Dynamic and static encryption key technology and method applied to encryption ship automatic identification system

Abstract

The invention relates to the technical field of communication, in particular to a dynamic and static secret key encryption technology and method applied to an encryption ship automatic identification system. Comprising a ship name, a call number, a ship length, a ship width, a ship type, a ship native place port and positioning antenna position information, and the ship AIS terminal module is configured to collect ship static data, dynamic data and navigation related data and broadcast the data through a very high frequency channel; the dynamic data comprises longitude and latitude coordinates of the ship, the speed to the ground, the course to the ground, the bow direction, the navigation state and the steering rate, and the navigation related data comprises the draft of the ship, the dangerous cargo type, the destination and the estimated arrival time; the core problem that a traditional AIS system is insufficient in data protection capacity in a dynamic threat environment can be solved.

Description

Technical Field

[0001] This invention relates to the field of communication technology, specifically to a dynamic and static encryption key technology and method applied to an encrypted ship automatic identification system. Background Technology

[0002] As a core infrastructure for maritime communication, the Automatic Identification System (AIS) enables data exchange between ships and between ships and shore via VHF channels. It plays an irreplaceable role not only in ensuring navigational safety and shipping efficiency for ordinary vessels but also in crucial scenarios such as law enforcement vessel supervision, enforcement, and mission scheduling. Law enforcement vessels, as a vital force in maritime law enforcement, rely heavily on the confidentiality of their navigation trajectories, real-time locations, and mission-related information to ensure the effectiveness of enforcement actions. For example, in surprise inspections and interceptions of violating vessels, if location information is obtained by ordinary vessels, enforcement targets may evade inspection, impacting enforcement effectiveness. However, with the increasing complexity of the maritime communication environment, the data security deficiencies of traditional AIS systems are becoming increasingly apparent. In existing technologies, AIS data is transmitted in plaintext or statically encrypted form. Attackers can steal sensitive information such as vessel position, course, and speed by eavesdropping or impersonating, and even tamper with data content, leading to serious consequences such as collision risks and unauthorized intrusion. This problem is particularly prominent in law enforcement scenarios: the public transmission nature of ordinary AIS messages may allow unauthorized vessels to track the real-time location of law enforcement vessels, directly threatening the confidentiality of law enforcement operations. More importantly, traditional key management schemes rely on manual intervention or fixed rules to generate keys, resulting in problems such as a single key distribution path, rigid update cycles, and insufficient dynamic adaptability. When ships navigate across regions or enter high-risk waters, existing technologies cannot dynamically adjust encryption strength according to real-time threat levels, exacerbating the conflict between the risk of key leakage and communication security. For law enforcement vessels, their navigation areas often involve sensitive waters and key regulatory areas, and their communication needs combine real-time requirements with confidentiality. The static encryption mechanisms and fixed key strategies of traditional AIS systems cannot meet the encrypted transmission requirements of law enforcement data, nor can they adapt to the dynamically changing communication environment during law enforcement.

[0003] Based on the above problems, there is an urgent need for a technical solution that can intelligently identify security threats based on navigation status and autonomously optimize encryption strategies to solve the core problem of insufficient data protection capabilities of traditional AIS systems in dynamic threat environments. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings of existing technologies and propose a dynamic and static encryption key technology for use in encrypted ship automatic identification systems, comprising: Ship AIS terminal module: configured to collect static data, dynamic data and navigation-related data of the ship, and broadcast them through VHF channels. The static data includes the ship name, call sign, length, beam, ship type, port of registry, and positioning antenna location information. The dynamic data includes the ship's latitude and longitude coordinates, speed above ground, heading above ground, heading, navigation status, and turning rate. The navigation-related data includes the ship's draft, type of dangerous goods, destination, and estimated time of arrival. Encrypted communication module: It adopts a hybrid encryption mechanism that combines dynamic and static keys to encrypt the data broadcast by the AIS terminal module in real time. The encryption process includes data padding, block encryption, encryption mode selection, and initialization vector generation steps. Key Management Module: Integrates artificial intelligence algorithms to realize full lifecycle management of key generation, distribution, update and destruction. The full lifecycle management covers the stages of key application, approval, generation, storage, distribution, use, backup, recovery, update, archiving and destruction. Base station service module: responsible for receiving encrypted AIS data, decrypting it, and pushing the decrypted data to the shore-based management system or other ship terminals. The decryption process includes key verification, data unpacking, data verification, and data reassembly steps. Artificial intelligence decision-making module: Based on the ship's navigation trajectory, communication frequency, and key usage, dynamically adjust the encryption strategy and key management strategy. The dynamic adjustment includes switching encryption algorithms, adjusting key length, changing key update cycle, and selecting encryption mode.

[0005] Preferably, the encrypted communication module employs the following hybrid encryption mechanism: The static key is used for ship identification and basic data encryption. The static key is 128 bits long and is encrypted using the AES encryption algorithm. The dynamic key is generated in real time by the key management module and distributed using an asymmetric encryption algorithm. The dynamic key is 256 bits long and is encrypted using the RSA encryption algorithm. The validity period adjustment strategy includes a geofencing strategy based on the ship's current location and a dynamic adjustment strategy based on the ship's communication frequency. The static key and the dynamic key are fused together by an XOR operation to form the final encryption key. The fusion process includes key padding, key alignment, XOR operation, and result verification to ensure the security of data transmission.

[0006] More preferably, the key management module includes: Key generation submodule: Based on the ship's unique identification code and current timestamp, an initial key is generated using a hash algorithm, including SHA-256 and SHA-3 algorithms. The initial key generation process includes data cleaning, data preprocessing, hash operation, and result postprocessing. Key distribution submodule: Distributes the generated key to the target ship's AIS terminal and base station service module through the Secure Sockets Layer protocol. The key distribution process includes key encryption, key transmission, key decryption, and key verification. Key update submodule: When a key leakage risk is detected or a preset update cycle is reached, the key update process is automatically triggered. The key update process includes key expiration declaration, new key generation, new key distribution, and old key destruction. The key destruction submodule performs irreversible destruction of the key when the key expires or the ship is deregistered. The key destruction process includes key erasure, key backup deletion, and key usage record clearing.

