A multi-mode communication hardware encryption system based on natural disaster prevention and control scene

Abstract

This invention discloses a multi-mode communication hardware encryption system based on natural disaster prevention and control scenarios, relating to the field of multi-mode communication hardware encryption; it includes: a terminal configuration module for predefining N disaster monitoring terminals, a trust domain construction module for constructing a local trust domain, a first key pair loading module for loading network domain key pairs bound to the local trust domain, a second key pair generation module for generating device key pairs, a dual signature generation module for generating an authorization signature and a device signature, and an encapsulation and transmission module for encapsulating the monitoring data packets to be transmitted and sending them to the receiving end; this invention, by concatenating the monitoring data to be transmitted with the terminal identifier and the collection timestamp in the hardware encryption module, achieves dual protection of the terminal's individual identity and the timeliness and uniqueness of the reporting behavior without relying on external random sources, effectively blocking signature forgery.

Description

Technical Field

[0001] This invention relates to the field of multimode communication hardware encryption, specifically a multimode communication hardware encryption system based on natural disaster prevention and control scenarios. Background Technology

[0002] In natural disaster prevention and control scenarios, disaster monitoring terminals need to continuously report monitoring data through multi-mode communication links. However, the field deployment environment makes the terminals vulnerable to physical capture or communication eavesdropping. Existing encryption methods usually only sign the original monitoring data once. They neither bind the terminal identity and collection time with the data content to generate a digest, nor introduce dynamic variables strongly correlated with the reporting time during the signing process. This allows attackers to intercept historical valid data packets and replay them at critical moments to forge a normal state. Even if some solutions use timestamps to prevent replay, the time information is often only appended as a plaintext field and does not participate in the signature calculation. It can still be stripped and replaced. Furthermore, there is a lack of differentiated signature mechanisms for the same terminal to report the same data multiple times (such as periodic heartbeats), which cannot ensure the uniqueness of each report. Summary of the Invention

[0003] To address the shortcomings of existing technologies, this invention provides a multi-mode communication hardware encryption system for natural disaster prevention and control scenarios. By introducing a dual encryption strategy of network domain signature and terminal signature, the technical problems mentioned in the background technology are solved.

[0004] To achieve the above objectives, the present invention provides the following technical solution:

[0005] A multi-mode communication hardware encryption system based on natural disaster prevention and control scenarios, wherein the system is executed by a hardware encryption module deployed on a disaster monitoring terminal, the hardware encryption module comprising:

[0006] The terminal configuration module is used to predefine N disaster monitoring terminals and configure terminal identifiers during the system deployment phase.

[0007] The trust domain construction module is used to construct a local trust domain based on N predefined disaster monitoring terminals and their terminal identifiers;

[0008] The first key pair loading module is used to load a network domain key pair bound to a local trust domain for the disaster monitoring terminal; wherein, the network domain key pair includes a network domain private key and a network domain public key;

[0009] The second key pair generation module is used to generate device key pairs for disaster monitoring terminals based on elliptic curve cryptography; wherein, the device key pair includes a device private key and a device public key;

[0010] The dual signature generation module is used to acquire the monitoring data to be transmitted collected by the disaster monitoring terminal, and generate an authorization signature and a device signature for the monitoring data to be transmitted;

[0011] The encapsulation and transmission module is used to encapsulate the monitoring data, authorization signature, device signature and corresponding terminal identifier into a monitoring data packet to be transmitted and send it to the receiving end.

[0012] In some specific embodiments, the construction steps of the trust domain construction module include:

[0013] S2-1. Obtain the equipment attribute information of each disaster monitoring terminal;

[0014] S2-2. Based on predefined equipment attribute information classification rules, disaster monitoring terminals with the same type of equipment attribute information are grouped into the same local trust domain.

[0015] In some specific embodiments, the generation step of the second key pair generation module includes:

[0016] S4-1. Load a parameter set consistent with the elliptic curve cryptography algorithm used by the network domain key pair; wherein, the parameter set includes the elliptic curve equation, curve order parameter, and base point coordinates defined in the finite prime field;

[0017] S4-2. Based on the disaster monitoring terminal identifier, determine the device private key within the numerical range defined by the curve order parameter;

[0018] S4-3. Using the device private key and the base point coordinates as input, perform a scalar dot product operation in the coordinate space defined by the elliptic curve equation to generate the corresponding device public key.

