A Key Hierarchical Management and Encryption Adaptation Method for Mine Monitoring Data Transmission

Abstract

This invention belongs to the field of data communication security technology, specifically relating to a key hierarchical management and encryption adaptation method for mine monitoring data transmission. The method includes acquiring raw monitoring data and classifying it into three levels: Level 1 core monitoring data, Level 2 important monitoring data, and Level 3 routine monitoring data; constructing a three-level key management system based on data levels; invoking corresponding encryption algorithms and keys according to data level identifiers to complete adaptive encryption adaptation, and transmitting data hierarchically according to priority; triggering dynamic updates of corresponding level keys based on transmission status and terminal online status; and decrypting the data level data level by level on the cloud monitoring platform. By adopting the above technical solution, this application can achieve precise matching of encryption strength and data value, strict correspondence between key levels and node permissions, dynamic adaptation of transmission priority and data timeliness, and immediate response of the key update mechanism to abnormal security events.

Description

Technical Field

[0001] This invention belongs to the field of data communication security technology, and in particular relates to a key hierarchical management and encryption adaptation method for mine monitoring data transmission. Background Technology

[0002] Mine safety monitoring, as a core component of mining production management, directly impacts the safety and efficiency of mineral resource extraction through the development and improvement of its technological system. Against the backdrop of accelerated digital and intelligent transformation, mine monitoring systems are evolving from traditional single-sensor, independent data acquisition models to diversified, comprehensive Internet of Things (IoT) sensing networks. Modern mine monitoring systems are widely deployed in key production stages such as mine ventilation, drainage, support, and hoisting. By deploying various sensors, monitoring terminals, and data acquisition devices, they achieve real-time perception and data collection of mine environmental parameters, equipment operating status, and personnel work behaviors. The effective transmission and secure management of this massive amount of monitoring data has become a critical infrastructure supporting mine safety production decisions.

[0003] Under current technological conditions, the encryption and key management of mine monitoring data transmission mainly employ a single symmetric encryption scheme or a hybrid encryption system based on public key infrastructure. Typical implementations include: using the national standard SM4 algorithm to uniformly encrypt all monitoring data in blocks; at the key management level, a global master key system is typically deployed, with all monitoring terminals sharing the same key resources for encryption and decryption. At the data transmission level, existing transmission schemes tend to use a unified transmission protocol and fixed transmission links, forwarding data through the same transmission channel regardless of its importance or sensitivity. This type of technology played a significant role in early mine information system development. Its design philosophy stemmed from the relatively simple network topology and singular business needs of the time, and through centralized key management and standardized encryption processes, it could meet the basic requirements for secure data transmission to a certain extent.

[0004] However, with the continuous improvement of mine intelligence and the explosive growth of monitoring data, the aforementioned technical solutions have gradually revealed deep-seated limitations in dealing with complex and ever-changing production environments. From the perspective of matching encryption performance with computing resources, different types of data in mine monitoring systems have significantly different sensitivity characteristics and timeliness requirements. Core monitoring information, such as threshold exceedance data and emergency equipment failure data that are crucial to major mine safety risks, has extremely high data value. Leakage or tampering could lead to serious safety accidents, thus requiring a high-strength full-data encryption strategy to ensure absolute data security. Important monitoring information, such as normal equipment operating parameters and steady-state environmental monitoring data, has relatively lower sensitivity but still has significant reference value; lightweight incremental encryption is sufficient to meet security requirements. As for routine data such as equipment logs and offline backup statistics, their main function is to provide historical data query and trend analysis support; integrity verification using hash digests is sufficient. Existing technologies uniformly adopt high-strength SM4 block encryption, which can ensure data security, but undoubtedly places excessive demands on the computing power of monitoring terminals. Especially in scenarios with large-scale deployment of IoT monitoring terminals, excessive encryption computing overhead will directly squeeze the effective computing power resources available for data acquisition and signal processing, resulting in a decrease in the overall system response efficiency.

[0005] From the perspective of the granularity of key management, the existing single global master key system suffers from technical defects such as blurred permission boundaries and coarse control granularity when facing multi-level and multi-role data transmission scenarios. In actual operation, mine monitoring systems involve multiple physical nodes, including cloud monitoring platforms, edge gateways, and various monitoring terminals. The access permissions and operational scope of data for nodes at different levels should be fundamentally different. Core monitoring data can only be processed by the cloud monitoring platform, important monitoring data can be pre-analyzed and processed by the edge gateway, and routine monitoring data can be mostly processed on the local terminal before being uploaded. However, the practice of all terminals sharing the same set of key resources in the existing technology allows any terminal holding a key to decrypt and access all monitoring data. This not only causes the failure of permission control but also faces the cascading security risk of exposing all system data in the event of a key leak. In addition, when the master key needs to be replaced due to security risks, the existing technology usually requires a unified key update operation for all terminals on the network. This will generate huge operation and maintenance costs and system downtime in large-scale deployment scenarios.

[0006] From the perspective of ensuring real-time data transmission, data of different sensitivity levels in mine monitoring systems have varying requirements for transmission latency. Core monitoring data, such as threshold over-limit alarms and emergency equipment failure data, are highly dependent on the timeliness of transmission; a one-second delay could result in the loss of a safety decision-making window. Therefore, they must be transmitted via the highest-priority real-time link. In contrast, routine monitoring data, such as log backups and statistical reports, are less sensitive to transmission latency and can be transmitted using fragmented network resources through bandwidth reuse. Current technologies employing uniform transmission priorities and fixed transmission links cannot dynamically adjust based on the importance and timeliness requirements of the data. This not only causes low-priority data to preempt transmission resources for high-priority data but also leads to an overall decrease in network bandwidth utilization. With the continuous growth of monitoring data volume, this technical solution lacking a hierarchical transmission mechanism will face increasingly severe transmission bottlenecks.

[0007] From the perspective of dynamic response in key update mechanisms, existing technologies typically employ a static, timed batch update model. This model exhibits significant lag when facing dynamically changing security threats. When a monitoring system detects abnormal access behavior or data transmission tampering risks, it needs to be able to immediately trigger temporary updates of relevant key levels to block potential security attacks. However, the design of key update processes in existing technologies usually relies on pre-set periodic tasks, lacking the ability to respond instantly to abnormal events. This makes them particularly passive in the face of increasingly complex and varied network attack methods. Furthermore, ensuring a smooth transition between old and new keys and maintaining the continuity of data transmission during the update process are also technical problems that existing technologies have not effectively solved.

[0008] Therefore, the core challenges facing key management and encryption adaptation in the field of mine monitoring data transmission lie in: how to establish a hierarchical key management system that can match the differences in data sensitivity, so that monitoring data of different sensitivity levels can obtain encryption protection strength commensurate with their security requirements, while avoiding the waste of computing resources and the decline in transmission efficiency caused by excessive encryption; how to achieve a precise correspondence between key management levels and data levels, so that each level of node can only access monitoring data within its authorized scope, thereby eliminating the security risks of unauthorized access at the source; and how to construct a dynamic key update mechanism, enabling the system to respond instantly to abnormal security events while ensuring a smooth transition of business continuity during key updates. The intertwined existence of these technical contradictions constitutes the key technical challenge currently facing this field, urgently requiring an innovative key hierarchical management and encryption adaptation method for a systematic solution. Summary of the Invention

[0009] This invention addresses the technical problems in existing mine monitoring data transmission technologies, such as extensive key management, simplistic encryption strategies, rigid transmission mechanisms, and delayed key updates. It provides a hierarchical key management and encryption adaptation method for mine monitoring data transmission. By establishing a data sensitivity-driven hierarchical key management system, it achieves precise matching between encryption strength and data value, strict correspondence between key levels and node permissions, dynamic adaptation between transmission priority and data timeliness, and immediate response of the key update mechanism to abnormal security events.

[0010] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: A key hierarchical management and encryption adaptation method for mine monitoring data transmission, based on an architecture including a mine cloud monitoring platform, an edge gateway, and a monitoring terminal, includes the following steps: S1: Mine monitoring data classification: Obtain the raw monitoring data collected by various monitoring terminals at the mine site, and combine the confidentiality level of the mine safety monitoring data, the real-time requirements of the data, and the data hazard weight to classify the raw monitoring data into three data levels: Level 1 core monitoring data, Level 2 important monitoring data, and Level 3 routine monitoring data, and generate classified monitoring data carrying data level identifiers.

