Intelligent fusion terminal full-link data security protection method and device

Abstract

The application provides a kind of intelligent fusion terminal full-link data security protection method and device, it is related to security protection technical field, comprising: based on security module to the multiple software layers of terminal executes multistage cross verification, all verification pass through and complete security start;Based on security module and external interactive object executes two-way identity authentication;According to security level, security module is called to the corresponding processing of data to be handled, and generates protected data;Based on security module, corresponding integrity check information is generated and is associatedly stored;Collect operation behavior information, generate current audit record based on operation behavior information and the chain structure of current audit chain, and current audit record is added to current audit chain, form tamper-proof audit chain;When detecting data anomaly, data recovery is carried out;If local recovery is unavailable, then receive the encrypted backup data returned by adjacent terminal, reconstruct local data after decryption by security module.

Description

Technical Field

[0001] This invention relates to the field of security protection technology, and in particular to a method and device for end-to-end data security protection of intelligent fusion terminals. Background Technology

[0002] As a core node of the power Internet of Things (IoT), intelligent converged terminals need to interact with the master station, smart meters, smart circuit breakers, and other terminals on massive amounts of data. This involves data types such as electricity consumption data, control commands, and status information, requiring extremely high levels of confidentiality, integrity, and non-repudiation. Existing data protection solutions have the following shortcomings: secure startup relies solely on one-way measurement, lacking cross-validation and easily bypassed; the identity authentication mechanism is simplistic, lacking two-way authentication, making it easy for counterfeit devices to access; data protection strategies are statically fixed and cannot be dynamically adjusted according to link status and business importance, resulting in insufficient protection for critical data and excessive protection for ordinary data; audit logs are stored in plaintext and lack tamper protection, making it difficult to trace security incidents; data storage uses a single-zone plaintext mode, which cannot be automatically recovered after damage and lacks inter-terminal collaborative recovery capabilities. These shortcomings make existing solutions unable to meet the power system's security requirements throughout the entire data lifecycle. Summary of the Invention

[0003] In view of this, the purpose of the present invention is to provide a method and device for full-link data security protection of intelligent fusion terminals. Through mesh cross-signature verification, dynamic hierarchical self-adaptation, blockchain-style audit chain and cross-device redundancy recovery, it realizes active defense of the terminal full-link, significantly improving the reliability of secure startup, the precision of data protection, the reliability of audit traceability and data disaster recovery capabilities.

[0004] In a first aspect, embodiments of the present invention provide a method for end-to-end data security protection of a smart converged terminal. The method includes: after the terminal is powered on, performing multi-level cross-signature verification on multiple software layers of the terminal based on a security module, and completing secure startup after all signatures are verified; obtaining the identity authentication request of an external interaction object, performing two-way identity authentication with the external interaction object based on the security module, and establishing a secure communication link; obtaining data to be processed, determining the security level of the data to be processed, and calling the security module to process the data to be processed accordingly based on the security level to generate protected data; storing the protected data in the terminal data center, and generating corresponding integrity verification information based on the security module for associated storage; during data interaction, collecting operation behavior information, generating a current audit record based on the operation behavior information and the chain structure of the current audit chain, and appending the current audit record to the current audit chain to form an anti-tampering audit chain; monitoring security events in the end-to-end in real time, and performing data recovery based on integrity verification information when data anomalies are detected; if local recovery is unavailable, initiating a cross-device recovery request to adjacent terminals through the security module, receiving encrypted backup data returned by adjacent terminals, and reconstructing local data after decryption through the security module.

[0005] In a preferred embodiment of the present invention, the aforementioned security module is an ESAM hardware security module. Based on the security module, multi-level cross-signature verification is performed on multiple software layers of the terminal, including: verifying the digital signature of the operating system kernel by calling ESAM through the bootloader UBOOT; booting the operating system kernel after successful verification; verifying the digital signatures of UBOOT, critical file system configurations, and the security chip scheduling APP by calling ESAM through the operating system kernel; launching the security chip scheduling APP after successful verification; reverse-verifying the digital signatures of UBOOT and the operating system kernel through the security chip scheduling APP calling ESAM, while simultaneously verifying the digital signatures of all business APPs; launching each business APP, and verifying the digital signatures of adjacent business APPs by calling ESAM between them, forming a mesh trust chain; after all signature verifications are successful, generating dynamic trust anchors for the current startup batch through ESAM, and writing the dynamic trust anchors into the secure storage area of ​​ESAM for rapid comparison during the next startup.

