Trusted safety traffic monitoring system based on anti-quantum key management framework

Abstract

The invention relates to a trusted security traffic monitoring system based on an anti-quantum key management framework, and relates to the technical field of smart city traffic, and the system comprises an initialization module which is used for carrying out the initialization processing of a cloud platform, an edge gateway and a camera node; the data acquisition and transmission module is used for acquiring and encrypting monitoring data based on the initialized camera node, and transmitting the encrypted monitoring data to the cloud platform through the edge gateway in a preset data transmission mode; wherein the preset data transmission mode comprises a cross-gateway area transmission mode and a same-gateway area transmission mode; and the data detection module is used for deleting or replacing the scene of the corresponding node when the edge gateway or the camera node shows a malicious behavior or the equipment is aged. According to the method, a key system is constructed through an encryption and decryption algorithm, so that the key management framework oriented to edge computing has quantum aggression resistance, and the security of a city monitoring system in a traditional scheme is improved.

Description

Technical Field

[0001] This invention relates to the field of smart city transportation technology, and in particular to a trusted and secure traffic monitoring system based on a quantum-resistant key management framework. Background Technology

[0002] With the continuous advancement of smart city construction, urban traffic monitoring systems have evolved from the traditional fixed-point recording mode to an intelligent system. Modern traffic monitoring systems generally adopt a three-tier architecture of "cloud-edge-device": the bottom layer consists of sensing devices (devices) such as cameras deployed at intersections and roads, the middle layer consists of edge computing nodes (such as edge gateways or local servers), and the top layer consists of a city-level cloud platform responsible for global scheduling and big data analysis.

[0003] Currently, mainstream urban traffic monitoring systems primarily rely on traditional cryptographic mechanisms (such as AES and RSA) for communication encryption and authentication to ensure data security. Meanwhile, to improve response efficiency, an increasing number of systems are introducing edge computing technology, offloading some data processing tasks to edge nodes to reduce reliance on the cloud and lower transmission latency. These existing systems reveal the following key issues in practical applications: Lack of resistance to quantum attacks: Currently widely used public-key cryptosystems such as RSA and ECC are based on the large integer factorization or discrete logarithm problem, which have been proven to be efficiently crackable on quantum computers. Although some research has attempted to introduce lattice-based encryption (such as RLWE) into IoT scenarios, large-scale deployment on resource-constrained edge devices is still in the experimental stage, and a mature key management system has not yet been formed.

[0004] Key management is complex and has poor scalability. In scenarios involving multiple cameras working collaboratively, frequent device access, disconnection, or temporary deployment (such as emergency monitoring points) leads to difficulties in key distribution and updates. Existing systems largely rely on centralized Certificate Authorities (CAs) for identity authentication and public key distribution, which not only incurs storage and communication overhead but also exhibits a strong dependence on CAs. Furthermore, each device needs to store a large amount of public key information from other nodes, resulting in high storage resource consumption and hindering long-term operation on low-power camera devices.

[0005] Insufficient data privacy protection makes it difficult to support encrypted computation: While some systems implement end-to-end encryption of video streams, decryption is often required before computation when cross-regional aggregation and analysis are needed, posing a risk of privacy breaches. Currently, only a few studies explore the application of additive homomorphic encryption in lightweight aggregation, but most have not been optimized for real-world deployment environments, limiting their practicality.

[0006] The device layer has weak security protection and lacks a dynamic trust mechanism. Front-end devices such as cameras are often deployed in open physical environments, making them vulnerable to physical tampering or network intrusion. Once hijacked, these devices could be used to fabricate traffic events (such as false congestion alarms), send malicious data, and interfere with command and control decisions. Current systems mostly rely on static ACLs (Access Control Lists) or periodic inspections to identify anomalies, making it difficult to cope with dynamically changing security threats. Summary of the Invention

[0007] The purpose of this invention is to address the lack of resistance to quantum attacks by introducing an encryption / decryption algorithm based on lattice-hard problems to enhance security, thus making the key management framework for edge computing resistant to quantum attacks. To address the complexity of key management, this invention designs a secure and reliable public key transfer protocol, enabling authentication during communication while maintaining confidentiality, reducing device dependence on a CA center. Furthermore, it introduces and combines a trusted node table and a key derivation algorithm, allowing key management through modifications to the trusted node table, simplifying operations and reducing public key storage overhead. To address the insufficient data privacy protection and difficulty in supporting ciphertext computation, the encryption algorithm inherently possesses additive homomorphism, meaning that the result of adding ciphertext is the same as the result of adding plaintext, a characteristic that expands the application scenarios of this solution. To address the lack of a dynamic trust mechanism in the system, this invention introduces a malicious behavior detection mechanism to evaluate the status of each node in real time, promptly removing malicious nodes from the parent trusted node table to prevent negative impacts from their provided data.

[0008] To achieve the above objectives, the present invention provides the following solution: A trusted and secure traffic monitoring system based on a quantum-resistant key management framework includes: The initialization module is used to initialize the cloud platform, edge gateway, and camera nodes. The data acquisition and transmission module is used to acquire and encrypt monitoring data based on the initialized camera nodes, and transmit the encrypted monitoring data to the cloud platform via the edge gateway using a preset data transmission method; wherein, the preset data transmission method includes: cross-gateway area transmission method and same-gateway area transmission method; The data detection module is used to delete or replace the corresponding nodes when the edge gateway or camera node exhibits malicious behavior or when the device is aging.