[0019] In some specific embodiments, the generation steps of the dual-signature generation module include:

[0020] S5-1. Perform a hash operation on the monitoring data to be transmitted to generate a data digest;

[0021] S5-2. Perform elliptic curve digital signature on the data digest based on the network domain private key to generate an authorized signature;

[0022] S5-3. Construct a composite byte string based on the authorized signature;

[0023] S5-4. Perform elliptic curve digital signature on the composite byte string based on the device private key to generate a device signature.

[0024] In some specific embodiments, a hash operation is performed on the monitoring data to be transmitted to generate a data digest, including:

[0025] S5-1-1. The monitoring data to be transmitted is concatenated with the corresponding terminal identifier and the collection timestamp of the monitoring data to be transmitted to form plaintext to be hashed.

[0026] S5-1-2. Perform a one-way hash operation on the plaintext to be hashed and output a byte string of fixed length;

[0027] S5-1-3. Use the fixed-length byte string as the data digest.

[0028] In some specific embodiments, an authorized signature is generated by performing an elliptic curve digital signature on the data digest based on the network domain private key, including:

[0029] S5-2-1. Load the network domain private key from the hardware encryption module;

[0030] S5-2-2: Invoke the elliptic curve cryptography algorithm, using the network domain private key and the data digest as input, to generate a digital signature byte string;

[0031] S5-2-3. Encode the digital signature byte string into a byte sequence of a preset format as the authorized signature.

[0032] In some specific embodiments, constructing a composite byte string based on the authorized signature includes:

[0033] S5-3-1. Obtain the timestamp when the authorization signature was generated as the authorization timestamp;

[0034] S5-3-2. Generate a first perturbation symbol, a second perturbation symbol, and a third perturbation symbol based on the authorized timestamp;

[0035] S5-3-3: Append the first perturbation character, the second perturbation character, and the third perturbation character to the end of the data digest, the authorization signature, and the authorization timestamp, respectively, to generate a perturbation code, a perturbation signature, and a perturbation timestamp;

[0036] S5-3-4. Concatenate the perturbation code, perturbation signature, and perturbation timestamp into a composite byte string.

[0037] In some specific embodiments, a first perturbation symbol, a second perturbation symbol, and a third perturbation symbol are generated based on the authorized timestamp, including:

[0038] S5-4-1. Convert the authorized timestamp into a 14-bit standardized time string;

[0039] S5-4-2. Extract the last digit of the time string as the seed number;

[0040] S5-4-3. Based on the seed number, repeatedly fill in to generate an extended number sequence of length 15 digits;

[0041] S5-4-4. Divide the extended number sequence into three sub-sequences;

[0042] S5-4-5. For each subsequence, calculate the floating-point weight of each number using minimum-maximum normalization.

[0043] S5-4-6. Based on the floating-point weights, perform a weighted summation on each subsequence to obtain the sequence perturbation value;

[0044] S5-4-7. Normalize the perturbation values ​​of each sequence and use them as the first perturbation symbol, the second perturbation symbol, and the third perturbation symbol, respectively.

[0045] This invention provides a multi-mode communication hardware encryption system based on natural disaster prevention and control scenarios, which has the following beneficial effects:

[0046] This invention generates a data digest by concatenating the monitoring data to be transmitted with the terminal identifier and the collection timestamp in a hardware encryption module and hashing the result. An authorization signature is then generated using a network domain private key. The authorization timestamp at the time of signature generation is obtained, and a first, second, and third perturbation character are derived from this. These characters are then appended to the data digest, authorization signature, and authorization timestamp to form a perturbation code, a perturbation signature, and a perturbation timestamp, respectively. These are concatenated into a composite byte string, which is then used to generate a device signature using a device private key derived from the terminal identifier. This ensures that even if the monitoring data content, terminal identifier, and collection time are identical, a difference in the authorization signature generation time will result in a change in the perturbation character, altering the composite byte string and uniquely identifying the device signature. Thus, without relying on an external random source, this invention achieves dual protection of terminal individual identity verification and the timeliness and uniqueness of reporting behavior, effectively preventing signature forgery. Attached Figure Description

[0047] Figure 1 This is a structural block diagram of a multi-mode communication hardware encryption system based on natural disaster prevention and control scenarios according to the present invention;

[0048] Figure 2 This is a flowchart illustrating a multi-mode communication hardware encryption system based on a natural disaster prevention and control scenario according to the present invention.

