Mine large model multi-modal communication control method facing information security

Abstract

This invention relates to the field of information security technology, specifically to a multimodal communication control method for large-scale mining models oriented towards information security. The method includes the following steps: reading mine video stream data and gas sensor data to obtain a zero-knowledge proof of communication; uploading the zero-knowledge proof of communication to a control gateway to obtain the source-end communication authentication result; and extracting mine prediction text and on-site image data when the source-end communication authentication result indicates that the link is in a legitimate connection state. This invention verifies at the receiving end whether the preset attribute private key parameters of the receiving device satisfy the access structure of the attribute access control matrix. Only after satisfying the requirement is a policy matrix decryption and restoration key generated, thus forming a closed control link for ciphertext distribution, permission verification, key restoration, and plaintext extraction. This improves the source credibility, permission precision, ciphertext distribution controllability, and plaintext recovery security in the multimodal communication process of large-scale mining models.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a multimodal communication control method for large-scale mining models oriented towards information security. Background Technology

[0002] The multimodal communication control method for large-scale mining models involves information security communication, intelligent sensing data transmission, multimodal data collaborative processing, terminal identity authentication, access control, encrypted distribution, key restoration, and secure decoding in the mining production environment. It addresses the transmission process of multi-source data such as underground video, images, text, and sensor monitoring values ​​between the acquisition end, control gateway, and receiving end devices, solving problems such as difficulty in confirming the source of terminals in the mining field, easy spoofing of communication links, difficulty in distinguishing the permissions of different personnel, and the risk of leakage during multimodal data transmission.

[0003] In existing technologies for multi-source data transmission in mines, security control typically revolves around the data flow between the acquisition end, control gateway, and receiving end devices. However, in practice, underground video, images, text, and sensor monitoring values ​​are easily transmitted as ordinary communication loads. There is a lack of strong binding verification between the acquisition end's identity and the data source, and it is difficult to establish continuous and reliable credentials between the terminal serial number, acquisition time, and link status. This increases the risk of forged terminals uploading abnormal gas sensor values ​​or forged video streams entering the control gateway. Furthermore, if access control relies primarily on account identity or fixed roles, it is difficult to simultaneously reflect the mine personnel's department number, level code, and underground location. The constraints on data combination can lead to issues such as overly broad or narrow permissions for dispatchers, inspectors, and safety managers when accessing the same predicted text or field image in different underground areas. Furthermore, if ciphertext distribution and key recovery lack a tight connection with the access structure, loose correspondences can easily form between the receiving device's identity, attribute private key, and ciphertext payload, resulting in unauthorized interpretation risks even after the ciphertext packet is forwarded. Additionally, the lack of ciphertext packet distribution records and receiver verification processes during multimodal data routing makes it difficult to trace which receiving device received which ciphertext payload, increasing the cost of locating leaks or mistransmissions. Therefore, improvements are needed. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies and propose a multimodal communication control method for large-scale mining models oriented towards information security.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: a multimodal communication control method for large-scale mining models oriented towards information security, comprising the following steps:

[0006] Read the mine video stream data and gas sensor data to obtain a communication zero-knowledge certificate; upload the communication zero-knowledge certificate to the control gateway to obtain the source communication authentication result;

[0007] When the source communication authentication result indicates that the link is in a legal connection state, mine prediction text and on-site image data are extracted and mapped to generate an attribute access control matrix; a random master secret value is selected in a finite domain and a secret sharing column vector is constructed; the attribute access control matrix and the secret sharing column vector are operated on to obtain the encryption distribution strategy component.

[0008] An elliptic curve group is introduced to construct a bilinear mapping function for group elements. The encryption distribution strategy component is substituted into the bilinear mapping function to calculate the pairing exponent and generate a session key. The session key is used to symmetrically encrypt the mine prediction text and on-site image data to obtain a modal data ciphertext packet. The communication routing forwarding rule table entry in the control gateway is read, and the modal data ciphertext packet is concatenated with the identity identifier of the receiving device to generate a ciphertext packet distribution record.

[0009] Extract the modal data ciphertext packet and the preset attribute private key parameter of the receiving device carried in the ciphertext packet distribution record, verify whether the preset attribute private key parameter of the receiving device satisfies the access structure of the attribute access control matrix, if it does, obtain the policy matrix decryption and restoration key; use the policy matrix decryption and restoration key to perform symmetric decoding and mapping on the ciphertext payload of the modal data ciphertext packet to obtain the multimodal secure plaintext payload.

[0010] Preferably, the step of obtaining the source-end communication authentication result is as follows:

[0011] Read the mine video stream data and gas sensor data, extract the generation timestamp of the mine video stream data according to the data frame header field, extract the terminal serial number of the gas sensor data according to the sensor message identifier field, arrange the generation timestamps in the order of acquisition, and merge the terminal serial numbers according to the terminal source to obtain the generation timestamp and terminal serial number.

[0012] The terminal private key corresponding to the terminal serial number is invoked, and a random blinding factor is generated according to the character position of the terminal private key. The terminal private key is set as the witness parameter, the generated timestamp is used as the timing constraint parameter, and the random blinding factor is used as the hidden perturbation parameter. The commitment value is concatenated and the response value is encapsulated on the witness parameter, the timing constraint parameter and the hidden perturbation parameter to obtain the zero-knowledge proof of communication.

