A data hierarchical encryption storage method for information security system

Abstract

The application discloses a data hierarchical encryption storage method for an information security system, and relates to the technical field of data encryption storage.The method encapsulates Beidou position, dispatching instructions, driver identity, cargo compartment state and satellite communication records into secure guest capsule data, calculates task exposure levels in combination with electronic fences, satellite links, antenna attitudes, terminal anti-disassembly and driver authentication state, generates different key thresholds and ciphertext partitions according to the levels, reduces local reading authority when being offline, crossing a border or the terminal being abnormal, makes high-level data maintain writable but not locally decryptable, and after communication is restored, the command center decides key recovery or failure according to a secure storage evidence chain, thereby improving the sensitive data storage security of Beidou vehicle-mounted terminals such as dangerous chemical product transport vehicles.

Description

Technical Field

[0001] This invention relates to the field of data encryption and storage technology, and in particular to a hierarchical encryption and storage method for data in information security systems. Background Technology

[0002] With the application of BeiDou vehicle-mounted terminals, satellite mobile communication terminals, and vehicle-to-everything (V2X) dispatch systems in scenarios such as hazardous chemical transportation, emergency communication support, and monitoring of engineering vehicles in remote areas, BeiDou location data, dispatch instruction data, driver identity data, cargo status data, and satellite communication record data are continuously generated during vehicle operation. This data is not only used for vehicle dispatching, driving monitoring, and anomaly tracing, but may also indirectly expose vehicle transportation routes, mission destinations, communication blind spots, driver identities, and cargo status. Therefore, vehicle-mounted information security systems typically need to encrypt and store this data.

[0003] Existing data encryption and storage methods mostly employ static hierarchical rules. For example, data is divided into ordinary data, important data, and confidential data according to data name, file type, or preset security level, and then stored in different areas using different encryption algorithms or different storage regions. This method is suitable for fixed office networks or server center scenarios, but it is difficult to adapt to the dynamic operating environment of Beidou vehicle-mounted terminals. For hazardous chemical transport vehicles, the sensitivity of the same type of data varies under different conditions. For example, a single Beidou location data point may have low sensitivity on ordinary road sections, but when it occurs simultaneously with temporary detour dispatch instructions, abnormal cargo compartment opening records, and satellite link downtime records, attackers may infer abnormal vehicle tasks, changes in transport routes, and weak communication areas, significantly increasing the consequences of leakage.

[0004] Meanwhile, BeiDou vehicle-mounted terminals are frequently located in areas with unstable satellite links, such as mountainous regions, ports, mining areas, and border highways, requiring offline operation, delayed uploads, and local data caching. If vehicles still retain complete keys or allow direct local reading of highly sensitive data during offline operations, attackers could potentially obtain continuous tracks, dispatch instructions, and identity data by disassembling the vehicle-mounted terminal, copying the storage chip, or bypassing driver authentication. While existing technologies can increase the difficulty of cracking ciphertext through encryption algorithms, they typically do not consider satellite link status, antenna attitude status, terminal anti-tamper status, electronic fence status, and driver authentication status together to determine key recoverability, nor do they establish a data protection mechanism that allows writing but not local decryption for offline operations.

[0005] Furthermore, existing data classification methods typically lack a dynamic evaluation process that integrates with the actual mission risks of vehicles. They cannot form mission exposure scoring thresholds based on historical safety object capsule data, nor can they predict when a terminal will enter an untrusted state based on link anomalies, antenna attitude anomalies, and driver authentication anomalies before the vehicle has completely lost contact. Summary of the Invention

[0006] The technical problem solved by this invention is that existing technologies are unable to dynamically determine the encryption level, key recovery conditions, and local reading permissions of sensitive data based on vehicle mission, location exposure, link status, and terminal trust status when the Beidou vehicle-mounted terminal is offline, the satellite link is unstable, or the terminal is at risk of being disassembled.

[0007] To solve the above-mentioned technical problems, the present invention provides the following technical solution: A method for hierarchical encrypted storage of data in an information security system includes the following steps: Step S1: The Beidou vehicle-mounted terminal collects the data to be stored and the operational constraint data, and encapsulates them into a safety object capsule data. Step S2: Calculate the task exposure level data based on the safety object capsule data; Step S3: Generate graded key threshold data based on task exposure level data; Step S4: Encrypt the data to be stored according to the hierarchical key threshold data, generate hierarchical ciphertext data and store it in partitions; Step S5: Adjust the local read permission data according to the running constraint data; Step S6: Perform key recovery or key expiration based on local read permission data, and generate a secure storage evidence chain.

[0008] Preferably, step S1 includes the following sub-steps: Step S101: Obtain the data to be stored, which includes BeiDou location data, dispatch instruction data, driver identity data, cargo compartment status data, and satellite communication record data; Step S102: Obtain operational constraint data, which includes task number data, electronic fence status data, satellite link status data, antenna attitude status data, terminal anti-tamper status data, and driver authentication status data. Step S103: Encapsulate the data to be stored and the running constraint data according to the same task number to generate the safety object capsule data.

[0009] Preferably, step S2 includes the following sub-steps: Step S201: Analyze the security object capsule data and calculate the data hazard value, spatial exposure value, link observable value, terminal capture risk value, and mission impact value respectively; Step S202: The data hazard value, spatial exposure value, link observable value, terminal capture risk value, and task impact value are summed according to preset weights to obtain task exposure score data; Step S203: Output task exposure level data based on task exposure score data, wherein the task exposure level data includes level 1, level 2, level 3 and level 4.