[0049] Figure 3 This is a schematic diagram of the device signature generation process described in this invention;

[0050] Figure 4 This is a schematic diagram of the composite string concatenation process described in this invention;

[0051] Figure 5This is a schematic diagram of the generation process of the perturbation symbol described in this invention. Detailed Implementation

[0052] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0053] First, the prior art and related concepts involved in the embodiments of the present invention will be described:

[0054] Hash operation: A cryptographic one-way function that maps input data (plaintext) of arbitrary length to a fixed-length output value (called a hash value or digest).

[0055] Local Trust Domain: Within a specific security boundary, a closed communication set consisting of a group of pre-registered and mutually authenticated legitimate devices. Devices within the domain share a unified root of trust (such as a network domain public key), and devices outside the domain cannot access the domain or are automatically denied access.

[0056] Example 1: Please refer to Figures 1 to 2 This invention provides a multi-mode communication hardware encryption system based on natural disaster prevention and control scenarios. The system is executed by a hardware encryption module deployed on a disaster monitoring terminal. The hardware encryption module includes:

[0057] The terminal configuration module is used to predefine N disaster monitoring terminals and configure terminal identifiers during the system deployment phase.

[0058] The terminal identifier is used to uniquely identify the disaster monitoring terminal, including but not limited to the factory serial number, IMEI, MAC address or public key fingerprint.

[0059] The trust domain construction module is used to construct a local trust domain based on N predefined disaster monitoring terminals and their terminal identifiers;

[0060] The first key pair loading module is used to load a network domain key pair bound to a local trust domain for the disaster monitoring terminal; wherein, the network domain key pair includes a network domain private key and a network domain public key;

[0061] Specifically, the network domain private key is injected into the hardware encryption module during the system deployment phase;

[0062] The second key pair generation module is used to generate device key pairs for disaster monitoring terminals based on elliptic curve cryptography; wherein, the device key pair includes a device private key and a device public key;

[0063] The elliptic curve cryptography algorithm described in this embodiment preferably adopts the national standard SM2 algorithm, NISTP-256 curve, or a compatible variant thereof.

[0064] The dual signature generation module is used to acquire the monitoring data to be transmitted collected by the disaster monitoring terminal, and generate an authorization signature and a device signature for the monitoring data to be transmitted;

[0065] The encapsulation and transmission module is used to encapsulate the monitoring data, authorization signature, device signature and corresponding terminal identifier into a monitoring data packet to be transmitted and send it to the receiving end.

[0066] In the hardware encryption module of the disaster monitoring terminal, the terminal configuration module predefines legitimate terminals and configures unique terminal identifiers during the deployment phase; the trust domain construction module establishes a local trust domain based on these terminals and their identifiers; the first key pair loading module securely injects the network domain private key bound to the trust domain into the module; the second key pair generation module derives the device key pair based on the terminal identifier and elliptic curve cryptography algorithm (such as SM2 or NISTP-256); after the monitoring data is collected, the dual signature generation module first uses the network domain private key to generate an authorization signature to prove the legitimacy of the organization, and then uses the device private key to generate a device signature to confirm the individual identity of the terminal; finally, the encapsulation and transmission module packages the monitoring data, dual signatures and terminal identifiers and sends them out through multi-mode communication hardware.

[0067] The aforementioned hardware encryption module enables the receiving end to verify that the data comes from a legitimate disaster monitoring terminal within the local trust domain and was indeed generated by that terminal at the time of reporting, thereby preventing unauthorized devices from impersonating the terminal. Especially under conditions where communication links are unstable at disaster sites such as landslides, floods, and earthquakes, and terminals are often unattended for extended periods and easily exposed, it ensures that the reported key monitoring data such as displacement, rainfall, and vibration cannot be forged or tampered with, providing authentic and reliable disaster monitoring data for emergency command.