[0013] The communication zero-knowledge proof is uploaded to the control gateway. The control gateway reads the system common generator and the preset terminal public key corresponding to the terminal serial number. A left-right balance judgment relationship is established according to the system common generator, the preset terminal public key, the commitment value in the communication zero-knowledge proof, and the response value in the communication zero-knowledge proof. The consistency of the pairing results on both sides of the left-right balance judgment relationship is judged to obtain the source end communication authentication result.

[0014] Preferably, the step of obtaining the attribute access control matrix is ​​as follows:

[0015] Read the link status identifier in the source communication identification result, determine whether the link status identifier corresponds to a valid connection status. If the link status identifier corresponds to a valid connection status, extract the mine prediction text from the mine large model output cache, extract the field image data from the field acquisition cache, collect the mine personnel department number, level code and underground location data, and merge the fields according to the same mine personnel identity identifier to obtain the mine prediction text, field image data and personnel attribute set.

[0016] The text load identifier of the mine prediction text is retained, the image load identifier of the field image data is retained, the mine personnel department number, level code, and underground location data in the personnel attribute set are read, the attribute nodes are arranged according to the access row corresponding to the department number, the permission column corresponding to the level code, and the area constraint bit corresponding to the underground location data, a linear secret shared access structure is established, and the attribute nodes are mapped to matrix row and column values ​​one by one to generate an attribute access control matrix.

[0017] Preferably, the step of obtaining the encrypted distribution strategy component is as follows:

[0018] Within a finite domain, a random master secret value is selected. A secret-sharing column vector is constructed with the random master secret value at the first position of the column vector and random filler values ​​in the remaining columns. Each row of the access vector in the attribute access control matrix is ​​sequentially operated on with the secret-sharing column vector to calculate the secret share parameter of each attribute node. Group generator variables are assigned to the secret share parameters according to the row number of each attribute node. The secret share parameters, group generator variables, and the correspondence between attribute nodes are encapsulated to obtain the encrypted distribution strategy component.

[0019] Preferably, the step of obtaining the modal data encrypted packet is as follows:

[0020] An elliptic curve group is introduced. The secret share parameter, group generator variable, and attribute node correspondence in the encryption distribution strategy component are read. The group generator variable is written into the pairing input bit of the elliptic curve group according to the attribute node correspondence. The secret share parameter is used as the exponential control quantity. The pairing result of each attribute node is exponentially synthesized. The exponential synthesis result is XORed with the hash operation value to generate the session key.

[0021] Read the text load field of the mine prediction text, read the image load field of the field image data, and concatenate the loads in the order of text load field first, image load field second, and load boundary identifier in the center. Use the session key to encrypt the load concatenation result in segments, and encapsulate each encrypted segment in the original segment order to obtain the modal data ciphertext package.

[0022] Preferably, the step of obtaining the encrypted packet distribution record is as follows:

[0023] Read the communication routing and forwarding rule entries in the control gateway, extract the identity identifier of the receiving device, concatenate the modal data encrypted packet with the identity identifier of the receiving device, match the path port identifier in the communication routing and forwarding rule entries according to the identity identifier of the receiving device, deliver the concatenated result to the path port corresponding to the path port identifier to perform the action, and generate an encrypted packet delivery record.

[0024] Preferably, the step of obtaining the decryption and restoration key of the strategy matrix is ​​as follows:

[0025] The distribution identifier field, receiver device identity identifier field, ciphertext payload field, and attribute private key field in the ciphertext packet distribution record are parsed. The ciphertext payload field is restored to the modal data ciphertext packet, and the attribute private key field is restored to the receiver device's preset attribute private key parameter, thus obtaining the modal data ciphertext packet and the receiver device's preset attribute private key parameter.

[0026] Based on the pre-set attribute private key parameters of the receiving device, the access row identifier, permission column identifier, and attribute node identifier in the attribute access control matrix are read. The pre-set attribute private key parameters of the receiving device are matched item by item with the attribute node identifiers. If the matched attribute node covers the necessary node corresponding to the access row identifier, the linear recovery coefficient is calculated. Using the linear recovery coefficient and the pre-set attribute private key parameters of the receiving device, a bilinear pairing operation is performed on the corresponding group generator variable in the modal data ciphertext packet to restore the secret shared master secret value, restore the session key, and obtain the policy matrix decryption and restoration key.

[0027] Preferably, the step of obtaining the multimodal secure plaintext payload is as follows:

[0028] Based on the decryption and restoration key of the strategy matrix, the ciphertext payload field, payload boundary identifier, and payload order identifier in the modal data ciphertext packet are read. Symmetric decoding is performed on the ciphertext payload field according to the payload order identifier. The text payload segment and image payload segment are divided according to the payload boundary identifier. The text payload segment is mapped to mine prediction text, and the image payload segment is mapped to on-site image data to obtain the multimodal security plaintext payload.

