Data encryption method and system for on-board memory chip

Abstract

The application discloses a kind of data encryption method and system of on-board storage chip, and the present application relates to the technical field of data encryption, independent key field corresponding to encryption level mark is called, and corresponding encrypted data stream is generated;Encrypted data stream is input into the encrypted storage area corresponding to on-board storage chip;At the same time, data destruction request signal is collected, the emergency level parameter carried by this data destruction request signal is marked, and the matching of encryption storage area and encryption level mark is combined to determine the corresponding gradient elimination strategy, improve the accuracy of gradient elimination strategy.Based on the security response content of on-board storage chip, the corresponding data self-destruction execution scheme is generated;If the aircraft is in the state of imminent crash or data out of control, load data self-destruction execution scheme, asynchronously eliminate the data area corresponding to each key elimination node, and synchronously trigger the fuse failure processing of key management module.

Description

Technical Field

[0001] This invention relates to the field of data encryption technology, and in particular to a data encryption method and system for an airborne storage chip. Background Technology

[0002] With the continuous improvement of the informatization level of avionics systems, airborne storage chips carry a large amount of classified data related to national security. In complex electromagnetic warfare and battlefield environments, aircraft are at risk of being shot down, captured, or having their data compromised due to network intrusion. Therefore, how to ensure that classified data in airborne storage chips is safely, thoroughly, and on demand destroyed in emergency situations to prevent the leakage of core secrets is a core issue that urgently needs to be addressed in the field of airborne information security.

[0003] Existing technologies often employ a crude destruction model, which indiscriminately erases all data in the storage area once a destruction request is triggered. This approach fails to correlate the encryption level of classified data with the urgency level of the current threat. In actual combat scenarios, indiscriminate destruction may result in high-secret core data not being completely erased due to excessive destruction time, or low-secret non-core data that still needs to maintain mission continuity may be mistakenly deleted. Due to the lack of precise control that combines the characteristics of the encrypted storage area with the urgency level parameters, the accuracy of the gradient elimination strategy is affected, resulting in low effectiveness of the data self-destruction execution scheme. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings of the prior art. This invention provides a data encryption method and system for airborne storage chips.

[0005] This invention provides a data encryption method for an airborne storage chip, comprising: The system obtains classified data from the aircraft's onboard storage chip, determines the corresponding encryption level identifier based on the parsing of the classified data, calls the independent key field corresponding to the encryption level identifier, and generates the corresponding encrypted data stream. The encrypted data stream is input into the encrypted storage area corresponding to the onboard storage chip; at the same time, the data destruction request signal is collected, the urgency level parameter carried by the data destruction request signal is marked, and the corresponding gradient elimination strategy is determined by combining the matching of the encrypted storage area and the encryption level identifier. Based on the identification of the gradient elimination strategy, the corresponding destruction execution path is determined, multiple key elimination nodes and their destruction priorities are marked, and the security response content of the airborne storage chip is determined in combination with the current state of the key management module integrated in the airborne storage chip, thereby generating the corresponding data self-destruction execution scheme. If the aircraft is in a crash imminent state or data loss state, the data self-destruction execution plan is loaded, and the corresponding hardware control logic is activated sequentially along the destruction execution path; the data areas corresponding to each key elimination node are asynchronously eliminated, and the circuit breaker failure processing of the key management module is triggered synchronously.

[0006] This invention provides a data encryption system for an airborne storage chip, which is applied to the aforementioned data encryption method for airborne storage chips; the data encryption system for the airborne storage chip includes: The hardware control module is used to acquire classified data from the aircraft's onboard storage chip, determine the corresponding encryption level identifier based on the parsing of the classified data, call the independent key field corresponding to the encryption level identifier, and generate the corresponding encrypted data stream. The gradient elimination module is used to input the encrypted data stream into the encrypted storage area corresponding to the airborne storage chip; at the same time, it collects the data destruction request signal, marks the urgency level parameter carried by the data destruction request signal, and determines the corresponding gradient elimination strategy by combining the matching of the encrypted storage area and the encryption level identifier. The data self-destruct module is used to determine the corresponding destruction execution path based on the identification of the gradient elimination strategy, mark multiple key elimination nodes and their destruction priorities, and determine the security response content of the airborne storage chip in combination with the current state of the key management module integrated in the airborne storage chip, thereby generating the corresponding data self-destruction execution scheme. The failure module is used to load a data self-destruction execution plan if the aircraft is in a crash imminent state or data loss state, and to activate the corresponding hardware control logic sequentially along the destruction execution path; to asynchronously eliminate the data areas corresponding to each key elimination node, and synchronously trigger the circuit breaker failure processing of the key management module.

[0007] Compared with the prior art, the beneficial effects of the present invention are: (1) Obtain classified data from the aircraft’s onboard storage chip, determine the corresponding encryption level identifier based on the parsing of the classified data, call the independent key field corresponding to the encryption level identifier, and generate the corresponding encrypted data stream; input the encrypted data stream into the encrypted storage area corresponding to the onboard storage chip; at the same time, collect the data destruction request signal, mark the emergency level parameter carried by the data destruction request signal, and determine the corresponding gradient elimination strategy by combining the matching of the encrypted storage area and the encryption level identifier. The introduction of the encrypted data stream further controls the encrypted storage area and the emergency level parameter, and improves the accuracy of the gradient elimination strategy.

[0008] (2) Based on the identification of the gradient elimination strategy, the corresponding destruction execution path is determined, multiple key elimination nodes and their destruction priorities are marked, and the security response content of the airborne storage chip is determined in combination with the current state of the key management module integrated in the airborne storage chip, thereby generating the corresponding data self-destruction execution scheme; if the aircraft is in a crash imminent state or data out of control state, the data self-destruction execution scheme is loaded, and the corresponding hardware control logic is activated sequentially along the destruction execution path; the data areas corresponding to each key elimination node are asynchronously eliminated, and the circuit breaker failure processing of the key management module is triggered synchronously, further controlling the security response content of the airborne storage chip, fully considering the hardware control logic, and improving the effectiveness of the data self-destruction execution scheme. Attached Figure Description

[0009] Figure 1 This is a flowchart illustrating the data encryption method for an airborne storage chip in an embodiment of the present invention; Figure 2 This is a flowchart illustrating step S11 of the data encryption method for an airborne storage chip in an embodiment of the present invention. Figure 3 This is a flowchart illustrating step S12 of the data encryption method for an airborne storage chip in an embodiment of the present invention. Figure 4 This is a flowchart illustrating step S13 of the data encryption method for an airborne storage chip in an embodiment of the present invention. Figure 5 This is a flowchart illustrating step S14 of the data encryption method for an airborne storage chip in an embodiment of the present invention. Figure 6 This is a schematic diagram of the structural composition of the data encryption system of the airborne storage chip in an embodiment of the present invention. Detailed Implementation

[0010] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.