[0068] Example 2: See Figures 3 to 5 The technical solution of this embodiment 2 differs from that of embodiment 1 in that it discloses the specific application steps of each module of the encryption system described in embodiment 1.

[0069] Specifically, in this embodiment, the construction steps of the trust domain construction module include:

[0070] S2-1. Obtain the equipment attribute information of each disaster monitoring terminal;

[0071] Specifically, the device attribute information includes at least one of the following: device type, deployment location, sensor type, or power supply mode;

[0072] S2-2. Based on predefined equipment attribute information classification rules, disaster monitoring terminals with the same type of equipment attribute information are grouped into the same local trust domain.

[0073] The device attribute information classification rules are used to securely group disaster monitoring terminals according to the needs of disaster prevention and control tasks, so as to form local trust domains corresponding to different monitoring areas, disaster types or emergency response levels.

[0074] In this embodiment, by grouping terminals, devices in the same monitoring area (such as a landslide hazard point), the same disaster type (such as an earthquake monitoring network), or the same emergency response level (such as a level-one flood control terminal) are assigned to independent local trust domains, thereby constructing a secure communication boundary in complex and ever-changing natural disaster prevention and control scenarios.

[0075] Specifically, in this embodiment, the generation steps of the second key pair generation module include:

[0076] S4-1. Load a parameter set consistent with the elliptic curve cryptography algorithm used by the network domain key pair; wherein, the parameter set includes the elliptic curve equation, curve order parameter, and base point coordinates defined in the finite prime field;

[0077] Specifically, the elliptic curve equations in the finite prime field are defined using the curve parameters recommended by the SM2 national cryptographic standard or the NISTP-256 curve.

[0078] The curve order parameter is the order (i.e., the total number of elements in the group) of the additive group formed by all rational points (including infinity) on the elliptic curve, denoted by n, which is a large prime number; the device private key is located in the interval... Select or derive integers from the given integers to ensure the safety of scalar multiplication operations;

[0079] The base point coordinates refer to a public base point in the elliptic curve addition group, and the coordinates of this base point are fixed constants.

[0080] S4-2. Based on the disaster monitoring terminal identifier, determine the device private key within the numerical range defined by the curve order parameter;

[0081] S4-3. Using the device private key and the base point coordinates as input, perform a scalar dot product operation in the coordinate space defined by the elliptic curve equation to generate the corresponding device public key, thereby forming a device key pair composed of the device private key and the device public key.

[0082] The disaster monitoring terminal uses its unique identifier to directly generate a device private key within the elliptic curve parameter range and calculates the corresponding public key to form a key pair. The private key is not stored; it is only derived from the identifier in real time during signing, avoiding key leakage due to device loss or disassembly. At the same time, it ensures that each terminal's identity credential corresponds one-to-one with its hardware identifier, supporting secure signing without external intervention, and is suitable for unattended outdoor scenarios.

[0083] Specifically, in this embodiment, the generation steps of the dual signature generation module include:

[0084] S5-1. Perform a hash operation on the monitoring data to be transmitted to generate a data digest;

[0085] S5-2. Perform elliptic curve digital signature on the data digest based on the network domain private key to generate an authorized signature;

[0086] S5-3. Construct a composite byte string based on the authorized signature;

[0087] S5-4. Perform elliptic curve digital signature on the composite byte string based on the device private key to generate a device signature.

[0088] The network domain private key is uniformly generated by the disaster monitoring and management center and securely injected into all disaster monitoring terminals within the local trusted domain during the deployment phase. It is used to authorize and sign the monitoring data digest, ensuring the organizational legitimacy of the data source.

[0089] Furthermore, the network domain public key is publicly distributed to ensure that the monitoring data has not been tampered with and originates from a legitimate trusted domain;

[0090] Furthermore, the device private key is independently generated and securely stored by each disaster monitoring terminal based on its unique identifier. This key is used to perform secondary signatures on composite byte strings containing dynamic disturbance information, thereby confirming the individual terminal identity. The dynamic disturbance symbol is generated based on the authorization timestamp, ensuring the time-limited uniqueness of each generated composite byte string. Even if the monitoring data content is the same, the device signature changes over time, effectively preventing replay attacks and signature forgery. This achieves a dual security mechanism of unified authorization by the management center and independent verification of individual terminal identities.