[0007] More preferably, the artificial intelligence decision-making module dynamically adjusts the encryption strategy and key management strategy using the following strategies: Based on the ship's historical navigation trajectory, the navigation area and communication needs in the future period are predicted. The navigation trajectory prediction adopts machine learning algorithms, including support vector machine algorithm, random forest algorithm, and neural network algorithm. Based on the prediction results, the validity period and encryption strength of the dynamic key are dynamically adjusted. The encryption strength adjustment includes encryption algorithm switching, key length adjustment, and encryption mode selection to ensure that the encryption strategy matches the ship's navigation area and communication needs. When a ship enters a high-risk area or the communication frequency is abnormal, the encryption strength is automatically increased and the key update cycle is shortened. The high-risk areas include military restricted areas, pirate activity areas, and sensitive sea areas. The abnormal communication frequency includes excessively high communication frequency and abnormal communication content.

[0008] More preferably, the encryption process of the hybrid encryption mechanism is represented by the following mathematical formula: ;

[0009] in, This represents the final encryption key. Indicates a static key. Indicates a dynamic key. Represents the XOR operation; static key The generation follows the following formula: ; in, Represents a hash function. A unique identifier for a ship. This represents the timestamp used to generate the static key. This indicates a string concatenation operation.

[0010] More preferably, the generation of the initial key in the key generation submodule can be represented by the following mathematical formula: ;

[0011] in, Indicates the initial key. Represents a hash function. A unique identifier for a ship. Indicates the current timestamp. This refers to random numbers generated by a random number generator; random numbers The generation follows the following formula: ;

[0012] in, This represents a pseudo-random number generation function. This represents the seed value, which is dynamically generated based on the ship's physical characteristics and the navigation environment.

[0013] More preferably, the encryption strength adjustment strategy of the artificial intelligence decision-making module can be expressed by the following mathematical formula: ; in, Indicates encryption strength. Indicated based on the ship's sailing distance The encryption strength adjustment function, Indicates based on communication risk level The encryption strength adjustment function, and Let represent the weight coefficients of the two functions, and satisfy . ; sailing distance The calculation formula is: ;

[0014] in, Indicates the ship's time sailing speed, and These represent the start and end times of the voyage, respectively.

[0015] A further preferred embodiment includes a data push module responsible for pushing the decrypted AIS data to the shore-based management system or other ship terminals. The strategy adopted for pushing the decrypted AIS data to the shore-based management system or other ship terminals includes: The pushed data is filtered according to the data recipient's permission level, which includes public, internal, and confidential levels. The filtering process includes data screening, data desensitization, and data encryption steps. During the data push process, compression algorithms are used to compress the data in order to reduce network bandwidth usage. The compression algorithms include lossless compression algorithms and lossy compression algorithms. The compression process includes data segmentation, compression encoding, and compressed data transmission steps. After the data push is completed, a push log is generated and stored in the database for subsequent auditing and traceability. The push log includes the push time, push data content, push result, and recipient information. The database includes relational databases and non-relational databases.

[0016] More preferably, it also includes an interface debugging module, which provides the following interface debugging functions: Provides API interfaces: Allows third-party systems to integrate and debug the ship's AIS encrypted communication system. The API interfaces include RESTful API interfaces and WebSocket API interfaces. The integration and debugging include system status query, system parameter configuration, and system log viewing operations. Provides a log interface: allows users to view system operation logs and error logs. The log interface includes a command-line interface and a graphical user interface. The system operation logs include system startup logs, system operation logs, and system shutdown logs. The error logs include system error logs, communication error logs, and encryption error logs. Provides a performance monitoring interface: allows users to view system resource usage and performance indicators in real time. The performance monitoring interface includes a system resource monitoring interface, a network performance monitoring interface, and an encryption performance monitoring interface. The system resource usage includes CPU utilization, memory utilization, and disk utilization. The performance indicators include data transmission rate, data encryption rate, and data decryption rate.

[0017] A dynamic and static encryption key method for use in an encrypted automatic identification system (AIS), applied to a dynamic and static encryption key technology for an encrypted AIS as described in any one of the above, comprising: The hash algorithm includes SHA-256 algorithm and SHA-3 algorithm, and the process of generating the initial key includes data cleaning, data preprocessing, hash operation and result postprocessing steps; S1: The generated key is distributed to the target ship's AIS terminal and base station service module via the Secure Sockets Layer protocol. The key distribution process includes key encryption, key transmission, key decryption, and key verification steps to ensure the security of the key during transmission. S2: When a risk of key leakage is detected or a preset update cycle is reached, the key update process is automatically triggered. The key update process includes key expiration declaration, new key generation, new key distribution, and old key destruction steps to ensure the timeliness and security of key updates. S3: When the key expires or the ship is deregistered, the key is irreversibly destroyed. The key destruction process includes key erasure, key backup deletion, and key usage record clearing steps to ensure that the key cannot be recovered or misused. S4: The generated key is stored using a secure key storage scheme, which includes a hardware security module storage scheme and an encrypted file system storage scheme to ensure the security of the key during storage. S5: Regularly back up the key and use the backup key to restore it when the key is lost or damaged. The backup process includes local backup and remote backup, and the restoration process includes key verification, key decryption and key import steps. S6: Perform auditing and traceability processing on the entire lifecycle of the key. The auditing process includes querying key usage records and viewing key operation logs. The traceability process includes tracing the key generation time and tracing the key distribution path. S7: Real-time monitoring of key management performance, including monitoring of key generation speed, key distribution efficiency, and key update timeliness, to ensure the efficiency and stability of key management; S8: Configure corresponding key security policies according to the ship's navigation area, communication requirements and security level. The key security policies include encryption algorithm selection, key length setting and key update cycle setting to ensure that key management matches the actual needs of the ship. S9: Provides a standardized key management interface, allowing third-party systems to integrate and debug the key management process. The key management interface includes a key generation interface, a key distribution interface, a key update interface, and a key destruction interface, ensuring the flexibility and scalability of key management.