[0006] In a preferred embodiment of the present invention, the aforementioned external interaction object includes a master station, a sensing device, or other terminals; the two-way authentication between the security module and the external interaction object includes: if the external interaction object is a master station, then two-way authentication is performed based on the national cryptographic SSL / SSAL protocol and through the channel layer and business layer digital certificates stored in the security module; if the external interaction object is a sensing device or other terminal, then two-way challenge-response authentication based on the national cryptographic algorithm is performed based on the symmetric key or digital certificate pre-set in the security module, and a session key for this communication is negotiated and generated; after the two-way authentication is successful, a secure communication link is established, and the session key is stored in the temporary key area of ​​the security module.

[0007] In a preferred embodiment of the present invention, the above-mentioned determination of the security level of the data to be processed and the invocation of the security module to process the data to be processed according to the security level includes: obtaining the link quality parameters of the current communication link, the security status score of the terminal device, and the service type label of the data to be processed; inputting the link quality parameters, security status score, and service type label into a preset dynamic hierarchical decision model, and outputting the current dynamic security level of the data to be processed, wherein the dynamic security level includes at least a normal level, an important level, and a critical level; if the current dynamic security level is a normal level, then the security module is invoked to calculate the MAC checksum of the data to be processed; if the current dynamic security level is an important level, then the security module is invoked to encrypt the data to be processed using a symmetric encryption algorithm; if the current dynamic security level is a critical level, then the security module is invoked to append the current timestamp and a random number to the data to be processed and perform digital signature processing; when a sudden change is detected in the link quality parameters or the security status score, an adaptive seamless switching of the processing strategy is triggered, and the switching process is transparent to the upper-layer business applications.

[0008] In a preferred embodiment of the present invention, when the external interaction object is an electricity meter, the security module is invoked according to the security level to process the data to be processed accordingly, including a conversion to encrypted reading strategy. Specifically, the following steps are taken: receiving a conversion key packet and at least one set of reading schemes issued by the main station; decrypting the conversion key packet and converting it into a local conversion key through the security module; obtaining the device model and protocol version number of the electricity meter; adaptively matching a target reading scheme from multiple sets of reading schemes based on the device model and protocol version number; and performing session negotiation with the electricity meter using the local conversion key through the security module based on the target reading scheme to obtain a temporary session key; assembling a ciphertext reading instruction using the temporary session key through the security module according to the target reading scheme, and sending the ciphertext reading instruction to the electricity meter; receiving the ciphertext reading result returned by the electricity meter; decrypting and performing MAC verification on the ciphertext reading result using the temporary session key through the security module to obtain plaintext reading data; and monitoring the remaining effective duration of the current session in real time, dynamically extending the effective duration of the session according to the priority of the current service, or triggering a re-negotiation with the electricity meter.

[0009] In a preferred embodiment of the present invention, the aforementioned security module is an ESAM hardware security module; storing the protected data in the terminal data center and generating corresponding integrity verification information based on the security module for associated storage includes: calling ESAM to encrypt each data record of the data to be processed line by line using the SM4 symmetric encryption algorithm to generate ciphertext data as protected data; calling ESAM to calculate the MAC value of the ciphertext data using the SM3 hash algorithm as integrity verification information; storing the ciphertext data in the corresponding location of the data area of ​​the data center, and storing a copy of the ciphertext data and the MAC value in the corresponding location of the backup area of ​​the data center according to the same data index, forming a dual storage mapping relationship.

[0010] In a preferred embodiment of the present invention, when data anomaly is detected, data recovery is performed based on integrity verification information, including: responding to a data read instruction, obtaining the target integrity verification value corresponding to the target data from the backup area, and calling the security module to recalculate the current integrity verification value of the target protected data in the data area; comparing the target integrity verification value with the current integrity verification value; if they match, the data is determined to be intact, and the security module is called to decrypt the target protected data and return; if they do not match, the target protected data in the data area is determined to have been tampered with, and the backup protected data is extracted from the backup area according to the data index, the backup protected data is overwritten into the data area, and a data recovery log is recorded; if both the data area and the backup area are damaged, the data feature template and statistical features of historically collected data are obtained from the security module, and a copy of the target data is automatically reconstructed according to the data feature template and statistical features.