[0091] Further, step S5-1 specifically includes:

[0092] S5-1-1. The monitoring data to be transmitted is concatenated with the corresponding terminal identifier and the collection timestamp of the monitoring data to be transmitted to form plaintext to be hashed.

[0093] S5-1-2. Perform a one-way hash operation on the plaintext to be hashed and output a byte string of fixed length;

[0094] In this specific embodiment, the one-way hash operation uses the SM3 cryptographic hash algorithm, which has an output length of 256 bits, matching the security strength of the SM2 elliptic curve cryptography algorithm.

[0095] S5-1-3. Use the fixed-length byte string as the data digest.

[0096] In this embodiment, the monitoring data to be transmitted is concatenated with its terminal identifier and collection timestamp and then hashed. The resulting data digest not only reflects the data content, but also binds the terminal identity and collection time, so that the data digest simultaneously contains the content, terminal identity and collection time, preventing attackers from stripping the identity information and forging reports.

[0097] Further, step S5-2 specifically includes:

[0098] S5-2-1. Load the network domain private key from the hardware encryption module;

[0099] S5-2-2: Invoke the elliptic curve cryptography algorithm, using the network domain private key and the data digest as input, to generate a digital signature byte string;

[0100] S5-2-3. Encode the digital signature byte string into a byte sequence of a preset format as the authorized signature.

[0101] The network domain private key is loaded inside the hardware encryption module, and elliptic curve signing is performed directly on the data digest to output a standard format authorization signature, avoiding the exposure of the private key in the main control chip memory; at the same time, the signature encoding format is unified to ensure that the authorization signature format generated by different terminals is consistent, which facilitates batch signature verification by the receiving end.

[0102] Furthermore, step S5-3 specifically includes:

[0103] S5-3-1. Obtain the timestamp when the authorization signature was generated as the authorization timestamp;

[0104] S5-3-2. Generate a first perturbation symbol, a second perturbation symbol, and a third perturbation symbol based on the authorized timestamp;

[0105] S5-3-3: Append the first perturbation character, the second perturbation character, and the third perturbation character to the end of the data digest, the authorization signature, and the authorization timestamp, respectively, to generate a perturbation code, a perturbation signature, and a perturbation timestamp;

[0106] S5-3-4. Concatenate the perturbation code, perturbation signature, and perturbation timestamp into a composite byte string.

[0107] Before generating the device signature, the data digest, authorization signature, and authorization timestamp are concatenated with a dynamic perturbation character to form a composite byte string. Since the perturbation character is derived from a timestamp accurate to the second, even if the monitoring data content, terminal identifier, and collection time are exactly the same (such as periodic heartbeat packets), the composite byte string will be different as long as the reporting time is different, ensuring that the device signature has time-sensitive uniqueness.

[0108] Further, step S5-4 specifically includes:

[0109] S5-4-1. Convert the authorized timestamp into a 14-bit standardized time string;

[0110] In this embodiment, the authorization timestamp is synchronously obtained by the hardware encryption module deployed on the disaster monitoring terminal when performing a digital signature operation, and converted into a 14-bit standardized time string; its format is YYYYMMDDHHmmss, where:

[0111] YYYY represents the Gregorian calendar year, consisting of four decimal digits, with a value range from 0000 to 9999;

[0112] MM represents the month of the year, consisting of two decimal digits, ranging from 01 (January) to 12 (December).

[0113] DD represents the date of the month, consisting of two decimal digits, with a value ranging from 01 to 31;

[0114] HH represents the hour in a 24-hour clock, consisting of two decimal digits, with a value range from 00 to 23;

[0115] mm represents minutes, consisting of two decimal digits, with a value range from 00 to 59;

[0116] ss represents seconds, consisting of two decimal digits, with a value range from 00 to 59.

[0117] For example, if the time information obtained by the hardware encryption module during a data reporting process corresponds to 11:28:03 on February 10, 2026, then the generated 14-bit standardized time string is 20260210112803. This time string serves as the input source for the perturbation algorithm, used to derive dynamic perturbation symbols, ensuring that each generated device signature has uniqueness in the time dimension.