[0018] Technical effects: This patent proposes an AI-based encrypted communication system for Automatic Identification System (AIS) of ships. This system integrates a ship AIS terminal module, an encrypted communication module, a key management module, a base station service module, and an AI decision-making module. The ship AIS terminal module is responsible for collecting static, dynamic, and navigation-related data from the ship and broadcasting it via VHF channels. The encrypted communication module employs a hybrid encryption mechanism combining dynamic and static keys to encrypt the data broadcast by the AIS terminal module in real time. The key management module integrates AI algorithms to manage the entire lifecycle of keys, including generation, distribution, updating, and destruction. The base station service module receives the encrypted AIS data, decrypts it, and pushes the decrypted data to a shore-based management system or other ship terminals. The AI ​​decision-making module dynamically adjusts the encryption and key management strategies based on the ship's navigation trajectory, communication frequency, and key usage. This system solves the problems of low data security and complex key management inherent in traditional ship AIS communication systems. It addresses the technical challenges of data being easily stolen or tampered with during transmission, and the cumbersome key management and distribution process, which fails to meet the high security requirements of modern ship communication. Traditional encryption strategies are often fixed and cannot be dynamically adjusted according to the ship's navigation area and communication needs, resulting in poor encryption effects or wasted resources. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a block diagram of a dynamic and static encryption key technology applied to an encrypted ship automatic identification system according to this application; Figure 2 This is a flowchart of the key management method for this application. Detailed Implementation

[0021] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0022] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, operations, elements, components and / or collections thereof.

[0023] Please see Figure 1 and Figure 2 Traditional technical solutions have the following technical problems: Traditional shipboard AIS communication systems suffer from low data security and complex key management. Data is vulnerable to theft or tampering during transmission, and the management and distribution of keys is cumbersome, failing to meet the high security requirements of modern ship communication. Furthermore, traditional encryption strategies are often fixed and cannot be dynamically adjusted according to the ship's navigation area and communication needs, resulting in poor encryption effectiveness or wasted resources.

[0024] Based on this, this application provides a dynamic and static encryption key technology for use in an encrypted automatic identification system for ships, including a ship AIS terminal module: configured to collect static data, dynamic data, and navigation-related data of the ship, and broadcast them via a VHF channel. The static data includes the ship's name, call sign, length, beam, type, port of registry, and positioning antenna location information. The dynamic data includes the ship's latitude and longitude coordinates, speed above ground, heading above ground, heading, navigation status, and turning rate. The navigation-related data includes the ship's draft, type of dangerous goods, destination, and estimated time of arrival. Encrypted communication module: It adopts a hybrid encryption mechanism that combines dynamic and static keys to encrypt the data broadcast by the AIS terminal module in real time. The encryption process includes data padding, block encryption, encryption mode selection, and initialization vector generation steps. Key Management Module: Integrates artificial intelligence algorithms to realize full lifecycle management of key generation, distribution, update and destruction. The full lifecycle management covers the stages of key application, approval, generation, storage, distribution, use, backup, recovery, update, archiving and destruction. Base station service module: responsible for receiving encrypted AIS data, decrypting it, and pushing the decrypted data to the shore-based management system or other ship terminals. The decryption process includes key verification, data unpacking, data verification, and data reassembly steps. Artificial intelligence decision-making module: Based on the ship's navigation trajectory, communication frequency, and key usage, dynamically adjust the encryption strategy and key management strategy. The dynamic adjustment includes switching encryption algorithms, adjusting key length, changing key update cycle, and selecting encryption mode.

[0025] Notably, this embodiment proposes an AI-based encrypted communication system for Automatic Identification System (AIS) of ships. This system integrates a ship AIS terminal module, an encrypted communication module, a key management module, a base station service module, and an AI decision-making module. The ship AIS terminal module is responsible for collecting static, dynamic, and navigation-related data from the ship and broadcasting it via a VHF channel. The encrypted communication module employs a hybrid encryption mechanism combining dynamic and static keys to encrypt the data broadcast by the AIS terminal module in real time. The key management module integrates AI algorithms to manage the entire lifecycle of keys, including generation, distribution, updating, and destruction. The base station service module receives the encrypted AIS data, decrypts it, and pushes the decrypted data to a shore-based management system or other ship terminals. The AI ​​decision-making module dynamically adjusts the encryption and key management strategies based on the ship's navigation trajectory, communication frequency, and key usage.

[0026] The technical effects achieved by the above embodiments include: by integrating artificial intelligence algorithms and hybrid encryption mechanisms, the system can significantly improve the security of data transmission. The combination of dynamic and static keys ensures both the flexibility of data transmission and enhances data security. Simultaneously, the key management module implements full lifecycle management of keys, simplifying the key management and distribution process and improving management efficiency. The artificial intelligence decision-making module can dynamically adjust encryption and key management strategies based on the ship's navigation trajectory and communication needs, making the system more adaptable to different navigation environments and communication requirements. This not only improves the system's security and reliability but also optimizes the efficiency of system resource utilization.

[0027] Traditional technical solutions have the following technical problems: Traditional encryption mechanisms often rely on a single static or dynamic key, making it difficult to balance security and flexibility in data transmission. While static keys are easy to manage, they offer lower security; dynamic keys, while offering higher security, are complex to manage and distribute. Therefore, an encryption mechanism is needed that can both guarantee data transmission security and simplify key management.

[0028] Based on this, the encrypted communication module adopts the following hybrid encryption mechanism: The static key is used for ship identification and basic data encryption. The static key is 128 bits long and is encrypted using the AES encryption algorithm. The dynamic key is generated in real time by the key management module and distributed using an asymmetric encryption algorithm. The dynamic key is 256 bits long and is encrypted using the RSA encryption algorithm. The validity period adjustment strategy includes a geofencing strategy based on the ship's current location and a dynamic adjustment strategy based on the ship's communication frequency. The static key and the dynamic key are fused together by an XOR operation to form the final encryption key. The fusion process includes key padding, key alignment, XOR operation, and result verification to ensure the security of data transmission.

[0029] It is worth noting that this embodiment further describes in detail the hybrid encryption mechanism employed by the encrypted communication module. This mechanism includes a static key used for ship identification and basic data encryption, and a dynamic key generated in real time by the key management module and distributed using an asymmetric encryption algorithm. During the encryption process, the static key and the dynamic key are fused through an XOR operation to form the final encryption key.

[0030] The technical effects achieved by the above embodiments include: by employing a hybrid encryption mechanism, the system can balance the security and flexibility of data transmission. The static key is used for ship identification and basic data encryption, ensuring the stability and reliability of data transmission; the dynamic key is generated in real time according to the ship's navigation area and communication needs, enhancing the security of data transmission. Simultaneously, the static and dynamic keys are fused through XOR operations to form a more complex final encryption key, further improving the security of data transmission. Furthermore, the application of asymmetric encryption algorithms simplifies the key distribution process and improves management efficiency.