[0011] Please see Figures 1 to 6 A data encryption method for an airborne storage chip, applied in data encryption scenarios; the data encryption method for the airborne storage chip includes: Step S11: Obtain classified data from the aircraft's onboard storage chip, determine the corresponding encryption level identifier based on the parsing of the classified data, call the independent key field corresponding to the encryption level identifier, and generate the corresponding encrypted data stream. Step S12: Input the encrypted data stream into the encrypted storage area corresponding to the onboard storage chip; at the same time, collect the data destruction request signal, mark the emergency level parameter carried by the data destruction request signal, and determine the corresponding gradient elimination strategy by combining the matching of the encrypted storage area and the encryption level identifier. Step S13: Based on the identification of the gradient elimination strategy, determine the corresponding destruction execution path, mark multiple key elimination nodes and their destruction priorities, and combine the current state of the key management module integrated in the airborne storage chip to determine the security response content of the airborne storage chip, thereby generating the corresponding data self-destruction execution scheme. Step S14: If the aircraft is in a crash imminent state or data out of control state, load the data self-destruction execution plan, and activate the corresponding hardware control logic sequentially along the destruction execution path; asynchronously eliminate the data areas corresponding to each key elimination node, and synchronously trigger the circuit breaker failure processing of the key management module.

[0012] refer to Figure 2 In step S11, the specific steps are as follows: S111: The onboard storage chip of the aircraft is marked. The onboard storage chip integrates a data preprocessing unit based on full-link perception. The data preprocessing unit acquires classified data in the airborne environment in real time and determines the corresponding feature vector based on the parsing of the classified data. It further loads a preset multi-dimensional security level strategy mechanism to determine the encryption level identifier corresponding to the classified data. The encryption level identifier includes top secret, confidential and secret levels. S112: Call the independent key field corresponding to the encryption level identifier. Each independent key field uses a physically isolated key generation hardware module, and different encryption level identifiers correspond to random number generators with different security entropy sources. The encryption window size is adaptively adjusted according to real-time data traffic fluctuations to generate the corresponding encrypted data stream.

[0013] In the embodiments of this application, the onboard storage chip of the aircraft is marked. The onboard storage chip integrates a data preprocessing unit based on end-to-end perception. The data preprocessing unit acquires classified data in the airborne environment in real time, and determines the corresponding feature vector based on the parsing of the classified data. It further loads a preset multi-dimensional security level strategy mechanism to determine the encryption level identifier corresponding to the classified data. The encryption level identifier includes top secret, confidential, and secret levels, which is compatible with the overall consideration of classified data and ensures the accuracy of the corresponding feature vector.

[0014] At this point, the aircraft's onboard storage chip is marked with both physical and logical tags to establish a unique addressing and security control base for the chip in the distributed storage architecture. Inside the onboard storage chip, a data preprocessing unit based on end-to-end awareness is integrated and initialized. This data preprocessing unit serves as the first-level security barrier for data ingress. The end-to-end awareness mechanism runs through the entire lifecycle from data capture, protocol parsing, feature extraction to security level determination, ensuring that classified data flowing into the airborne environment is under mandatory control before it is written to disk, thereby eliminating the risk of plaintext data being exposed on the chip's internal bus. When an aircraft enters a sensitive area to carry out a reconnaissance mission, airborne sensors such as electro-optical radar, synthetic aperture radar, and signal reconnaissance generate massive amounts of reconnaissance data. The data preprocessing unit of the airborne storage chip acquires the classified data streams in the airborne environment in real time through a high-speed data bus. The preprocessing unit performs low-level protocol stripping and deep message parsing on the classified data streams, identifies the "type attributes" of the data payload, such as image frames, radar pulse descriptors, communication signal frequency bands, etc., and the metadata information they carry, providing a structured data source for the subsequent construction of feature vectors.

[0015] Based on the parsed structured classified data, the data preprocessing unit extracts multi-dimensional security and business features and constructs feature vectors. These feature vectors include, but are not limited to, the security level identifier of the data source sensor, the threat index of the sensitive area where the reconnaissance target is located, the entropy distribution characteristics of the data payload, and time-frequency feature parameters. To reduce computational overhead and eliminate redundant interference, the preprocessing unit uses a feature selection algorithm to reduce and map the above initial high-dimensional features, generating a fixed-length feature vector with high representational ability to accurately represent the inherent attributes and sensitivity of the current classified data.

[0016] Within the secure storage area of ​​the onboard storage chip, a multi-dimensional security level strategy mechanism is pre-installed and loaded. This mechanism consists of a security level determination rule base, a weight allocation matrix, and a decision tree model. The preprocessing unit inputs the aforementioned generated feature vectors into this multi-dimensional security level strategy mechanism. The decision tree model performs step-by-step conditional branching based on the parameters of each dimension in the feature vectors and calculates a comprehensive sensitivity score in conjunction with the weight allocation matrix. This multi-dimensional security level strategy mechanism comprehensively considers data source attributes, regional sensitivity, and inherent content characteristics to ensure multi-dimensional cross-validation and tamper resistance in security level determination.

[0017] Based on the comprehensive sensitivity score output by the multi-dimensional security level strategy mechanism, it is mapped and compared with the preset security level threshold range to determine the encryption level identifier corresponding to the current classified data. The encryption level identifier is strictly divided into top secret, confidential, and secret levels, and a security level label with a timestamp and data handle is generated. The security level label is bound and encapsulated with the original classified data as the unique index credential for subsequent calls to independent key fields and differentiated encryption algorithms.

[0018] Specifically, when the aircraft flies into a sensitive area for close reconnaissance, its high-resolution optical camera captures images of new military facilities of strategic value within the sensitive area, and this image data flows into the onboard storage chip in real time as classified data.

[0019] The airborne storage chip is designated as the core storage node for processing reconnaissance operations. Its built-in end-to-end sensing data preprocessing unit captures the image data stream. The preprocessing unit parses the image data stream, extracts the video frame header information, identifies the current frame as a high-resolution optical image, and extracts metadata, such as the shooting coordinates being located in the core area of ​​a sensitive region.

[0020] The preprocessing unit constructs a feature vector containing [data source = high-precision optical camera (weight 0.3), coordinate region = , core area of ​​sensitive region (weight 0.5), image entropy value = high complexity (weight 0.2)]. A multi-dimensional security classification strategy mechanism is loaded, and the decision tree model determines that the data source is a high-value reconnaissance source, and the coordinates fall within the core area of ​​the sensitive region. The image entropy value represents a large amount of information, and the comprehensive score exceeds the top-secret threshold. This classified image data is then precisely marked as "top-secret" encryption. Conversely, if the aircraft only detects conventional terrain or non-core meteorological text data at the edge of a sensitive region, and its feature vector has a low comprehensive score after being processed by the multi-dimensional security classification strategy mechanism, it is marked as "secret" encryption. Through this process, the airborne storage chip achieves adaptive dynamic security classification based on data content and mission scenario.

[0021] Furthermore, the independent key field corresponding to the encryption level identifier is invoked. Each independent key field uses a physically isolated key generation hardware module, and different encryption level identifiers correspond to random number generators with different security entropy sources. The encryption window size is adaptively adjusted according to real-time data traffic fluctuations to generate the corresponding encrypted data stream, thus introducing the corresponding encrypted data stream.

[0022] At this point, based on the encryption level identifier (Top Secret, Confidential, or Secret), the key bus routing module inside the onboard storage chip parses the identifier and generates a corresponding domain selection enable signal to call the independent key domain uniquely mapped to the encryption level identifier. The independent key domain adopts a deep trench isolation and independent power supply network design in the chip semiconductor physical layout to achieve physical-level side-channel attack isolation between different encryption level domains, ensuring that the computing power consumption and electromagnetic radiation characteristics of the high-encryption level key domain will not cause crosstalk and leakage to the low-encryption level domain, thereby building a physical boundary for encryption level control at the hardware topology level.