[0118] S5-4-2. Extract the last digit of the time string as the seed number;

[0119] S5-4-3. Based on the seed number, repeatedly fill in to generate an extended number sequence of length 15 digits;

[0120] S5-4-4. Divide the extended number sequence into three sub-sequences;

[0121] S5-4-5. For each subsequence, calculate the floating-point weight of each number using minimum-maximum normalization.

[0122] The formula for calculating the floating-point weight is:

[0123] ;

[0124] in, Let i be the number in the i-th position of the subsequence. and Let be the minimum and maximum values ​​of all numbers in the k-th subsequence, respectively.

[0125] Specifically, the floating-point weights employ a min-max normalization method, linearly scaling the numbers in each subsequence to a numerical range of [0.00, 1], which serves as their relative position weight within that subsequence. This weight reflects the distribution ratio of the numbers within the subsequence relative to the minimum and maximum values, thereby achieving a non-linear perturbation mapping of the original number sequence.

[0126] Because the weights dynamically adjust according to the distribution of numbers within the subsequences, even a slight change in the input time string (such as adding 1 to the seconds digit) will cause a change in the structure of the extended number sequence, which in turn causes a chain reaction of changes in the minimum, maximum, and corresponding weights of each subsequence. This high sensitivity to input perturbations results in significant differences in the final generated perturbation values, forming an output characteristic similar to an avalanche effect.

[0127] For example, when the authorization timestamp changes from 20260210112803 to 20260210112804, the seed number changes from 3 to 4, causing the extended sequence to change accordingly. This shifts the numerical distribution of each subsequence, and the floating-point weights generated after min-max normalization are also dynamically adjusted, ultimately resulting in significant differences in the generated perturbation values. In this way, a sensitive response to minute changes in the input is achieved, effectively improving the anti-forgery capability of the signature data.

[0128] S5-4-6. Based on the floating-point weights, perform a weighted summation on each subsequence to obtain the sequence perturbation value;

[0129] S5-4-7. Normalize the perturbation values ​​of each sequence and use them as the first perturbation symbol, the second perturbation symbol, and the third perturbation symbol, respectively.

[0130] The authorized timestamp is converted into a 14-bit normalized time string, and an extended sequence is generated based on its last digit. Then, three sets of perturbation symbols are derived through subsequence partitioning and min-max normalization. This can amplify second-level time variations into significantly different perturbation values. Even if the time difference is only 1 second, the perturbation symbols will be significantly different, thus providing a highly sensitive dynamic perturbation source for composite byte strings.

[0131] It should be noted that the normalization here uses the min-max normalization method, mapping the perturbation values ​​of each subsequence to the numerical range of [0.00, 1.00], generating perturbation numbers with fixed precision. The purpose of this normalization is to unify the numerical range of the perturbation symbol, ensuring that it is always represented with the same number of decimal places (e.g., two decimal places), thereby avoiding the problem of inconsistent bit lengths in the final perturbation symbol due to different bit lengths in the original sequence perturbation values.

[0132] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer program are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means.

[0133] The computer-readable storage medium can be any available medium that a computer can access, or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g.,...), etc. DVD ( ), or semiconductor media. Semiconductor media can be solid-state drives (SSDs).

