculate the time difference between the current encryption time value and the data acquisition timestamp value, and use it as the normal encryption time difference. The normal encryption time difference is moduloed by the length of the polling subkey sequence to obtain the normal polling index value. The corresponding subkey is selected from the polling subkey sequence according to the normal polling index value as the normal candidate subkey. Extract the key version number of the ordinary candidate subkey, query the preset key version compatibility list, and verify whether the key version number is within the compatibility range. If it is not compatible, select the subkey corresponding to the next index from the polling subkey sequence as the ordinary candidate subkey, and repeat the verification until a compatible version subkey is found as the ordinary target polling subkey. The ordinary non-sensitive data is converted into a byte array as a normal byte stream to be encrypted. A preset check value of the normal byte stream to be encrypted is calculated as the normal data check value. The normal data check value is appended to the end of the normal byte stream to be encrypted to generate an extended byte stream to be encrypted. Initialize the context environment of the symmetric encryption algorithm, set the encryption mode to the preset block cipher working mode, generate a random fixed-length initial vector, use the ordinary target polling subkey as the encryption key, use the initial vector as the encryption parameter, input the extended byte stream to be encrypted to perform symmetric encryption operation, and generate an encrypted byte stream; The initial vector is concatenated with the encrypted byte stream, with the initial vector first and the encrypted byte stream second, to generate a normal data encryption result. The normal data encryption result includes the initial vector required for decryption and the encrypted normal non-sensitive data.

7. The method according to claim 6, characterized in that, Also includes: Read the header information of ordinary non-sensitive data. The header information includes data type identifier, data length and acquisition device number. Separate the header information from the data body and use it as ordinary data header and ordinary data body. The ordinary data body is compressed to convert it into compressed data. The length ratio of the data body before and after compression is calculated. If the ratio is greater than a preset threshold, the original data body is retained; otherwise, the compressed data body is used as the processed data body. The ordinary data header is concatenated with the processed data body to generate ordinary data to be encrypted. The format of the ordinary data to be encrypted is a byte stream with the data header first and the data body last. Select the ordinary target polling subkey corresponding to the current encryption time from the polling subkey sequence, use the ordinary target polling subkey as the input key of the symmetric encryption algorithm, perform symmetric encryption processing on the ordinary data to be encrypted, and generate an intermediate encryption result; Extract the encryption state parameters generated during the symmetric encryption process, and convert the encryption state parameters into a byte array as a state parameter byte stream; The intermediate encryption result is concatenated with the state parameter byte stream, with the intermediate encryption result first and the state parameter byte stream second, to generate a normal data encryption result.

8. The method according to claim 1, characterized in that, The step of associating and binding the encryption results of the key data and the encryption results of the ordinary data with the hash verification values ​​of the corresponding target polling subkeys to generate associated data pairs of encrypted data and hash verification values ​​includes: Extract the target polling subkey used to encrypt key sensitive data, and use it as the key encryption subkey. Perform a preset hash operation on the key encryption subkey to generate a fixed-length key subkey hash value. Convert the key subkey hash value into a fixed-length hexadecimal string, and use it as the key hash string. The key data encryption result is converted into an encoded string with a preset encoding method, which is used as the key encryption encoded string. A preset key data separator is added to the end of the key encryption encoded string, and then the key hash string is concatenated to generate a key association string. The format of the key association string is that the key encryption encoded string, the separator, and the key hash string are concatenated in sequence. Extract the target polling subkey used to encrypt ordinary non-sensitive data, and use it as the ordinary encryption subkey. Perform a preset hash operation on the ordinary encryption subkey to generate a fixed-length ordinary subkey hash value. Convert the ordinary subkey hash value into a fixed-length hexadecimal string, and use it as the ordinary hash string. The ordinary data encryption result is converted into an encoded string with a preset encoding method, which is used as an ordinary encryption encoded string. A preset ordinary data separator is added to the end of the ordinary encryption encoded string, and then the ordinary hash string is concatenated to generate an ordinary associated string. The format of the ordinary associated string is that the ordinary encryption encoded string, the separator, and the ordinary hash string are concatenated in sequence. Add a key data type identifier prefix to the key association string. This prefix is ​​a preset binary code, which is converted into a hexadecimal string and added to the beginning of the association string to generate a key data association pair. A common data type identifier prefix is ​​added to the common association string. This prefix is ​​a preset binary code, which is converted into a hexadecimal string and added to the beginning of the association string to generate a common data association pair. The key data association pair and the common data association pair together constitute a set of association data pairs between encrypted data and hash verification value.

9. A computer device comprising a memory and a processor, the memory storing a computer program executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method according to any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the method according to any one of claims 1 to 8.

Images