[0029] Compared with the prior art, the advantages and positive effects of the present invention are as follows:

[0030] This invention generates zero-knowledge proofs for communication by reading mine video stream data and gas sensor data, and forms source-end communication authentication results within the control gateway. This ensures consistency verification of the acquisition terminal's identity, data source, and link status before transmission, reducing the risk of data contamination caused by forged terminal access and abnormal link transmission. Only when the source-end communication authentication result indicates a legitimate connection status is the mine prediction text and on-site image data extracted. Furthermore, the mine personnel's department number, level code, and underground location data are mapped to an attribute access control matrix, transforming data access boundaries from single-identity judgment to multi-attribute constraints, improving the accuracy of permission differentiation between different positions, levels, and underground locations. Finally, an encryption distribution strategy component is generated using a random master secret value, a secret-sharing column vector, and the attribute access control matrix, binding the key distribution process to the access structure. This reduces the impact of single-point key leakage on overall data security. Session keys are generated by pairing exponential terms and hash values, and symmetric encryption is applied to mine prediction text and on-site image data. This allows text and image payloads to form modal data ciphertext packets under unified session constraints, improving confidentiality in multimodal payload transmission. A traceable delivery process is established through communication routing forwarding rule entries, receiver device identification, and ciphertext packet delivery records. At the receiver, it is verified whether the receiver device's pre-set attribute private key parameters satisfy the access structure of the attribute access control matrix. Only after satisfaction is a policy matrix decryption and restoration key generated. This ensures a closed control link for ciphertext delivery, permission verification, key restoration, and plaintext extraction, thereby improving the source credibility, permission precision, ciphertext distribution controllability, and plaintext recovery security in the multimodal communication process of large-scale mine models. Attached Figure Description

[0031] Figure 1 This is a schematic diagram of the steps of the present invention;

[0032] Figure 2 The distribution diagram of timing constraint parameters and system time difference in the step of obtaining source-end communication authentication results;

[0033] Figure 3 This is a graph showing the distribution of segmented encryption efficiency and segmented symmetric decoding time for modal data ciphertext packets. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0035] Please see Figure 1-3 This invention provides a technical solution: a multimodal communication control method for large-scale mining models oriented towards information security, comprising the following steps:

[0036] Read the mine video stream data and gas sensor data to obtain the zero-knowledge certificate for communication; upload the zero-knowledge certificate for communication to the control gateway to obtain the source communication authentication result;

[0037] When the source communication authentication result indicates that the link is in a legal connection state, mine prediction text and on-site image data are extracted and mapped to generate an attribute access control matrix; a random master secret value is selected in a finite domain and a secret sharing column vector is constructed. The attribute access control matrix and the secret sharing column vector are operated on to obtain the encryption distribution strategy component.

[0038] Elliptic curve groups are introduced to construct a bilinear mapping function for group elements. The encryption distribution strategy component is substituted into the bilinear mapping function to calculate the pairing exponent and generate a session key. The session key is used to symmetrically encrypt the mine prediction text and on-site image data to obtain the modal data ciphertext packet. The communication routing forwarding rule table entries in the control gateway are read, and the modal data ciphertext packet is concatenated with the identity identifier of the receiving device to generate the ciphertext packet distribution record.

[0039] Extract the modal data ciphertext packet and the pre-set attribute private key parameter of the receiving device carried in the ciphertext packet distribution record. Verify whether the pre-set attribute private key parameter of the receiving device satisfies the access structure of the attribute access control matrix. If it does, obtain the policy matrix decryption and restoration key. Use the policy matrix decryption and restoration key to perform symmetric decoding and mapping on the ciphertext payload of the modal data ciphertext packet to obtain the multimodal secure plaintext payload.

[0040] The steps for obtaining the source-end communication authentication result are as follows:

[0041] Read the mine video stream data and gas sensor data, extract the generation timestamp of the mine video stream data according to the data frame header field, extract the terminal serial number of the gas sensor data according to the sensor message identifier field, arrange the generation timestamps in the order of acquisition, and merge the terminal serial numbers according to the terminal source to obtain the generation timestamp and terminal serial number.

[0042] The terminal private key corresponding to the terminal serial number is invoked, and a random blinding factor is generated according to the character position of the terminal private key. The terminal private key is set as the witness parameter, the generated timestamp is used as the timing constraint parameter, and the random blinding factor is used as the hidden perturbation parameter. The commitment value is concatenated and the response value is encapsulated on the witness parameter, the timing constraint parameter and the hidden perturbation parameter to obtain the zero-knowledge proof of communication.

[0043] The communication zero-knowledge proof is uploaded to the control gateway. The control gateway reads the system common generator and the preset terminal public key corresponding to the terminal serial number. A left-right balance judgment relationship is established according to the system common generator, the preset terminal public key, the commitment value in the communication zero-knowledge proof, and the response value in the communication zero-knowledge proof. The consistency judgment is performed on the pairing results of the two sides of the left-right balance judgment relationship to obtain the source end communication authentication result.

[0044] Specifically, it reads mine video stream data and gas sensor data. Specifically, it subscribes to video stream data from designated cameras via Real-time Transport Protocol (RTSP) and subscribes to gas sensor topics using Message Queuing Telemetry Transport (MQTT) protocol to receive sensor data. For the received H.264 video stream data, it parses the MP4 container format, locates the "mvhd" (Movie Header Box) or "tkhd" (Track Header Box) field, and extracts the 64-bit generation timestamp. This timestamp is in seconds calculated in Coordinated Universal Time (UTC) from midnight on January 1, 1904. For the received JSON format sensor messages, such as {"deviceId": "GAS-001-A-F01", "value": 1.2, "unit": "%", "timestamp":} The process starts by parsing the "deviceId" field of the device number 1677628800 to obtain the terminal serial number "GAS-001-A-F01". Then, it gathers all extracted video generation timestamps and sensor message timestamps into a list and sorts the list in ascending order to ensure the temporal continuity of events. Simultaneously, from all parsed terminal serial numbers, according to preset naming rules (e.g., "GAS" represents gas, "001" represents device number, "A" represents area, and "F01" represents floor or specific location), it extracts the area and location information representing the terminal's origin. Based on this source information, terminal serial numbers with the same origin are aggregated into the same set. For example, all serial numbers originating from "Area A Main Lane" such as "GAS-001-A-M01" and "GAS-002-A-M01" are merged together, ultimately forming a timestamp sequence sorted by time and a set of terminal serial numbers categorized by physical origin, thus obtaining the generation timestamp and terminal serial number.