[0011] In a preferred embodiment of the present invention, a cross-device recovery request is initiated to adjacent terminals through a security module, and encrypted backup data is received from the adjacent terminals. This includes: when the local backup area is detected to be completely unavailable and the data area is damaged, generating a cross-device recovery request message through the security module, the message containing the device identifier of the local terminal, the data range to be recovered, and a timestamp, and digitally signing the message through the security module; broadcasting the signed cross-device recovery request message to at least one adjacent terminal through the local communication interface, and receiving an authentication challenge returned by the adjacent terminal; responding to the authentication challenge, completing two-way identity authentication with the adjacent terminal through the security module, and establishing a temporary secure recovery channel; receiving encrypted backup data blocks sent by the adjacent terminals through the temporary secure recovery channel, decrypting and performing MAC verification on the encrypted backup data blocks through the security module, and reconstructing the target data in the local data area using the decrypted data.

[0012] In a preferred embodiment of the present invention, a current audit record is generated based on the operation behavior information and the chain structure of the current audit chain, and the current audit record is appended to the current audit chain to form a tamper-proof audit chain. This includes: obtaining operation behavior information, which at least includes operation time, operation type, operation object identifier, operator certificate serial number, and operation result; generating an operation fingerprint of the current operation based on the operation behavior information, where the operation fingerprint is a hash value obtained by hashing the operation behavior information; reading the block hash value of the previous audit record in the current audit chain from the secure storage area of ​​the security module, concatenating the operation fingerprint, the block hash value of the previous audit record, and the current timestamp, and performing digital signature through the security module to generate the current audit block; storing the current audit block in the local audit log area, and updating the block hash value of the current audit block to the secure storage area of ​​the security module to form a tamper-proof audit chain with consecutive block hash values; and uploading the current audit block to the main station via an encrypted link after integrity protection by the security module.

[0013] Secondly, embodiments of the present invention also provide a full-link data security protection device for intelligent converged terminals. The device includes: a secure startup module, used to perform multi-level cross-signature verification on multiple software layers of the terminal based on the security module after the terminal is powered on, and complete secure startup after all signatures are verified; a secure communication link establishment module, used to obtain the identity authentication request of an external interaction object, and establish a secure communication link based on the two-way identity authentication performed between the security module and the external interaction object; a protected data generation module, used to obtain data to be processed, determine the security level of the data to be processed, and call the security module to process the data to be processed according to the security level to generate protected data; and an associated storage module, used to store the protected data. The data is stored in the terminal data center and associated with the corresponding integrity verification information generated by the security module. The anti-tampering audit chain formation module is used to collect operation behavior information during data interaction, generate the current audit record based on the operation behavior information and the chain structure of the current audit chain, and append the current audit record to the current audit chain to form an anti-tampering audit chain. The security event monitoring module is used to monitor security events in the entire chain in real time. When data anomalies are detected, data recovery is performed based on integrity verification information. If local recovery is unavailable, a cross-device recovery request is initiated to adjacent terminals through the security module. The encrypted backup data returned by the adjacent terminals is received, decrypted by the security module, and the local data is reconstructed.

[0014] The embodiments of the present invention bring the following beneficial effects: This invention provides a method and apparatus for end-to-end data security protection of intelligent converged terminals. After the terminal powers on, it acquires the initial root of trust and certificate chain stored in the ESAM (Elastic Root Acquisition Management System). Based on the ESAM, it performs multi-level cross-signature verification on the terminal's bootloader layer, operating system layer, scheduling application layer, and business application layer. Secure boot is completed after all verifications pass. It then acquires the authentication request from an external interaction object, performs two-way authentication with the external interaction object based on the digital certificate stored in the ESAM, and establishes a secure communication link. Next, it acquires the raw business data to be processed, identifies the dynamic security level of the raw business data in real time, calls the ESAM to select the corresponding target protection strategy based on the dynamic security level, and performs cryptographic operations on the raw business data based on the target protection strategy to generate protected data units. Finally, it stores the protected data units in the data area of ​​the terminal's data center, and simultaneously... ESAM performs integrity verification calculations on protected data units and synchronously stores the calculated integrity verification values ​​in the backup area of ​​the data center. During the entire data link interaction process, it collects operation behavior information in real time, obtains the hash value of the previous audit record in the current audit chain, concatenates the operation behavior information with the hash value of the previous audit record, and performs digital signature through ESAM to generate the current audit record. This audit record is then appended to the current audit chain to form an immutable blockchain-style audit chain. It monitors security events in the entire link in real time. When an anomaly is detected in the data area, it prioritizes reading the integrity verification value from the backup area and restoring the data in the data area. If the backup area is unavailable, it initiates a digitally signed cross-device recovery request to adjacent terminals through ESAM, receives encrypted backup data returned by adjacent terminals, decrypts it through ESAM, and reconstructs the local data.