[0031] Traditional technical solutions suffer from the following problems: traditional key management modules are often functionally limited, making it difficult to manage the entire key lifecycle. Furthermore, the key distribution and update process is cumbersome and insecure, making it vulnerable to theft or tampering. In addition, the key destruction process is incomplete, posing a risk of recovery or misuse. Therefore, the key management module includes: Key generation submodule: Based on the ship's unique identification code and current timestamp, an initial key is generated using a hash algorithm, including SHA-256 and SHA-3 algorithms. The initial key generation process includes data cleaning, data preprocessing, hash operation, and result postprocessing. Key distribution submodule: Distributes the generated key to the target ship's AIS terminal and base station service module through the Secure Sockets Layer protocol. The key distribution process includes key encryption, key transmission, key decryption, and key verification. Key update submodule: When a key leakage risk is detected or a preset update cycle is reached, the key update process is automatically triggered. The key update process includes key expiration declaration, new key generation, new key distribution, and old key destruction. The key destruction submodule performs irreversible destruction of the key when the key expires or the ship is deregistered. The key destruction process includes key erasure, key backup deletion, and key usage record clearing.

[0032] It is worth noting that this embodiment describes in detail the composition and function of the key management module. This module includes a key generation submodule, a key distribution submodule, a key update submodule, and a key destruction submodule. The key generation submodule generates an initial key based on the ship's unique identifier and the current timestamp; the key distribution submodule distributes the generated key to the target ship's AIS terminal and base station service module via the Secure Sockets Layer protocol; the key update submodule automatically triggers the key update process when a key leakage risk is detected or a preset update cycle is reached; and the key destruction submodule irreversibly destroys the key when it expires or the ship is deregistered.

[0033] The technical effects achieved by the above embodiments include: by integrating functions such as key generation, distribution, updating, and destruction, the key management module realizes full lifecycle management of keys. Generating initial keys based on the ship's unique identifier and current timestamp ensures key uniqueness and timeliness. Key distribution via Secure Sockets Layer (SSL) protocol improves key security during transmission. Automatic key update triggering ensures timely and secure key updates. Furthermore, the irreversible key destruction process completely eliminates the risk of key recovery or misuse. These measures collectively improve the efficiency and security of key management.

[0034] Traditional technical solutions suffer from the following problems: traditional encryption and key management strategies are often fixed and cannot be dynamically adjusted according to the ship's navigation area and communication needs. This leads to poor encryption effectiveness or wasted resources when the ship enters high-risk areas or experiences abnormal communication frequencies. Therefore, an intelligent decision-making module is needed that can dynamically adjust encryption and key management strategies based on the ship's navigation area and communication needs. Based on this, the artificial intelligence decision-making module adopts the following strategy to dynamically adjust the encryption and key management strategies: Based on the ship's historical navigation trajectory, the navigation area and communication needs in the future period are predicted. The navigation trajectory prediction adopts machine learning algorithms, including support vector machine algorithm, random forest algorithm, and neural network algorithm. Based on the prediction results, the validity period and encryption strength of the dynamic key are dynamically adjusted. The encryption strength adjustment includes encryption algorithm switching, key length adjustment, and encryption mode selection to ensure that the encryption strategy matches the ship's navigation area and communication needs. When a ship enters a high-risk area or the communication frequency is abnormal, the encryption strength is automatically increased and the key update cycle is shortened. The high-risk areas include military restricted areas, pirate activity areas, and sensitive sea areas. The abnormal communication frequency includes excessively high communication frequency and abnormal communication content.

[0035] It is worth noting that this embodiment describes the specific strategies employed by the artificial intelligence decision-making module to dynamically adjust encryption and key management strategies. This module predicts the navigation area and communication needs for a future period based on the ship's historical navigation trajectory, and dynamically adjusts the validity period and encryption strength of the dynamic key according to the prediction results. When the ship enters a high-risk area or experiences abnormal communication frequencies, the module will also automatically increase the encryption strength and shorten the key update cycle.

[0036] The technical effects achieved by the above embodiments include: by integrating artificial intelligence algorithms, the decision-making module can predict the navigation area and communication needs for a future period based on the ship's historical navigation trajectory, and dynamically adjust the encryption and key management strategies according to the prediction results. This makes the system more adaptable to different navigation environments and communication needs, improving the system's security and reliability. Simultaneously, automatically increasing encryption strength and shortening the key update cycle when the ship enters a high-risk area or experiences abnormal communication frequencies further enhances system security. These measures collectively optimize the efficiency of system resource utilization and improve the overall performance of the system.

[0037] Traditional technical solutions suffer from the following technical problems: when describing a hybrid encryption mechanism, an accurate and concise way is needed to express the encryption process and the key generation process. Mathematical formulas can clearly illustrate these processes and are easy to understand and implement. Therefore, the encryption process of the hybrid encryption mechanism is represented by the following mathematical formula: ;

[0038] in, This represents the final encryption key. Indicates a static key. Indicates a dynamic key. Represents the XOR operation; static key The generation follows the following formula: ;

[0039] in, Represents a hash function. A unique identifier for a ship. This represents the timestamp used to generate the static key. This indicates a string concatenation operation.

[0040] The formula describes how the final encryption key is generated in a hybrid encryption mechanism. Among them, This represents the final encryption key, which is obtained through a static key. With dynamic key Perform XOR ( It is obtained through calculation.

[0041] The final encryption key is the key actually used to encrypt the ship's AIS data. It combines the characteristics of static and dynamic keys, ensuring both the stability and security of data transmission.

[0042] Static keys: Static keys are pre-generated and fixed keys, primarily used for ship identification and basic data encryption. They are based on the ship's unique identification code (MMSI) and the static key generation timestamp. Generated through a hash function, it is unique and time-sensitive.

[0043] Dynamic keys: Dynamic keys are keys generated in real time by the key management module, and their validity period is dynamically adjusted according to the ship's navigation area and communication needs. The introduction of dynamic keys enhances the security of data transmission because even if the static key is leaked, attackers cannot crack the dynamic key in a short period of time.

[0044] The XOR operation is a binary operation that returns 1 when the two compared bits are different, and 0 otherwise. In encryption, the XOR operation is used to fuse the static key with the dynamic key to generate a more complex final encryption key. This fusion method retains the stability of the static key while increasing the randomness of the dynamic key, thus significantly improving the security of data transmission. This formula describes how a static key is generated. Wherein, Indicates a static key. Represents a hash function. A unique identifier for a ship. This represents the timestamp used to generate the static key. This indicates a string concatenation operation.