[0011] S2: Layered Key System Construction: Based on the three data levels defined in step S1, a matching data-driven three-level key management system is built. The three-level key management system includes a first-level global master key, a second-level classification group key, and a third-level terminal session key from top to bottom. The first-level global master key is deployed on the mine cloud monitoring platform and is used to complete the generation, updating, and access control of lower-level keys. The second-level classification group key is configured for each data level, encrypted and generated by the first-level global master key, and stored in the mine edge gateway. The third-level terminal session key is configured independently for each monitoring terminal, encrypted and generated by the corresponding second-level classification group key, and dynamically synchronized to the corresponding monitoring terminal.

[0012] S3: Adaptive Encryption Strategy: Based on the data level identifiers of the hierarchical monitoring data, a three-level key management system is constructed and matched. The corresponding encryption algorithm and key are called to complete the adaptive encryption adaptation. For the first-level core monitoring data, the national standard SM4 block encryption algorithm is used in combination with the first-level global master key for full encryption processing. For the second-level important monitoring data, the national standard SM4 lightweight encryption algorithm is used in combination with the second-level classification group key for incremental encryption processing. For the third-level routine monitoring data, the hash digest encryption algorithm is used in combination with the third-level terminal session key for verification encryption processing, generating the corresponding level of encrypted monitoring data packets.

[0013] S4: Hierarchical Encrypted Data Transmission: Encapsulate different levels of encrypted monitoring data packets with corresponding transmission frame headers and transmit them hierarchically through the mine's dedicated transmission link; among them, the encrypted data packets of the first-level core monitoring data are transmitted using the highest priority dedicated real-time link, the encrypted data packets of the second-level important monitoring data are transmitted using the normal priority stable link, and the encrypted data packets of the third-level regular monitoring data are transmitted using the low priority bandwidth multiplexing link.

[0014] S5: Dynamic Key Update and Verification: The mine cloud monitoring platform monitors the transmission status of encrypted monitoring data packets at all levels and the online status of terminals in real time. Based on transmission latency, terminal access frequency, and data leakage risk coefficient, it triggers dynamic updates of the corresponding level keys. The first-level global master key is updated periodically, and after the update, the second-level classification group key and the third-level terminal session key are updated synchronously with each level of encryption. The second-level classification group key and the third-level terminal session key are temporarily updated immediately when abnormal access or data transmission tampering risks are detected.

[0015] S6: Layered Decryption Verification and Restoration: After receiving encrypted monitoring data packets of various levels, the mine cloud monitoring platform parses the data level identifiers in the data packets and sequentially calls the keys of the corresponding levels to decrypt them level by level; it decrypts the first-level core monitoring data encryption packet using the first-level global master key, decrypts the second-level important monitoring data encryption packet using the corresponding second-level classification group key, and verifies and decrypts the third-level regular monitoring data encryption packet using the corresponding third-level terminal session key. After decryption, it verifies the data integrity and restores the original monitoring data.

[0016] Preferably, the specific process of classifying mine monitoring data in step S1 is as follows: S11: Acquire raw monitoring data collected by various monitoring terminals at the mine site. D raw ; S12: Regarding the raw monitoring data D raw The classification level coefficient S, real-time requirement coefficient T, and data hazard weight coefficient W are obtained by quantification, and the quantification relationship is as follows: S = f S ( D raw ); T = f T ( D raw ); W = f W ( D raw ); in, S is the confidentiality level coefficient, with a value range of [0,1]. The larger the value, the higher the level of confidentiality of the data; T is the real-time requirement coefficient, with a value range of [0,1]. The larger the value, the higher the real-time requirement of data transmission; W is the data hazard weight coefficient, with a value range of [0,1]. The larger the value, the greater the security hazard caused by data leakage or tampering. f S This is a classification level mapping function, assigned values ​​according to mine safety and confidentiality regulations; f T This is a real-time mapping function, assigned a value based on the data transmission delay tolerance. f W The hazard weight mapping function is assigned values ​​based on the mine safety risk assessment standards; Classification level mapping function f S The mapping rules are as follows: D raw Classified data containing significant safety hazards that could directly cause accidents: f S ( D raw =1.0; D raw Includes key equipment parameters and environmentally sensitive data: f S ( D raw =0.7; D raw Includes routine operating data and non-sensitive operating condition data: f S ( D raw =0.3; D raw Includes logs, statistics, backups, and non-classified data: f S ( D raw =0.0.

[0017] Real-time mapping function f T The mapping rules are as follows: D raw For over-limit alarms and emergency fault data, the latency tolerance is ≤50ms. f T ( D raw =1.0; D raw For real-time parameters of critical equipment, latency tolerance ≤200ms: f T ( D raw =0.8; D raw For steady-state environment data and normal operating condition data, the latency tolerance is ≤2000ms. f T ( D raw =0.5; D raw For logs, backups, and statistics, there are no strict limitations on latency tolerance. f T ( D raw =0.2.

[0018] Harm weight mapping function f W The mapping rules are as follows: D raw Data indicating a significant exceedance of safety thresholds or potential mass casualty incidents: f W ( D raw =0.9; D raw Data on critical equipment malfunctions and data that may lead to localized accidents: f W ( D raw =0.7; D raw These are standard equipment parameters and environmental steady-state data; the hazards are limited and controllable. f W ( D raw =0.4; D raw For logs, backups, and statistical data, the risk of leakage or tampering is extremely low. f W ( D raw =0.1.

[0019] S13: Calculate the overall risk value R using a weighted fusion method. R=α · S+β · T+c· W ; Where R is the comprehensive risk value of the data, and its value ranges from [0,1]. α Weighting based on the level of confidentiality; β For real-time weighting; c Assign data hazard weights; satisfy normalization constraints α + β + c =1. Based on industry standards for mine safety management, and taking into account the relative importance of three dimensions—data confidentiality, real-time requirements, and safety hazard consequences—the Analytic Hierarchy Process (AHP) is used to determine the weighting coefficients.

[0020] S14: Based on the comprehensive risk value R of the data, determine the data level according to a preset threshold range: When R∈[0.7, 1], it is determined to be first-level core monitoring data; When R∈[0.4, 0.7), it is determined to be secondary important monitoring data; When R∈[0, 0.4), it is determined to be Level III routine monitoring data.

[0021] S15: Generate tiered data: Generate tiered monitoring data carrying data level identifiers. D grade Its data structure satisfies: D grade =( D raw , R , ID L , t )in, ID L The data level identifier is 0x01 for Level 1 core monitoring data, 0x02 for Level 2 important monitoring data, and 0x03 for Level 3 routine monitoring data; t is the data acquisition timestamp, used for subsequent transmission timing verification.

[0022] Preferably, the specific process of step S2 is as follows: S21: Level 1 Global Master Key Generation and Deployment: The mine cloud monitoring platform uses the recommended elliptic curve parameters (SM2-p256) of the national cryptographic standard SM2 to generate a first-level global master key. K 1. The key length is 256 bits; the generation formula is: K 1 = SM2_GenKey( N, p, q ); in, N It is a source of random entropy; p、qSM2 elliptic curve parameters; SM2_GenKey(·) is the national standard SM2 key generation function; K 1. The hardware security module HSM, stored in the cloud, is used only for lower-level key generation, updates, and access control, and is not distributed externally.

[0023] The storage of the primary global master key adopts a hardware security module protection mode. The plaintext key only resides in the secure memory area briefly during encryption and decryption operations and is immediately cleared after the calculation is completed. The update cycle of the primary global master key is set to a value range between 24 hours and 168 hours.

[0024] S22: Secondary Classification Group Key Generation and Distribution: Based on the three data levels output by S1, three sets of secondary classification group keys are generated. K 2,1 , K 2,2 , K 2,3 ; by the first-level global master key K 1. Generated using the national cryptographic algorithm SM4, the generation formula is: K 2,i =SM4_Enc( S i , K 1), i=1,2,3; in, i =1 corresponds to the first-level core data; i =2 corresponds to secondary important data; i =3 corresponds to Level III routine monitoring data; S i This is the key seed bound to the data level; SM4_Enc(·) is the national standard SM4 encryption function; after generation, it is sent to the mine edge gateway through a secure channel and stored in encryption. S23: Level 3 Terminal Session Key Generation and Dynamic Synchronization: When each monitoring terminal connects to the edge gateway, the gateway selects the corresponding secondary classification group key based on the data level of the terminal. K 2,i Use the national cryptographic SM4 algorithm to generate a level 3 terminal session key. K 3,j The formula for generating the formula is: K 3,j =SM4_Enc( Z j , K 2,i ); in, j A unique identifier for the terminal;Z j Use a random seed for the terminal; K 3,j For the first j Each terminal's session key is generated and encrypted by the edge gateway before being sent to the corresponding monitoring terminal. The terminal stores the key securely locally, and each session binds to a unique key. K 3,j ; S24: The three-level key system has been completed. Forming a top-down three-level keychain: K 1→{ K 2,1 , K 2,2 , K 2,3}→{ K 3,j}; Implement a one-to-one mapping between data level, key level, and terminal permission.