[0015] Other features and advantages of this disclosure will be set forth in the following description, or some features and advantages may be inferred from the description or determined without doubt, or may be learned by practicing the techniques described above.

[0016] To make the above-mentioned objects, features and advantages of this disclosure more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0017] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0018] Figure 1 A flowchart illustrating a method for end-to-end data security protection of an intelligent fusion terminal, as provided in an embodiment of the present invention; Figure 2 A flowchart of another intelligent fusion terminal end-to-end data security protection method provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of a smart fusion terminal end-to-end data security protection device provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] As a core node of the power Internet of Things (IoT), intelligent converged terminals need to interact with the master station, smart meters, smart circuit breakers, and other terminals on massive amounts of data. This involves data types such as electricity consumption data, control commands, and status information, requiring extremely high levels of confidentiality, integrity, and non-repudiation. Existing data protection solutions have the following shortcomings: secure startup relies solely on one-way measurement, lacking cross-validation and easily bypassed; the identity authentication mechanism is simplistic, lacking two-way authentication, making it easy for counterfeit devices to access; data protection strategies are statically fixed and cannot be dynamically adjusted according to link status and business importance, resulting in insufficient protection for critical data and excessive protection for ordinary data; audit logs are stored in plaintext and lack tamper protection, making it difficult to trace security incidents; data storage uses a single-zone plaintext mode, which cannot be automatically recovered after damage and lacks inter-terminal collaborative recovery capabilities. These shortcomings make existing solutions unable to meet the power system's security requirements throughout the entire data lifecycle.

[0021] Based on this, the present invention provides a method and apparatus for end-to-end data security protection of intelligent converged terminals. After the terminal is powered on, a security module performs multi-level cross-signature verification on multiple software layers of the terminal, and secure startup is completed after all verifications pass. It obtains the authentication request of an external interaction object, performs two-way authentication with the external interaction object based on the security module, and establishes a secure communication link. It obtains data to be processed, determines the security level of the data to be processed, and calls the security module to process the data to be processed accordingly based on the security level, generating protected data. The protected data is stored in the terminal data center, and corresponding integrity verification information is generated based on the security module for associated storage. During data interaction, it collects operation behavior information, generates a current audit record based on the operation behavior information and the chain structure of the current audit chain, and appends the current audit record to the current audit chain to form an anti-tampering audit chain. It monitors security events in the entire link in real time, and when data anomalies are detected, data recovery is performed based on integrity verification information. If local recovery is unavailable, a cross-device recovery request is initiated to adjacent terminals through the security module, and encrypted backup data returned by adjacent terminals is received, decrypted by the security module, and the local data is reconstructed. This approach achieves proactive defense across the entire terminal chain through mesh cross-signature verification, dynamic hierarchical self-adaptation, blockchain-style audit chain, and cross-device redundancy recovery, significantly improving the reliability of secure startup, the precision of data protection, the reliability of audit tracing, and the data disaster recovery capability.

[0022] Example 1 This invention provides a method for end-to-end data security protection of intelligent converged terminals. Figure 1 This is a flowchart illustrating a method for end-to-end data security protection of an intelligent fusion terminal, as provided in an embodiment of the present invention. Figure 1 As shown, the end-to-end data security protection method for this intelligent fusion terminal may include the following steps: Step S101: After the terminal is powered on, the security module performs multi-level cross-signature verification on multiple software layers of the terminal. After all signatures are verified, the secure startup is completed.