[0045] A hash function is a function that maps an input of arbitrary length to an output of fixed length. In this patent, a hash function is used to generate a static key, ensuring the uniqueness and unpredictability of the static key. Commonly used hash functions include SHA-256 and SHA-3.

[0046] A unique ship identifier (MMSI) is a unique identifier assigned to each vessel by the International Maritime Organization (IMO) to uniquely identify a vessel globally. Using the MMSI as one of the inputs to the hash function ensures that the generated static key is closely related to the vessel's identity.

[0047] A timestamp is generated for the static key: The static key generation timestamp records the specific time the static key was generated. Using this as one of the inputs to the hash function ensures that even if two ships have the same MMSI, their generated static keys will be different due to their different generation times. This further enhances the uniqueness and timeliness of the static key.

[0048] For string concatenation operations: The string concatenation operation combines MMSI and These are concatenated into a single string, which serves as the complete input to the hash function. This ensures that the hash function takes into account both the ship's identity and the generation time, resulting in a more accurate static key.

[0049] It is worth mentioning that this embodiment provides a mathematical formula representing the encryption process in the hybrid encryption mechanism. This formula indicates that the final encryption key is obtained through an XOR operation between the static key and the dynamic key. Furthermore, a formula for generating the static key is also provided, which is generated using a hash function based on the ship's unique identification code and the static key generation timestamp.

[0050] The technical effects achieved by the above embodiments include: This solution describes the encryption process and key generation process in the hybrid encryption mechanism using mathematical formulas.

[0051] Traditional technical solutions suffer from the following technical problems: when describing the key generation submodule, an accurate and concise way is needed to express the initial key generation process. Mathematical formulas can clearly demonstrate this process and are easy to understand and implement.

[0052] Based on this, the generation of the initial key in the key generation submodule can be represented by the following mathematical formula: ;

[0053] in, Indicates the initial key. Represents a hash function. A unique identifier for a ship. Indicates the current timestamp. This refers to random numbers generated by a random number generator; random numbers The generation follows the following formula: ;

[0054] in, This represents a pseudo-random number generation function. This represents the seed value, which is dynamically generated based on the ship's physical characteristics and the navigation environment.

[0055] The formula describes how the initial key is generated in the key generation submodule. Wherein, Indicates the initial key. Represents a hash function. A unique identifier for a ship. Indicates the current timestamp. This represents a random number generated by a random number generator.

[0056] The initial key is the first key generated by the key management module, serving as the basis for subsequent key generation and distribution. The security of the initial key directly affects the security of the entire key management module.

[0057] Unique Identifier for Vessels: As a unique identifier for a vessel, the MMSI ensures the association between the initial key and the vessel's identity.

[0058] The current timestamp records the specific time when the initial key was generated, increasing the timeliness and uniqueness of the initial key.

[0059] The initial key is a random number generated by a random number generator. This increases the randomness and unpredictability of the initial key. Even if an attacker obtains the ship's MMSI and generation time, the initial key cannot be easily guessed due to the presence of the random number.

[0060] The formula describes random numbers The generation method. Among them, Represents a random number. This represents a pseudo-random number generation function. This represents the seed value.

[0061] Random numbers play a crucial role in the initial key generation process, increasing the randomness and unpredictability of the key.

[0062] A pseudo-random number generation function is a function that can generate sequences of numbers that appear random but are actually generated by a deterministic algorithm. In this patent, the pseudo-random number generation function is used to generate random numbers. This ensures that each generated random number has sufficient randomness.

[0063] Seed value: The seed value is the input parameter of the pseudo-random number generation function, which determines the sequence of random numbers generated. In this patent, the seed value is dynamically generated based on the ship's physical characteristics and navigation environment, ensuring the uniqueness and unpredictability of the random numbers. The ship's physical characteristics may include its length, width, tonnage, etc., while the navigation environment may include the ship's current position, speed, heading, etc.

[0064] It is worth mentioning that this embodiment provides a mathematical formula for generating the initial key in the key generation submodule. This formula generates the initial key using a hash function based on the ship's unique identification code, the current timestamp, and a random number. Simultaneously, a formula for generating the random number is also provided, which is based on a pseudo-random number generation function and a seed value.

[0065] The technical effects achieved by the above embodiments include: describing the initial key generation process through mathematical formulas, and introducing a random number generation formula to enhance the randomness and security of the initial key.

[0066] Traditional technical solutions suffer from the following technical problems: when describing the AI ​​decision-making module, an accurate and concise way is needed to express the encryption strength adjustment strategy. Mathematical formulas can clearly demonstrate this strategy and are easy to understand and implement.

[0067] Based on this, the encryption strength adjustment strategy of the artificial intelligence decision-making module can be expressed by the following mathematical formula: ; in, Indicates encryption strength. Indicated based on the ship's sailing distance The encryption strength adjustment function, Indicates based on communication risk level The encryption strength adjustment function, and Let represent the weight coefficients of the two functions, and satisfy . ; sailing distance The calculation formula is: ;

[0068] in, Indicates the ship's speed at a given time. and These represent the start and end times of the voyage, respectively.

[0069] The encryption strength adjustment strategy in the artificial intelligence decision-making module is described. Indicates encryption strength. Indicated based on the ship's sailing distance The encryption strength adjustment function, Indicates based on communication risk level The encryption strength adjustment function, and Let represent the weight coefficients of the two functions, and satisfy . .

[0070] Encryption strength: Encryption strength is an indicator of the security of an encryption algorithm, determining the computational resources and time required for an attacker to crack encrypted data. In this patent, the encryption strength can be dynamically adjusted according to the ship's navigation area and communication needs.

[0071] This is a encryption strength adjustment function based on the ship's sailing distance: the function adjusts the encryption strength according to the ship's sailing distance. To adjust the encryption strength. The greater the sailing distance, the higher the communication risks that ships may face, thus requiring higher encryption strength to protect the security of data transmission.

[0072] This is a function to adjust encryption strength based on communication risk level: the function adjusts the encryption strength according to the communication risk level. The encryption strength is adjusted accordingly. A higher communication risk level indicates a more severe communication threat to the ship, thus requiring higher encryption strength to counter potential attacks.