[0025] Preferably, the specific process of step S3 is as follows: S31: Analyzing hierarchical monitoring data D grade Data level identifiers in ID L Determine the monitoring data level: ID L =0x01: Level 1 core monitoring data D1; ID L =0x02: Level II Important Monitoring Data D2; ID L =0x03: Level III routine monitoring data D3; S32: Based on the determined monitoring data level, call the corresponding encryption algorithm and key to complete adaptive encryption adaptation; S33: Encapsulate plaintext D3 with digest ciphertext C3 to generate a three-level encrypted monitoring data packet P3; Where H3 is the SM3 hash digest; C3 is the digest ciphertext; and SM3(·) is the Chinese national cryptographic hash function. Output encrypted monitoring data packets P that correspond one-to-one with the data level L : P L =P1, ID L =0x01; P L =P2, ID L =0x02; P L =P3, ID L =0x03; Complete the adaptive adaptation of encryption strategies with data levels and key levels.

[0026] Preferably, step S32 includes the following processes: If it is Level 1 core monitoring data D1, then the national standard SM4 block encryption algorithm combined with the Level 1 global master key is used. K 1. Perform full encryption; divide D1 into 128-bit data blocks B. 1,1 B 1,2 , ···, B 1,m Encryption is performed using SM4-ECB mode: C 1,k =SM4-ECB(B 1,k , K1); k=1,2,···,m; Concatenate the ciphertext and add a frame header to generate a level-one encrypted monitoring data packet P1; where C 1,k This is a first-level data ciphertext block; SM4-ECB(·) is the national standard SM4 electronic codebook encryption function; If the data is a secondary important monitoring data point D2, extract the incremental data ΔD2 relative to the previous period, and use the national cryptographic SM4 lightweight encryption algorithm combined with the corresponding secondary classification group key K. 2,2 Incremental encryption is performed; the standard SM4-CBC mode is adopted, and an initialization vector is introduced. IV : C2=SM4-CBC(ΔD2, K) 2,2 , IV ); The incremental ciphertext is associated with and encapsulated with the historical data reference identifier to generate a secondary encrypted monitoring data packet P2; where C2 is the secondary incremental ciphertext. IV A 128-bit random initialization vector; SM4-CBC(·) is the SM4 cipher block chaining encryption function; If the data is D3 from a Level 3 routine monitoring system, a hash digest H3 is generated using the national cryptographic SM3 hash algorithm, and then combined with the corresponding Level 3 terminal session key K. 3,j Encrypted digest: H3 = SM3(D3); C3 = SM4 - ECB(H3, K3, j).

[0027] Preferably, the specific process of step S4 is as follows: S41: For the generated encrypted monitoring data packets P1, P2, and P3, respectively encapsulate them with level-specific transmission frame headers. FH LThe frame header structure is standardized and includes: a frame start character and a data level identifier. ID L Data packet sequence number SN timestamp t Link priority marking Pr Key version See Verification code CRC The frame header format satisfies: FH L =(0xAA55, ID L , SN , t , P r, See , CRC ); Among them, link priority marking Pr Values: Level 1 data Pr =3 (highest), secondary data Pr =2 (regular), Level 3 data Pr =1 (lowest); S42: Perform link priority scheduling matching: Parse priority flags in frame header Pr Mapped to the corresponding dedicated transmission link: when Pr =3 (Level 1 Core Data P1): Scheduled to a dedicated real-time link L 1. Configure backup link L 1-bak Bandwidth guarantee factor or 1≥0.9, end-to-end latency limit τ1≤50ms; bandwidth guarantee factor = reserved bandwidth of link / total bandwidth of link; When Pr=2 (secondary critical data P2): Schedule to a stable link. L 2. Configure backup link L 2-bak Bandwidth guarantee factor or 2≥0.7, end-to-end delay upper limit τ2≤200ms; when Pr =1 (Level 3 routine monitoring data P3): Dispatch to bandwidth reuse link, i.e., main link L 3. A statistical multiplexing mechanism is adopted, with a latency limit τ3 ≤ 2000ms; S43: Perform hierarchical link transmission: Based on the link mapping relationship, the encrypted data packets encapsulated with frame headers are pushed to the corresponding links for transmission: Dedicated real-time link L 1. Dedicated bandwidth, priority forwarding, and prohibition of low-priority data preemption; Stable link L2: Allocate fixed bandwidth to ensure continuous and stable data transmission; Bandwidth multiplexing link L 3: Reuse idle bandwidth on the link without occupying high-priority resources; Step S43 is followed by transmission link isolation verification: during transmission, this is performed via the frame header. ID L Verify link matching consistency to avoid cross-level data crosstalk; If the verification fails, link rerouting is triggered to ensure hierarchical transmission isolation and output encrypted data packet streams that match the link, providing transmission status information for S5 key updates.

[0028] Preferably, the specific process of step S5 is as follows: S51: Real-time acquisition of multi-dimensional state parameters: The mine cloud monitoring platform collects three types of triggering parameters in real time: Transmission delay parameters: End-to-end delay of encrypted data packets at various levels t i , i =1,2,3; Terminal access frequency parameter: Number of times a terminal accesses the network per unit time f j , j Terminal number; Data breach risk level R risk Calculated by weighting terminal security status, link encryption strength, and historical anomaly count: R risk =λ1· S term +λ2· S link +λ3· N abn ; in, S term Give the terminal security score ([0,1]); S link Score the link encryption strength ([0,1]); N abn λ1, λ2, and λ3 are the normalized values ​​of the number of historical anomalies ([0,1]); λ1, λ2, and λ3 are the weighting coefficients, satisfying λ1+λ2+λ3=1, and can take values ​​of λ1=0.4, λ2=0.3, and λ3=0.3. S52: Trigger a primary global master key K1 update according to a preset period T1 (24-168 hours): K 1-new =SM2_GenKey(N′).

[0029] Where N′ is the new random entropy source; The updated system adopts a top-down encrypted synchronization mechanism. K 1-new Encryption generates new secondary classification group keys K 2,i-new : K 2,i-new =SM4_Enc( S i , K 1-new ), i =1,2,3; Edge gateway receiving K 2,i-new Then, a new Level 3 terminal session key is generated using encryption: K 3,j-new = SM4_Enc( Z j ,K 2,i-new ); Complete the full-link synchronous update of keys from Level 1 to Level 2 to Level 3; S53: Real-time update of secondary classification group key triggered: The corresponding secondary classification group key is triggered when any of the following conditions are met. K 2,i Real-time updates: continuous n L The delay exceeded the limit for one cycle: t L > t L th (Level 1) t 1 th =50ms, Level 2 t 2 th =200ms, Level 3 t 3 th =2000ms); Detection of data tampering risk: CRC checksum mismatch or hash digest comparison failure; Updated formula: K 2,i-temp =SM4_Enc( S i ′ , K 1); in, S i′ This is a temporary key seed; after updating, it will be synchronized to the edge gateway, replacing the original one. K 2,i ; S54: Level 3 terminal session key instant update triggered: The terminal's corresponding Level 3 session key will be triggered if any of the following conditions are met. K 3,j Real-time updates: Abnormal high-frequency access: f j >f j th ; f j th 1.5 times the base frequency; Terminal offline reconnection attempt or unauthorized access attempt; Updated formula: K 3,j-temp =SM4_Enc( Z j ′ , K 2,i ); in, Z j ' It serves as a temporary random seed for the terminal; after updating, it is encrypted and distributed to the corresponding terminal by the edge gateway.