[0045] The process involves retrieving the terminal private key corresponding to the terminal serial number. This private key is pre-stored in the device's Secure Element (SE) and accessed through the hardware security module interface. A random blinding factor is generated based on the character order of the terminal private key. Specifically, the process involves: retrieving the byte string representation of the terminal private key (a 256-bit integer), reversing its byte order, and then appending a nanosecond-level timestamp of the current time as the nonce. The SHA-256 hash algorithm is then used to calculate a 256-bit hash value as the random blinding factor. This process ensures that even with the same private key, the generated blinding factor is different each time. The obtained terminal private key is then set as the witness parameter. The generation timestamp obtained from the previous step and associated with the current terminal operation will be used as the timing constraint parameter. The newly generated random blinding factor is used as a hidden perturbation parameter. Then, the commitment value is concatenated and the response value is encapsulated. First, based on the secp256k1 curve of elliptic curve cryptography (ECC), a common base point is selected. Calculate the commitment value This is a point on an elliptic curve; then, a challenge value is calculated. Its calculation method is based on the commitment value. coordinates and timing constraint parameters After concatenating with publicly available device information (such as the terminal serial number), the result is calculated again using the SHA-256 hash algorithm. Next, the response value is calculated. ,in Based on Finally, the commitment value will be determined. Response value and timing constraint parameters They are encapsulated together into a data structure to obtain a zero-knowledge proof for communication.

[0046] The zero-knowledge certificate for communication is uploaded to the control gateway, which then parses the certificate to extract the commitment value. Response value and timing constraint parameters Simultaneously, a preset timeliness verification threshold is read. This threshold is set based on statistical data of average network latency and terminal processing time. For example, if the average latency is 100 milliseconds and the processing time is 50 milliseconds, a threshold considering clock skew can be set to 200 milliseconds, thus incorporating the timing constraint parameters in the verification document. The system time is compared with the gateway's current system time. If the absolute value of the difference exceeds the validity verification threshold, it is considered a replay attack and the communication is rejected. If it is within the validity period, the corresponding pre-set terminal public key is retrieved from the gateway's built-in Public Key Infrastructure (PKI) database based on the terminal identity identifier implicit in the certificate (or the terminal serial number uploaded along with it). The public key satisfies The relationship, among which For the terminal private key, The system uses common generators (i.e., base points of elliptic curves). Then, the control gateway uses the exact same hash algorithm and concatenation order as the terminal, utilizing the received commitment value. Timing constraint parameters and the queried terminal public key Recalculate the challenge value Then, a left-right balance determination relationship is established for verification. The specific verification equation is as follows: The left side of the equation is used to calculate the response value. With base point Scalar multiplication, calculating the newly generated challenge value on the right side of the equation. With terminal public key Multiply by the scalar, then combine the result with the commitment value. Perform point addition operations and check the consistency of coordinates between the calculation results on the left and right sides (both are points on the elliptic curve). If the coordinates of the two points are exactly the same, the identification is successful, and a source communication identification result indicating that the link is in a legal connection state is generated.

[0047] The steps to obtain the attribute access control matrix are as follows:

[0048] Read the link status identifier in the source communication authentication result, determine whether the link status identifier corresponds to a valid connection status. If the link status identifier corresponds to a valid connection status, extract the mine prediction text from the mine large model output cache, extract the field image data from the field acquisition cache, collect the mine personnel department number, level code and underground location data, and merge the fields according to the identity identifier of the same mine personnel to obtain the mine prediction text, field image data and personnel attribute set.

[0049] The text load identifier of the mine prediction text is retained, and the image load identifier of the field image data is retained. The mine personnel department number, level code, and underground location data in the personnel attribute set are read. The attribute nodes are arranged according to the access row corresponding to the department number, the permission column corresponding to the level code, and the area constraint bit corresponding to the underground location data. A linear secret shared access structure is established, and the attribute nodes are mapped to matrix row and column values ​​one by one to generate an attribute access control matrix.

[0050] Specifically, the link status identifier in the source communication authentication result is read to determine if it is a preset valid status code. For example, "0x00" represents success and "0x01" represents failure. If the link status identifier is "0x00", the mine prediction text is extracted from the mine large model output cache. This cache is a first-in-first-out (FIFO) queue. Using the unique transaction ID associated with the current session as the key, a JSON object is extracted, containing mine prediction text such as {"prediction_id": "PRED-123", "text": "It is predicted that the roof pressure is abnormal 30 meters ahead, and there is a risk of roof collapse"}. At the same time, the field image data associated with the transaction ID is extracted from the field acquisition cache. This data is a JPEG format byte stream and is marked with a universally unique identifier (UUID). Then, based on the identity identifier of the mine personnel who triggered the prediction event, such as employee number "EMP7854", a query is initiated to the personnel information management database (such as a MySQL database), executing SELECT department_id, level_code, location_data FROM personnel_info WHERE employee_id = The operation *EMP7854* retrieves the personnel's department number "DEPT-COAL-01", level code "LVL-4", and real-time underground location data "ZONE-A-TUNNEL-03". It then merges the extracted mine prediction text, on-site image data, and queried personnel attributes (department number, level code, and underground location data) into a single data structure, such as a composite JSON object containing all the information, resulting in the mine prediction text, on-site image data, and personnel attribute set.