[0023] Within the selected independent key domain, the corresponding physically isolated key generation hardware module is activated. For different encryption level identifiers, each key generation hardware module embeds a random number generator with different security entropy source levels: the top-secret independent key domain is configured with a high-bandwidth true random number generator (TRNG) based on quantum tunneling effect or thermal noise as a security entropy source, the confidential independent key domain is configured with a TRNG entropy source based on ring oscillator jitter, and the secret independent key domain is configured with an entropy source based on a mixture of deterministic random bit generator (DRBG) and physical noise. The above heterogeneous entropy source architecture ensures that the high-secret key has extremely high information entropy and unpredictability in the generation process. The key generation hardware module dynamically derives the working key of the current session based on this random number through the key derivation function (KDF).

[0024] Optionally, if the classified data is determined to be top secret, the key bus routing module only outputs a high-level enable signal to the top-secret key domain, while forcibly pulling the enable signals of the other two key domains down to a low level, thus preventing accidental cross-domain calls at the hardware level. The selected independent key domain then activates its internal key generation hardware module, which contains a high-bandwidth true random number generator based on the quantum tunneling effect to generate an initial entropy source seed. This seed is input to the key derivation function, and combined with the unique context parameters of the current session, dynamically derives the working key for this encryption operation. This working key is transmitted to the hardware encryption engine via an independent secure die bus within the chip, either in ciphertext or with verification, for performing encryption operations on the plaintext classified data.

[0025] Conversely, if the classified data is determined to be either confidential or secret, the corresponding independent key field is invoked, and a random number generator with a lower security entropy source level is activated to derive a session key of appropriate strength. Throughout the process, the mapping relationship between the encryption level identifier and the independent key field is directly parsed and executed by the hardware logic without software intervention, thus ensuring the determinism and tamper resistance of the mapping.

[0026] The data flow control unit of the airborne storage chip monitors the data flow fluctuation status on the airborne bus in real time and extracts the data packet arrival rate and load ratio per unit time as flow characteristic parameters. When a "sudden increase in data flow, such as a sudden burst of detection by a sensor" is detected, in order to avoid the encryption engine becoming a throughput bottleneck, the control unit adaptively expands the encryption window size according to the preset flow-window mapping strategy, that is, aggregating multiple consecutive plaintext data blocks into a macroblock for single key loading and encryption context initialization. When a decrease in data flow is detected, the encryption window size is adaptively reduced, and encryption is performed on a fine-grained data block basis, thereby achieving a dynamic balance between system encryption throughput and real-time performance while ensuring encryption strength.

[0027] The key generation hardware module privately transmits the derived working key to the hardware encryption engine via the chip's secure die bus. The encryption engine performs stream cipher or block cipher encryption operations on the plaintext data stream within the adaptive encryption window according to the algorithm strength requirements corresponding to the current encryption level identifier. For example, top secret level uses SM4 / 256-bit or AES-256, confidential level uses SM4 / 192-bit, and secret level uses SM4 / 128-bit. After encryption, the encryption engine encapsulates the security level identifier label, window sequence number, and integrity check code in the header of the ciphertext data packet, thereby generating an encrypted data stream with anti-tampering and anti-replay attack capabilities, which is then output to the subsequent caching and storage scheduling module.

[0028] Specifically, the key bus routing module of the airborne storage chip resolves the "Top Secret" identifier, generates a high-level enable signal, and calls the physically isolated Top Secret independent key field inside the chip. This area is physically isolated from the Confidential and Secret fields. The key generation hardware module in the Top Secret key field is awakened, and a true random number generator based on the quantum tunneling effect is started as a high-security entropy source to generate an initial random seed with the highest information entropy and derive the Top Secret working key.

[0029] Meanwhile, due to strong electromagnetic interference encountered by the aircraft over a sensitive area, the sensor data stream exhibited instantaneous explosive fluctuations. The data stream control unit of the onboard storage chip detected the surge in traffic and adaptively expanded the encryption window from a single frame size to a macroblock window that aggregates multiple frames. The hardware encryption engine received the top-secret working key and used the highest-strength encryption algorithm, such as AES-256, to perform high-speed encryption on the video stream within the macroblock window, which was then encapsulated to generate a top-secret encrypted data stream.

[0030] Conversely, if the aircraft simultaneously collects atmospheric environmental text parameters of a sensitive area during the same reconnaissance mission and determines them to be "secret," the system calls a physically isolated secret-level independent key field, activates a random number generator based on a DRBG hybrid entropy source to generate a standard strength key, and because the environmental data flow is smooth, the encryption window adaptively shrinks to a single message granularity, using a standard "strength algorithm: such as AES-128" to generate a secret-level encrypted data stream. Through the above mechanism, the airborne storage chip achieves a precise adaptive match between security level and computing power, and between security and efficiency in complex reconnaissance scenarios.

[0031] refer to Figure 3 In step S12, the specific steps are as follows: S121: Obtain the encrypted storage area corresponding to the airborne storage chip. The encrypted storage area is dynamically divided into multiple data storage areas with independent access control logic. Input the encrypted data stream to the corresponding data storage area. At the same time, establish a global situational awareness monitoring loop to collect data destruction request signals in real time. S122: Decode the data destruction request signal and extract the urgency level parameter carried by the data destruction request signal. The urgency level parameter is used to characterize the urgency of the current threat. Combine the urgency level parameter with the physical address of the encrypted storage area and synchronously map the security weight corresponding to the encryption level identifier to obtain the gradient elimination strategy in the current environment. The gradient elimination strategy defines the priority response relationship of different security levels of data in the destruction sequence.

[0032] In the embodiments of this application, the encrypted storage area corresponding to the airborne storage chip is obtained. The encrypted storage area is dynamically divided into multiple data storage areas with independent access control logic. The encrypted data stream is input to the corresponding data storage area. At the same time, a global situational awareness monitoring loop is established to collect data destruction request signals in real time. The collection of data destruction request signals is introduced.

[0033] At this point, the encrypted storage area corresponding to the onboard storage chip is obtained. This encrypted storage area is dynamically divided into multiple data storage areas with independent access control logic on the physical storage medium. The encryption level identifier and real-time write load determined by the dynamic partitioning mechanism are dynamically allocated by the storage microcontroller inside the chip to the physical address boundaries of the storage blocks. An independent access control logic list is configured for each partitioned data storage area. This list includes the area's security level attribute, read and write permission bits, and cross-domain access prohibition flag, so that the top secret, confidential, and secret data storage areas are logically hard isolated, blocking unauthorized access and cross-domain side-channel attack paths.

[0034] The encrypted data stream, based on the encryption level identifier tag carried in its package header, is directed to the corresponding security level data storage area through the secure write data channel inside the chip. During the input process, the storage microcontroller performs hardware-level matching and verification between the security level tag of the encrypted data stream and the access control logic of the target data storage area. Only when the security level of the data stream matches the security level of the area and the write permission is valid, a write enable signal is triggered to physically write the encrypted data stream to disk. Otherwise, the write is rejected and a security exception interrupt is triggered, thereby ensuring that high-security level encrypted data will never be downgraded to a low-security level area due to routing errors.