[0023] The security module refers to the hardware security computing module built into the intelligent converged terminal, preferably an ESAM (Embedded Secure Access Module) that has passed the national commercial cryptography testing and certification. The ESAM integrates a secure storage area (for storing sensitive data such as keys, certificates, and trust anchors) and a cryptographic operation unit (supporting hardware acceleration of national cryptographic algorithms such as SM1 / SM2 / SM3 / SM4). Its core security features include: keys never leaving the chip, cryptographic operations completed internally, and physical anti-attack capabilities (such as anti-probe and anti-power consumption analysis).

[0024] The multiple software layers refer to the various software levels that the terminal goes through from power-on to service operation, including at least: the bootloader layer (UBOOT), the operating system layer (Linux kernel), the scheduling application layer (security chip scheduling APP), and the service application layer (various service APPs). Each layer is an independent executable file or image file, stored in different partitions of the terminal's Flash memory.

[0025] Multi-level cross-verification refers to a verification structure that is not limited to a single forward transmission, but includes forward verification, reverse verification, and peer-to-peer cross-verification. The multi-level aspect is reflected in the verification coverage of four layers: U-Boot, kernel, scheduling APP, and business APP; the cross-verification aspect is reflected in the verification directions including upper-layer verification of lower-layer (forward), lower-layer verification of upper-layer (reverse), and mutual verification between layers (peer-to-peer).

[0026] Secure boot refers to the process where every layer of software undergoes digital signature verification from the moment the terminal is powered on until the operating system and business apps are fully operational. This ensures that all running software is an authorized and legitimate version, and has not been tampered with or implanted with malicious code.

[0027] After the terminal powers on, the CPU reads and executes the U-Boot program from the boot partition of Flash. Before executing any business logic, U-Boot first sends an initialization command to the ESAM chip via a hardware interface (SPI or I²C bus) to read the pre-set initial trusted root (including root certificate, device unique identifier, etc.) in the ESAM secure storage area. U-Boot reads the operating system kernel image file from the Flash kernel partition and calculates the hash value of the image file using the SM3 algorithm. U-Boot sends the calculated hash value along with the digital signature of the kernel image (pre-signed by the State Grid Unified Cryptography Service Platform using an SM2 private key) to ESAM. ESAM uses the public key corresponding to the root certificate stored internally to decrypt the digital signature using SM2, obtaining the decrypted hash value, and compares it with the hash value calculated by U-Boot. If they match, the kernel image has not been tampered with, and U-Boot boots the kernel; if they do not match, the signature verification fails, the terminal stops booting, and a security log is recorded. After the operating system kernel boots, the trusted measurement module in the kernel reads the U-Boot binary file from the Flash boot partition and the installation package file of the security chip scheduling app from the Flash APP partition. The kernel calculates the SM3 hash value of these two files respectively and sends them, along with their corresponding digital signatures, to ESAM for verification. After successful verification, the kernel launches the security chip scheduling app. After the security chip scheduling app starts, it actively reads the U-Boot and kernel image files from Flash, recalculates the hash values, and calls ESAM for verification. This reverse verification step aims to prevent U-Boot or the kernel from being maliciously replaced after the forward verification is completed but before the kernel starts. The security chip scheduling app traverses all business app installation packages in the Flash APP partition, calculates the SM3 hash value for each app installation package, and calls ESAM to verify its digital signature. Business apps that pass verification are allowed to be decompressed and run; apps that fail verification are marked as untrusted, refused to run, and logged. After each business app starts, they call ESAM to verify the digital signatures of adjacent business apps according to a preset cross-verification matrix. For example, in a scenario with three business apps, app 1 verifies apps 2 and 3, app 2 verifies apps 1 and 3, and app 3 verifies apps 1 and 2, forming a fully connected mesh structure. This mechanism ensures that even if a business app is dynamically replaced after the scheduled app's signature verification, it will still be detected by the other business apps. After all signature verifications are successful, the security chip schedules the app to call ESAM to generate digest information for this batch of startups (including a list of file hash values ​​at each layer, signature timestamps, etc.), uses the SM3 algorithm to calculate the hash value of the digest information as a dynamic trust anchor, and writes it to the ESAM secure storage area.On the next startup, U-Boot first reads the anchor point and quickly compares it with the current file hash value. If they match, it skips the full signature verification to speed up the startup; if they do not match, it triggers the full signature verification and records the exception.