[0009] Optionally, the initialization module includes: The cloud platform initialization unit is used to generate keys for all edge gateways and distribute the keys through a secure channel; The edge gateway initialization unit is used by each edge gateway to generate keys for the camera nodes in its jurisdiction and distribute the keys through a secure channel. The camera node initialization unit is used by each camera node to store the devices located at adjacent intersections. .

[0010] Optionally, in the cloud platform initialization unit: cloud platform The value generated by performing SeedGen() twice is denoted as the seed. and cloud platform According to the seed Your own unique identifier and random values Execute key generation algorithm And thereby obtain cloud platform Corresponding key pair ; When a legitimate edge gateway connects to the system and initializes, the cloud platform... For this edge gateway node The generation of random values ​​is denoted as Then to Execute key generation algorithm Obtain the gateway node Corresponding key pair cloud platform Will be for edge gateways generated Distributed directly to the edge gateway via a physical security channel Nodes, and on the cloud platform Trusted Node Table Store itself and nodes of Value, Name, Randomly Generated Values ​​and states.

[0011] Optionally, in the edge gateway initialization unit: Edge gateway Randomly generate a seed And for themselves and each camera node Generate different random values , respectively denoted as and ; Edge gateway Execute key generation algorithm and key generation algorithm , respectively obtained Public-private key pair used for broadcasting and the corresponding camera nodes public and private key pairs ; When a legitimate camera node During registration, the edge gateway Will Distributed directly to legitimate camera nodes via physically secure channels and the gateway itself and camera nodes The only Value, node name, randomly generated The values ​​and corresponding status records are stored in the gateway. Trusted node table in internal storage Then broadcast your public key. ; Camera Node In addition to storing your own public and private keys It also needs to store the data of other devices at adjacent intersections. This is to facilitate scenarios involving communication between device nodes; after the camera nodes are assigned, the corresponding edge gateway in the jurisdiction... In the trusted node table Table Chinese records ID of the device at the adjacent intersection.

[0012] Optionally, the data acquisition and transmission module includes: The data acquisition unit is used to monitor traffic data based on the initialized camera nodes. Encrypted transmission unit, used in camera nodes Upload data hour, Encrypt it using your own identifier and public key to obtain the transmitted ciphertext. Then the encrypted data is sent to the edge gateway. Edge gateway After receiving messages from camera nodes within its jurisdiction, the system will aggregate the messages, i.e. Received camera node Uploaded encrypted information Afterwards, in order to obtain , First, process the ciphertext to obtain: Then, it is decrypted using a decryption algorithm to obtain... If the data has not been tampered with or lost ;Then The processed data is then further encrypted to obtain... And upload it to the cloud platform. cloud platform After collecting data uploaded from edge gateways in various regions, it decrypts the data using its own private key; The cross-gateway area communication unit is used to enable cross-gateway area communication between camera nodes within the jurisdiction of the edge gateway and those under the jurisdiction of different gateways when camera nodes belonging to different edge gateways need to exchange information, based on a cross-regional public key transfer protocol. The same gateway area communication unit is used for secret communication between two different camera nodes under the same gateway.

[0013] Optionally, based on a cross-regional public key transfer protocol, cross-gateway region communication for camera nodes within the jurisdiction of the edge gateway and in different gateway jurisdictions includes: When the edge gateway camera nodes Want to connect with edge gateway camera nodes To prevent messages from being tampered with during clandestine communications, Firstly on the cloud platform Verification in the public table The state, and then to and Send requests simultaneously; For The request: Use your own public key Identity of the requesting party timestamp Request instructions The message is encrypted, and the sender's identity is appended to the beginning of the encrypted message. The specific request content is as follows ; After receiving the message, obtain the sender's identity and request timestamp, and then use the identity information... Get the sender from its own trusted node list. The corresponding random value Through calculation Obtain the sender's private key to decrypt the ciphertext ,have This allows us to obtain the node that the sender wishes to access. Regarding the direction Request: use Public key pair sender name ,identity The gateway where the sender is located Request the identity of the target party timestamp Request instructions The message is encrypted; the specific request content is... ; After decrypting the received request, the sender's gateway is obtained and accessed on the cloud platform. Public Form China Verification Once the node's status is verified as legitimate, it accesses the public information in its trusted node table. Based on the identity of the requesting target party Perform a search. Adjacent nodes must contain Otherwise, the verification process will not pass; when the search value exists and its corresponding status is valid, it proves that the target node is a valid node, and it is also found in its own node table. corresponding ,pass get ,Then pass public key sender identity Request the identity of the target party Request the target party's public key information Current sender identity timestamp Encrypt, to Send reply information: ; After receiving and decrypting the message, check it. Adjacent nodes contain Otherwise, the verification process will not pass, and further checks will be required. and Check if the sender, recipient, and timestamp match; if they match, then proceed. Public key to Send sender identity Request the identity of the target party Sender's public key information Current sender identity timestamp encrypted messages and simultaneously through Public Key Towards The message includes the identity of the target party being requested. Request the target party's public key information timestamp , reply command The message, the specific content is as follows ; receive Afterwards, check and Check if the sender, destination, sender's edge gateway, and timestamp are consistent; if consistent, then send to... Send message ,show Requesting to establish a session with you, The public key is ; and After a session is established, the system defaults to a session lifespan of 10 minutes. When the session ends, and refresh each and of And update the corresponding trusted node table. and of The value will also derive from this change. and The new public key is encrypted with the original public key and sent to the device node. The device node then updates its stored public key, thus completing the public key update.