[0035] Inside the airborne storage chip, a global situational awareness monitoring loop is established that runs through all data storage areas, access control logic modules, and external sensor interfaces. This monitoring loop uses independent physical detection traces and interrupt response networks to monitor the chip's internal status registers, power fluctuations, and external bus control signals in real time. This enables multi-dimensional parallel monitoring of storage area temperature, voltage, read / write frequency, and bus instruction types, thereby building a highly real-time and highly reliable environment and status awareness neural network at the hardware topology level.

[0036] Based on the aforementioned all-domain situational awareness monitoring loop, the airborne storage chip uses a combination of polling and hard interrupts to collect data destruction request signals triggered by airborne avionics systems, emergency control units, or self-developed sensors in real time. The data destruction request signals include crash warning levels, self-destruct command messages, or physical anti-tamper trigger signals. After the monitoring loop performs de-jitter filtering and signal integrity verification on the above signals, it converts them into standardized destruction interrupt events and pushes them to the subsequent safety decision-making module to ensure zero-latency capture and no omission of destruction requests under extreme situations.

[0037] Specifically, the onboard storage chip acquires its encrypted storage area, and the storage microcontroller dynamically divides the area into a first region and a second region based on the load. The first region is configured with top-secret access control logic, which only responds to write enable with the highest privileges, while the second region is configured with secret access control logic. Top-secret optical encrypted data streams are routed to the first region via a secure write channel, while secret meteorological encrypted data streams are routed to the second region. During this process, the microcontroller strictly verifies the security level matching degree, and top-secret data cannot be mistakenly written to the second region due to the physical isolation mechanism.

[0038] When the aircraft is locked onto by enemy air defense radar over a sensitive area, the onboard flight control system issues an evasion command. At this time, the global situational awareness monitoring loop already established inside the onboard storage chip not only monitors the write status of the first and second regions in real time, but also captures abnormal signals on the onboard avionics bus in real time.

[0039] When the flight control system determines that there is a risk of being shot down and issues a "Level 1 crash warning" signal, the signal is instantly captured by the monitoring circuit through an independent detection line. After debouncing and verification, it is immediately pushed into the chip's safety decision queue as a data destruction request signal, thus gaining a millisecond-level first-hand response time for subsequent gradient erasure.

[0040] Furthermore, the data destruction request signal is decoded, and the urgency level parameter carried by the data destruction request signal is extracted. The urgency level parameter is used to characterize the urgency of the current threat. Combining the urgency level parameter with the physical address of the encrypted storage area, and synchronously mapping the security weights corresponding to the encryption level identifier, a gradient elimination strategy for the current environment is obtained. The gradient elimination strategy defines the priority response relationship of data with different security levels in the destruction sequence, introduces encrypted data streams, further controls the encrypted storage area and urgency level parameter, and improves the accuracy of the gradient elimination strategy.

[0041] At this time, the security control logic of the airborne storage chip receives the data destruction request signal transmitted by the global situational awareness monitoring loop. It uses the embedded signal decoding matrix to strip the protocol and restore the waveform of the request signal, and extracts the emergency level parameter encapsulated in it. The emergency level parameter is a multi-bit encoded field used to quantify the urgency of the threat currently faced by the aircraft. For example, level 1 indicates that the aircraft is locked on by enemy fire and is about to crash; level 2 indicates that the communication link has been compromised and the data is out of control; and level 3 indicates that the conventional anti-tampering is triggered. This parameter serves as the initial boundary constraint for the subsequent triggering gradient elimination strategy and determines the time margin of the data destruction task.

[0042] The extracted urgency level parameters are jointly parsed with the physical address topology of the encrypted storage area. Since the encrypted storage area is dynamically divided into multiple data storage regions with independent access control logic, each region has a defined physical address range and bit width boundary on the chip silicon wafer. The security control logic adjusts the addressing weight of the physical address according to the urgency level parameters. When the urgency level is extremely high, the physical address segment where the high-security data is located is locked first. Combining the dielectric breakdown characteristics of the storage medium inside the chip and the data overwrite delay parameters, the time cost required for each physical address segment to complete reliable destruction is calculated, thereby establishing a time constraint mapping relationship between the physical address space and the urgency level.

[0043] Based on physical address mapping, the security control logic synchronously reads the encryption level identifiers of the encrypted data streams stored in each data storage area (Top Secret, Confidential, and Secret) and inputs them into a preset security weight allocation model. This model assigns differentiated security weight factors to different security level identifiers according to a multi-dimensional security level strategy mechanism. For example, Top Secret is assigned a weight of 0.7, Confidential 0.2, and Secret 0.1. The weight factor is positively correlated with the sensitivity of the data and the depth of harm after it is deciphered. This security weight serves as the core criterion for scheduling and destroying concurrent resources, ensuring that limited destruction bandwidth and timing resources are tilted towards nodes with high security weights.

[0044] Based on the time constraints of the aforementioned urgency level parameters, the topology overhead of the encrypted storage area's physical address, and the security weight of the encryption level identifier, the security control logic dynamically solves the problem using a multi-objective optimization algorithm to generate a gradient elimination strategy for the current environment. This gradient elimination strategy defines the priority response relationship of data with different security levels in the destruction sequence, specifically as follows: When the urgency level is extremely high, the strategy strictly follows the descending order of security weights, that is, top secret data receives the highest destruction priority and the most thorough physical destruction resources, followed by confidential data, and secret data is only logically erased or retained; when the urgency level is low and there is sufficient time margin, the strategy can allocate resources to complete the complete destruction of all confidential data in sequence, thereby achieving the optimal balance between threat urgency and data security.

[0045] Optionally, for the gradient elimination strategy, when the urgency level is 1 and the time window is capped at 900 microseconds, the top-secret region requires 800 microseconds with a weight of 0.7, the confidential region requires 400 microseconds with a weight of 0.2, and the secret region requires 60 microseconds with a weight of 0.1. Since 900 microseconds is insufficient to accommodate the combined destruction time of the top-secret and confidential regions, the decision-making process prioritizes the top-secret region in the strategy, with a destruction time of 800 microseconds. The remaining time window is only 100 microseconds, insufficient to complete the 400-microsecond destruction of the confidential region. Therefore, both confidential and secret regions are postponed, and the final gradient elimination strategy contains only one instruction: prioritize and only perform physical breakdown destruction on the top-secret region. If the urgency level is 2 and the time window is ample to 2000 microseconds, the strategy sequentially includes destruction instructions for the top-secret, confidential, and secret regions.

[0046] Specifically, the security control logic of the airborne storage chip decodes the signal and extracts the emergency level parameter as "Level 1: Crash Imminent", indicating that the current threat is extremely urgent and the system has only a millisecond-level time window to perform destruction. The security logic merges the "Level 1" parameter with the physical address of the encrypted storage area, locks the "first area: physical address 0x0000-0x0FFF" storing top-secret reconnaissance images and the "second area: physical address 0x1000-0x1FFF" storing secret meteorological data, and assesses that the time required for the complete destruction of the first area is approaching the system limit.