[0028] In terms of effectiveness, through a multi-level cross-signature verification mechanism, the terminal establishes a complete trust chain covering all software layers, starting from the hardware root of trust. Any software tampering at any layer will be detected and prevented from starting or running by at least one verification step, fundamentally eliminating the possibility of malicious program implantation. The introduction of the cross-signature verification matrix enables mutual supervision among various business apps, avoiding a trust vacuum caused by the bypassing of a single verification node.

[0029] For example, a smart converged terminal in a power distribution room of a certain area is powered on and restarted. The terminal contains an electricity consumption data acquisition app, a smart circuit breaker control app, and a low-voltage feeder monitoring app. U-Boot reads the kernel image, calculates the SM3 hash, and verifies the signature; the kernel then starts. The kernel verifies the signatures of U-Boot and the scheduling app, and the scheduling app starts. The scheduling app then verifies the signatures of U-Boot and the kernel, and all three service apps verify the signatures in sequence. The electricity consumption data acquisition app verifies the signature of the smart circuit breaker control app, the smart circuit breaker control app verifies the signature of the low-voltage feeder monitoring app, and the low-voltage feeder monitoring app verifies the signature of the electricity consumption data acquisition app; all verifications are successful. ESAM generates and stores a dynamic trust anchor point, and startup is complete.

[0030] Specifically, the security module is the ESAM hardware security module. Based on the security module, multi-level cross-signature verification is performed on multiple software layers of the terminal, including: verifying the digital signature of the operating system kernel by calling ESAM through the bootloader UBOOT, and booting the operating system kernel after successful verification; verifying the digital signatures of UBOOT, key file system configurations, and the security chip scheduling APP by calling ESAM through the operating system kernel, and launching the security chip scheduling APP after successful verification; verifying the digital signatures of UBOOT and the operating system kernel by calling ESAM through the security chip scheduling APP, and simultaneously verifying the digital signatures of all business APPs by calling ESAM; launching each business APP, and verifying the digital signatures of adjacent business APPs by calling ESAM among the business APPs to form a mesh trust chain; after all signature verifications are successful, generating dynamic trust anchors for the current boot batch through ESAM, and writing the dynamic trust anchors to the secure storage area of ​​ESAM for rapid comparison during the next boot.

[0031] UBOOT is an open-source bootloader widely used in embedded Linux systems. It is the first program executed after the terminal is powered on, responsible for initializing the hardware and loading the operating system kernel from the storage medium.

[0032] The Security Chip Scheduling App is a special system-level application that runs with high priority in the terminal operating system. It is responsible for the unified management and scheduling of ESAM hardware resources. All other business apps that need to use ESAM's cryptographic operation functions must apply for and obtain authorization through the Security Chip Scheduling App.

[0033] The dynamic trust anchor is a digest value generated by ESAM after all signature verifications have passed during each secure boot. It represents the boot status and includes a list of hash values ​​for each layer of software files used in the boot process, along with the signature verification timestamp. On the next boot, U-Boot can quickly compare the current file hash value with the hash value stored in the anchor. If they match, the entire signature verification process is skipped, significantly reducing boot time.

[0034] Among them, the mesh trust chain refers to the fully connected verification relationship formed by mutual verification signatures between various business apps. Unlike the traditional chain trust chain (where only the upper layer verifies the lower layer), each node in the mesh structure is verified by other nodes, eliminating the risk of a single verification node being bypassed.

[0035] U-Boot reads the kernel image from the Flash kernel partition, calculates the SM3 hash, and calls ESAM to verify the digital signature. If verification passes, the kernel boots. After kernel boot, it reads the U-Boot file and the security chip scheduling APP file from Flash, calculates their hashes, and calls ESAM to verify the signature. After the security chip scheduling APP starts, it proactively reverse-verifies the signatures of U-Boot and the kernel to prevent tampering during the time window between forward signature verification and kernel boot. Subsequently, it verifies the signatures of all business APPs. After each business APP starts, they mutually verify their signatures according to a preset cross-verification matrix. For example, in a scenario with three business APPs, APP1 verifies APP2 and APP3, APP2 verifies APP1 and APP3, and APP3 verifies APP1 and APP2, forming a fully connected mesh structure. After all signature verifications pass, ESAM generates and stores dynamic trust anchors.