[0014] Optionally, secret communication between two different camera nodes under the same gateway includes: When the edge gateway camera nodes Want to connect with camera nodes under the same gateway When conducting secret communications, Use your own public key Towards The message includes the identity of the target party being requested. timestamp Request instructions The information is encrypted and a unique identifier is appended at the beginning of the message. The specific message content is as follows ; Upon receiving the message, the sender's identity is obtained, and the sender is retrieved from its list of trusted nodes. of Through calculation Obtain the sender's public / private key pair This allows the sender to decrypt the ciphertext and obtain the node they wish to access. ; Verify the node's legitimacy by checking your trusted node list, and also find it in your own node list. corresponding ,pass Calculated Then immediately to and Send message: and ; and After a session is established, the system defaults to a session lifespan of 10 minutes. When the session ends, refresh and of And update the corresponding trusted node table. and of The value will also derive from this change. and The new public key is encrypted with the original public key and sent to the device node. The device node then updates its stored public key, thus completing the public key update.

[0015] Optionally, the data detection module includes: The camera node detection unit is used to monitor the number of vehicles entering and leaving the camera. The total number of vehicles entering the camera is recorded as positive and the number of vehicles leaving the camera is recorded as negative. By analyzing preset conditions, the status of the edge gateway corresponding to the camera node in its trusted node table is managed. The edge gateway detection unit is used to detect the status of the edge gateway using a trust detection mechanism.

[0016] Optionally, a camera node detection unit is used to monitor the number of vehicles entering under the camera's view. and the number of vehicles that drove out Suppose a certain intersection is... Multiple cameras provide coverage, among which the first... The net traffic flow under each camera is Then the total net traffic flow at the entire intersection is Under ideal conditions (no vehicles remaining stationary for extended periods or mysteriously disappearing), if the traffic light cycle operates normally, then... It will fluctuate slightly around zero; let this amplitude be... ;like Furthermore, data that persists for an extended period beyond a certain threshold is considered a potential anomaly. An analysis of preset conditions, combined with a manual review mechanism, will determine any abnormal data that does not fall under the preset conditions as malicious behavior.

[0017] Optionally, a trust detection mechanism is employed to detect the status of the edge gateway, including: After collecting edge gateway data, the success rate, response time, historical behavior, and resource availability metrics of the tasks are analyzed. A total weighted score is obtained through pre-assigned weights, and the status of the edge gateway is determined by the score.

[0018] The beneficial effects of this invention are as follows: This invention is based on the construction of a key system, which makes the key management framework for edge computing resistant to quantum attacks, thereby increasing the security of urban monitoring systems in traditional solutions.

[0019] Based on a secure and reliable public key transmission protocol, authentication can be performed during communication while maintaining confidentiality, reducing the device's dependence on a CA center. In addition, by combining a trusted node table and a key derivation algorithm, key management can be performed by modifying the trusted node table, which not only makes the operation more convenient but also reduces the storage overhead of public keys.

[0020] Because encryption algorithms inherently possess additive homomorphism, meaning that the result of adding ciphertext is the same as the result of adding plaintext, this characteristic allows the solution of this invention to have more application scenarios.

[0021] A malicious behavior detection mechanism is introduced to evaluate the status of each node in real time and remove malicious nodes from the trusted node table of the superior node in a timely manner to prevent the negative impact of the data they provide. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings and tables used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a schematic diagram of the general architecture of a smart city traffic monitoring system according to an embodiment of the present invention; Figure 2 This is a schematic diagram of a road section in a real-world application. Figure 3 This is a schematic diagram of a communication scenario in a cross-gateway area communication unit; Figure 4 A schematic diagram of the public key transfer protocol in a cross-gateway area communication unit; Figure 5 This is a schematic diagram of a communication scenario within a communication unit in the same gateway area. Figure 6 This is a schematic diagram of the public key transfer protocol in a communication unit within the same gateway area. Figure 7This is an example of an RLWE-based key derivation algorithm from the present invention. Figure 8 The runtime and accuracy of this embodiment of the invention are the running time and accuracy under different message quantity parameters; where (a) is the running time of the algorithm including three steps under different message quantity n, and (b) is the accuracy of the algorithm in successfully decrypting under different message quantity n. Detailed Implementation

[0024] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0025] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0026] This embodiment proposes a trusted and secure traffic monitoring system based on a quantum-resistant key management framework, including: The initialization module is used to initialize the cloud platform, edge gateway, and camera nodes. The data acquisition and transmission module is used to acquire and encrypt monitoring data based on the initialized camera nodes, and transmit the encrypted monitoring data to the cloud platform via the edge gateway using a preset data transmission method; wherein, the preset data transmission method includes: cross-gateway area transmission method and same-gateway area transmission method; The data detection module is used to delete or replace the corresponding nodes when the edge gateway or camera node exhibits malicious behavior or when the device is aging.