[0051] Preserving the text payload identifier (e.g., "PRED-123") of the mine prediction text and the image payload identifier (e.g., its UUID) of the field image data, the mine personnel department number "DEPT-COAL-01", level code "LVL-4", and underground location data "ZONE-A-TUNNEL-03" from the personnel attribute set are read. Based on a predefined access policy, such as "(department is DEPT-COAL-01 and level is greater than or equal to LVL-3) or (level is LVL-5)", an access structure for the Linear Secret Sharing Scheme (LSSS) is established. This access structure is mapped to a... matrix ,in It refers to the number of attributes involved in the strategy. This represents the maximum number of columns required to implement the logic. The specific mapping process is as follows: The OR gate is placed on the left side of the matrix by copying the vector of the first column; the AND gate is expressed in subsequent columns through a chained relationship. For the example above, an attribute mapping function can be defined. Associate the rows of the matrix with specific attributes, such as , , , ,matrix The structure is as follows:

[0052] ;

[0053] In this matrix, the first and second / third rows represent a threshold gate (level LVL-3 or higher) by sharing the second column and having opposite coefficients (1 and -1). They also implement an AND operation with the first row by sharing the first column (both are 1). The fourth row represents an independent OR branch, with its first column set to 1 and the rest to 0. Each element (0, 1, -1) and the mapping between rows and attributes (e.g.) The function records the data and generates an attribute access control matrix.

[0054] The steps to obtain the encrypted distribution strategy component are as follows:

[0055] Within a finite domain, a random master secret value is selected. A secret-sharing column vector is constructed with the random master secret value at the first position and random filler values ​​in the remaining columns. Each row of the access vector in the attribute access control matrix is ​​sequentially operated on with the secret-sharing column vector to calculate the secret share parameter of each attribute node. Group generator variables are assigned to the secret share parameters according to the row number of each attribute node. The secret share parameters, group generator variables, and the correspondence between attribute nodes are encapsulated to obtain the encrypted distribution strategy component.

[0056] Specifically, in a finite field Select a random master secret value prime numbers The bit length matches the order of the elliptic curve group (e.g., 256 bits), and this selection process is accomplished by calling a cryptographically secure pseudorandom number generator (CSPRNG) according to the number of columns in the attribute access control matrix. (in the previous example) ), construct a Secret shared column vector Its construction method is to use a random master secret value Place it at the beginning of the vector and generate it using CSPRNG. Random fill value Fill the remaining columns, i.e. Attribute access control matrix Each row of access vectors ( From 1 to ) sequentially share column vectors with the secret Perform a dot product operation to calculate the secret share parameter corresponding to each attribute node. For example, for the aforementioned matrix The first line has a secret share parameter of: Next, each secret share parameter is assigned according to its row number. Assign a unique group generator variable These group generator variables are pre-defined from a bilinear group. Selected, publicly available, linearly independent elements, such as Finally, all the calculated secret share parameters will be... The corresponding group generator variables and the original attribute node correspondence Encapsulate it into a structured list to obtain the encrypted distribution strategy component.

[0057] The steps to obtain the modal data encrypted packet are as follows:

[0058] Elliptic curve group is introduced. The secret share parameter, group generator variable, and attribute node correspondence in the encryption distribution strategy component are read. The group generator variable is written into the pairing input bit of the elliptic curve group according to the attribute node correspondence. The secret share parameter is used as the exponential control quantity. The pairing result of each attribute node is exponentially synthesized. The exponential synthesis result is XORed with the hash operation value to generate the session key.

[0059] Read the text payload field of the mine prediction text and the image payload field of the field image data. Perform payload concatenation in the order of text payload field first, image payload field second, and payload boundary identifier in the center. Use the session key to encrypt the payload concatenation result in segments. Encapsulate each encrypted segment in the original segment order to obtain the modal data ciphertext package.

[0060] Specifically, an elliptic curve group is introduced, specifically a BN curve that supports bilinear pairing, such as BN-256, which defines two cyclic groups. , and a target cyclic group and a bilinear mapping Read each element in the encrypted distribution strategy component, i.e., {share: generator: attribute: The set of} will generate metavariables for each group. As the first input to the pairing function, and using a... Publicly available, fixed generators As the second input, forming a paired input bit. The corresponding secret share parameter As an exponential control variable, the pairing result of each attribute node is calculated and exponentially synthesized to obtain an intermediate ciphertext component. Simultaneously calculate another intermediate ciphertext component. ,in It is the random master secret value selected in the previous step, followed by the calculation of an intermediate value encapsulated in a key. , here yes The two public base points in the value Hash operations are performed using KDF2 (key derivation function), i.e. This yields a hash value with the same length as the target symmetric key. The result of the exponent synthesis is the target group element. , and this hash value Perform an XOR fusion operation, specifically by... Serialize to a byte string, then... Perform a bitwise XOR operation to generate the final 256-bit session key.