[0073] and The weighting coefficients determine the relative importance of the two factors—navigation distance and communication risk level—in adjusting the encryption strength. This is achieved through adjustments... and The value of this value allows the encryption strength adjustment strategy to better suit the actual communication environment and security requirements. Meanwhile, This ensures the rationality and effectiveness of the weighting coefficients.

[0074] The formula describes the sailing distance The calculation method. Among them, Indicates the distance traveled. Indicates the ship's time sailing speed, and These represent the start and end times of the voyage, respectively.

[0075] in, Sailing distance: Sailing distance is the total distance a ship travels within a specific time period. It is one of the important indicators for assessing a ship's navigation area and communication needs.

[0076] Speed ​​of navigation: The speed of navigation is the speed at which a ship travels at any given time. The ship's speed. By monitoring the ship's speed in real time, the distance traveled by the ship within a specific time period can be accurately calculated.

[0077] and The start and end times of the voyage define the time range for calculating the voyage distance. By calculating the integral of the ship's speed between these two times, the total distance traveled within that time period can be obtained.

[0078] It is worth mentioning that this embodiment provides a mathematical formula for the encryption strength adjustment strategy in the artificial intelligence decision-making module. This formula indicates that the encryption strength is obtained through a linear combination of the ship's sailing distance and the communication risk level. Furthermore, a formula for calculating the sailing distance is also provided, which is obtained by integrating the ship's speed over time.

[0079] Traditional technical solutions suffer from the following technical problems: During data transmission, it is necessary to ensure data security, integrity, and traceability. Simultaneously, data compression is required to reduce network bandwidth consumption and improve data transmission efficiency. Traditional data transmission methods often focus only on data transmission itself, neglecting data security, integrity, and traceability. Therefore, this paper also includes a data transmission module responsible for pushing decrypted AIS data to the shore-based management system or other ship terminals. The strategies employed in pushing the decrypted AIS data to the shore-based management system or other ship terminals include: The pushed data is filtered according to the data recipient's permission level, which includes public, internal, and confidential levels. The filtering process includes data screening, data desensitization, and data encryption steps. During the data push process, compression algorithms are used to compress the data in order to reduce network bandwidth usage. The compression algorithms include lossless compression algorithms and lossy compression algorithms. The compression process includes data segmentation, compression encoding, and compressed data transmission steps. After the data push is completed, a push log is generated and stored in the database for subsequent auditing and traceability. The push log includes the push time, push data content, push result, and recipient information. The database includes relational databases and non-relational databases.

[0080] It is worth noting that this embodiment describes the functions and strategies of the data push module. This module is responsible for pushing decrypted AIS data to the shore-based management system or other ship terminals, and employs strategies such as data filtering, compression, and log generation during the push process. The data filtering strategy filters the pushed data according to the data recipient's permission level; the compression strategy uses compression algorithms to compress the data to reduce network bandwidth consumption; and the log generation strategy generates push logs after the data push is completed and stores them in the database for subsequent auditing and traceability.

[0081] The technical effects achieved by the above embodiments include: by employing strategies such as data filtering, compression, and log generation, the data push module can ensure the security, integrity, and traceability of data. The data filtering strategy filters the pushed data according to the data recipient's permission level, ensuring the security of data transmission; the compression strategy uses compression algorithms to compress the data, reducing network bandwidth consumption and improving data transmission efficiency; the log generation strategy generates push logs and stores them in the database after the data push is completed, facilitating subsequent auditing and traceability. These measures collectively improve the performance and reliability of the data push module.

[0082] Traditional technical solutions suffer from the following technical problems: The development and maintenance of a ship's AIS encrypted communication system requires system integration, debugging, and performance monitoring. Traditional systems often only provide limited interfaces and debugging functions, making it difficult to meet complex development and maintenance needs.

[0083] Based on this, an interface debugging module is also included, which provides the following interface debugging functions: Provides API interfaces: Allows third-party systems to integrate and debug the ship's AIS encrypted communication system. The API interfaces include RESTful API interfaces and WebSocket API interfaces. The integration and debugging include system status query, system parameter configuration, and system log viewing operations. Provides a log interface: allows users to view system operation logs and error logs. The log interface includes a command-line interface and a graphical user interface. The system operation logs include system startup logs, system operation logs, and system shutdown logs. The error logs include system error logs, communication error logs, and encryption error logs. Provides a performance monitoring interface: allows users to view system resource usage and performance indicators in real time. The performance monitoring interface includes a system resource monitoring interface, a network performance monitoring interface, and an encryption performance monitoring interface. The system resource usage includes CPU utilization, memory utilization, and disk utilization. The performance indicators include data transmission rate, data encryption rate, and data decryption rate.

[0084] It is worth mentioning that this embodiment describes the functions of the interface debugging module and the interface debugging features it provides. This module provides API interfaces, log interfaces, and performance monitoring interfaces, allowing third-party systems to integrate and debug the ship's AIS encrypted communication system, and allowing users to view system operation logs, error logs, and performance indicators.

[0085] The technical effects achieved by the above embodiments include: by providing rich interface debugging functions, the interface debugging module can meet complex development and maintenance needs. The API interface allows third-party systems to integrate and debug the ship's AIS encrypted communication system, improving the system's flexibility and scalability; the log interface allows users to view system operation logs and error logs, facilitating troubleshooting and system optimization; and the performance monitoring interface allows users to view system resource usage and performance indicators in real time, providing data support for system performance optimization. These measures collectively improve the performance and reliability of the interface debugging module and reduce the system's development and maintenance costs.

[0086] Traditional technical solutions suffer from the following problems: Traditional key management methods are often single-function and struggle to manage the entire lifecycle of keys. Furthermore, key management and distribution processes are cumbersome and insecure, making them vulnerable to theft or tampering. In addition, functions such as key backup and recovery, auditing and traceability, and performance monitoring are often lacking or incomplete.