[0027] Specifically, such as Figure 1 As shown, this embodiment addresses the field of smart city traffic monitoring systems and the classic three-layer edge computing architecture. The city data cloud platform primarily handles global task allocation and deep data computation. Furthermore, the cloud platform is responsible for distributing keys to each node in the edge layer and managing and registering nodes. The edge gateway or edge server connects the front-end camera devices and the back-end cloud platform, undertaking tasks such as computation, encryption, and decryption of data uploaded by the device nodes. It also distributes keys to and manages each camera node in the device layer. In smart city traffic monitoring systems, device nodes are typically cameras, but note that these cameras are not ordinary cameras with only recording capabilities; they are embedded... A dedicated camera capable of basic tasks such as data collection and communication with superiors.

[0028] The layers are managed sequentially from top to bottom using a cloud-edge-device path. One edge gateway can manage multiple camera nodes, while the cloud platform provides unified management for all edge gateways or servers. Let's call the cloud platform... The edge layer is The number of gateways or servers in the layer is Then a gateway or server can be denoted as Let the number of cameras controlled by one gateway be . ,but The camera in the corresponding device layer is denoted as In the entire network, each node will have an independent .

[0029] Furthermore, the initialization module includes: The cloud platform initialization unit is used to generate keys for all edge gateways and distribute the keys through a secure channel; The edge gateway initialization unit is used by each edge gateway to generate keys for the camera nodes in its jurisdiction and distribute the keys through a secure channel. The camera node initialization unit is used by each camera node to store the devices located at adjacent intersections. .

[0030] Specifically, in this embodiment, constructing a trusted and secure traffic monitoring system based on a quantum-resistant key management framework first requires initializing the system network. The initialization process mainly consists of three steps: the cloud platform generates keys for all edge gateways and distributes these keys through a secure channel; each edge gateway generates keys for the camera nodes within its jurisdiction and distributes these keys through a secure channel; and each camera node stores the devices located at adjacent intersections. .

[0031] cloud platform The value generated by performing SeedGen() twice is denoted as the seed. ,and cloud platform According to the seed Your own unique identifier and random values Execute key generation algorithm And thereby obtain cloud platform Corresponding key pair When a legitimate edge gateway When connecting to this system and initializing, For this edge gateway node Assigning values ​​via SeedGen() Then combine Its own serial number implement Obtain the gateway node Corresponding key pair . Will be for edge gateways generated Distributed directly to the node via a physically secure channel, and on the cloud platform. The trusted node table stores itself and the nodes. of Value, Name, Randomly Generated Values ​​and states, including those on the cloud platform. The table specifications for the trusted node table in the database are shown in Table 1. (Legitimate Edge Gateway) The steps for connecting to and initializing this system are the same as described above.

[0032] Table 1 Cloud Platform Table specification for trusted nodes in (Table C) In summary, in this step, Store seeds , and the trusted node table Broadcast your public key and for and The edge gateway node distributes the corresponding public-private key pair.

[0033] Figure 2 This is a schematic diagram illustrating the gateway deployment and camera numbering in a localized scenario of a real-world application, specifically an edge gateway registered in the cloud and assigned a public-private key pair. and The camera nodes are assigned to areas near the data source in jurisdictions A and B respectively to control camera nodes for data collection and other tasks. Therefore, they also need to record the number of camera nodes within their respective jurisdictions. Similarly, all camera nodes within a certain jurisdiction are connected to the corresponding edge gateway managing that jurisdiction within the system. The initialization process is similar to the above operations. Next, we will... Access For example, the rest Nodes connect to the corresponding gateway The steps are the same: Edge gateway Randomly generate seeds using SeedGen(). They also need to consider their own and the camera nodes' responsibilities. Generate random values, denoted as follows: and Then the edge gateway Execute key generation algorithm and key generation algorithm Obtain your own public / private key pair for broadcasting. and cameras of When legal When registering, Will Distributed directly to the node via a physically secure channel, and in Add yourself and the camera to the trusted node table in internal storage. The only Value, node name, randomly generated Values ​​and their corresponding states. Therefore, during the initialization phase, Eventually stored Distributed key pairs Newly generated seeds and Trusted Node Table Then broadcast your public key. And distribute a corresponding public-private key pair to each legitimate camera node. The table specification of the trusted node table of the edge gateway in the database is shown in Table 2.

[0034] Table 2. Table Specifications for Trusted Nodes of the Edge Gateway (Table E_a) The initialization of camera nodes requires consideration of the specific physical allocation of the cameras. For example, camera nodes... In addition to storing your own public and private keys In addition, it is also necessary to store other devices at the same and adjacent intersections (including...) , , , )of This is to facilitate scenarios involving communication between device nodes. After the camera nodes are assigned, the corresponding edge gateway for the jurisdiction... In the trusted node table Table Chinese records Adjacent intersection equipment , , , ID.

[0035] Furthermore, the data acquisition and transmission module includes: The data acquisition unit is used to monitor traffic data based on the initialized camera nodes. Encrypted transmission unit, used in camera nodes Upload data hour, Encrypt it using your own identifier and public key to obtain the transmitted ciphertext. Then the encrypted data is sent to the edge gateway. Edge gateway After receiving messages from camera nodes within its jurisdiction, it will aggregate these messages, i.e. Received upload from camera node Encrypted information ( Afterwards, in order to obtain , First, the ciphertext is processed using a preset method to obtain: Then, it is decrypted using a decryption algorithm to obtain... If the data has not been tampered with or lost ;Then The processed data is then further encrypted to obtain... And upload it to the cloud platform. cloud platform After collecting data uploaded from edge gateways in various regions, it decrypts the data using its own private key.