[0061] Read the text payload field of the mine prediction text, such as "Abnormal roof pressure is expected 30 meters ahead, posing a risk of roof collapse," and encode it into a UTF-8 byte string. Read the image payload field of the on-site image data, i.e., the raw byte stream in JPEG format, and define a special 16-byte payload boundary identifier, such as "0xDEADBEEFCAFEBABE". Concatenate these three parts into a single plaintext payload byte array, following the order of text payload field first, image payload field second, and payload boundary identifier centered. Using the 256-bit session key generated in the previous step, select AES-256. -GCM, as a symmetric encryption algorithm, encrypts the concatenated plaintext payload in segments. The segment size is set to a fixed value, such as 1024 bytes. For each 1024-byte plaintext segment, a unique 96-bit random number (nonce) is generated as the initialization vector for the GCM mode. The segment is then encrypted using the session key to generate a ciphertext segment and an authentication tag. The encrypted result of each segment, including its corresponding nonce, ciphertext segment, and authentication tag, is encapsulated according to the segment order of the original plaintext. The encapsulation format can be a JSON array, where each element contains {"nonce": "...", "ciphertext":"...", "tag": "..."}. A version number and an encryption algorithm identifier are added to the outermost layer, ultimately forming a complete, structured data packet, thus obtaining the modal data ciphertext packet.

[0062] The steps to obtain the encrypted packet distribution record are as follows:

[0063] Read the communication routing and forwarding rule entries in the control gateway, extract the identity identifier of the receiving device, concatenate the modal data encrypted packet with the identity identifier of the receiving device, match the path port identifier in the communication routing and forwarding rule entries according to the identity identifier of the receiving device, deliver the concatenated result to the path port corresponding to the path port identifier to perform the action, and generate an encrypted packet delivery record.

[0064] Specifically, the system reads the communication routing and forwarding rule entries stored in memory (e.g., using Redis) in the control gateway. Each entry is a key-value pair collection, where the key is the receiver device identifier and the value is a JSON object containing the path identifier and the action to be performed, such as {"DEV-MGR-01": {"path_id": "eth1", "action": "forward"}}. The system iterates through these entries, extracting all receiver device identifiers that match the current policy, such as "DEV-MGR-01" and "DEV-CTRL-02". For each selected receiver device identifier, the system concatenates the encrypted modal data packet obtained in the previous step with its fields. Specifically, this is implemented by creating a new JSON object containing {"recipient_id": "DEV-MGR-01", "payload":}. The "<modal data encrypted packet>"} structure is used, where the payload field is the Base64 encoded string of the entire modal data encrypted packet. Then, using the receiver device identifier "DEV-MGR-01" from the concatenation result as the key, the communication routing forwarding rule table entry is queried again to match and obtain the corresponding path port identifier "eth1" and the execution action "forward". Based on the execution action "forward", the concatenation result of this field is used as the payload of a data frame and encapsulated into an Ethernet frame. Its destination MAC address is set to the MAC address of the next-hop network device connected to the path port "eth1". Then, the Ethernet frame is sent from the physical port "eth1". This process is repeated for each target receiving device to generate a series of encrypted packet transmission records. These records are written to a temporary log file, which contains transmission timestamps, receiver device identifiers, transmission status and other information.

[0065] The steps to obtain the strategy matrix decryption and restoration key are as follows:

[0066] Parse the distribution identifier field, receiver device identity identifier field, ciphertext payload field, and attribute private key field in the ciphertext packet distribution record. Restore the ciphertext payload field to the modal data ciphertext packet and restore the attribute private key field to the receiver device's preset attribute private key parameter to obtain the modal data ciphertext packet and the receiver device's preset attribute private key parameter.

[0067] Based on the pre-set attribute private key parameters of the receiving device, the access row identifier, permission column identifier, and attribute node identifier in the attribute access control matrix are read. The pre-set attribute private key parameters of the receiving device are matched item by item with the attribute node identifiers. If the matched attribute node covers the necessary node corresponding to the access row identifier, the linear recovery coefficient is calculated. Using the linear recovery coefficient and the pre-set attribute private key parameters of the receiving device, a bilinear pairing operation is performed on the corresponding group generator variable in the modal data ciphertext packet to restore the secret shared master secret value, restore the session key, and obtain the policy matrix decryption and restoration key.

[0068] Specifically, the JSON structure in the encrypted packet delivery record is parsed, the "payload" field is extracted and Base64 decoded to obtain the original modal data encrypted packet. Simultaneously, from the secure storage area on the receiving device's local machine (e.g., the Trusted Platform Module, TPM), a pre-configured set of attribute private key parameters associated with the device is read by inputting the device identity and access authorization token. This set is a structure containing multiple private key components, such as [{"attribute": "DEPT-COAL-01", "key": "sk1"}, {"attribute": "LVL-4", "key": "sk2"}], where each private key component corresponds to a user attribute. The decoded encrypted payload field is restored to the modal data encrypted packet, and the read attribute private key set is restored to the receiving device's preset attribute private key parameters, thus obtaining the modal data encrypted packet and the receiving device's preset attribute private key parameters.