[0047] The security weights of the encryption level identifiers are mapped synchronously. Top-secret data in the first area is assigned an extremely high weight of 0.7, while secret data in the second area has a weight of only 0.1. Based on the above fusion calculation, the airborne storage chip dynamically generates a gradient elimination strategy: under the time constraint of impending crash, the destruction priority is strictly arranged in descending order of security weight. The strategy instruction "First Area: Top-secret" takes priority to exclusively use the internal high-voltage breakdown logic for physical destruction. "Second Area: Secret" is judged to be retained or only have lightweight logic block erasure in this strategy due to its extremely low weight and insufficient time. Thus, in the instant of irreversible crash, the most critical reconnaissance data in sensitive areas is absolutely destroyed, achieving a balance between security and gradient response under extreme conditions.

[0048] refer to Figure 4 In step S13, the specific steps are as follows: S131: Perform logical analysis on the gradient elimination strategy and construct the corresponding directed acyclic graph during the analysis. Use the directed acyclic graph as the destruction execution path. The destruction execution path is marked with multiple key elimination nodes. Each key elimination node corresponds to a specific logical page in the onboard storage chip. Determine the destruction priority of each key elimination node based on the criticality of the data in each key elimination node and the corresponding refresh frequency. S132: Monitor the key management module integrated in the airborne storage chip in real time and dynamically poll the current status of the key management module to detect the operation and latching status of the key management module. Further combine the load of the airborne storage chip to determine the security response content of the airborne storage chip. Based on the security response content and the previous execution content of the airborne storage chip, determine the corresponding data self-destruction execution scheme. The data self-destruction execution scheme includes the fuse instruction sequence, voltage overload parameters and physical erase timing. In the embodiments of this application, the gradient elimination strategy is logically parsed, and a corresponding directed acyclic graph is constructed during the parsing process. The directed acyclic graph is used as the destruction execution path, and multiple key elimination nodes are marked in the destruction execution path. Each key elimination node corresponds to a specific logical page in the onboard storage chip. The destruction priority of each key elimination node is determined according to the criticality of the data in each key elimination node and the corresponding refresh frequency. This approach takes into account the overall criticality of the data in each key elimination node and the corresponding refresh frequency, ensuring the accuracy of the destruction priority of each key elimination node.

[0049] At this point, the security scheduling engine inside the onboard storage chip performs logical parsing on the aforementioned gradient elimination strategy, extracting the density-level response relationship, timing constraints, and resource allocation rules contained in the strategy. Based on the parsed set of rules, the security scheduling engine constructs a corresponding directed acyclic graph (DAG) in the chip memory. The DAG uses nodes to represent destruction action entities and directed edges to represent the execution dependencies and timing relationships between actions, thereby transforming the abstract gradient strategy into strict topological execution logic. This ensures that there is no deadlock risk due to circular waiting during the destruction process, forming a destruction execution path with unidirectional convergence characteristics.

[0050] In the constructed directed acyclic graph, multiple critical elimination nodes are marked. Each critical elimination node is not an abstract storage area, but rather corresponds precisely to a specific logical page in the onboard storage chip through the chip's internal bus address mapping mechanism. The logical page is the smallest addressable and erasable unit of the storage medium. The security scheduling engine breaks down the high-density destruction tasks in the gradient elimination strategy and distributes them to specific logical page addresses, so that each critical elimination node carries micro-operation instructions to perform overwrite, erase, or physical breakdown on a specific logical page, thereby achieving precise sinking of the destruction granularity from the macro region to the micro logical page.

[0051] For each critical elimination node in the directed acyclic graph, the security scheduling engine extracts the criticality parameter and refresh frequency parameter of the data within the logical page corresponding to that node. The criticality parameter is determined by the aforementioned encryption level identifier and security weight, representing the depth of harm after the data is obtained by the adversary. The refresh frequency parameter represents the frequency with which the logical page is read and written by the host during normal operation. A high refresh frequency means that the data is in a high-frequency active state, and its remaining plaintext remnants or cached features are more easily captured by the side channel. The security scheduling engine performs weighted calculations on the above two-dimensional parameters according to a preset priority evaluation model. Logical pages with higher criticality and higher refresh frequency are assigned higher destruction priority to their corresponding critical elimination nodes, and vice versa, thereby establishing the absolute execution order of multi-branch concurrent destruction in the topology path.

[0052] Specifically, the security scheduling engine performs logical analysis on the currently generated gradient elimination strategy of "prioritizing top secret, taking into account confidential, and retaining secret". It constructs a directed acyclic graph (DAG) with multiple concurrent branches in the internal register as the destruction execution path. The engine precisely anchors the key elimination nodes in the graph to the physical storage medium. For example, the task of "destroying top secret reconnaissance images" is decomposed into ten key elimination nodes corresponding to logical pages Page_0x01 to Page_0x0A of the storage medium, and the task of "destroying secret meteorological parameters" is mapped to the node on Page_0x80.

[0053] In the priority determination phase, for different data pages belonging to the same top-secret level, the engine detected that Page_0x01 stores real-time video streams of the core sensitive area, which is of extremely high importance and is in a state of continuous writing and high refresh rate, while Page_0x0A stores static images of the previously planned route with an extremely low refresh rate. Based on the priority evaluation model, the Page_0x01 node is assigned the "highest destruction priority: such as priority 0", the Page_0x0A node is assigned the "second highest priority: such as priority 1", and the secret-level Page_0x80 node is assigned the "lowest priority: such as priority 9". Thus, within an extreme time window, the onboard storage chip prioritizes the destructive erasure of the core video logical pages of the sensitive area that are frequently active, ensuring that the most dangerous and active classified data is completely erased first.

[0054] Furthermore, the key management module integrated into the airborne storage chip is monitored in real time, and its current status is dynamically polled to detect its operation and latching status. The security response content of the airborne storage chip is then determined based on its load conditions and past execution patterns. This data self-destruction execution scheme includes a fuse trigger sequence, voltage overload parameters, and physical erase timing, taking into account the overall characteristics of the airborne storage chip and ensuring the accuracy of its security response content.

[0055] At this time, the security master controller inside the onboard storage chip monitors and polls the integrated key management module in real time and at high frequency through a dedicated on-chip bus. The polling operation reads the hardware status register of the key management module at microsecond intervals to detect its "operational status: such as the busy / idle status of the cryptographic operation engine and the frequency drift of the internal oscillator" and "latch status: such as whether the master key is in the secure latch bit and whether the key reading anti-tampering sensor has been triggered". This builds a health and availability profile of the key management module in the time dimension, ensuring that the subsequent self-destruct scheme has a precise execution anchor point at the key level.

[0056] While acquiring the status of the key management module, the security controller simultaneously collects the load information of the onboard storage chip, including storage bus occupancy, read / write queue depth, and storage medium temperature parameters. The security controller performs a joint matrix evaluation with the current status of the key management module: if the key module is in a latched secure state and the chip load is at critical overload, the security response tends to be "lightweight key destruction + logic block erasure" to avoid hardware thermal runaway; if the key module is in an unauthorized intrusion alarm state and the chip load has sufficient margin, the security response is upgraded to the highest response level of "key melting + high-voltage physical breakdown", thereby achieving dynamic adaptation between the security response strategy and the chip's real-time physical load capacity.

[0057] The security controller retrieves past execution data recorded in the non-volatile memory area. This data includes the success rate of historical gradient elimination, the wear leveling of logic pages, and the peak drift of historical voltage overload. By fitting and extrapolating the aforementioned security response data with historical execution characteristics, a customized data self-destruction execution scheme is generated. This scheme includes "fuse-off instruction sequence: defining the order of key fuse-off and irreversible register write instructions", "voltage overload parameters: dielectric breakdown voltage accurate to the millivolt level and overload duration", and "physical erase timing: clock ticks and intervals for asynchronous erase of each logic page". This ensures that the self-destruction scheme has 100% executability and irreversibility under the current physical degradation state of the chip.