[0036] Specifically, in this embodiment, once the monitoring system initialization is complete, cameras in various areas are manually installed at intersections to monitor traffic flow and collect traffic data. The devices periodically upload data to the edge gateway, which performs simple calculations and statistics on the data before uploading it to the cloud platform. This allows the platform to analyze and predict traffic conditions across the entire area. In this example, the devices upload data every minute, and the edge gateway aggregates and decrypts the messages after every three data segments are uploaded. Throughout this process, this invention emphasizes the security of data flow to prevent data from being forged at the source or tampered with during transmission, which could affect the correctness of the entire system.

[0037] Camera Node The data collected every 60 seconds is denoted as ,calculate To enable authentication of the transmitted messages, an additional authentication function was added to the encrypted message. Then Upload to .

[0038] Extracting messages and Find it in your own data table Extract the corresponding row Value, calculated get( , (To calculate the statistics within 3 minutes) Data on vehicles passing through under surveillance. Calculate Dec( )get Because of the homomorphism of addition in the algorithm, ,therefore Without decrypting and summing each message individually, the results within 3 minutes were obtained. The total number of vehicles passing through under surveillance. When camera nodes belonging to different edge gateways need to exchange information, such as when suspicious persons or vehicles appear in the monitored area and may move to multiple areas, secure communication between the device nodes is essential to prevent suspicious persons from tampering with the data and thus losing track of the target. For this scenario, this system designs a cross-regional public key transfer protocol to ensure secure and reliable communication between camera nodes within the jurisdiction of an edge gateway and those in different gateway jurisdictions.

[0039] Furthermore, the data acquisition and transmission module also includes: The cross-gateway area communication unit is used to enable cross-gateway area communication between camera nodes within the jurisdiction of the edge gateway and those under the jurisdiction of different gateways when camera nodes belonging to different edge gateways need to exchange information, based on a cross-regional public key transfer protocol. The same gateway area communication unit is used for secret communication between two different camera nodes under the same gateway.

[0040] Specifically, in this embodiment, the communication scenario in the cross-gateway area communication unit is as follows: Figure 3 As shown: The target vehicle is from the current camera When a vehicle enters an adjacent section of road from its jurisdictional section, the adjacent camera... Belongs to the gateway Not the gateway to which the current camera belongs. Within the jurisdiction, communication between camera nodes in different gateway jurisdictions is required.

[0041] At this time, the edge gateway camera nodes Requires and edge gateway camera nodes For secret communication, the public key transfer protocol followed by the system in this case is as follows: Figure 4 As shown: 1. First of all Searching in the public table Verify its status, ensure its credibility and legitimacy, and then submit it to... and Send requests simultaneously: a) To : ( ) b) To : 2. Received message Next, extract the requester's identity, and then check its own trusted node table. Search requester If it exists, then obtain it. status and : a) Check if the retrieved value is in the "valid" state; otherwise, the program terminates. b) calculate Obtain the private key from the requester. ; c) calculate ,have ; 3. calculate ,have a) In the public table Central verification of the gateway node in the jurisdiction The state; b) In its own trusted node list Search for the target node name in the middle If it exists, then obtain it. State, neighboring nodes, , : i. Check if the status of the retrieved value is "valid"; otherwise, the program terminates. ii. Check if adjacent nodes contain Otherwise, the program will be interrupted. iii. pass get ; 4. Towards Send message: 5. calculate ,have : a) examine and The requester, the target, and the timestamp must be consistent; otherwise, the program will terminate. b) examine Adjacent nodes contain Otherwise, the program will be interrupted. Then Xianghe and Send requests simultaneously: c) To : d) To : 6. receive Then, calculate have : a) Inspection and If the requester, the target, the edge gateway to which the requester belongs, and the timestamp are consistent, the process proceeds to the next step; otherwise, it fails and the process is interrupted. b) Towards send ,show Request to establish a session, The public key is .

[0042] 7. receive Afterwards, through Decrypt the message to obtain ; 8. receive Afterwards, through Decrypt the message to obtain .

[0043] Through this process, and Each node has obtained the other's reliable public key, thus enabling them to establish a session and conduct secure communication between edge nodes.

[0044] In this embodiment, the situation in the same area is as follows: Figure 5 As shown, when the target vehicle moves away from the current camera... When a vehicle enters an adjacent section of road from its jurisdictional section, the adjacent camera... It also belongs to the gateway. Then, communication with camera nodes within the same gateway's jurisdiction is required. At this point, the edge gateway... camera nodes Want to connect with camera nodes under the same gateway For secret communication, the public key transfer protocol followed by the system in this case is as follows: Figure 6 As shown: 1. Towards send: ( ) 2. Received message Next, extract the requester's identity, and then check its own trusted node table. Search requester If it exists, then obtain it. status and : a) Check if the retrieved value is in the "valid" state; otherwise, the program terminates. b) calculate Get the requester's ( ); c) calculate ,have ; Then, Extract target node And in its own trusted node list Search in the middle, if it exists, then get state, Adjacent nodes : d) Check if the status of the retrieved value is "valid"; otherwise, the program terminates. e) Check if adjacent nodes contain Otherwise, the program will be interrupted. f) pass get ; 3. Towards and Send message: a) To : ; b) To : ; 4. receive Afterwards, through Decrypt the message to obtain ; receive Afterwards, through Decrypt the message to obtain .