[0030] Preferably, the specific process of step S6 is as follows: S61: Encrypted data packet reception and frame header parsing: The mine cloud monitoring platform receives encrypted monitoring data packets transmitted via S4. P L parse the transmission frame header FH L Extract data level identifiers ID L Key version number Ver, timestamp t And the CRC checksum, to determine the decryption level of the data packet; S62: Execute the corresponding decryption process based on the decryption level of the data packet. like ID L =0x01 (Level 1 Core Data P1), the cloud-based monitoring platform calls the currently valid Level 1 global master key K1 and decrypts the ciphertext block of the data using SM4-ECB mode. C 1,k : B 1,k =SM4-Dec( C 1,k , K1); By piecing together and decrypting the data blocks, the original plaintext data of the primary core can be restored. 1,raw ; like ID L =0x02 (Secondary Important Data P2), the cloud monitoring platform matches the corresponding secondary classification group key K according to the key version number Ver. 2,2 Decrypting incremental ciphertext C2 using the standard SM4-CBC mode: ΔD2=SM4-Dec(C2, K 2,2 , IV ); By combining historical data citation identifiers, the plaintext D of the secondary important original data is restored. 2,raw ; like ID L =0x03 (Level 3 routine monitoring data P3), the cloud monitoring platform matches the corresponding Level 3 terminal session key based on the key version number Ver. K 3,j Decrypt the ciphertext C3 to obtain the restored hash digest H3′: H3′=SM4-Dec(C3, K 3,j ); Recalculate the SM3 hash digest H3 for the plaintext D3 of the data packet, compare H3 with H3', and complete the integrity verification. S63: Data Integrity Verification and Restoration Level 1 data: Verify the integrity of the decrypted data block sequence and the consistency of the frame header CRC; Secondary data: Verify the consistency between incremental data and historical data; Level 3 data: Verify that H3=H3'; if they match, the data is complete. After successful verification, the restored original monitoring data will be output. D raw If the verification fails, the abnormal data packet will be discarded and a key update warning will be triggered.

[0031] Preferably, step S5 also includes a smooth transition and verification between the old and new keys: Set transition period after key update T trans , T transThe transmission cycle is set to 1-3 periods. During the transition period, both the old and new keys are valid concurrently, with the new key taking precedence. If decryption with the new key fails, the old key is then attempted. All data packets during the transition period are simultaneously decrypted and compared using both the old and new keys. The cloud and the terminal verify the consistency of the decryption results using both keys. Upon successful verification, the old key is automatically destroyed at the end of the transition period, providing a valid key for S6 layered decryption. If the decryption results of the old and new keys are inconsistent, key tampering is determined, triggering an emergency key update across all layers. Attached Figure Description Figure 1 This is a flowchart illustrating the key hierarchical management and encryption adaptation method for mine monitoring data transmission according to the present invention. Figure 2 This is a schematic diagram of the encrypted data transmission process of the present invention; Figure 3 This is a schematic diagram of the layered decryption, verification, and restoration process of the present invention. Detailed Implementation

[0032] The following is in conjunction with the appendix Figure 1~Figure 3 The present invention will be further described in detail below: Example 1 See appendix Figure 1 As shown, a key hierarchical management and encryption adaptation method for mine monitoring data transmission is implemented based on a collaborative architecture of a mine cloud monitoring platform, a mine edge gateway, monitoring terminals at various levels, and the communication network connecting them. The mine cloud monitoring platform serves as the core control node of the entire system, integrating a key generation module, a key access control subsystem, an abnormal behavior detection subsystem, and a data processing and display module. The platform is configured with two sets of hardware security modules, one serving as the master key storage device and the other as the disaster recovery key storage device. The two hardware security modules synchronize and back up keys through an encrypted channel. The key generation module generates a 256-bit random number based on the national cryptographic algorithm SM2 as the primary global master key. The plaintext of this master key only resides briefly in the secure memory area during encryption and decryption operations and is immediately cleared after the calculation is completed, ensuring the security of the master key.

[0033] Mine edge gateways are deployed in critical locations within the mine, with each gateway managing all monitoring terminals within its coverage area. Each edge gateway integrates a transmission link quality monitoring subsystem, responsible for real-time collection of performance metrics for each transmission link and dynamically adjusting data packet routing strategies based on these metrics. The edge gateway also stores secondary classification group keys issued by the cloud-based monitoring platform. These keys are encrypted using a primary global master key, decrypted during encryption operations, and immediately deleted after use.

[0034] Monitoring terminals are distributed at various monitoring points in the mine, responsible for collecting original monitoring data and performing encryption operations. Each monitoring terminal is equipped with a secure storage area for storing the three-level terminal session keys sent by the edge gateway. The monitoring terminal adaptively adjusts the complexity of the encryption algorithm according to its own CPU load and available memory. The terminal has a built-in resource monitoring module that samples the CPU occupancy rate C and the remaining memory M every 500 ms. Three-level thresholds are set: when the high-level C>80%, lightweight SM4 (reduced number of rounds) is enabled; when the medium-level 50%<C≤80%, standard SM4 is enabled; when the low-level C≤50%, full-scale SM4 encryption is enabled; when the memory threshold M<1MB, the buffer size is reduced to ensure that the data encryption task can still be normally completed under limited computing resources.

[0035] It includes the following steps: S1: Classification of mine monitoring data: Obtain the original monitoring data collected by each monitoring terminal at the mine site, and combine the classified level of the mine safety monitoring data, the real-time requirement of the data, and the data hazard weight to divide the original monitoring data into three data levels: first-level core monitoring data, second-level important monitoring data, and third-level regular monitoring data, and generate classified monitoring data with data level identifiers. S2: Hierarchical construction of the key system: Based on the three data levels divided in step S1, build a matching data-driven three-level key management system; The three-level key management system includes a first-level global master key, a second-level classification group key, and a third-level terminal session key from top to bottom; The first-level global master key is deployed on the mine cloud supervision platform to complete the generation, update, and permission control of the lower-level keys; The second-level classification group keys are respectively configured for each data level, encrypted and generated by the first-level global master key, and stored in the mine edge gateway; The third-level terminal session keys are independently configured for each monitoring terminal, encrypted and generated by the corresponding second-level classification group keys, and dynamically synchronized to the corresponding monitoring terminals. S3: Adaptive adaptation of encryption policies: Based on the data level identifiers of the classified monitoring data, match the constructed three-level key management system, and call the encryption algorithms and keys of the corresponding levels to complete adaptive encryption adaptation; For the first-level core monitoring data, use the national secret SM4 block encryption algorithm combined with the first-level global master key for full-scale encryption processing; For the second-level important monitoring data, use the lightweight encryption algorithm of national secret SM4 combined with the second-level classification group key for incremental encryption processing; For the third-level regular monitoring data, use the hash digest encryption algorithm combined with the third-level terminal session key for verification encryption processing to generate encrypted monitoring data packets of the corresponding levels. S4: Hierarchical encrypted data transmission: Encapsulate the encrypted monitoring data packets of different levels with corresponding transmission frame headers and transmit them hierarchically through the mine's dedicated transmission link; among them, the encrypted data packets of the first-level core monitoring data are transmitted using the highest priority dedicated real-time link, the encrypted data packets of the second-level important monitoring data are transmitted using the normal priority stable link, and the encrypted data packets of the third-level normal monitoring data are transmitted using the low priority bandwidth multiplexing link. S5: Dynamic Key Update and Verification: The mine cloud monitoring platform monitors the transmission status of encrypted monitoring data packets at all levels and the online status of terminals in real time. Based on transmission latency, terminal access frequency, and data leakage risk coefficient, it triggers dynamic updates of the corresponding level keys. The first-level global master key is updated periodically, and after the update, the second-level classification group key and the third-level terminal session key are updated synchronously with each level of encryption. The second-level classification group key and the third-level terminal session key are temporarily updated immediately when abnormal access or data transmission tampering risks are detected. S6: Layered Decryption Verification and Restoration: After receiving encrypted monitoring data packets of various levels, the mine cloud monitoring platform parses the data level identifiers in the data packets and sequentially calls the keys of the corresponding levels to decrypt them level by level; it decrypts the first-level core monitoring data encryption packet using the first-level global master key, decrypts the second-level important monitoring data encryption packet using the corresponding second-level classification group key, and verifies and decrypts the third-level regular monitoring data encryption packet using the corresponding third-level terminal session key. After decryption, it verifies the data integrity and restores the original monitoring data.