[0010] Preferably, the calculation logic for the spatial exposure value is as follows: If the data to be stored only includes a single device state, then the space exposure value is low; If the data to be stored includes continuous BeiDou location data, the spatial exposure value is calculated based on the number of samples, duration, and number of electronic fences passed through the continuous BeiDou location data. If the data to be stored includes both continuous BeiDou location data and scheduling command data, then the spatial exposure value should be increased.

[0011] Preferably, the calculation logic for the link observable value and the terminal takeover risk value is as follows: Calculate link observables based on the number of retransmissions, disconnection duration, and session failures in the satellite link status data; The risk value of terminal hijacking is calculated based on antenna attitude status data, terminal anti-tamper status data, and driver authentication status data. When the terminal's anti-tamper status data is abnormal, the terminal's risk value is directly marked as high.

[0012] Preferably, step S3 includes the following sub-steps: Step S301: If the task exposure level data is level 1, then generate local key threshold data; Step S302: If the task exposure level data is level 2, then generate key threshold data in which both the local key fragment and the command center key fragment participate in the recovery. Step S303: If the task exposure level data is level 3, then generate at least two key threshold data from the vehicle security chip key fragment, the command center key fragment, and the task token key fragment to participate in the recovery. Step S304: If the mission exposure level data is level 4, then generate at least three key threshold data for recovery from the vehicle security chip key fragment, command center key fragment, satellite session key fragment, and location trusted receipt key fragment.

[0013] Preferably, step S4 includes the following sub-steps: Step S401: Generate a data key based on the hierarchical key threshold data, and use the data key to encrypt the data to be stored to generate hierarchical ciphertext data. Step S402: Write the Level 1 ciphertext data to the local ciphertext area, write the Level 2 ciphertext data to the restricted index ciphertext area, write the Level 3 ciphertext data to the trajectory ciphertext area and the task ciphertext area, and write the Level 4 ciphertext data to the delayed recovery ciphertext area. Step S403: Write the partition location, task number data, task exposure level data, and encrypted digest into the secure storage evidence chain.

[0014] Preferably, step S5 includes the following sub-steps: Step S501: Read the operation constraint data and determine whether the satellite link status data, antenna attitude status data, terminal anti-tamper status data, electronic fence status data and driver authentication status data are abnormal; Step S502: If all the running constraint data are normal, generate local read permission data that allows reading. Step S503: If any running constraint data is abnormal, the local read permission data is reduced according to the task exposure level data, so that the level 3 ciphertext data is in the state of generating only digests, and the level 4 ciphertext data is in the state of being undecryptable.

[0015] Preferably, step S6 includes the following sub-steps: Step S601: After the Beidou vehicle terminal restores reliable communication, it uploads the secure storage evidence chain to the command center. In step S602, the command center determines whether the data during the offline period is trustworthy based on the operational constraint data and ciphertext digest in the securely stored evidence chain. Step S603: If the location is deemed trustworthy, return the location trust receipt key fragment and the task token key fragment. If the key is deemed untrustworthy, a key invalidation command will be issued.

[0016] Preferably, after receiving the key expiration command, the Beidou vehicle terminal deletes the locally available key fragment, marks the corresponding hierarchical encrypted data as controlled sealed data, and writes the key expiration time, task number data, task exposure level data, and controlled sealed result into the secure storage evidence chain.

[0017] The beneficial effects of this invention are as follows: This method encapsulates BeiDou location, dispatch instructions, driver identity, cargo compartment status, and satellite communication records into secure object capsule data. It also calculates the task exposure level by combining electronic fence, satellite link, antenna attitude, terminal anti-tampering, and driver authentication status. Different key thresholds and encrypted partitions are generated according to the level. When the device is offline, crosses boundaries, or the terminal is abnormal, the local read permission is reduced, so that high-level data can be written but not decrypted locally. After communication is restored, the command center decides whether to restore or invalidate the key based on the secure storage evidence chain, thereby improving the security of sensitive data storage of BeiDou vehicle-mounted terminals such as hazardous chemical transport vehicles. Attached Figure Description

[0018] Figure 1 The present invention provides a flowchart of a data hierarchical encryption storage method for an information security system, which is an embodiment of the present invention. Detailed Implementation

[0019] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0020] Example, refer to Figure 1 This paper provides a hierarchical encrypted data storage method for information security systems, comprising the following steps: Step S1: The Beidou vehicle-mounted terminal collects the data to be stored and the operational constraint data, and encapsulates them into a safety object capsule data.

[0021] Step S2: Calculate the task exposure level data based on the safety object capsule data.

[0022] Step S3: Generate graded key threshold data based on task exposure level data.

[0023] Step S4: Encrypt the data to be stored according to the hierarchical key threshold data, generate hierarchical ciphertext data and store it in partitions.

[0024] Step S5: Adjust the local read permission data according to the running constraint data.

[0025] Step S6: Perform key recovery or key expiration based on local read permission data, and generate a secure storage evidence chain.

[0026] Step S1 includes the following sub-steps: Step S101: Obtain the data to be stored, which includes BeiDou location data, dispatch instruction data, driver identity data, cargo compartment status data, and satellite communication record data.

[0027] In step S101, the Beidou vehicle-mounted terminal collects data to be stored while the vehicle is performing a hazardous materials transportation task. This data is not a single file, but rather consists of multiple types of sensitive data generated during vehicle operation. These include: Beidou location data (sampling time, longitude, latitude, speed, and heading); dispatch instruction data (instruction number, instruction content category, instruction validity duration, and reception time); driver identity data (driver number and authentication result); cargo compartment status data (cargo compartment opening / closing status, cargo compartment temperature, cargo compartment vibration intensity, and abnormal opening markers); and satellite communication record data (session number, number of retransmissions, disconnection duration, number of session failures, and link latency). This data is used for subsequent calculations of data hazard values ​​and spatial exposure values, and also serves as the original data that ultimately needs to be encrypted and stored.