[0069] Based on the attribute list contained in the pre-set attribute private key parameter of the receiving device, such as "DEPT-COAL-01" and "LVL-4", the attribute access control matrix contained in the header of the modal data ciphertext packet is read. and attribute mapping functions From the matrix The rows that correspond to the attributes held by the receiving end are selected from the matrix to form a submatrix. And determine this submatrix Can the row vectors be linearly combined into a vector? This process is equivalent to solving for whether a set of linear restitution coefficients exists. , making ,in It is the set of row indices corresponding to the attributes possessed by the receiving end. If such coefficients exist (i.e., covering the necessary nodes corresponding to the accessed row identifiers), then Gaussian elimination is used to calculate this set of coefficients. For example, regarding the access strategy in the previous example, if the receiver possesses attributes "DEPT-COAL-01" and "LVL-4", then its attribute row indices are 1 and 3, which can be calculated. ,satisfy It cannot be recovered, but if you have "LVL-5", then... It can be recovered using the calculated linear recovery coefficient. And the corresponding private key component in the preset attribute private key parameter of the receiving device, for the corresponding intermediate ciphertext component in the modal data ciphertext packet. Perform bilinear pairing operation, specifically calculate as follows: ,in It is the private key of the corresponding attribute at the receiving end, and this calculation result will be equal to This means restoring the shared master secret value and then recalculating it using the previous KDF2 function and the published base point. The recovered and Perform an XOR operation to recover the session key, which is the decryption key for the policy matrix.

[0070] The steps for obtaining a multimodal secure plaintext payload are as follows:

[0071] Based on the strategy matrix decryption and restoration key, the encrypted payload field, payload boundary identifier, and payload order identifier in the modal data encrypted packet are read. Symmetric decoding is performed on the encrypted payload field according to the payload order identifier. The text payload segment and image payload segment are divided according to the payload boundary identifier. The text payload segment is mapped to mine prediction text, and the image payload segment is mapped to on-site image data to obtain multimodal security plaintext payload.

[0072] Specifically, based on the policy matrix decryption key (i.e., the recovered session key), the JSON structure of the modal data ciphertext packet is parsed, its payload order identifier (e.g., version number and encryption algorithm identifier) ​​is read, and the location of the encrypted data in the JSON array is identified. Following the original order of elements in the array, the nonce, ciphertext payload field, and authentication tag of each encrypted segment are extracted one by one. For each segment, the AES-256-GCM decryption algorithm is used, taking the policy matrix decryption key, nonce, ciphertext payload field, and authentication tag as input, to perform the decryption operation. If the authentication tag verification passes, the plaintext of that segment is obtained; if the authentication tag verification of any segment fails, then... Immediately terminate the decryption process and report the error. Concatenate all successfully decrypted plaintext segments in their original order to form a complete plaintext payload byte array. Search for the predefined 16-byte payload boundary identifier "0xDEADBEEFCAFEBABE" in this array. Based on the position of this identifier, divide the plaintext payload byte array into two parts: the part before the identifier is the text payload segment, and the part after the identifier is the image payload segment. Decode the text payload segment using UTF-8 and map it back to the original mine prediction text string. Map the image payload segment directly as a JPEG format binary data stream to the field image data to obtain the multimodal secure plaintext payload.