[0036] In this embodiment, the core task of mine monitoring data classification in step S1 is to divide the collected raw monitoring data into three levels: Level 1 core monitoring data, Level 2 important monitoring data, and Level 3 routine monitoring data, and to load a data level identifier into each data packet. The specific process is as follows: S11: Acquire raw monitoring data collected by various monitoring terminals at the mine site. D raw ; S12: Regarding the raw monitoring data D raw The classification level coefficient S, real-time requirement coefficient T, and data hazard weight coefficient W are obtained by quantification, and the quantification relationship is as follows: S = f S ( D raw ); T = f T ( D raw ); W = f W( D raw ); in, S is the confidentiality level coefficient, with a value range of [0,1]. The larger the value, the higher the level of confidentiality of the data; T is the real-time requirement coefficient, with a value range of [0,1]. The larger the value, the higher the real-time requirement of data transmission; W is the data hazard weight coefficient, with a value range of [0,1]. The larger the value, the greater the security hazard caused by data leakage or tampering. f S This is a classification level mapping function, assigned values ​​according to mine safety and confidentiality regulations; f T This is a real-time mapping function, assigned a value based on the data transmission delay tolerance. f W The hazard weight mapping function is assigned values ​​based on the mine safety risk assessment standards; Classification level mapping function f S The mapping rules are as follows: D raw Classified data containing significant safety hazards that could directly cause accidents: f S ( D raw =1.0; D raw Includes key equipment parameters and environmentally sensitive data: f S ( D raw =0.7; D raw Includes routine operating data and non-sensitive operating condition data: f S ( D raw =0.3; D raw Includes logs, statistics, backups, and non-classified data: f S ( D raw =0.0; Real-time mapping function f T The mapping rules are as follows: D raw For over-limit alarms and emergency fault data, the latency tolerance is ≤50ms. f T ( Draw =1.0; D raw For real-time parameters of critical equipment, latency tolerance ≤200ms: f T ( D raw =0.8; D raw For steady-state environment data and normal operating condition data, the latency tolerance is ≤2000ms. f T ( D raw =0.5; D raw For logs, backups, and statistics, there are no strict limitations on latency tolerance. f T ( D raw =0.2; Harm weight mapping function f W The mapping rules are as follows: D raw Data indicating a significant exceedance of safety thresholds or potential mass casualty incidents: f W ( D raw =0.9; D raw Data on critical equipment malfunctions and data that may lead to localized accidents: f W ( D raw =0.7; D raw These are standard equipment parameters and environmental steady-state data; the hazards are limited and controllable. f W ( D raw =0.4; D raw For logs, backups, and statistical data, the risk of leakage or tampering is extremely low. f W ( D raw =0.1; S13: Calculate the overall risk value R using a weighted fusion method. R=α · S+β · T+c · W ; Where R is the comprehensive risk value of the data, and its value ranges from [0,1]. α Weighting based on the level of confidentiality; β For real-time weighting; c Assign data hazard weights; satisfy normalization constraints α + β + c =1; Different weights can be set for different scenarios, as follows: In application scenarios involving gas, fire, or personnel evacuation alarms a、b、c 0.3, 0.5, and 0.2 can be used respectively. In application scenarios involving monitoring of critical equipment such as support structures or roof slabs, a、b、c These can be taken as 0.3, 0.3, and 0.4 respectively. In typical environments or equipment condition log application scenarios, a、b、c The values ​​can be 0.4, 0.2, and 0.4 respectively.

[0037] S14: Based on the comprehensive risk value R of the data, determine the data level according to a preset threshold range: When R∈[0.7, 1], it is determined to be first-level core monitoring data; When R∈[0.4, 0.7), it is determined to be secondary important monitoring data; When R∈[0, 0.4), it is determined to be Level III routine monitoring data; S15: Generate tiered data: Generate tiered monitoring data carrying data level identifiers. D grade Its data structure satisfies: D grade =( D raw , R , ID L , t )in, ID L The data level identifier is 0x01 for Level 1 core monitoring data, 0x02 for Level 2 important monitoring data, and 0x03 for Level 3 routine monitoring data; t is the data acquisition timestamp, used for subsequent transmission timing verification.

[0038] Example 2 Based on Example 1, the generation process of the Level 1 global master key is completed in the built-in key generation module of the cloud-based monitoring platform using the national cryptographic algorithm SM2. The key generation module calls the random number generation function of the SM2 algorithm to generate a 256-bit random number as the Level 1 global master key. The storage of this master key adopts a hardware security module protection mode. The plaintext of the master key only resides briefly in a secure memory area during encryption and decryption operations, and is immediately cleared after each operation, leaving no plaintext trace on the disk or persistent storage device. The update cycle of the Level 1 global master key is set to a value range between 24 and 168 hours, with a default update cycle of 72 hours.

[0039] S21: Level 1 Global Master Key Generation and Deployment: The mine cloud monitoring platform uses the national cryptographic SM2 algorithm to generate a first-level global master key. K 1. The key length is 256 bits; the generation formula is: K 1 = SM2_GenKey( N, p, q ); in, N It is a source of random entropy; p、q SM2 elliptic curve parameters; SM2_GenKey(·) is the national standard SM2 key generation function; K 1. The hardware security module HSM, stored in the cloud, is used only for lower-level key generation, updates, and access control, and is not distributed externally.

[0040] The first-level global master key here K The 1 refers to the SM2 private key, deployed in the cloud-based HSM hardware security module, used only for decryption and lower-level key signing, and never distributed externally. Simultaneously, an SM2 public key is also generated, publicly available on the network gateway or terminals, used for encrypting uplink key requests and key synchronization commands.

[0041] S22: Secondary Classification Group Key Generation and Distribution: Based on the three data levels output by S1, three sets of secondary classification group keys are generated. K 2,1 , K 2,2 , K 2,3 ; by the first-level global master key K 1. Generated using the national cryptographic algorithm SM4, the generation formula is: K 2,i =SM4_Enc( S i , K 1), i=1,2,3; in,i =1 corresponds to the first-level core data; i =2 corresponds to secondary important data; i =3 corresponds to Level III routine monitoring data; S i A key seed that is bound to the data level. S i = f SID ( i ),in f SID For data-level IDL and preset salt values Salt i The key derivation function, S i =SHA256(IDL‖ Salt i ||Timestamp); SM4_Enc(·) is the national standard SM4 encryption function; after generation, it is sent to the mine edge gateway through a secure channel and stored in encryption. S23: Level 3 Terminal Session Key Generation and Dynamic Synchronization: When each monitoring terminal connects to the edge gateway, the gateway selects the corresponding secondary classification group key based on the data level of the terminal. K 2,i Use the national cryptographic SM4 algorithm to generate a level 3 terminal session key. K 3,j The formula for generating the formula is: K 3,j =SM4_Enc( Z j , K 2,i ); in, j A unique identifier for the terminal; Z j Use the terminal as a random seed. Z j Use the terminal's built-in TRNG to generate a 64-bit random number or UUID; K 3,j For the first j Each terminal's session key is generated and encrypted by the edge gateway before being sent to the corresponding monitoring terminal. The terminal stores the key securely locally, and each session binds to a unique key. K 3,j ; S24: The three-level key system has been completed. Forming a top-down three-level keychain: K 1→{ K 2,1 ,K 2,2 , K 2,3}→{ K 3,j}; Implement a one-to-one mapping between data level, key level, and terminal permission.

[0042] In another embodiment of this example, a first-level global master key K 1. Hardware root trust storage is employed, deploying a security chip compliant with the TPM 2.0 specification within the edge gateway. The Level 1 global master key is stored only in the protected storage area (PCR) of the security chip and cannot be directly read by software. The Level 2 classification group key is protected by SM4 encryption + SM2 signature. Specifically, the Level 2 classification group key is generated by encryption within the security chip using the SM4 algorithm, and then signed and encapsulated using the SM2 digital signature algorithm to prevent tampering. The Level 3 terminal session key uses SM9 identifier cryptography for certificate-free distribution. This employs the SM9 identifier cryptography algorithm, using the unique identifier of the monitoring terminal (which can be the device serial number + SIM card number) as the public key, achieving secure key distribution without the need for pre-deployed certificates.

[0043] The specific process of step S3 is as follows: S31: Analyzing hierarchical monitoring data D grade Data level identifiers in ID L Determine the monitoring data level: ID L =0x01: Level 1 core monitoring data D1; ID L =0x02: Level II Important Monitoring Data D2; ID L =0x03: Level III routine monitoring data D3; S32: Based on the determined monitoring data level, the corresponding encryption algorithm and key are invoked to complete adaptive encryption adaptation. The specific process is as follows: If it is Level 1 core monitoring data D1, then the national standard SM4 block encryption algorithm combined with the Level 1 global master key is used. K 1. Perform full encryption; divide D1 into 128-bit data blocks B. 1,1 B 1,2 , ···, B 1,m Encryption is performed using SM4-ECB mode: C 1,k =SM4-ECB(B 1,k , K1); k=1,2,···,m; Concatenate the ciphertext and add a frame header to generate a level-one encrypted monitoring data packet P1; where C 1,k SM4-ECB(·) is the encryption function of the national standard SM4 electronic codebook.