[0087] Based on this, this embodiment provides a dynamic and static encryption key method for use in an encrypted automatic identification system for ships, applied to a dynamic and static encryption key technology for use in an encrypted automatic identification system for ships as described in any of the above embodiments, including: The hash algorithm includes SHA-256 algorithm and SHA-3 algorithm, and the process of generating the initial key includes data cleaning, data preprocessing, hash operation and result postprocessing steps; S1: The generated key is distributed to the target ship's AIS terminal and base station service module via the Secure Sockets Layer protocol. The key distribution process includes key encryption, key transmission, key decryption, and key verification steps to ensure the security of the key during transmission. S2: When a risk of key leakage is detected or a preset update cycle is reached, the key update process is automatically triggered. The key update process includes key expiration declaration, new key generation, new key distribution, and old key destruction steps to ensure the timeliness and security of key updates. S3: When the key expires or the ship is deregistered, the key is irreversibly destroyed. The key destruction process includes key erasure, key backup deletion, and key usage record clearing steps to ensure that the key cannot be recovered or misused. S4: The generated key is stored using a secure key storage scheme, which includes a hardware security module storage scheme and an encrypted file system storage scheme to ensure the security of the key during storage. S5: Regularly back up the key and use the backup key to restore it when the key is lost or damaged. The backup process includes local backup and remote backup, and the restoration process includes key verification, key decryption and key import steps. S6: Perform auditing and traceability processing on the entire lifecycle of the key. The auditing process includes querying key usage records and viewing key operation logs. The traceability process includes tracing the key generation time and tracing the key distribution path. S7: Real-time monitoring of key management performance, including monitoring of key generation speed, key distribution efficiency, and key update timeliness, to ensure the efficiency and stability of key management; S8: Configure corresponding key security policies according to the ship's navigation area, communication requirements and security level. The key security policies include encryption algorithm selection, key length setting and key update cycle setting to ensure that key management matches the actual needs of the ship. S9: Provides a standardized key management interface, allowing third-party systems to integrate and debug the key management process. The key management interface includes a key generation interface, a key distribution interface, a key update interface, and a key destruction interface, ensuring the flexibility and scalability of key management.

[0088] It is worth mentioning that this embodiment proposes a key management method for dynamic and static encryption key technology applied to encrypted ship automatic identification systems. This method includes steps such as key generation, distribution, updating, destruction, storage, backup and recovery, auditing and traceability, performance monitoring, and security policy configuration. Through a standardized key management interface, third-party systems can integrate and debug the key management process.

[0089] The technical effects achieved by the above embodiments include: by integrating functions such as key generation, distribution, updating, destruction, storage, backup and recovery, auditing and traceability, performance monitoring, and security policy configuration, this key management method realizes full lifecycle management of keys. The standardized key management interface allows third-party systems to integrate and debug the key management process, improving system flexibility and scalability. Simultaneously, this method also improves the efficiency and security of key management, reducing the risk of key theft or tampering. Furthermore, the key backup and recovery function ensures timely recovery of lost or damaged keys, guaranteeing system continuity and stability. The auditing and traceability function provides strong protection for the compliance and security of the key management process. The performance monitoring function allows for real-time monitoring of key management performance indicators, providing data support for system performance optimization. These measures collectively improve the performance and reliability of the key management method and reduce system operating costs.

[0090] Unless otherwise specified, the equipment components involved in the above embodiments are all conventional equipment components, and the connection methods and control methods involved are all conventional connection methods and control methods unless otherwise specified.

[0091] The present invention has been described in detail above with reference to the embodiments. However, those skilled in the art will understand that, without departing from the spirit of the present invention, various specific parameters in the above embodiments can be changed to form multiple specific embodiments, all of which are common variations of the present invention, and will not be described in detail here.

Claims

1. A dynamic and static encryption key technology applied to an encrypted ship automatic identification system, characterized in that, include: Ship AIS terminal module: configured to collect static data, dynamic data and navigation-related data of the ship, and broadcast them through VHF channels. The static data includes the ship's name, call sign, length, beam, type, port of registry and positioning antenna location information. The dynamic data includes the ship's latitude and longitude coordinates, speed above ground, heading above ground, heading, navigation status and turning rate. The navigation-related data includes the ship's draft, type of dangerous goods, destination and estimated time of arrival. Encrypted communication module: It adopts a hybrid encryption mechanism that combines dynamic and static keys to encrypt the data broadcast by the AIS terminal module in real time. The encryption process includes data padding, block encryption, encryption mode selection, and initialization vector generation steps. Key Management Module: Integrates artificial intelligence algorithms to realize full lifecycle management of key generation, distribution, update and destruction. The full lifecycle management covers the key application, approval, generation, storage, distribution, use, backup, recovery, update, archiving and destruction stages. Base station service module: responsible for receiving encrypted AIS data, decrypting it, and pushing the decrypted data to the shore-based management system or other ship terminals. The decryption process includes key verification, data unpacking, data verification, and data reassembly steps. Artificial intelligence decision-making module: Based on the ship's navigation trajectory, communication frequency, and key usage, dynamically adjust the encryption strategy and key management strategy. The dynamic adjustment includes switching encryption algorithms, adjusting key length, changing key update cycle, and selecting encryption mode.

2. The dynamic and static encryption key technology applied to an encrypted ship automatic identification system according to claim 1, characterized in that, The encrypted communication module employs the following hybrid encryption mechanism: The static key is used for ship identification and basic data encryption. The static key is 128 bits long and is encrypted using the AES encryption algorithm. The dynamic key is generated in real time by the key management module and distributed using an asymmetric encryption algorithm. The dynamic key is 256 bits long and is encrypted using the RSA encryption algorithm. The validity period adjustment strategy includes a geofencing strategy based on the ship's current location and a dynamic adjustment strategy based on the ship's communication frequency. The static key and the dynamic key are fused together by an XOR operation to form the final encryption key. The fusion process includes key padding, key alignment, XOR operation, and result verification to ensure the security of data transmission.

3. The dynamic and static encryption key technology applied to an encrypted ship automatic identification system according to claim 1, characterized in that, The key management module includes: Key generation submodule: Based on the ship's unique identification code and current timestamp, an initial key is generated using a hash algorithm, including SHA-256 and SHA-3 algorithms. The initial key generation process includes data cleaning, data preprocessing, hash operation, and result postprocessing. Key distribution submodule: Distributes the generated key to the target ship's AIS terminal and base station service module through the Secure Sockets Layer protocol. The key distribution process includes key encryption, key transmission, key decryption, and key verification. Key update submodule: When a key leakage risk is detected or a preset update cycle is reached, the key update process is automatically triggered. The key update process includes key expiration declaration, new key generation, new key distribution, and old key destruction. The key destruction submodule performs irreversible destruction of the key when the key expires or the ship is deregistered. The key destruction process includes key erasure, key backup deletion, and key usage record clearing.