[0028] Step S102: Obtain operational constraint data, which includes task number data, electronic fence status data, satellite link status data, antenna attitude status data, terminal anti-tamper status data, and driver authentication status data.

[0029] In step S102, the Beidou vehicle-mounted terminal synchronously collects operational constraint data. Task number data is generated by the command center when the task is issued, used to identify the vehicle's current transportation task. Electronic fence status data indicates whether the vehicle is within the authorized transportation corridor. Satellite link status data is output by the satellite communication module, reflecting link stability. Antenna attitude status data is output by the vehicle-mounted antenna detection module, reflecting whether the antenna has experienced abnormal obstruction, abnormal rotation, or abnormal disconnection. Terminal anti-tamper status data is output by the vehicle-mounted terminal casing opening sensor and power integrity detection circuit, used to determine whether the terminal has been disassembled. Driver authentication status data is generated from facial recognition, password token, or vehicle identification card authentication results. All of the above operational constraint data is then incorporated into subsequent processes for calculating task exposure level, determining local read access permissions, and generating a secure storage evidence chain.

[0030] Step S103: Encapsulate the data to be stored and the running constraint data according to the same task number to generate the safety object capsule data.

[0031] In step S103, using the task number data as the primary key, the data to be stored and the operational constraint data within the same sampling period are encapsulated into a secure object capsule data. The secure object capsule data is not a simple data packet, but rather the smallest security judgment unit used to determine the encryption level. Its form can be expressed as: ; in, Indicates the first Data on individual safe object capsules, Indicates the first One piece of data to be stored. Indicates the first One set of operational constraint data, This represents the task number data. This indicates the sampling time. This encapsulation method allows for subsequent determination of whether a scheduling instruction was generated in a normal link state, or when it was disconnected from the network, crossed boundaries, or when the terminal was suspected of being disassembled, thus avoiding static classification based solely on file name.

[0032] Step S2 includes the following sub-steps: Step S201: Analyze the data of the security object capsule and calculate the data hazard value, spatial exposure value, link observable value, terminal capture risk value and mission impact value respectively.

[0033] The calculation logic for spatial exposure values ​​is as follows: If the data to be stored only includes single device states, then the space exposure value is low.

[0034] If the data to be stored includes continuous BeiDou location data, the spatial exposure value is calculated based on the number of samples, duration, and number of electronic fences passed through the continuous BeiDou location data.

[0035] If the data to be stored includes both continuous BeiDou location data and scheduling command data, then the spatial exposure value should be increased.

[0036] The calculation logic for link observables and terminal takeover risk values ​​is as follows: The link observables are calculated based on the number of retransmissions, disconnection duration, and session failures in the satellite link status data.

[0037] The risk value of terminal takeover is calculated based on antenna attitude status data, terminal anti-tamper status data, and driver authentication status data.

[0038] When the terminal's anti-tamper status data is abnormal, the terminal's risk value is directly marked as high.

[0039] In step S201, the data from the safety capsule is parsed, and the data hazard value, spatial exposure value, link observability value, terminal capture risk value, and task impact value are calculated respectively. The data hazard value reflects the direct harm caused by the leakage of the data to be stored. Basic hazard scores are assigned to BeiDou location data, dispatch command data, driver identity data, cargo compartment status data, and satellite communication record data. For example, the basic hazard score for a single device status log is 20, the basic hazard score for satellite communication record data is 55, the basic hazard score for driver identity data is 75, the basic hazard score for cargo compartment abnormal opening records is 80, and the basic hazard score for temporary detour dispatch commands is 90. If a safety capsule contains multiple types of data to be stored, the data hazard value is the larger of the highest basic hazard score and the weighted comprehensive hazard score. ; in, Indicates the first Data hazard values ​​for individual safety capsules. Indicates the first The data of the first safe object capsule The basic hazard score of the data to be stored. Indicates the first The hazard weight of the data to be stored This indicates the number of data categories to be stored. The purpose of this calculation method is to directly reflect the highest risk when a single data type is highly sensitive, and to increase the risk value when multiple moderately sensitive data are combined to infer the task intent.

[0040] Spatial exposure values ​​reflect whether the data to be stored can be used to deduce vehicle routes, parking areas, and mission destinations. First, the number of consecutive samples, trajectory duration, and number of geofence crossings are extracted from the BeiDou location data, and then converted into spatial exposure sub-values ​​ranging from 0 to 100. ; ; ; in, Indicates the first The number of continuous BeiDou location samples included in each secure object capsule data. This represents the baseline value for the number of consecutive samples. Indicates the duration of the trajectory. Indicates the baseline value of duration. Indicates the number of times the electronic fence has been passed. This indicates the baseline value for the number of electronic fences. Spatial exposure value: ; in, Indicates the spatial exposure value. This represents the spatial exposure weight. It can be set during implementation. =0.3、 =0.40、 =0.30. If the data to be stored contains both continuous BeiDou location data and scheduling command data, then... Increase it to no less than 70 to characterize how attackers can infer mission intent by combining route and scheduling content.