[0044] While performing SM4-ECB mode encryption, automatically append associated data ( IDL , t , ID term Naturally tamper-proof and replay-proof.

[0045] If the data is a secondary important monitoring data point D2, extract the incremental data ΔD2 relative to the previous period, and use the national cryptographic SM4 lightweight encryption algorithm combined with the corresponding secondary classification group key K. 2,2 Incremental encryption is performed; the standard SM4-CBC mode is adopted, and an initialization vector is introduced. IV : C2=SM4-CBC(ΔD2, K) 2,2 , IV ); The incremental ciphertext is associated with and encapsulated with the historical data reference identifier to generate a secondary encrypted monitoring data packet P2; where C2 is the secondary incremental ciphertext. IV 128-bit random initialization vector; SM4-CBC(·) is the national standard SM4 cipher block chaining encryption function.

[0046] SM4 lightweight encryption refers to a solution that retains the complete round function, simplifies key expansion operations, reduces computing power overhead, and does not degrade security strength based on the standard SM4 algorithm. It is specifically designed for low-power monitoring terminals in mines.

[0047] If the data is D3 from a Level 3 routine monitoring system, a hash digest H3 is generated using the national cryptographic SM3 hash algorithm, and then combined with the corresponding Level 3 terminal session key K. 3,j Encrypted digest: H3 = SM3(D3); C3 = SM4 - ECB(H3, K3, j).

[0048] S33: Encapsulate plaintext D3 with digest ciphertext C3 to generate a three-level encrypted monitoring data packet P3; Where H3 is the SM3 hash digest; C3 is the digest ciphertext; and SM3(·) is the Chinese national cryptographic hash function. Output encrypted monitoring data packets P that correspond one-to-one with the data level L : P L =P1, ID L =0x01; P L=P2, ID L =0x02; P L =P3, ID L =0x03; Complete the adaptive adaptation of encryption strategies with data levels and key levels.

[0049] Example 3 Based on Example 1 or Example 2, the specific process of step S4 is as follows: S41: For the generated encrypted monitoring data packets P1, P2, and P3, respectively encapsulate them with level-specific transmission frame headers. FH L The frame header structure is standardized and includes: a frame start character and a data level identifier. ID L Data packet sequence number SN timestamp t Link priority marking Pr Key version See Verification code CRC The frame header format satisfies: FH L =(0xAA55, ID L , SN , t , Pr , See , CRC ); Among them, link priority marking Pr Values: Level 1 data Pr =3 (highest), secondary data Pr =2 (regular), Level 3 data Pr =1 (lowest); S42: Perform link priority scheduling matching: Parse priority flags in frame header Pr Mapped to the corresponding dedicated transmission link: when Pr =3 (Level 1 Core Data P1): Scheduled to a dedicated real-time link, i.e., the main link. L 1. Use independent physical channels or VLAN isolation; priority scheduling is achieved by parsing the frame header through the QoS module of the edge gateway. Pr The field pushes data to the corresponding queue and configures the backup link L. 1-bak Bandwidth guarantee factor or 1≥0.9, the bandwidth guarantee coefficient is implemented through the WFQ scheduling algorithm, and the end-to-end latency limit τ1≤50ms; whenPr =2 (Secondary Important Data P2): Scheduled to a stable link, i.e., the main link. L 2. Configure backup link L 2-bak Bandwidth guarantee factor or 2≥0.7, end-to-end delay upper limit τ2≤200ms; when Pr =1 (Level 3 routine monitoring data P3): Dispatch to bandwidth reuse link, i.e., main link L 3. A statistical multiplexing mechanism is adopted, with a latency limit τ3 ≤ 2000ms; If the main link latency exceeds the limit or the packet loss rate is >5%, the system will automatically and smoothly switch to the backup link. After the main link recovers, low-speed traffic will gradually switch back to the main link to avoid traffic jitter.

[0050] S43: Perform hierarchical link transmission: Based on the link mapping relationship, the encrypted data packets encapsulated with frame headers are pushed to the corresponding links for transmission: Dedicated real-time link L 1. Dedicated bandwidth, priority forwarding, and prohibition of low-priority data preemption; Stable link L 2: Allocate fixed bandwidth to ensure continuous and stable data transmission; Bandwidth multiplexing link L 3: Reuse idle bandwidth on the link without occupying high-priority resources; Step S43 is followed by transmission link isolation verification: during transmission, this is performed via the frame header. ID L Verify link matching consistency to avoid cross-level data crosstalk; If the verification fails, link rerouting is triggered to ensure hierarchical transmission isolation and output encrypted data packet streams that match the link, providing transmission status information for S5 key updates.

[0051] In this embodiment, the specific structure of the transmission frame header includes: a frame header start identifier field, occupying 2 bytes, used to identify the start position of the data packet; a data level identifier field, occupying 1 byte, used to identify the first, second, or third level data level corresponding to the data packet; a data packet sequence number field, occupying 4 bytes, used to identify the sequence number of the data packet in the data transmission sequence; a timestamp field, occupying 8 bytes, used to identify the time information of the data packet generation time; an encryption algorithm identifier field, occupying 1 byte, used to identify the encryption algorithm type used by the data packet; a key version number field, occupying 2 bytes, used to identify the version information of the key used by the data packet; a data payload length field, occupying 2 bytes, used to identify the length of the subsequent data payload; and a frame header checksum field, occupying 2 bytes, used to perform integrity checks on each field of the frame header.

[0052] The specific process of step S5 is as follows: S51: Real-time acquisition of multi-dimensional state parameters: The mine cloud monitoring platform collects three types of triggering parameters in real time: Transmission delay parameters: End-to-end delay of encrypted data packets at various levels t i , i =1,2,3; Terminal access frequency parameter: Number of times a terminal accesses the network per unit time f j , j Terminal number; Data breach risk level R risk Calculated by weighting terminal security status, link encryption strength, and historical anomaly count: R risk =λ1· S term +λ2· S link +λ3· N abn ; in, S term Give the terminal security score ([0,1]); S link Score the link encryption strength ([0,1]); N abn λ1, λ2, and λ3 are the normalized values ​​of the number of historical anomalies ([0,1]); λ1, λ2, and λ3 are the weighting coefficients, satisfying λ1+λ2+λ3=1, and can take values ​​of λ1=0.4, λ2=0.3, and λ3=0.3. S52: Trigger a primary global master key K1 update according to a preset period T1 (24-168 hours): K 1-new =SM2_GenKey(N′).

[0053] Where N′ is the new random entropy source; The updated system adopts a top-down encrypted synchronization mechanism. K 1-new Encryption generates new secondary classification group keys K 2,i-new : K 2,i-new =SM4_Enc( S i , K 1-new ), i=1,2,3; Edge gateway receiving K 2,i-new Then, a new Level 3 terminal session key is generated using encryption: K 3,j-new = SM4_Enc( Z j ,K 2,i-new ); Complete the full-link synchronous update of keys from Level 1 to Level 2 to Level 3; S53: Real-time update of secondary classification group key triggered: The corresponding secondary classification group key is triggered when any of the following conditions are met. K 2,i Real-time updates: continuous n L The delay exceeded the limit for one cycle: t L > t L th (Level 1) t 1 th =50ms, Level 2 t 2 th =200ms, Level 3 t 3 th =2000ms); Detection of data tampering risk: CRC checksum mismatch or hash digest comparison failure; Updated formula: K 2,i-temp =SM4_Enc( S i ′ , K 1); in, S i ′ This is a temporary key seed; after updating, it will be synchronized to the edge gateway, replacing the original one. K 2,i ; S54: Level 3 terminal session key instant update triggered: The terminal's corresponding Level 3 session key will be triggered if any of the following conditions are met. K 3,j Real-time updates: Abnormal high-frequency access: f j >f j th ; fj th 1.5 times the base frequency; Terminal offline reconnection attempt or unauthorized access attempt; Updated formula: K 3,j-temp =SM4_Enc( Z j ′ , K 2,i ); in, Z j ' It serves as a temporary random seed for the terminal; after updating, it is encrypted and distributed to the corresponding terminal by the edge gateway.

[0054] Step S5 also includes setting up a smooth transition and verification between the old and new keys: Set transition period after key update T trans , T trans The transmission cycle is set to 1 to 3 cycles. During the transition period, the old and new keys are valid in parallel. The cloud and the terminal respectively verify the consistency of the decryption results of the old and new keys. After the verification is passed, the old key is automatically destroyed at the end of the transition period, providing a valid key for S6 layered decryption.