[0045] Through this process, and Both parties have obtained each other's public keys through reliable means, thus enabling them to establish sessions and conduct secure communication within the edge gateway.

[0046] Furthermore, the data detection module includes: The camera node detection unit is used to monitor the number of vehicles entering under the camera's view. and the number of vehicles that drove out Suppose a certain intersection is... Multiple cameras provide coverage, among which the first... The net traffic flow under each camera is Then the total net traffic flow at the entire intersection is Under ideal conditions (no vehicles remaining stationary for extended periods or mysteriously disappearing), if the traffic light cycle operates normally, then... It will fluctuate slightly around zero. Therefore, this unit will And it continues for more than the threshold time. Such situations are considered potential anomalies. Anomalies that do not fall under the preset conditions are analyzed and, in conjunction with a manual review mechanism, identified as malicious behavior. The edge gateway detection unit is used to detect the status of the edge gateway using a trust detection mechanism.

[0047] Based on historical observation data of typical urban intersections, the normal error caused by... The fluctuation range is approximately Vehicles per minute, a brief backlog caused by a 30-second traffic light cycle can lead to achieve Vehicles; therefore, the detection unit is recorded. .

[0048] Furthermore, the analysis of preset scenarios includes: when the total traffic flow reaches a positive value of a preset threshold within a first preset time period, it is considered a normal situation under traffic lights, that is: if This is considered normal error; When the total traffic flow reaches a positive value of the preset threshold for a period of time that is greater than a first preset duration but less than a first preset duration, it is determined that a traffic jam has occurred at the intersection. That is: if Continue to exceed minutes but no more than If it takes minutes, it is very likely a real traffic jam. When the total traffic flow reaches a positive value exceeding the preset threshold for a period exceeding the second preset duration, the system issues a prompt, awaiting manual determination to determine whether the situation stems from an external attack on the camera node. Continue to exceed The timeout lasting several minutes strongly suggests that the camera was hijacked and continuously falsely reported "vehicles entering."

[0049] In this embodiment, as Figure 7 As shown, the key derivation algorithm The steps are as follows: Define a quotient ring Elements on the ring are indicated in bold. . Represents a noise component , and All values ​​are sampled from this noise distribution, i.e. .

[0050] remember Indicates all that satisfy and of The set; therefore .also The function is used to generate a deterministic key. and Mapped to respectively superior.

[0051] Generate a key based on the corresponding parameters: SeedGen(): Generates a 256-bit random number using SHA256; : return( ); : A 256-bit random number generated by SeedGen(); According to the provisions of GB / T28181-2016 "Technical Requirements for Information Transmission, Exchange and Control of Public Security Video Surveillance Network System", It consists of 20 decimal digits and is unique.

[0052] : A 256-bit random number generated by SeedGen(); Hash(param): Implemented using the XOF extended output function SHAKE256 based on the fips202 standard; Expand(param): Implementation of the XOF extended output function SHAKE256 based on the fips202 standard; ; .

[0053] Regarding the message Encrypt: :return ; remember It is the number of messages sent by a participant. The ciphertext set is ,but .

[0054] :return ; Furthermore, the key pair exhibits additive homomorphism.

[0055] The code running environment for this experiment is based on the Ubuntu 22.04.4 LTS (Jammy Jellyfish) operating system (64-bit architecture) with kernel version 6.8.0-64-generic. This ensures the underlying system compatibility, stability, and resource scheduling capabilities of the Python code during the experiment, providing reliable hardware and system support for data processing tasks.

[0056] The specific parameters of this algorithm are q=19464 and t=256. Let's assume the running time and accuracy under different message quantity parameters, such as... Figure 8 of (a) Figure 8 As shown in (b).

[0057] from Figure 8 As can be seen from (a), the algorithm's runtime is mainly concentrated in the key decryption algorithm Decrypt(). This is because as the number of messages increases, the number of objects to be processed in the message aggregation and key decryption steps also increases; from Figure 8 As can be seen in (b), The decryption accuracy was 100% when dealing with a certain number of messages; The decryption accuracy rate is also above 95%; however, as the number of messages increases, the accuracy rate drops significantly. This is because noise information accumulates during the aggregation of ciphertext messages, thus interfering with the accuracy of decryption.

[0058] Overall, the encryption scheme used in this system achieves millisecond-level processing speeds for each step, and... At that time, the decryption accuracy rate reached at least 95%, so in terms of efficiency, our solution has practical application value.

[0059] This embodiment constructs a secure edge gateway cluster to run a quantum-resistant key derivation program. This program stores the device ID through the secure chip of the terminal monitoring device group and generates a key in conjunction with the random number issued by the edge gateway. In scenarios requiring device group collaboration, communication between device groups passes through an edge gateway, where authentication and key transfer are performed based on a key transfer protocol to ensure that the communicating parties can conduct secure and reliable sessions. Each jurisdiction's edge gateway periodically receives real-time data uploaded from the device group, verifies the correctness of the calculation of the device group based on the law of conservation of traffic and the fault tolerance rate specified by the system, and updates its own trusted node table according to the calculation results; After verifying the reliability of the device group nodes, the edge gateways in each jurisdiction perform privacy calculations on the data collected and encrypted by the device group, and then upload the results to the cloud platform in encryption. The cloud platform aggregates the data after simple processing by the edge gateways and feeds it into the training of a large-scale urban traffic model. It also records the response time, historical behavior, and resource availability of each edge gateway, and evaluates the availability and trustworthiness of the gateways according to the system's preset weights to determine whether each gateway is capable of performing the next task.