[0041] In step S201, the link observables are calculated from satellite link status data and are used to reflect whether the communication link is in a state susceptible to replay, detection, or abnormal interference. The number of retransmissions, disconnection duration, session failures, and sudden increases in link latency are extracted to obtain link sub-values, and a weighted summation method is used to generate the link observables. ; in, Indicates the observable value of the link. This indicates the number of retransmissions. This represents the duration of the disconnection. This subvalue represents the number of session failures. This indicates the number of times the link latency suddenly increases. This indicates the link weight. If the satellite link is offline for more than 180 seconds within 10 minutes, or if the number of session failures reaches 3, the link observability value will be no less than 75. This value will subsequently be used in the calculation of the mission exposure level and will also serve as the basis for reducing local read permissions.

[0042] In step S201, the terminal takeover risk value is calculated from antenna attitude status data, terminal anti-tamper status data, and driver authentication status data. If the terminal anti-tamper status data indicates abnormal opening, abnormal power-off relocation, or security chip access failure, the terminal takeover risk value is directly marked as 100. If the terminal anti-tamper status data is normal, the risk value is calculated based on the number of times the antenna attitude is abnormal, the number of times driver authentication fails, and the number of times the terminal restarts abnormally. ; in, This indicates that the terminal has acquired the risk value. This indicates an antenna attitude anomaly sub-value. This indicates a driver authentication failure subvalue. This indicates a subvalue indicating an abnormal terminal restart. This represents the terminal risk weight. It can be set during implementation. =0.25、 =0.35、 =0.40.

[0043] In step S201, the task impact value is determined by the task type corresponding to the task number data. The command center writes the task impact baseline value to the task number data when issuing the task. For example, the baseline value is 30 for ordinary logistics tasks, 60 for cold chain pharmaceutical transportation tasks, 80 for hazardous chemical transportation tasks, and 90 for emergency communication support tasks. If the dispatch instruction data involves temporary detours, temporary stops, destination changes, or emergency takeover, the task impact value is increased to no less than 85. The task impact value is subsequently used to prevent the encryption level from being lowered in high-impact tasks simply because a single operational data point is normal.

[0044] Step S202: The data hazard value, spatial exposure value, link observable value, terminal capture risk value, and task impact value are summed according to preset weights to obtain task exposure score data.

[0045] In step S202, task exposure score data is calculated based on data hazard value, spatial exposure value, link observable value, terminal capture risk value, and task impact value. The formula for calculating the task exposure score data is: ; in, Indicates the first Task exposure score data for each safe object capsule. For data hazard values, This represents the spatial exposure value. For link observables, To capture risk values ​​for the terminal, This represents the task's impact value. During implementation, the task exposure level threshold is... to These values ​​can be set to 0.24, 0.22, 0.20, 0.18, and 0.16 respectively. This weight setting indicates that the inherent danger of the data and its spatial exposure have a greater impact on the consequences of leakage, while the link status and terminal status have a greater impact on the risk of off-network leakage. The task impact value is used to adjust the sensitivity of the business scenario.

[0046] Step S203: Output task exposure level data based on task exposure score data, wherein the task exposure level data includes level 1, level 2, level 3 and level 4.

[0047] In step S203, a safety runaway prediction model is established to predict whether the vehicle terminal may lose its trusted state during the next prediction period. The input vector of the safety runaway prediction model is: ; in, This indicates an abnormal flag for the electronic fence; 0 indicates normal operation and 1 indicates abnormal operation. This indicates an abnormal antenna attitude; 0 indicates normal and 1 indicates abnormal. This indicates an abnormal driver certification flag; 0 is normal, and 1 is abnormal. The data for predicting loss of control is as follows: ; ; ; ; in, This indicates data predicting a runaway safety situation. Indicates model parameters, This represents the compression function. During model training, historical security capsule data is used as samples. If a satellite link interruption, electronic fence malfunction, terminal tampering malfunction, or driver authentication failure occurs within 15 minutes of a sample being generated, the training labels will be... =1, otherwise =0. The model loss function is: ; in, Indicates the number of training samples. Indicates an indicator function, = , =1 After training, the task exposure score data is corrected using the safety runaway prediction data: ; in, This indicates the revised task exposure score data. = , =100 , =0.75, =0.25. When a vehicle has not yet actually left the network, but the model predicts that it has a high probability of losing control within 15 minutes, the classification level can be increased in advance to avoid high-level data remaining readable after the risk arrives.

[0048] The task exposure level threshold can be obtained from historical security object capsule data. During implementation, at least 300 historical security object capsule data entries are selected, and safety management personnel categorize them into four types based on the consequences of leakage: normal operation, equipment status sensitive, route / identity sensitive, and core task sensitive. The system then calculates the corrected task exposure score data for each of the four types of samples, and uses the average of the 95th percentile and 5th percentile of adjacent categories as candidate thresholds. ; in, Indicates category and categories Candidate thresholds between Indicates category The revised task exposure score set, Indicates category The revised task exposure score set, This represents the 95th percentile. This indicates the 5th percentile.

[0049] Table 1 Table 1 shows that the candidate threshold between normal operation and equipment status sensitivity is 34, which is taken as 35 considering security redundancy. The candidate threshold between equipment status sensitivity and route identity sensitivity is 60, and the candidate threshold between route identity sensitivity and mission core sensitivity is 80. Therefore, the judgment rule for mission exposure level data is as follows: <35 is Level 1, 35≤ <60 is Level 2, 60≤ <80 is level 3. A score of ≥80 corresponds to Level 4. The predicted risk threshold can be set at 0.70, which is derived from the fact that, in historical samples, after the predicted risk of runaway safety reached 0.70, the proportion of samples with a lost credible state within 15 minutes exceeded 80%.