[0055] The specific process of step S6 is as follows: S61: Encrypted data packet reception and frame header parsing: The mine cloud monitoring platform receives encrypted monitoring data packets transmitted via S4. P L parse the transmission frame header FH L Extract data level identifiers ID L Key version number Ver, timestamp t And the CRC checksum, to determine the decryption level of the data packet; S62: Execute the corresponding decryption process based on the decryption level of the data packet. like ID L =0x01 (Level 1 Core Data P1), the cloud-based monitoring platform calls the currently valid Level 1 global master key K1 and decrypts the ciphertext block of the data using SM4-ECB mode. C 1,k : B 1,k =SM4-Dec( C 1,k , K1); By piecing together and decrypting the data blocks, the original plaintext data of the primary core can be restored. 1,raw ; like ID L =0x02 (Secondary Important Data P2), the cloud monitoring platform matches the corresponding secondary classification group key K according to the key version number Ver. 2,2 Decrypting incremental ciphertext C2 using the standard SM4-CBC mode: ΔD2=SM4-Dec(C2, K 2,2 , IV ); By combining historical data citation identifiers, the plaintext D of the secondary important original data is restored. 2,raw ; like ID L =0x03 (Level 3 routine monitoring data P3), the cloud monitoring platform matches the corresponding Level 3 terminal session key based on the key version number Ver. K 3,j Decrypt the ciphertext C3 to obtain the restored hash digest H3′: H3′=SM4-Dec(C3, K 3,j ); Recalculate the SM3 hash digest H3 for the plaintext D3 of the data packet, compare H3 with H3', and complete the integrity verification. S63: Data Integrity Verification and Restoration Level 1 data: Verify the integrity of the decrypted data block sequence and the consistency of the frame header CRC, and detect whether there is any data packet loss or out-of-order situation; Secondary data: Verify the consistency between incremental data and historical data, and detect whether there is any data tampering or replacement; Level 3 data: Verify that H3=H3'; if they match, the data is complete. After successful verification, the restored original monitoring data will be output. D raw If the verification fails, the abnormal data packet will be discarded and a key update warning will be triggered.

[0056] In another embodiment, this includes a transmission quality monitoring process: The system collects performance metrics for each transmission link in real time. These metrics include: bandwidth utilization (reflecting the current load on the link); packet loss rate (reflecting the link's reliability); latency jitter (reflecting the link's stability); and round-trip latency (reflecting the link's end-to-end delay). The performance metrics are collected once per second, and the collected data is stored in the edge gateway's local database, supporting historical data querying and analysis.

[0057] Based on the collected performance metrics, the routing strategy for data packets of each level is dynamically adjusted. The triggering conditions for dynamic routing adjustment are as follows: when the bandwidth utilization of a link exceeds 80%, the system switches subsequent high-priority data packets to a backup transmission link; when the packet loss rate of a link exceeds 5%, the system considers the link to have a reliability problem, marks the link as unavailable, and migrates the data packets carried on the link to other available links; when the latency jitter of a link exceeds 20 milliseconds, the system lowers the trust level of the link and prioritizes other links with better stability when selecting routes.

[0058] When a link quality degradation is detected that affects data transmission timeliness, the transmission link quality monitoring subsystem will switch the affected high-priority data packets to a backup transmission link. The switchover process employs a smooth transition mechanism, automatically switching to the new link after all data packets on the original link have been sent, thus avoiding out-of-order packet issues. The backup transmission link reserves no less than 50% of the bandwidth of the primary link to ensure it can handle all high-priority traffic in the event of a primary link failure.

[0059] It also includes an abnormal behavior detection process during data transmission, as detailed below: First, a baseline model of normal behavior for each monitoring terminal is established. The process of establishing the baseline model is as follows: The system collects characteristic data such as data transmission cycle, data volume range, and communication mode of each terminal under normal operating conditions; the collection cycle is set to 14 days to ensure that the collected data can cover various normal operating scenarios; statistical analysis is performed on the collected characteristic data, and the mean and standard deviation of each characteristic are calculated to form a baseline model of normal behavior.

[0060] After the baseline model is established, the system continuously monitors the actual behavior of each terminal and compares the actual behavior with the normal behavior baseline. When the actual behavior of the monitored terminal deviates from the normal behavior baseline by more than a preset threshold, abnormal behavior is determined. The deviation threshold is calculated using the Euclidean distance algorithm, comparing each feature value of the actual behavior with each feature value of the baseline model to calculate the overall degree of deviation. The preset threshold is three times the standard deviation of the baseline model; behavior exceeding this threshold is judged as abnormal behavior.

[0061] For terminals exhibiting abnormal behavior, the system implements the following control measures: limiting data transmission rate to 50% of the normal rate; suspending data transmission until the nature of the abnormal behavior is confirmed; and triggering key updates when the abnormal behavior is determined to be a security threat, triggering an immediate update of the corresponding Level 3 terminal session key. The implementation of these control measures follows the principle of minimum impact, prioritizing mild control measures such as rate limiting, and only taking more stringent measures if the abnormal behavior persists or worsens.

Claims

1. A key hierarchical management and encryption adaptation method for mine monitoring data transmission, based on an architecture including a mine cloud monitoring platform, an edge gateway, and a monitoring terminal, characterized in that... Includes the following steps: S1: Obtain the raw monitoring data collected by various monitoring terminals at the mine site, divide it into three data levels: primary core monitoring data, secondary important monitoring data, and tertiary routine monitoring data, and generate graded monitoring data with data level identifiers; S2: Based on the data hierarchy, a matching data-driven three-level key management system is built. The three-level key management system includes, from top to bottom, a first-level global master key, a second-level classification group key, and a third-level terminal session key. S3: Based on the data level identifier of the hierarchical monitoring data, match the constructed three-level key management system, and call the corresponding level encryption algorithm and key to complete adaptive encryption adaptation; S4: Encapsulate different levels of encrypted monitoring data packets with corresponding level transmission frame headers and transmit them in a hierarchical manner through the mine's dedicated transmission link; S5: Real-time monitoring of the transmission status of encrypted monitoring data packets at all levels and the online status of terminals, triggering dynamic updates of the corresponding level keys based on transmission latency, terminal access frequency and data leakage risk coefficient; The first-level global master key is updated periodically, and after the update, the second-level classification group key and the third-level terminal session key are updated synchronously with encryption at each level; the second-level classification group key and the third-level terminal session key are temporarily updated immediately when abnormal access or data transmission tampering risks are detected. S6: After receiving encrypted monitoring data packets of each level, parse the data level identifier in the data packet, and call the corresponding level key to decrypt level by level in sequence; decrypt the first-level core monitoring data encryption packet with the first-level global master key, decrypt the second-level important monitoring data encryption packet with the corresponding second-level classification group key, and decrypt the third-level regular monitoring data encryption packet with the corresponding third-level terminal session key verification. After decryption, verify the data integrity and restore the original monitoring data.

2. The key hierarchical management and encryption adaptation method for mine monitoring data transmission according to claim 1, characterized in that, The specific process of classifying mine monitoring data in step S1 is as follows: S11: Acquire raw monitoring data collected by various monitoring terminals at the mine site. D raw ; S12: Regarding the raw monitoring data D raw The classification level coefficient S, real-time requirement coefficient T, and data hazard weight coefficient W are obtained by quantification respectively. S13: Calculate the overall risk value R using a weighted fusion method; S14: Based on the comprehensive risk value R of the data, determine the data level according to a preset threshold range; S15: Generate tiered monitoring data carrying data level identifiers. D grade .