[0058] Specifically, the security controller of the onboard storage chip dynamically polls the internal key management module and detects that the hardware tamper protection sensor of the top-secret key domain has been triggered, and the key is currently in a "dangerous intrusion latch state," but the cryptographic operation engine is still online. At the same time, the controller reads that the current read / write queue depth of the chip has reached 85%, the load is extremely high, and it is busy writing the last batch of sensitive area images. Based on this state and load, the security controller determines the security response to "immediately execute the highest-level key circuit breaker and temporarily postpone large-scale physical breakdown to prevent chip thermal failure."

[0059] The security controller read past execution data and discovered that the logic pages responsible for storing top-secret video data had been frequently overwritten, indicating a decrease in the dielectric breakdown voltage threshold due to wear. Based on this historical characteristic, the security controller dynamically modified and generated the final data self-destruction execution plan: In the fuse trigger sequence, fuse trigger commands with all 0xFF were written continuously to the top-secret key field to lock the key; in the voltage overload parameters, the breakdown voltage of severely worn logic pages was reduced from the standard 18V to 16.5V, and the duration was compressed to 50 microseconds to prevent overvoltage from burning out the bus; in the physical erase timing, top-secret nodes were scheduled to execute asynchronously at microsecond intervals, while secret nodes were erased only when the main bus was idle. Thus, the aircraft's onboard storage chip accurately output a convergent and guaranteed self-destruction plan under extreme load and damage conditions.

[0060] refer to Figure 5 In step S14, the specific steps are as follows: S141: Mark the aircraft's sensing network, monitor the aircraft's attitude parameters and bus control status in real time through the sensing network, and determine the aircraft's crash imminent state or data loss state in combination with the aircraft's abnormal data signals. If the aircraft is in a crash imminent state or data loss state, immediately trigger a hardware interrupt signal and simultaneously load the data self-destruct execution plan. S142: In the data self-destruction execution scheme, the hardware control logic corresponding to each key elimination node is activated sequentially along the destruction execution path. A multi-threaded concurrent control mechanism is used to asynchronously eliminate the data area corresponding to each key elimination node. At the same time as the data destruction is executed, the key management module's fuse failure processing is triggered synchronously. The key management module is permanently destroyed by physical fuse burning or high voltage breakdown, making the encrypted data stream in the onboard storage chip completely unrecoverable at the physical level.

[0061] In the embodiments of this application, the aircraft's sensing network is marked, and the aircraft's attitude parameters and bus control status are monitored in real time through the sensing network. Combined with the abnormal data signals of the aircraft, the aircraft's crash imminent state or data loss state is determined. If the aircraft is in a crash imminent state or data loss state, a hardware interrupt signal is immediately triggered, and a data self-destruction execution scheme is loaded simultaneously. This further controls the safety response content of the onboard storage chip, fully considers the hardware control logic, and improves the effectiveness of the data self-destruction execution scheme.

[0062] At this point, the aircraft's perception network is marked. This network consists of multiple heterogeneous sensor nodes distributed within the avionics system, flight control bus, and onboard storage chip's internal sensor array. Through this perception network, the aircraft's "attitude parameters: including pitch angle, roll angle, yaw angle, and three-axis angular velocity" and "bus control status: including the arbitration occupancy status of the bus master controller and command response timeout count" are monitored in real time using a combination of high-frequency polling and event-driven methods. These multi-dimensional parameters are directly transmitted back to the safety decision microcontroller of the onboard storage chip via an independent safety sideband bus, constructing a real-time digital twin mapping between the aircraft's physical situation and data link situation.

[0063] The safety decision microcontroller integrates real-time acquired attitude parameters and bus control status with "abnormal data signals" in the airborne environment, such as fire alarm trigger signals, anti-crash acceleration switch switching signals, and illegal bus tampering injection messages. It then performs logical deductions using pre-set crash approach determination and data loss determination models: when attitude parameters indicate that the aircraft's trajectory has deviated from the controllable envelope and abnormal data signals continuously confirm irreversible damage to the aircraft, the aircraft is determined to be in a crash approach state; when the bus control status indicates that the host interface has lost arbitration and abnormal data signals indicate unauthorized malicious read requests, the aircraft is determined to be in a data loss state.

[0064] Once the logical deduction confirms that the aircraft is in a state of imminent crash or data loss, the safety decision microcontroller of the onboard storage chip immediately unlocks the underlying hardware interrupt mask bit and outputs an unmaskable hardware interrupt signal (NMI) to the self-destruct execution engine inside the chip. This hardware interrupt signal directly penetrates the instruction pipeline on the rising edge of the clock, forcibly suspending all current regular read and write transactions, and simultaneously loading the data self-destruct execution scheme generated in the aforementioned S132 from the protected read-only memory area into the high-speed register file of the self-destruct execution engine, so that the chip state machine atomically switches from the normal operation mode to the physical self-destruct mode within microseconds.

[0065] Specifically, the onboard storage chip monitors in real time through a marked sensing network that: the aircraft's attitude parameters undergo a drastic change, the roll angle instantly exceeds 60 degrees and the pitch angle drops sharply, the bus control status shows that the main flight control computer's polling cycle for the storage bus has seriously exceeded the limit, accompanied by abnormal data signals, the fuselage crash protection sensor outputs a high level, and an unauthenticated retry message is detected at the bus end; the safety decision microcontroller fuses and judges the above signals, confirms that the aircraft's trajectory has deviated irreversibly and that the system is at risk of being taken over by enemy electronic warfare and losing data control, that is, it determines that the aircraft has simultaneously entered the "crash imminent state" and the "data loss state".

[0066] The moment this extreme state is established, the microcontroller immediately triggers the highest priority hardware interrupt signal. This interrupt signal instantly severs the physical link between the onboard storage chip and the external avionics bus, forcibly stopping any possible spying or reading operations by the enemy. Simultaneously, a data self-destruction execution plan containing the "top secret key melting instruction sequence, 16.5V voltage overload parameters, and microsecond-level physical erase timing sequence" is loaded into the top-level register of the execution engine, securing a decisive millisecond-level first-mover advantage for the subsequent complete physical destruction of core reconnaissance data in sensitive areas.

[0067] Furthermore, in the data self-destruction execution scheme, the hardware control logic corresponding to each key elimination node is activated sequentially along the destruction execution path, and a multi-threaded concurrent control mechanism is used to asynchronously eliminate the data area corresponding to each key elimination node; while the data destruction is being executed, the key management module's fuse failure processing is triggered synchronously, and the key management module is permanently destroyed by physical fuse burning or high voltage breakdown, making the encrypted data stream in the onboard storage chip completely unrecoverable at the physical level, thus introducing the concept that the encrypted data stream in the onboard storage chip is completely unrecoverable at the physical level.