[0060] This embodiment constructs a key system based on encryption and decryption algorithms, making the key management framework for edge computing resistant to quantum attacks and increasing the security of urban monitoring systems in traditional solutions.

[0061] Based on a secure and reliable public key transmission protocol, authentication can be performed during communication while maintaining confidentiality, reducing the device's dependence on a CA center. In addition, by combining a trusted node table and a key derivation algorithm, key management can be performed by modifying the trusted node table, which not only makes the operation more convenient but also reduces the storage overhead of public keys.

[0062] The encryption algorithm inherently possesses additive homomorphism, meaning that the result of adding ciphertext is the same as the result of adding plaintext. This characteristic makes this scheme applicable to more scenarios.

[0063] A malicious behavior detection mechanism is introduced to evaluate the status of each node in real time and remove malicious nodes from the trusted node table of the superior node in a timely manner to prevent the negative impact of the data they provide.

[0064] The embodiments described above are merely preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Various modifications and improvements made to the technical solutions of the present invention by those skilled in the art without departing from the spirit of the present invention should fall within the protection scope defined by the claims of the present invention.

Claims

1. A trusted and secure traffic monitoring system based on a quantum-resistant key management framework, characterized in that, include: The initialization module is used to initialize the cloud platform, edge gateway, and camera nodes. The data acquisition and transmission module is used to acquire and encrypt monitoring data based on the initialized camera nodes, and transmit the encrypted monitoring data to the cloud platform via the edge gateway using a preset data transmission method; wherein, the preset data transmission method includes: cross-gateway area transmission method and same-gateway area transmission method; The data detection module is used to delete or replace the corresponding nodes when the edge gateway or camera node exhibits malicious behavior or when the device is aging.

2. The trusted and secure traffic monitoring system based on a quantum-resistant key management framework according to claim 1, characterized in that, The initialization module includes: The cloud platform initialization unit is used to generate keys for all edge gateways and distribute the keys through a secure channel; The edge gateway initialization unit is used by each edge gateway to generate keys for the camera nodes in its jurisdiction and distribute the keys through a secure channel. The camera node initialization unit is used by each camera node to store the devices located at adjacent intersections. .

3. The trusted and secure traffic monitoring system based on a quantum-resistant key management framework according to claim 2, characterized in that, In the cloud platform initialization unit: cloud platform The value generated by performing SeedGen() twice is denoted as the seed. and cloud platform According to the seed Your own unique identifier and random values Execute key generation algorithm And thereby obtain cloud platform Corresponding key pair ; When a legitimate edge gateway connects to the system and initializes, the cloud platform... For this edge gateway node The generation of random values ​​is denoted as Then to Execute key generation algorithm Obtain the gateway node Corresponding key pair ; cloud platform Will be for edge gateways generated Distributed directly to the edge gateway via a physical security channel Nodes, and on the cloud platform Trusted Node Table Store itself and nodes of Value, Name, Randomly Generated Values ​​and states.

4. The trusted and secure traffic monitoring system based on a quantum-resistant key management framework according to claim 2, characterized in that, In the edge gateway initialization unit: Edge gateway Randomly generate a seed And for themselves and each camera node Generate different random values , respectively denoted as and ; Edge gateway Execute key generation algorithm and key generation algorithm , respectively Public-private key pair used for broadcasting and the corresponding camera nodes public and private key pairs ; When a legitimate camera node During registration, the edge gateway Will Distributed directly to legitimate camera nodes via physically secure channels and the gateway itself and camera nodes The only Value, node name, randomly generated The values ​​and corresponding status records are stored in the gateway. Trusted Node Table in Internal Storage middle; Then broadcast your public key. ; Camera Node In addition to storing your own public and private keys It also needs to store the data of other devices at adjacent intersections. This is to facilitate scenarios involving communication between device nodes; After the camera nodes are assigned, the corresponding edge gateway for the jurisdiction is... In the trusted node table Table Chinese records ID of the device at the adjacent intersection.

5. The trusted and secure traffic monitoring system based on a quantum-resistant key management framework according to claim 1, characterized in that, The data acquisition and transmission module includes: The data acquisition unit is used to monitor traffic data based on the initialized camera nodes. Encrypted transmission unit, used in camera nodes Upload data hour, Encrypt it using your own identifier and public key to obtain the transmitted ciphertext. Then the encrypted data is sent to the edge gateway. Edge gateway After receiving messages from camera nodes within its jurisdiction, the system will aggregate the messages, i.e. Received camera node Uploaded encrypted information Afterwards, in order to obtain , First, process the ciphertext to obtain: Then, it is decrypted using a decryption algorithm to obtain... If the data has not been tampered with or lost ;Then The processed data is then further encrypted to obtain... And upload it to the cloud platform. cloud platform After collecting data uploaded from edge gateways in various regions, it decrypts the data using its own private key; The cross-gateway area communication unit is used to enable cross-gateway area communication between camera nodes within the jurisdiction of the edge gateway and those under the jurisdiction of different gateways when camera nodes belonging to different edge gateways need to exchange information, based on a cross-regional public key transfer protocol. The same gateway area communication unit is used for secret communication between two different camera nodes under the same gateway.