[0073] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments that can be applied to other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A multimodal communication control method for large-scale mine models oriented towards information security, characterized in that, Includes the following steps: Read mine video stream data and gas sensor data to obtain zero-knowledge proof of communication. Upload the zero-knowledge proof of communication to the control gateway to obtain the source communication authentication result; When the source communication authentication result indicates that the link is in a legal connection state, mine prediction text and on-site image data are extracted and mapped to generate an attribute access control matrix; a random master secret value is selected in a finite domain and a secret sharing column vector is constructed; the attribute access control matrix and the secret sharing column vector are operated on to obtain the encryption distribution strategy component. An elliptic curve group is introduced to construct a bilinear mapping function for group elements. The encryption distribution strategy component is substituted into the bilinear mapping function for group elements to calculate the pairing exponent and generate a session key. The session key is used to symmetrically encrypt the mine prediction text and on-site image data to obtain a modal data ciphertext packet. Read the communication routing forwarding rule entry in the control gateway, concatenate the modal data ciphertext packet with the identity identifier of the receiving device, and generate a ciphertext packet distribution record; Extract the modal data ciphertext packet and the preset attribute private key parameter of the receiving device carried in the ciphertext packet distribution record, verify whether the preset attribute private key parameter of the receiving device satisfies the access structure of the attribute access control matrix, and if it does, obtain the policy matrix decryption and restoration key. The encrypted payload of the modal data ciphertext packet is symmetrically decoded and mapped using the decryption key of the policy matrix to obtain the multimodal secure plaintext payload. 2.The information security-oriented mine large model multi-modal communication control method according to claim 1, characterized in that, The steps for obtaining the source-end communication authentication result are as follows: Read the mine video stream data and gas sensor data, extract the generation timestamp of the mine video stream data according to the data frame header field, extract the terminal serial number of the gas sensor data according to the sensor message identifier field, arrange the generation timestamps in the order of acquisition, and merge the terminal serial numbers according to the terminal source to obtain the generation timestamp and terminal serial number. The terminal private key corresponding to the terminal serial number is invoked, and a random blinding factor is generated according to the character position of the terminal private key. The terminal private key is set as the witness parameter, the generated timestamp is used as the timing constraint parameter, and the random blinding factor is used as the hidden perturbation parameter. The commitment value is concatenated and the response value is encapsulated on the witness parameter, the timing constraint parameter and the hidden perturbation parameter to obtain the zero-knowledge proof of communication. The communication zero-knowledge proof is uploaded to the control gateway. The control gateway reads the system common generator and the preset terminal public key corresponding to the terminal serial number. A left-right balance judgment relationship is established according to the system common generator, the preset terminal public key, the commitment value in the communication zero-knowledge proof, and the response value in the communication zero-knowledge proof. The consistency of the pairing results on both sides of the left-right balance judgment relationship is judged to obtain the source end communication authentication result. 3.The information security-oriented mine large model multi-modal communication control method according to claim 1, characterized in that, The steps for obtaining the attribute access control matrix are as follows: Read the link status identifier in the source communication identification result, determine whether the link status identifier corresponds to a valid connection status. If the link status identifier corresponds to a valid connection status, extract the mine prediction text from the mine large model output cache, extract the field image data from the field acquisition cache, collect the mine personnel department number, level code and underground location data, and merge the fields according to the same mine personnel identity identifier to obtain the mine prediction text, field image data and personnel attribute set. The text load identifier of the mine prediction text is retained, the image load identifier of the field image data is retained, the mine personnel department number, level code, and underground location data in the personnel attribute set are read, the attribute nodes are arranged according to the access row corresponding to the department number, the permission column corresponding to the level code, and the area constraint bit corresponding to the underground location data, a linear secret shared access structure is established, and the attribute nodes are mapped to matrix row and column values ​​one by one to generate an attribute access control matrix. 4.The information security-oriented mine large model multi-modal communication control method according to claim 1, characterized in that, The steps for obtaining the encrypted distribution strategy component are as follows: Within a finite domain, a random master secret value is selected. A secret-sharing column vector is constructed with the random master secret value at the first position of the column vector and random filler values ​​in the remaining columns. Each row of the access vector in the attribute access control matrix is ​​sequentially operated on with the secret-sharing column vector to calculate the secret share parameter of each attribute node. Group generator variables are assigned to the secret share parameters according to the row number of each attribute node. The secret share parameters, group generator variables, and the correspondence between attribute nodes are encapsulated to obtain the encrypted distribution strategy component. 5.The information security-oriented mine large model multi-modal communication control method according to claim 1, characterized in that, The steps for obtaining the modal data ciphertext packet are as follows: An elliptic curve group is introduced. The secret share parameter, group generator variable, and attribute node correspondence in the encryption distribution strategy component are read. The group generator variable is written into the pairing input bit of the elliptic curve group according to the attribute node correspondence. The secret share parameter is used as the exponential control quantity. The pairing result of each attribute node is exponentially synthesized. The exponential synthesis result is XORed with the hash operation value to generate the session key. Read the text load field of the mine prediction text, read the image load field of the field image data, and concatenate the loads in the order of text load field first, image load field second, and load boundary identifier in the center. Use the session key to encrypt the load concatenation result in segments, and encapsulate each encrypted segment in the original segment order to obtain the modal data ciphertext package.

6. The multimodal communication control method for large-scale mine models oriented towards information security according to claim 1, characterized in that, The steps for obtaining the encrypted packet distribution record are as follows: Read the communication routing and forwarding rule entries in the control gateway, extract the identity identifier of the receiving device, concatenate the modal data encrypted packet with the identity identifier of the receiving device, match the path port identifier in the communication routing and forwarding rule entries according to the identity identifier of the receiving device, deliver the concatenated result to the path port corresponding to the path port identifier to perform the action, and generate an encrypted packet delivery record. 7.The information security-oriented mine large model multi-modal communication control method according to claim 1, characterized in that, The steps for obtaining the decryption and restoration key of the strategy matrix are as follows: The distribution identifier field, receiver device identity identifier field, ciphertext payload field, and attribute private key field in the ciphertext packet distribution record are parsed. The ciphertext payload field is restored to the modal data ciphertext packet, and the attribute private key field is restored to the receiver device's preset attribute private key parameter, thus obtaining the modal data ciphertext packet and the receiver device's preset attribute private key parameter. Based on the pre-set attribute private key parameters of the receiving device, the access row identifier, permission column identifier, and attribute node identifier in the attribute access control matrix are read. The pre-set attribute private key parameters of the receiving device are matched item by item with the attribute node identifiers. If the matched attribute node covers the necessary node corresponding to the access row identifier, the linear recovery coefficient is calculated. Using the linear recovery coefficient and the pre-set attribute private key parameters of the receiving device, a bilinear pairing operation is performed on the corresponding group generator variable in the modal data ciphertext packet to restore the secret shared master secret value, restore the session key, and obtain the policy matrix decryption and restoration key. 8.The information security-oriented mine large model multi-modal communication control method according to claim 1, characterized in that, The steps for obtaining the multimodal secure plaintext payload are as follows: Based on the decryption and restoration key of the strategy matrix, the ciphertext payload field, payload boundary identifier, and payload order identifier in the modal data ciphertext packet are read. Symmetric decoding is performed on the ciphertext payload field according to the payload order identifier. The text payload segment and image payload segment are divided according to the payload boundary identifier. The text payload segment is mapped to mine prediction text, and the image payload segment is mapped to on-site image data to obtain the multimodal security plaintext payload.

Images