[0050] Step S3 includes the following sub-steps: In step S301, when the mission exposure level data is Level 1, local key threshold data is generated. Level 1 data mainly includes engine operation logs, non-sensitive equipment temperatures, and ordinary communication heartbeat records; if leaked, the route, identity, or mission content cannot be recovered. A data key is generated using the local key within the vehicle's security chip, and the Beidou vehicle terminal is allowed to read it under maintenance permissions. At this time, the securely stored evidence chain still records the mission number data, mission exposure level data, and ciphertext digest, but the command center does not need to participate in key recovery.

[0051] In step S302, when the mission exposure level data is Level 2, hierarchical key threshold data is generated, which is jointly recovered by the local key fragment and the command center key fragment. Level 2 data mainly includes satellite communication record data, equipment status anomaly records, and short-term link anomaly data. While individual leaks cannot fully deduce the mission route, they can expose the communication patterns of the vehicle-mounted terminal. The data key is split into two key fragments: the local key fragment is stored in the vehicle-mounted security chip, and the command center key fragment is stored in the command center key server. When the vehicle is disconnected from the network, writing Level 2 hierarchical encrypted data is allowed, but batch export of plaintext is not permitted.

[0052] Step S303: If the task exposure level data is level 3, then generate at least two key threshold data from the vehicle security chip key fragment, the command center key fragment, and the task token key fragment to participate in the recovery.

[0053] In step S303, when the task exposure level data is level 3, a 2-out-of-3 key threshold data is generated. Level 3 data mainly includes continuous BeiDou location data, driver identity data, cargo compartment abnormal status data, and dispatch instruction data. The data key is split into an onboard security chip key fragment, a command center key fragment, and a task token key fragment. Only any two key fragments that meet the conditions can recover the data key. The task token key fragment is generated by the task number data and the task validity period. After the vehicle exceeds the task validity period, this key fragment cannot be used for recovery.

[0054] Step S304: If the mission exposure level data is level 4, then generate at least three key threshold data for recovery from the vehicle security chip key fragment, command center key fragment, satellite session key fragment, and location trusted receipt key fragment.

[0055] In step S304, when the task exposure level data is level 4, the system generates 3 out of 4 key threshold data. Level 4 data mainly includes temporary detour scheduling instructions, destination change instructions, abnormal opening records of hazardous chemical cargo compartments, and continuous trajectory segments in sensitive areas during vehicle disconnection. The system splits the data key into vehicle security chip key segments, command center key segments, satellite session key segments, and location trusted receipt key segments. The data key can only be recovered if at least three of these key segments simultaneously meet the recovery conditions. During vehicle disconnection, only the uncrackable level 4 ciphertext data and ciphertext digest are stored locally; the complete data key cannot be recovered.

[0056] Key fragments can be generated using a finite-field threshold partitioning model. Let the data key be... finite field is The threshold number is The total number of segments is Construct the threshold polynomial: ; ; The key fragment is: ; in, Indicates the first A key fragment, This represents the finite field value corresponding to the fragment number. This represents the corresponding function value. During recovery, a set of key fragments that meets the threshold number is used. calculate: ; ; Using the above model, even if an attacker obtains the vehicle terminal storage chip, they can only obtain local key fragments and cannot recover the level 3 and level 4 data keys separately.

[0057] Step S4 includes the following sub-steps: Step S401: Generate a data key based on the hierarchical key threshold data, and use the data key to encrypt the data to be stored to generate hierarchical ciphertext data.

[0058] In step S401, the system generates a data key based on the hierarchical key threshold data, and encrypts the data to be stored using the SM4 GCM encryption mode to generate hierarchical ciphertext data. The encryption input includes the data to be stored, task number data, task exposure level data, and sampling time, where the task number data, task exposure level data, and sampling time serve as additional authentication data for integrity protection. The hierarchical ciphertext data can be represented as: ; ; in, This indicates hierarchical encrypted data. Indicates the data key. Indicates the data to be stored. This indicates additional authentication data. This indicates the task exposure level data. Additional authentication data is not used directly as plaintext business content, but is used to prevent encrypted data from being replaced under other task ID data.

[0059] Step S402: Write Level 1 ciphertext data to the local ciphertext area, write Level 2 ciphertext data to the restricted index ciphertext area, write Level 3 ciphertext data to the trajectory ciphertext area and the task ciphertext area, and write Level 4 ciphertext data to the delayed recovery ciphertext area.

[0060] In step S402, the hierarchical encrypted data is written to different partitions according to the task exposure level data. Level 1 hierarchical encrypted data is written to the local encrypted area for vehicle maintenance. Level 2 hierarchical encrypted data is written to the restricted index encrypted area, where the terminal only saves the sampling time, device number, and encrypted digest, and does not save the plaintext index that can be read in batches. Level 3 hierarchical encrypted data is written to the trajectory encrypted area and the task encrypted area. Among them, continuous Beidou location data is written to the trajectory encrypted area, and dispatch instruction data, driver identity data, and cargo compartment status data are written to the task encrypted area. Level 4 hierarchical encrypted data is written to the delayed recovery encrypted area, where the terminal only retains the encrypted digest, task number data, and partition location.

[0061] In step S402, the trajectory ciphertext in the trajectory ciphertext area does not simply store continuous coordinates. Instead, it first converts continuous BeiDou position data into trajectory skeleton data and then encrypts it. The trajectory skeleton data consists of spatial grid numbers and time period numbers, and does not store the original continuous coordinates. Its generation logic is as follows: ; in, Indicates the first The data of the first safe object capsule The spatial grid number corresponding to each location point Indicates longitude. Indicates latitude, This indicates the grid side length. The trajectory skeleton data and task content are encrypted separately, preventing attackers from directly piecing together vehicle routes and scheduling information from a single encrypted partition.