[0134] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; multiple units or components may be combined or integrated into another system, or some features may be omitted or not performed. Furthermore, the mutual couplings or direct couplings or communication connections shown or discussed may be indirect couplings or communication connections between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0135] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A multi-mode communication hardware encryption system based on natural disaster prevention and control scenarios, characterized in that, The system is executed by a hardware encryption module deployed on a disaster monitoring terminal, the hardware encryption module comprising: The terminal configuration module is used to predefine N disaster monitoring terminals and configure terminal identifiers during the system deployment phase. The trust domain construction module is used to construct a local trust domain based on N predefined disaster monitoring terminals and their terminal identifiers; The first key pair loading module is used to load a network domain key pair bound to a local trust domain for the disaster monitoring terminal; wherein, the network domain key pair includes a network domain private key and a network domain public key; The second key pair generation module is used to generate device key pairs for disaster monitoring terminals based on elliptic curve cryptography; wherein, the device key pair includes a device private key and a device public key; The dual signature generation module is used to acquire the monitoring data to be transmitted collected by the disaster monitoring terminal, and generate an authorization signature and a device signature for the monitoring data to be transmitted; The generation steps of the dual-signature generation module include: Perform a hash operation on the monitoring data to be transmitted to generate a data digest; Based on the network domain private key, perform elliptic curve digital signature on the data digest to generate an authorized signature; Construct a composite byte string based on the authorized signature; Based on the device's private key, perform an elliptic curve digital signature on the composite byte string to generate a device signature; The step of performing a hash operation on the monitoring data to be transmitted to generate a data digest includes: The monitoring data to be transmitted is concatenated with the corresponding terminal identifier and the collection timestamp of the monitoring data to be transmitted to form plaintext to be hashed; Perform a one-way hash operation on the plaintext to be hashed, and output a byte string of fixed length; The fixed-length byte string is used as the data digest; The step of constructing a composite byte string based on the authorized signature includes: Obtain the timestamp at which the authorization signature was generated as the authorization timestamp; Generate a first perturbation symbol, a second perturbation symbol, and a third perturbation symbol based on the authorized timestamp; The first perturbation character, the second perturbation character, and the third perturbation character are respectively appended to the end of the data digest, the authorization signature, and the authorization timestamp to generate a perturbation code, a perturbation signature, and a perturbation timestamp; The perturbation code, perturbation signature, and perturbation timestamp are concatenated into a composite byte string; The encapsulation and transmission module is used to encapsulate the monitoring data, authorization signature, device signature and corresponding terminal identifier into a monitoring data packet to be transmitted and send it to the receiving end.

2. The multi-mode communication hardware encryption system based on natural disaster prevention and control scenarios according to claim 1, characterized in that: The construction steps of the trust domain construction module include: S2-1. Obtain the equipment attribute information of each disaster monitoring terminal; S2-2. Based on predefined equipment attribute information classification rules, disaster monitoring terminals with the same type of equipment attribute information are grouped into the same local trust domain.

3. The multi-mode communication hardware encryption system based on natural disaster prevention and control scenarios according to claim 1, characterized in that, The generation steps of the second key pair generation module include: S4-1. Load a parameter set consistent with the elliptic curve cryptography algorithm used by the network domain key pair; wherein, the parameter set includes the elliptic curve equation, curve order parameter, and base point coordinates defined in the finite prime field; S4-2. Based on the disaster monitoring terminal identifier, determine the device private key within the numerical range defined by the curve order parameter; S4-3. Using the device private key and the base point coordinates as input, perform a scalar dot product operation in the coordinate space defined by the elliptic curve equation to generate the corresponding device public key.

4. A multi-mode communication hardware encryption system based on natural disaster prevention and control scenarios according to claim 1, characterized in that, Based on the network domain private key, perform an elliptic curve digital signature on the data digest to generate an authorized signature, including: S5-2-1. Load the network domain private key from the hardware encryption module; S5-2-2: Invoke the elliptic curve cryptography algorithm, using the network domain private key and the data digest as input, to generate a digital signature byte string; S5-2-3. Encode the digital signature byte string into a byte sequence of a preset format as the authorized signature.

5. A multi-mode communication hardware encryption system based on natural disaster prevention and control scenarios according to claim 4, characterized in that: Based on the authorized timestamp, a first perturbation symbol, a second perturbation symbol, and a third perturbation symbol are generated, including: S5-4-1. Convert the authorized timestamp into a 14-bit standardized time string; S5-4-2. Extract the last digit of the time string as the seed number; S5-4-3. Based on the seed number, repeatedly fill in to generate an extended number sequence of length 15 digits; S5-4-4. Divide the extended number sequence into three sub-sequences; S5-4-5. For each subsequence, calculate the floating-point weight of each number using minimum-maximum normalization. S5-4-6. Based on the floating-point weights, perform a weighted summation on each subsequence to obtain the sequence perturbation value; S5-4-7. Normalize the perturbation values ​​of each sequence and use them as the first perturbation symbol, the second perturbation symbol, and the third perturbation symbol, respectively.

Images