[0068] At this point, the self-destruct execution engine of the onboard storage chip receives the loaded data self-destruct execution scheme and, along the destruction execution path defined by the aforementioned directed acyclic graph, generates on-chip addressing enable signals in sequence according to the destruction priority of each key elimination node. The addressing enable signals precisely point to the physical address of the specific logical page corresponding to each key elimination node and sequentially activate the hardware control logic bound to that logical page, such as the charge pump boost circuit, word line / bit line gating switch, and erase state machine. This ensures that "high-priority nodes: top-secret active data pages" obtain hardware execution resources first, while low-priority nodes enter the pending execution state according to the path topology order, ensuring that the destruction action is strictly controlled and irreversibly advanced in terms of timing.

[0069] Optionally, the onboard memory chip is equipped with independent hardware control logic for each logical page. This hardware control logic mainly consists of three parts: a page address decoder, a charge pump boost circuit, and an erase state machine; the page address decoder is responsible for receiving the address enable signal from the self-destruct execution engine and connecting this signal to the word line and bit line gating switches in the chip's memory array.

[0070] When the physical address carried by the address enable signal matches the address of a logic page, the decoder outputs a high-level pulse, closing the word line gating switch and bit line gating switch corresponding to that logic page, thereby electrically connecting that logic page to the charge pump boost circuit and the erase state machine. The charge pump boost circuit is composed of multiple voltage multiplier rectifier units connected in series. Its input is the chip's internal 3.3V power supply, and its output can be adjusted in steps between 15V and 20V. The erase state machine is a hardwired finite state automaton containing five states: idle, precharge, erase pulse application, erase verification, and complete, without relying on any software instructions.

[0071] After the hardware control logic is activated, the self-destruct execution engine uses a multi-threaded concurrent control mechanism to asynchronously erase the data areas corresponding to each critical erasure node. The multi-threaded concurrent control mechanism is manifested in the microcontroller inside the chip distributing multiple independent erase instruction contexts in parallel, so that critical erasure nodes distributed in different memory array banks or different logical page areas can synchronously perform high-voltage overwrite or block erase operations without clock dependence and interlock waiting. This asynchronous erasure mode breaks the bandwidth bottleneck of serial erasure, maximizes the data throughput destruction rate within the extreme time window of the aircraft crash, and ensures that high-density and high-refresh-frequency sensitive data are erased concurrently by multiple points in a very short time.

[0072] While the asynchronous data erasure is being performed, the security controller synchronously outputs an unmaskable circuit breaker signal to the key management module. The circuit breaker signal acts directly on the power supply and control top layer of the key management module, bypassing any software-interventionable register interface, and forcibly starts the self-destruct routine of the key management module. This allows the key destruction and data erasure to overlap in parallel with zero latency on the time axis, preventing attackers from using the time difference in data erasure to intercept keys and reverse-engineer ciphertext.

[0073] After responding to the fuse trigger signal, the key management module performs permanent physical destruction. It applies an overrated current to the on-chip integrated laser-tuned fuse array, causing the physical fuse to undergo irreversible thermal melting and disconnection. Simultaneously, it applies a high-voltage pulse far exceeding the dielectric breakdown voltage to the dielectric layer of the key storage area, causing the gate oxide layer to undergo hard breakdown. The above physical destruction mechanism completely cuts off the charge retention capability and read path of the key storage unit from the silicon substrate level. As a result, the encrypted data stream in the onboard memory chip loses its decryption key source and becomes an unrecoverable scrambled state at the physical level, achieving absolute destruction of information.

[0074] Specifically, the self-destruct execution engine follows the path of the directed acyclic graph, prioritizing the addressing enable of the "logical page: node priority 0" of the core site of the sensitive storage area's top-secret video, activating its charge pump and erase state machine, and sequentially activating the hardware control logic of the classified radar parameter page; the engine initiates multi-threaded concurrent control, simultaneously applying asynchronous erase operations to the top-secret video page, the classified parameter page, and the secret track page, with multiple storage array banks independently performing high-voltage overwrite within the same millisecond, without queuing or waiting, squeezing the microsecond-level time window before crashing to the extreme.

[0075] At the same moment the data page is concurrently overwritten, the main controller synchronously triggers the fuse signal of the key management module. The physical fuse in the top-secret independent key domain is instantly subjected to an ultra-high current and melts. At the same time, the key storage unit is punctured by the high-voltage pulse and breaks down the gate oxide layer. When the aircraft finally crashes, the top-secret video and other data in the airborne storage chip have been asynchronously erased and destroyed. The only decryption key holding these ciphertexts has been completely burned and punctured at the physical silicon level, ensuring that even if the enemy salvages the storage chip wreckage, they will absolutely not be able to recover any reconnaissance data about sensitive areas from the physical level.

[0076] Please see Figure 6 The data encryption system for the airborne storage chip is applied to the aforementioned data encryption method for the airborne storage chip; the data encryption system for the airborne storage chip includes: The hardware control module 21 is used to acquire classified data from the aircraft's onboard storage chip, determine the corresponding encryption level identifier based on the parsing of the classified data, call the independent key field corresponding to the encryption level identifier, and generate the corresponding encrypted data stream. The gradient elimination module 22 is used to input the encrypted data stream into the encrypted storage area corresponding to the airborne storage chip; at the same time, it collects the data destruction request signal, marks the emergency level parameter carried by the data destruction request signal, and determines the corresponding gradient elimination strategy by combining the matching of the encrypted storage area and the encryption level identifier. The data self-destruct module 23 is used to determine the corresponding destruction execution path based on the identification of the gradient elimination strategy, mark multiple key elimination nodes and their destruction priorities, and determine the security response content of the airborne storage chip in combination with the current state of the key management module integrated in the airborne storage chip, thereby generating the corresponding data self-destruction execution scheme. The failure module 24 is used to load a data self-destruction execution scheme if the aircraft is in a crash imminent state or a data loss state, and to activate the corresponding hardware control logic sequentially along the destruction execution path; to asynchronously eliminate the data areas corresponding to each key elimination node, and to synchronously trigger the circuit breaker failure processing of the key management module.

[0077] It should be noted that although multiple modules are mentioned in the detailed description above, this division is not mandatory; in fact, according to the embodiments of this disclosure, the features and functions of two or more modules or described above can be embodied in one module; conversely, the features and functions of one module described above can be further divided into multiple modules to be embodied.

[0078] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the disclosure herein; this application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein; the specification and embodiments are to be considered exemplary only.

[0079] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A data encryption method for an airborne storage chip, characterized in that, include: The aircraft integrates an onboard storage chip, which is used to obtain classified data from the onboard storage chip. Based on the parsing of the classified data, the corresponding encryption level identifier is determined, the independent key field corresponding to the encryption level identifier is called, and the corresponding encrypted data stream is generated. The encrypted data stream is input into the encrypted storage area corresponding to the onboard storage chip; at the same time, the data destruction request signal is collected, the urgency level parameter carried by the data destruction request signal is marked, and the corresponding gradient elimination strategy is determined by combining the matching of the encrypted storage area and the encryption level identifier. Based on the identification of the gradient elimination strategy, the corresponding destruction execution path is determined, multiple key elimination nodes and their destruction priorities are marked, and the security response content of the airborne storage chip is determined in combination with the current state of the key management module integrated in the airborne storage chip, thereby generating the corresponding data self-destruction execution scheme. If the aircraft is in a crash imminent state or data loss state, the data self-destruction execution plan is loaded, and the corresponding hardware control logic is activated sequentially along the destruction execution path; the data areas corresponding to each key elimination node are asynchronously eliminated, and the circuit breaker failure processing of the key management module is triggered synchronously.