3. The key hierarchical management and encryption adaptation method for mine monitoring data transmission according to claim 1, characterized in that, The specific process of step S2 is as follows: S21: Generation and Deployment of the Level 1 Global Master Key: Generating the Level 1 Global Master Key by Calling the National Cryptographic Algorithm SM2 K 1; S22: Generation and Distribution of Secondary Classification Group Keys: Based on the three data levels output from S1, three sets of secondary classification group keys are generated. K 2,1 , K 2,2 , K 2,3 ; by the first-level global master key K 1. Generated using the national cryptographic algorithm SM4; S23: Level 3 Terminal Session Key Generation and Dynamic Synchronization: When each monitoring terminal connects to the edge gateway, the gateway selects the corresponding secondary classification group key based on the data level of the terminal. K 2,i Use the national cryptographic SM4 algorithm to generate a level 3 terminal session key. K 3,j ; S24: The three-level key system has been completed. Forming a top-down three-level keychain: K 1→{ K 2,1 , K 2,2 , K 2,3 }→{ K 3,j } 4. The key hierarchical management and encryption adaptation method for mine monitoring data transmission according to claim 3, characterized in that, The specific process of step S3 is as follows: S31: Analyzing hierarchical monitoring data D grade Data level identifiers in ID L Determine the monitoring data level: ID L =0x01: Level 1 core monitoring data D1; ID L =0x02: Level II Important Monitoring Data D2; ID L =0x03: Level III routine monitoring data D3; S32: Based on the determined monitoring data level, call the corresponding encryption algorithm and key to complete adaptive encryption adaptation; S33: Encapsulate plaintext D3 with digest ciphertext C3 to generate a three-level encrypted monitoring data packet P3; Where H3 is the SM3 hash digest; C3 is the digest ciphertext; and SM3(·) is the Chinese national cryptographic hash function. Output encrypted monitoring data packets that correspond one-to-one with the data level. P L : P L =P1, ID L =0x01; P L =P2, ID L =0x02; P L =P3, ID L =0x03。 5. The key hierarchical management and encryption adaptation method for mine monitoring data transmission according to claim 4, characterized in that, Step S32 Includes the following processes: If it is Level 1 core monitoring data D1, then the national standard SM4 block encryption algorithm combined with the Level 1 global master key is used. K 1. Perform full encryption; divide D1 into 128-bit data blocks B. 1,1 B 1,2 , ···, B 1,m Encryption is performed using SM4-ECB mode: C 1,k =SM4-ECB(B 1,k , K1);k=1,2,···,m; Concatenate the ciphertext and add a frame header to generate a first-level encrypted monitoring data packet P1; Among them, C 1,k This is a first-level data ciphertext block; SM4-ECB(·) is the national standard SM4 electronic codebook encryption function; If the data is a secondary important monitoring data point D2, extract the incremental data ΔD2 relative to the previous period, and use the national cryptographic SM4 lightweight encryption algorithm combined with the corresponding secondary classification group key K. 2,2 Perform incremental encryption; The standard SM4-CBC pattern is adopted, and an initial vector is introduced. IV : C2=SM4-CBC(ΔD2,K 2,2 , IV ); The incremental ciphertext is associated with and encapsulated with the historical data reference identifier to generate a secondary encrypted monitoring data packet P2; where C2 is the secondary incremental ciphertext. IV A 128-bit random initialization vector; SM4-CBC(·) is the SM4 cipher block chaining encryption function; If the data is D3 from a Level 3 routine monitoring system, a hash digest H3 is generated using the national cryptographic SM3 hash algorithm, and then combined with the corresponding Level 3 terminal session key K. 3,j Encrypted digest: H3 = SM3(D3); C3 = SM4 - ECB(H3, K3, j).

6. The key hierarchical management and encryption adaptation method for mine monitoring data transmission according to claim 4, characterized in that, The specific process of step S4 is as follows: S41: For the generated encrypted monitoring data packets P1, P2, and P3, respectively encapsulate them with level-specific transmission frame headers. FH L The frame header structure is standardized and includes: a frame start character and a data level identifier. ID L Data packet sequence number SN timestamp t Link priority marking Pr Key version Ver Verification code CRC The frame header format satisfies: FH L =(0xAA55, ID L , SN , t , P r, Ver , CRC ); Among them, link priority marking Pr Values: Level 1 data Pr =3. Secondary data Pr =2. Level 3 data Pr =1; S42: Perform link priority scheduling matching: Parse priority flags in frame header Pr Mapped to the corresponding dedicated transmission link: when Pr =3: Scheduled to a dedicated real-time link, which is the main link. L 1; when Pr =2: Scheduled to a stable link, i.e., the main link. L 2; when Pr =1: Scheduled to a bandwidth multiplexing link, i.e., the main link. L 3; S43: Perform hierarchical link transmission: Based on the link mapping relationship, the encrypted data packets after encapsulating the frame header are pushed to the corresponding links for transmission.

7. The key hierarchical management and encryption adaptation method for mine monitoring data transmission according to claim 6, characterized in that, The specific process of step S5 is as follows: S51: Real-time acquisition of multi-dimensional state parameters: The mine cloud monitoring platform collects three types of triggering parameters in real time: Transmission delay parameters: End-to-end delay of encrypted data packets at various levels τ i , i =1,2,3; Terminal access frequency parameter: Number of times a terminal accesses the network per unit time f j , j Terminal number; Data breach risk level R risk Calculated by weighting terminal security status, link encryption strength, and historical anomaly count: R risk =λ1· S term +λ2· S link +λ3· N abn ; in, S term Assess endpoint security. S link Score the encryption strength of the link; N abn λ1, λ2, and λ3 are normalized values ​​for the number of historical anomalies; λ1, λ2, and λ3 are weighting coefficients. S52: Trigger a level-one global master key K1 update according to a preset period T1: K 1-new =SM2_GenKey(N′)。 Where N′ is the new random entropy source; The updated system adopts a top-down encrypted synchronization mechanism. K 1-new Encryption generates new secondary classification group keys K 2,i-new : K 2,i-new =SM4_Enc( S i , K 1-new ), i =1,2,3; Edge gateway receiving K 2,i-new Then, a new Level 3 terminal session key is generated using encryption: K 3,j-new = SM4_Enc( Z j ,K 2,i-new ); Complete the full-link synchronous update of keys from Level 1 to Level 2 to Level 3; S53: Real-time update of secondary classification group key triggered: The corresponding secondary classification group key is triggered when any of the following conditions are met. K 2,i Real-time updates: continuous n L The delay exceeded the limit for one cycle: τ L > τ L th ; Detection of data tampering risk: CRC checksum mismatch or hash digest comparison failure; Updated formula: K 2,i-temp =SM4_Enc( S i ′ , K 1); in, S i ′ This is a temporary key seed; after updating, it will be synchronized to the edge gateway, replacing the original one. K 2,i ; S54: Level 3 terminal session key instant update triggered: The terminal's corresponding Level 3 session key will be triggered if any of the following conditions are met. K 3,j Real-time updates: Abnormal high-frequency access: f j >f j th ; f j th Frequency threshold; Terminal offline reconnection attempt or unauthorized access attempt; Updated formula: K 3,j-temp =SM4_Enc( Z j ′ , K 2,i ); in, Z j ' This is a temporary random seed for the terminal.

8. The key hierarchical management and encryption adaptation method for mine monitoring data transmission according to claim 7, characterized in that, The specific process of step S6 is as follows: S61: Receive encrypted monitoring data packets transmitted by S4 P L parse the transmission frame header FH L Extract data level identifiers ID L Key version number Ver, timestamp t And the CRC checksum, to determine the decryption level of the data packet; S62: Execute the corresponding decryption process based on the decryption level of the data packet. like ID L =0x01, The cloud-based monitoring platform calls the currently valid primary global master key K1 and decrypts the ciphertext block of data using SM4-ECB mode. C 1,k : B 1,k =SM4-Dec( C 1,k , K1); By piecing together and decrypting the data blocks, the original plaintext data of the primary core can be restored. 1,raw ; like ID L =0x02, The cloud-based monitoring platform matches the corresponding secondary classification group key K based on the key version number Ver. 2,2 Decrypting incremental ciphertext C2 using the standard SM4-CBC mode: ΔD2=SM4-Dec(C2, K 2,2 , IV ); By combining historical data citation identifiers, the plaintext D of the secondary important original data is restored. 2,raw ; like ID L =0x03, The cloud-based monitoring platform matches the corresponding Level 3 terminal session key based on the key version number Ver. K 3,j Decrypt the ciphertext C3 to obtain the restored hash digest H3′: H3′=SM4-Dec(C3, K 3,j ); Recalculate the SM3 hash digest H3 for the plaintext D3 of the data packet, compare H3 with H3', and complete the integrity verification. S63: Data Integrity Verification and Restoration Level 1 data: Verify the integrity of the decrypted data block sequence and the consistency of the frame header CRC; Secondary data: Verify the consistency between incremental data and historical data; Level 3 data: Verify that H3=H3'; if they match, the data is complete. After successful verification, the restored original monitoring data will be output. D raw If the verification fails, the abnormal data packet will be discarded and a key update warning will be triggered.

9. A key hierarchical management and encryption adaptation method for mine monitoring data transmission according to claim 7, characterized in that, Step S5 also includes setting up a smooth transition and verification between the old and new keys: Set transition period after key update T trans During the transition period, both the old and new keys are valid in parallel. The cloud and the terminal verify the consistency of the decryption results of the old and new keys respectively. After the verification is passed, the old key is automatically destroyed at the end of the transition period, providing a valid key for S6 layered decryption.

Images