4. The dynamic and static encryption key technology applied to an encrypted ship automatic identification system according to claim 1, characterized in that, The artificial intelligence decision-making module dynamically adjusts the encryption strategy and key management strategy using the following strategies: Based on the ship's historical navigation trajectory, the navigation area and communication needs in the future period are predicted. The navigation trajectory prediction adopts machine learning algorithms, including support vector machine algorithm, random forest algorithm, and neural network algorithm. Based on the prediction results, the validity period and encryption strength of the dynamic key are dynamically adjusted. The encryption strength adjustment includes encryption algorithm switching, key length adjustment, and encryption mode selection to ensure that the encryption strategy matches the ship's navigation area and communication needs. When a ship enters a high-risk area or the communication frequency is abnormal, the encryption strength is automatically increased and the key update cycle is shortened. The high-risk areas include military restricted areas, pirate activity areas, and sensitive sea areas. The abnormal communication frequency includes excessively high communication frequency and abnormal communication content.

5. The dynamic and static encryption key technology applied to an encrypted ship automatic identification system according to claim 2, characterized in that, The encryption process of the hybrid encryption mechanism is represented by the following mathematical formula: ； in, This represents the final encryption key. Indicates a static key. Indicates a dynamic key. Represents the XOR operation; static key The generation follows the following formula: ； in, Represents a hash function. A unique identifier for a ship. This represents the timestamp used to generate the static key. This indicates a string concatenation operation.

6. The dynamic and static encryption key technology applied to an encrypted ship automatic identification system according to claim 3, characterized in that, The generation of the initial key in the key generation submodule can be expressed by the following mathematical formula: ； in, Indicates the initial key. Represents a hash function. A unique identifier for a ship. Indicates the current timestamp. This refers to random numbers generated by a random number generator; random numbers The generation follows the following formula: ； in, This represents a pseudo-random number generation function. This represents the seed value, which is dynamically generated based on the ship's physical characteristics and the navigation environment.

7. The dynamic and static encryption key technology applied to an encrypted ship automatic identification system according to claim 4, characterized in that, The encryption strength adjustment strategy of the artificial intelligence decision-making module can be expressed by the following mathematical formula: ； in, Indicates encryption strength. Indicated based on the ship's sailing distance The encryption strength adjustment function, Indicates based on communication risk level The encryption strength adjustment function, and Let represent the weight coefficients of the two functions, and satisfy . ; sailing distance The calculation formula is: ； in, Indicates the ship's time sailing speed, and These represent the start and end times of the voyage, respectively.

8. The dynamic and static encryption key technology applied to an encrypted ship automatic identification system according to claim 1, characterized in that, It also includes a data push module, responsible for pushing the decrypted AIS data to the shore-based management system or other ship terminals. The strategies used to push the decrypted AIS data to the shore-based management system or other ship terminals include: The pushed data is filtered according to the data recipient's permission level, which includes public, internal, and confidential levels. The filtering process includes data screening, data desensitization, and data encryption steps. During the data push process, compression algorithms are used to compress the data in order to reduce network bandwidth usage. The compression algorithms include lossless compression algorithms and lossy compression algorithms. The compression process includes data segmentation, compression encoding, and compressed data transmission steps. After the data push is completed, a push log is generated and stored in the database for subsequent auditing and traceability. The push log includes the push time, push data content, push result, and recipient information. The database includes relational databases and non-relational databases.

9. The dynamic and static encryption key technology applied to an encrypted ship automatic identification system according to claim 1, characterized in that, It also includes an interface debugging module, which provides the following interface debugging functions: Provides API interfaces: Allows third-party systems to integrate and debug the ship's AIS encrypted communication system. The API interfaces include RESTful API interfaces and WebSocket API interfaces. The integration and debugging include system status query, system parameter configuration, and system log viewing operations. Provides a log interface: allows users to view system operation logs and error logs. The log interface includes a command-line interface and a graphical user interface. The system operation logs include system startup logs, system operation logs, and system shutdown logs. The error logs include system error logs, communication error logs, and encryption error logs. Provides a performance monitoring interface: allows users to view system resource usage and performance indicators in real time. The performance monitoring interface includes a system resource monitoring interface, a network performance monitoring interface, and an encryption performance monitoring interface. The system resource usage includes CPU utilization, memory utilization, and disk utilization. The performance indicators include data transmission rate, data encryption rate, and data decryption rate.

10. A dynamic and static encryption key method for use in an encrypted automatic identification system for ships, applied to the dynamic and static encryption key technology for use in an encrypted automatic identification system for ships as described in any one of claims 1-9, characterized in that, include: The hash algorithm includes SHA-256 algorithm and SHA-3 algorithm, and the process of generating the initial key includes data cleaning, data preprocessing, hash operation and result postprocessing steps; S1: The generated key is distributed to the target ship's AIS terminal and base station service module via the Secure Sockets Layer protocol. The key distribution process includes key encryption, key transmission, key decryption, and key verification steps to ensure the security of the key during transmission. S2: When a risk of key leakage is detected or a preset update cycle is reached, the key update process is automatically triggered. The key update process includes key expiration declaration, new key generation, new key distribution, and old key destruction steps to ensure the timeliness and security of key updates. S3: When the key expires or the ship is deregistered, the key is irreversibly destroyed. The key destruction process includes key erasure, key backup deletion, and key usage record clearing steps to ensure that the key cannot be recovered or misused. S4: The generated key is stored using a secure key storage scheme, which includes a hardware security module storage scheme and an encrypted file system storage scheme to ensure the security of the key during storage. S5: Regularly back up the key and use the backup key to restore it when the key is lost or damaged. The backup process includes local backup and remote backup, and the restoration process includes key verification, key decryption and key import steps. S6: Perform auditing and traceability processing on the entire lifecycle of the key. The auditing process includes querying key usage records and viewing key operation logs. The traceability process includes tracing the key generation time and tracing the key distribution path. S7: Real-time monitoring of key management performance, including monitoring of key generation speed, key distribution efficiency, and key update timeliness, to ensure the efficiency and stability of key management; S8: Configure corresponding key security policies according to the ship's navigation area, communication requirements and security level. The key security policies include encryption algorithm selection, key length setting and key update cycle setting to ensure that key management matches the actual needs of the ship. S9: Provides a standardized key management interface, allowing third-party systems to integrate and debug the key management process. The key management interface includes a key generation interface, a key distribution interface, a key update interface, and a key destruction interface, ensuring the flexibility and scalability of key management.

Images