[0062] In step S403, the partition location, task number data, task exposure level data, ciphertext digest, local read permission data, and key status data are written into the secure storage evidence chain. The ciphertext digest can be generated using a hash function. ; in, Indicates the first A secure chain of evidence records. This indicates the previous secure storage evidence chain record. Indicates the partition location. Indicates a ciphertext digest. This indicates local read permission data. This represents key status data. This secure storage chain of evidence is used by the command center to determine whether data was accessed or sealed abnormally during the off-network period.

[0063] Step S5 includes the following sub-steps: Step S501: Read the operation constraint data and determine whether the satellite link status data, antenna attitude status data, terminal anti-tamper status data, electronic fence status data, and driver authentication status data are abnormal.

[0064] In step S501, the system determines whether the BeiDou vehicle-mounted terminal is in a trusted state based on the operational constraint data. The trusted state judgment value can be expressed as: ; in, This indicates a normal flag corresponding to the electronic fence status data. This indicates a normal flag corresponding to the satellite link status data. This indicates the normal marker corresponding to the antenna attitude state data. This indicates a normal flag corresponding to the terminal's tamper-proof status data. This represents the normal flag corresponding to the driver authentication status data. Each normal flag is set to 1 when normal and 0 when abnormal. When =1, the Beidou vehicle-mounted terminal is in a trusted state. When =0, the Beidou vehicle terminal is not in a trusted state.

[0065] In step S502, if the Beidou vehicle-mounted terminal is in a trusted state and the safety runaway prediction data is lower than the prediction risk threshold, the system generates local read permission data that is allowed to be read according to the task exposure level data. Level 1 encrypted data allows local decryption and reading; Level 2 encrypted data allows digest query and single authorized reading; Level 3 encrypted data allows reading when the driver authentication status data is normal and the task token is valid; Level 4 encrypted data, even in a trusted state, can only be read after obtaining the command center key fragment and the location trusted receipt key fragment.

[0066] In step S503, if the Beidou vehicle-mounted terminal is not in a trusted state, or the security failure prediction data reaches 0.70, the local read access permissions are reduced. Level 1 encrypted data can still be read under maintenance permissions to ensure vehicle operation safety; Level 2 encrypted data is only allowed to be written and digest queried; Level 3 encrypted data is only allowed to generate encrypted digests and is not allowed to be decrypted locally; Level 4 encrypted data is set to an undecryptable state, and the local key fragment is marked as frozen. Through this process, the vehicle can continue to record data even when it is offline, crosses boundaries, has its terminal disassembled, or its authentication fails, but it cannot become a source of high-level sensitive data leakage.

[0067] Step S6 includes the following sub-steps: In step S601, after the Beidou vehicle-mounted terminal restores trusted communication, it uploads the secure storage evidence chain to the command center. The uploaded content includes task number data, task exposure level data, ciphertext digest, partition location, local read permission data, key status data, operational constraint data, and sampling time. The command center can determine whether the data was trusted during the offline period without receiving plaintext data to be stored, thereby reducing the scope of plaintext exposure.

[0068] In step S602, the command center determines the credibility of the offline period based on the secure storage evidence chain. The judgment criteria include: whether adjacent digests in the secure storage evidence chain are continuous; whether the terminal's tamper-proof status data remains normal; whether the electronic fence status data shows no unauthorized boundary crossings; whether the driver authentication status data shows no consecutive failures; and whether the Level 4 encrypted data has not been decrypted locally. If all the above conditions are met, the data is judged to be credible; if the secure storage evidence chain is broken, the terminal's tamper-proof status is abnormal, or there are local read records of Level 4 encrypted data, the data is judged to be untrustworthy.

[0069] In step S603, if the command center determines the data is trustworthy, it returns the location trust receipt key fragment and the task token key fragment, enabling the Beidou vehicle-mounted terminal or authorized audit terminal to recover the level 3 or level 4 data key and decrypt the hierarchical encrypted data according to their permissions. If the command center determines the data is untrustworthy, it issues a key expiration command, the Beidou vehicle-mounted terminal deletes the locally available key fragment, marks the corresponding hierarchical encrypted data as controlled sealed data, and writes the key expiration time, task number data, task exposure level data, and controlled sealing result into the secure storage evidence chain.

[0070] This method encapsulates the data to be stored and operational constraint data into secure object capsules, ensuring that each piece of data to be encrypted carries task number data, BeiDou location data, electronic fence status data, satellite link status data, antenna attitude status data, terminal tamper protection status data, and driver authentication status data before entering the storage process. Compared to static classification based solely on file name or data type, this method can determine the actual operational environment in which the data was generated. For example, BeiDou location data, if it appears in a routine inspection task, can be classified as lower-level; if it appears simultaneously with temporary detour scheduling instructions, hazardous materials transportation tasks, and satellite link downtime records, it will be classified as higher-level. This improves the match between data classification results and actual leakage consequences.

[0071] This method calculates data hazard value, spatial exposure value, link observable value, terminal capture risk value, and task impact value to form task exposure score data. This score data is then combined with security runaway prediction data to correct the task exposure score data. This allows the system to not only identify currently occurring high-risk states but also to proactively identify risks of vehicles entering offline, boundary-crossing, or untrusted states. This approach avoids the problem of traditional encrypted storage systems passively adjusting permissions only after a risk has occurred. It can proactively increase data encryption levels and restrict local read permissions before satellite link failures, antenna attitude anomalies, or driver authentication anomalies escalate further.