6. The trusted and secure traffic monitoring system based on a quantum-resistant key management framework according to claim 5, characterized in that, Based on a cross-regional public key transfer protocol, cross-gateway regional communication between camera nodes within the jurisdiction of an edge gateway and in different gateway jurisdictions includes: When the edge gateway camera nodes Want to connect with edge gateway camera nodes To prevent messages from being tampered with during clandestine communications, Firstly on the cloud platform Verification in the public table The state, and then to and Send requests simultaneously; For The request: Use your own public key Identity of the requesting party timestamp Request instructions The message is encrypted, and the sender's identity is appended to the beginning of the encrypted message. The specific request content is as follows ; After receiving the message, obtain the sender's identity and request timestamp, and then use the identity information... Get the sender from its own trusted node list. The corresponding random value Through calculation Obtain the sender's private key to decrypt the ciphertext ,have This allows us to obtain the node that the sender wishes to access. ; For The request: use Public key pair sender name ,identity The gateway where the sender is located Request the identity of the target party timestamp Request instructions The message is encrypted; the specific request content is... ; After decrypting the received request, the sender's gateway is obtained, and then the request is processed on the cloud platform. Public Form China Verification After verifying the status of the node as legitimate, it accesses the public information in its trusted node table. Based on the identity of the requesting target party Perform a search. Adjacent nodes must contain Otherwise, the verification process will not pass; when the search value exists and its corresponding status is valid, it proves that the target node is a valid node, and it is also found in its own node table. corresponding ,pass get ,Then pass public key sender identity Request the identity of the target party Request the target party's public key information Current sender identity timestamp Encrypt, to Send reply information: ; After receiving and decrypting the message, check it. Adjacent nodes contain Otherwise, the verification process will not pass, and further checks will be required. and Check if the sender, recipient, and timestamp match; if they match, then proceed. Public key to Send sender identity Request the identity of the target party Sender's public key information Current sender identity timestamp encrypted messages and simultaneously through Public Key Towards The message includes the identity of the target party being requested. Request the target party's public key information timestamp , reply command The message, the specific content is as follows ; receive Afterwards, check and Check if the sender, destination, sender's edge gateway, and timestamp are consistent; if consistent, then send to... Send message ,show Requesting to establish a session with you, The public key is ; and After a session is established, the system defaults to a session lifespan of 10 minutes. When the session ends, and refresh each and of And update the corresponding trusted node table. and of The value will also derive from this change. and The new public key is encrypted with the original public key and sent to the device node. The device node then updates its stored public key, thus completing the public key update.

7. The trusted and secure traffic monitoring system based on a quantum-resistant key management framework according to claim 6, characterized in that, Secret communication between two different camera nodes under the same gateway includes: When the edge gateway camera nodes Want to connect with camera nodes under the same gateway When conducting secret communications, Use your own public key Towards The message includes the identity of the target party being requested. timestamp Request instructions The information is encrypted and a unique identifier is appended at the beginning of the message. The specific message content is as follows ; Upon receiving the message, the sender's identity is obtained, and the sender is retrieved from its list of trusted nodes. of Through calculation Obtain the sender's public / private key pair This allows the sender to decrypt the ciphertext and obtain the node they wish to access. ; Verify the node's legitimacy by checking your trusted node list, and also find it in your own node list. corresponding ,pass Calculated Then immediately to and Send message: and ; and After a session is established, the system defaults to a session lifespan of 10 minutes. When the session ends, refresh and of And update the corresponding trusted node table. and of The value will also derive from this change. and The new public key is encrypted with the original public key and sent to the device node. The device node then updates its stored public key, thus completing the public key update.

8. The trusted and secure traffic monitoring system based on a quantum-resistant key management framework according to claim 1, characterized in that, The data detection module includes: The camera node detection unit is used to monitor the number of vehicles entering and leaving the camera. The total number of vehicles entering the camera is recorded as positive and the number of vehicles leaving the camera is recorded as negative. By analyzing preset conditions, the status of the edge gateway corresponding to the camera node in its trusted node table is managed. The edge gateway detection unit is used to detect the status of the edge gateway using a trust detection mechanism.

9. The trusted and secure traffic monitoring system based on a quantum-resistant key management framework according to claim 8, characterized in that, The camera node detection unit is used to monitor the number of vehicles entering under the camera's view. and the number of vehicles that drove out Suppose a certain intersection is... Multiple cameras provide coverage, among which the first... The net traffic flow under each camera is Then the total net traffic flow at the entire intersection is ; Ideally, if the traffic light cycle operates normally, then It will fluctuate slightly around zero; let this amplitude be... Then the unit will And it continues for more than the threshold time The situation is considered a potential anomaly; By analyzing preset scenarios and combining them with a manual review mechanism, abnormal data that does not fall under the preset conditions is identified as malicious behavior.

10. The trusted and secure traffic monitoring system based on a quantum-resistant key management framework according to claim 8, characterized in that, The edge gateway status is detected using a trust detection mechanism, including: After collecting edge gateway data, the success rate, response time, historical behavior, and resource availability metrics of the tasks are analyzed. A total weighted score is obtained through pre-assigned weights, and the status of the edge gateway is determined by the score.

Images