2. The data encryption method for an airborne storage chip according to claim 1, characterized in that, The process of acquiring classified data from the aircraft's onboard storage chip, determining the corresponding encryption level identifier based on the parsing of the classified data, calling the independent key field corresponding to the encryption level identifier, and generating the corresponding encrypted data stream includes: The aircraft's onboard storage chip integrates a data preprocessing unit based on end-to-end perception. The data preprocessing unit acquires classified data in the airborne environment in real time, determines the corresponding feature vector based on the parsing of the classified data, and further loads a preset multi-dimensional security level strategy mechanism to determine the encryption level identifier corresponding to the classified data. The encryption level identifier includes top secret, confidential, and secret levels.

3. The data encryption method for an airborne storage chip according to claim 2, characterized in that, The process of acquiring classified data from the aircraft's onboard storage chip, determining the corresponding encryption level identifier based on the parsing of the classified data, calling the independent key field corresponding to the encryption level identifier, and generating the corresponding encrypted data stream further includes: The system calls upon the independent key field corresponding to the encryption level identifier. Each independent key field uses a physically isolated key generation hardware module, and different encryption level identifiers correspond to random number generators with different security entropy sources. The encryption window size is adaptively adjusted according to real-time data traffic fluctuations to generate the corresponding encrypted data stream.

4. The data encryption method for an airborne storage chip according to claim 1, characterized in that, The process involves inputting the encrypted data stream into the encrypted storage area corresponding to the onboard storage chip; simultaneously, acquiring a data destruction request signal, marking the urgency level parameter carried by the data destruction request signal, and determining the corresponding gradient elimination strategy by combining the matching of the encrypted storage area and the encryption level identifier, including: The encrypted storage area corresponding to the onboard storage chip is obtained. The encrypted storage area is dynamically divided into multiple data storage areas with independent access control logic. The encrypted data stream is input to the corresponding data storage area. At the same time, a global situational awareness monitoring loop is established to collect data destruction request signals in real time.

5. The data encryption method for an airborne storage chip according to claim 4, characterized in that, The process of inputting encrypted data streams into the encrypted storage area corresponding to the onboard storage chip, simultaneously acquiring data destruction request signals, marking the urgency level parameters carried by the data destruction request signals, and determining the corresponding gradient elimination strategy by combining the matching of the encrypted storage area and the encryption level identifier, further includes: The data destruction request signal is decoded, and the urgency level parameter carried by the data destruction request signal is extracted. The urgency level parameter is used to characterize the urgency of the current threat. The urgency level parameter is combined with the physical address of the encrypted storage area, and the security weight corresponding to the encryption level identifier is mapped synchronously to obtain the gradient elimination strategy in the current environment. The gradient elimination strategy defines the priority response relationship of data with different security levels in the destruction sequence.

6. The data encryption method for an airborne storage chip according to claim 1, characterized in that, The process involves identifying the gradient elimination strategy, determining the corresponding destruction execution path, marking multiple key elimination nodes and their destruction priorities, and combining this with the current state of the key management module integrated into the onboard storage chip to determine the security response content of the onboard storage chip, thereby generating a corresponding data self-destruction execution scheme, including: The gradient elimination strategy is logically parsed, and a corresponding directed acyclic graph is constructed during the parsing process. The directed acyclic graph is used as the destruction execution path. Multiple key elimination nodes are marked in the destruction execution path. Each key elimination node corresponds to a specific logical page in the onboard storage chip. The destruction priority of each key elimination node is determined according to the criticality of the data in each key elimination node and the corresponding refresh frequency.

7. The data encryption method for an airborne storage chip according to claim 6, characterized in that, The process of determining the corresponding destruction execution path based on the identification of the gradient elimination strategy, marking multiple key elimination nodes and their destruction priorities, and determining the security response content of the onboard storage chip in conjunction with the current state of the key management module integrated in the onboard storage chip to generate a corresponding data self-destruction execution scheme also includes: The key management module integrated into the airborne storage chip is monitored in real time, and its current status is dynamically polled to detect its operation and latching status. Furthermore, the security response content of the airborne storage chip is determined in combination with the load of the airborne storage chip. Based on the security response content and the previous execution content of the airborne storage chip, a corresponding data self-destruction execution scheme is determined. The data self-destruction execution scheme includes a fuse instruction sequence, voltage overload parameters, and physical erase timing.

8. The data encryption method for an airborne storage chip according to claim 1, characterized in that, If the aircraft is in a near-crash or data loss state, a data self-destruction execution scheme is loaded, and the corresponding hardware control logic is activated sequentially along the destruction execution path; asynchronous elimination is performed on the data areas corresponding to each key elimination node, and the circuit breaker failure processing of the key management module is triggered synchronously, including: The aircraft's sensing network is marked, and the aircraft's attitude parameters and bus control status are monitored in real time through the sensing network. Combined with the abnormal data signals of the aircraft, the aircraft's crash imminent state or data loss state is determined. If the aircraft is in a crash imminent state or data loss state, a hardware interrupt signal is immediately triggered, and a data self-destruct execution plan is loaded simultaneously.

9. The data encryption method for an airborne storage chip according to claim 8, characterized in that, If the aircraft is in a near-crash or data loss state, a data self-destruction execution scheme is loaded, and the corresponding hardware control logic is activated sequentially along the destruction execution path; asynchronous elimination is performed on the data areas corresponding to each key elimination node, and the circuit breaker failure processing of the key management module is triggered synchronously. The scheme also includes: In the data self-destruction execution scheme, the hardware control logic corresponding to each key elimination node is activated sequentially along the destruction execution path. A multi-threaded concurrent control mechanism is used to asynchronously eliminate the data area corresponding to each key elimination node. At the same time as the data destruction execution, the key management module's fuse failure handling is triggered synchronously. The key management module is permanently destroyed by physical fuse burning or high voltage breakdown, making the encrypted data stream in the onboard storage chip completely unrecoverable at the physical level.

10. A data encryption system for an airborne storage chip, characterized in that, The data encryption system for the airborne storage chip is applied to the data encryption method for the airborne storage chip as described in any one of claims 1-9; the data encryption system for the airborne storage chip includes: The hardware control module is used to acquire classified data from the aircraft's onboard storage chip, determine the corresponding encryption level identifier based on the parsing of the classified data, call the independent key field corresponding to the encryption level identifier, and generate the corresponding encrypted data stream. The gradient elimination module is used to input the encrypted data stream into the encrypted storage area corresponding to the airborne storage chip; at the same time, it collects the data destruction request signal, marks the urgency level parameter carried by the data destruction request signal, and determines the corresponding gradient elimination strategy by combining the matching of the encrypted storage area and the encryption level identifier. The data self-destruct module is used to determine the corresponding destruction execution path based on the identification of the gradient elimination strategy, mark multiple key elimination nodes and their destruction priorities, and determine the security response content of the airborne storage chip in combination with the current state of the key management module integrated in the airborne storage chip, thereby generating the corresponding data self-destruction execution scheme. The failure module is used to load a data self-destruction execution plan if the aircraft is in a crash imminent state or data loss state, and to activate the corresponding hardware control logic sequentially along the destruction execution path; to asynchronously eliminate the data areas corresponding to each key elimination node, and synchronously trigger the circuit breaker failure processing of the key management module.

Images