[0072] This method determines task exposure level thresholds using historical safety object capsule data, providing a data source and statistical basis for classifying Level 1, 2, 3, and 4 data. The thresholds are not arbitrarily set based on experience, but rather determined by the corrected task exposure score distribution based on historical samples from normal operations, equipment status sensitivity, route identity sensitivity, and core task sensitivity. This allows the method to recalibrate thresholds using historical samples across different fleets, task types, and operating areas, improving the reproducibility and transferability of the data classification rules.

[0073] This method generates tiered key threshold data based on task exposure level data, ensuring that different levels of data correspond to different key fragmentation quantities, key fragment storage locations, and key recovery conditions. For Level 1 data, local reading by the vehicle terminal is allowed to ensure vehicle maintenance and operation; for Level 2 data, recovery requires the participation of both local key fragments and command center key fragments; for Level 3 data, recovery requires at least two of the following: vehicle security chip key fragments, command center key fragments, and task token key fragments; for Level 4 data, recovery requires at least three of the following: vehicle security chip key fragments, command center key fragments, satellite session key fragments, and location trusted receipt key fragments. Therefore, even if an attacker obtains the vehicle terminal's local storage chip, they cannot recover high-level tiered encrypted data using only local key fragments.

[0074] This method achieves differentiated storage of data with varying levels of sensitivity by writing hierarchical encrypted data into local encrypted areas, restricted index encrypted areas, trajectory encrypted areas, task encrypted areas, and delayed recovery encrypted areas. Particularly for continuous BeiDou location data and scheduling instruction data, this method partitions and stores trajectory encrypted data and task encrypted data, making it difficult for attackers to directly reconstruct the complete transportation route and scheduling intent by file order, time order, or storage location even if they obtain partial encrypted data. For Level 4 data, this method uses a delayed recovery encrypted area for storage, allowing only encrypted digests and undecryptable encrypted text to be written during vehicle offline periods, thus balancing offline record requirements with sensitive information protection needs.

[0075] This method dynamically adjusts local read access permissions based on operational constraint data and safety runaway prediction data. When abnormalities occur in geofence status data, satellite link status data, antenna attitude status data, terminal tamper protection status data, or driver authentication status data, the system does not simply stop data collection. Instead, it reduces read access permissions based on the task exposure level. For Level 1 data, necessary local maintenance read capabilities are retained; for Level 2 data, only digest querying and writing are allowed; for Level 3 data, only ciphertext digest generation is allowed; and for Level 4 data, it enters an undecryptable state. This solves the problem of continuously recording data while the vehicle is off-grid, without allowing the vehicle terminal to become a source of sensitive data leakage.

[0076] This method securely stores a chain of evidence, recording task number data, task exposure level data, partition location, ciphertext digest, local read permission data, and key status data. This allows the command center to determine whether there was any risk of data tampering, abnormal reading, or terminal disassembly during the off-network period after the vehicle regains trusted communication. If the securely stored chain of evidence is continuous and the operational constraint data is reliable, the command center returns a location-secured receipt key fragment and a task token key fragment, enabling the authorized terminal to recover the key and read the data. If the securely stored chain of evidence is broken or the terminal's anti-tamper status is abnormal, a key invalidation command is issued, and the corresponding hierarchical ciphertext data is marked as controlled sealed data. This mechanism improves the controllability of off-network data recovery and anomaly tracing.

[0077] In summary, this method does not simply increase the strength of the encryption algorithm, but rather, based on the actual operating scenarios of BeiDou vehicle-mounted terminals, it incorporates vehicle tasks, location exposure, satellite links, antenna attitude, terminal tamper protection, and driver authentication into the data classification, key splitting, ciphertext partitioning, permission adjustment, and evidence retention processes. This achieves dynamic hierarchical encrypted storage for vehicle-mounted information security systems. It can reduce the risk of data leakage for hazardous materials transport vehicles, emergency communication vehicles, and engineering vehicles in remote areas when operating off-network, with terminals seized, or in abnormal link conditions, and improve the security of sensitive data storage, recovery, and auditing.

[0078] Example 2: A hazardous chemical transport vehicle was performing a mission on a mountainous road. The Beidou vehicle-mounted terminal collected the data shown in Table 2 within 10 minutes: Table 2 set up =60, =600 seconds, =3, then the spatial exposure sub-values ​​are 100, 100, and 66.7 respectively. (According to...) =0.30、 =0.40、 Calculated at 0.30, the spatial exposure value is approximately 90. Since the safety capsule data simultaneously contains continuous BeiDou location data and temporary detour scheduling instruction data, the spatial exposure value remains at 90. The data hazard value of the temporary detour scheduling instruction is 90; the satellite link outage duration exceeds 180 seconds and the number of session failures is 3, resulting in a link observability value of 80; the combined risk of terminal takeover due to abnormal antenna attitude and driver authentication failure is 68; the hazardous materials transportation mission, coupled with the temporary detour instruction, results in a mission impact value of 90.

[0079] Substitute into the task exposure scoring formula: ; The task exposure score is approximately 84. If the safety runaway prediction model outputs Pk=0.76, then the corrected task exposure score is: ; in, =84, =76, =0.75, =0.25, calculated as follows =82. Because... If the value is ≥80, the secure object capsule data is classified as Level 4. A 4-out-of-3 tiered key threshold data is generated, and the corresponding tiered ciphertext data is written to the delayed recovery ciphertext area. If the vehicle continues to disconnect from the network, only writing and generating ciphertext digests are allowed; local decryption is not permitted. Once the vehicle regains trusted communication, the command center determines the trustworthiness of the disconnection period based on the secure storage evidence chain. Only then will it return the location trust receipt key fragment and the mission token key fragment; otherwise, key invalidation processing is performed.

[0080] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program code. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0081] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the protection scope of the present invention.

Claims

1. A method for hierarchical encrypted storage of data in an information security system, characterized in that, Includes the following steps: Step S1: The Beidou vehicle terminal collects data to be stored and operational constraint data, and encapsulates them into a safe object capsule data. The data to be stored includes Beidou location data, scheduling instruction data, driver identity data, cargo compartment status data, and satellite communication record data. The operational constraint data includes task number data, electronic fence status data, satellite link status data, antenna attitude status data, terminal anti-tamper status data, and driver authentication status data. Step S2: Calculate the task exposure level data based on the safety object capsule data; Step S3: Generate graded key threshold data based on task exposure level data; Step S4: Encrypt the data to be stored according to the hierarchical key threshold data, generate hierarchical ciphertext data and store it in partitions; Step S5: Adjust the local read permission data according to the running constraint data; Step S6: Perform key recovery or key expiration based on local read permission data, and generate a secure storage evidence chain; Step S2 includes the following sub-steps: Step S201: Analyze the security object capsule data and calculate the data hazard value, spatial exposure value, link observable value, terminal capture risk value, and mission impact value respectively; Step S202: The data hazard value, spatial exposure value, link observable value, terminal capture risk value, and task impact value are summed according to preset weights to obtain task exposure score data; Step S203: Output task exposure level data based on task exposure score data, wherein the task exposure level data includes level 1, level 2, level 3 and level 4; Step S3 includes the following sub-steps: Step S301: If the task exposure level data is level 1, then generate local key threshold data; Step S302: If the task exposure level data is level 2, then generate key threshold data in which both the local key fragment and the command center key fragment participate in the recovery. Step S303: If the task exposure level data is level 3, then generate at least two key threshold data from the vehicle security chip key fragment, the command center key fragment, and the task token key fragment to participate in the recovery. Step S304: If the mission exposure level data is level 4, then generate at least three key threshold data for recovery from the vehicle security chip key fragment, command center key fragment, satellite session key fragment, and location trusted receipt key fragment.

2. The data hierarchical encryption storage method for an information security system as described in claim 1, characterized in that, Step S1 includes the following sub-steps: Step S101: Obtain the data to be stored; Step S102: Obtain runtime constraint data; Step S103: Encapsulate the data to be stored and the running constraint data according to the same task number to generate the safety object capsule data.

3. The data hierarchical encryption storage method for an information security system as described in claim 1, characterized in that, The calculation logic for the spatial exposure value is as follows: If the data to be stored only includes a single device state, then the space exposure value is low; If the data to be stored includes continuous BeiDou location data, the spatial exposure value is calculated based on the number of samples, duration, and number of electronic fences passed through the continuous BeiDou location data. If the data to be stored includes both continuous BeiDou location data and scheduling command data, then the spatial exposure value should be increased.

4. The data hierarchical encryption storage method for an information security system as described in claim 1, characterized in that, The calculation logic for the link observable value and the terminal takeover risk value is as follows: Calculate link observables based on the number of retransmissions, disconnection duration, and session failures in the satellite link status data; The risk value of terminal hijacking is calculated based on antenna attitude status data, terminal anti-tamper status data, and driver authentication status data. When the terminal's anti-tamper status data is abnormal, the terminal's risk value is directly marked as high.

5. A data hierarchical encryption storage method for an information security system as described in claim 1, characterized in that, Step S4 includes the following sub-steps: Step S401: Generate a data key based on the hierarchical key threshold data, and use the data key to encrypt the data to be stored to generate hierarchical ciphertext data. Step S402: Write the Level 1 ciphertext data to the local ciphertext area, write the Level 2 ciphertext data to the restricted index ciphertext area, write the Level 3 ciphertext data to the trajectory ciphertext area and the task ciphertext area, and write the Level 4 ciphertext data to the delayed recovery ciphertext area. Step S403: Write the partition location, task number data, task exposure level data, and encrypted digest into the secure storage evidence chain.

6. A data hierarchical encryption storage method for an information security system as described in claim 1, characterized in that, Step S5 includes the following sub-steps: Step S501: Read the operation constraint data and determine whether the satellite link status data, antenna attitude status data, terminal anti-tamper status data, electronic fence status data and driver authentication status data are abnormal; Step S502: If all the running constraint data are normal, generate local read permission data that allows reading. Step S503: If any running constraint data is abnormal, the local read permission data is reduced according to the task exposure level data, so that the level 3 ciphertext data is in the state of generating only digests, and the level 4 ciphertext data is in the state of being undecryptable.

7. A data hierarchical encryption storage method for an information security system as described in claim 1, characterized in that, Step S6 includes the following sub-steps: Step S601: After the Beidou vehicle terminal restores reliable communication, it uploads the secure storage evidence chain to the command center. In step S602, the command center determines whether the data during the offline period is trustworthy based on the operational constraint data and ciphertext digest in the securely stored evidence chain. Step S603: If the location is deemed trustworthy, return the location trust receipt key fragment and the task token key fragment. If the key is deemed untrustworthy, a key invalidation command will be issued.

8. A data hierarchical encryption storage method for an information security system as described in claim 7, characterized in that, After receiving the key expiration command, the Beidou vehicle terminal deletes the locally available key fragment, marks the corresponding hierarchical encrypted data as controlled sealed data, and writes the key expiration time, task number data, task exposure level data, and controlled sealing result into the secure storage evidence chain.

Images