[0036] Step S102: Obtain the authentication request of the external interaction object, perform two-way authentication between the security module and the external interaction object, and establish a secure communication link.

[0037] Among them, external interaction objects refer to external devices that interact with the smart converged terminal, including three categories: master station (power dispatch master station or electricity information collection master station), sensing devices (such as smart energy meters, low-voltage feeder monitoring units, smart circuit breakers), and other terminals (same type of smart converged terminal or other power terminals).

[0038] Two-way authentication refers to a mechanism in which both parties in a communication verify each other's identity. That is, the terminal verifies the identity of the external object, while the external object also verifies the identity of the terminal, rather than only one party verifying the other.

[0039] A secure communication link refers to a communication channel established after two-way authentication, which encrypts and protects the integrity of transmitted data. All data on the link is encrypted using a session key and verified using MAC.

[0040] Digital certificates are electronic credentials issued by the State Grid Unified Cryptography Service Platform, containing the certificate holder's identity information, public key, validity period, and issuer information. Terminals store channel-layer certificates (used to establish secure communication channels) and business-layer certificates (used for signing and encrypting business data) through ESAM.

[0041] The session key is a temporary key negotiated and generated by both parties after successful two-way authentication. It is used for data encryption and MAC calculation during the current communication session. The session key is stored in the ESAM temporary key area and is automatically cleared when the terminal is powered off.

[0042] The terminal receives authentication requests from external objects via communication interfaces (4G / 5G / Ethernet interfaces for communication with the master station, and CAN / RS-485 / Bluetooth interfaces for communication with sensing devices or other terminals). It then parses the object type identifier field in the request message to determine the type of the external object. If the external object is the master station: the terminal sends an authentication request message to the master station, carrying the terminal device's unique identifier and the channel layer digital certificate stored in ESAM; after verifying the validity of the terminal certificate, the master station returns its own certificate and a random number; the terminal verifies the master station certificate through ESAM, signs the random number using the private key in ESAM based on the national cryptographic SSL / SSAL protocol, and returns it; after the master station verifies the signature, two-way authentication is completed, and both parties establish an encrypted communication link based on the negotiated session key. If the external object is a sensing device or other terminal: the terminal generates a random number R1 and sends it to the external object; the external object uses the symmetric key in its ESAM to encrypt or sign R1 and returns it; the terminal verifies the result through its own ESAM and returns it; after successful verification, the external object generates a random number R2 and sends it to the terminal; the terminal uses the symmetric key in its ESAM to process R2 and returns it; after successful verification by the external object, two-way authentication is completed, and the session key for this communication is negotiated and generated.

[0043] In terms of effectiveness, the two-way authentication mechanism based on digital certificates completely eliminates the problem of counterfeit devices accessing the system. External entities must possess a legitimate digital certificate issued by the unified cryptographic service platform or a pre-installed symmetric key to pass authentication; simple identifiers such as device serial numbers are insufficient for verification.

[0044] Specifically, the external interaction objects include the main station, sensing devices, or other terminals; the two-way authentication between the security module and the external interaction objects can include: if the external interaction object is the main station, then two-way authentication is performed based on the national cryptographic SSL / SSAL protocol and through the channel layer and business layer digital certificates stored in the security module; if the external interaction object is a sensing device or other terminal, then two-way challenge-response authentication based on the national cryptographic algorithm is performed based on the symmetric key or digital certificate pre-installed in the security module, and the session key for this communication is negotiated and generated; after the two-way authentication is successful, a secure communication link is established, and the session key is stored in the temporary key area of ​​the security module.

[0045] Among them, the national cryptographic SSL / SSAL protocol: SSL is the standard Secure Sockets Layer protocol; SSAL is the national cryptographic SSL protocol, which uses national cryptographic algorithms such as SM2 / SM3 / SM4 to replace international algorithms and complies with the requirements of the State Cryptography Administration.

[0046] Two-way challenge-response authentication is an identity authentication method based on a challenge-response mechanism. The verifier generates a random number (challenge) and sends it to the verifier. The verifier uses its own key to encrypt or sign the random number (response) and returns it. The verifier then verifies whether the response is correct.

[0047] The terminal and the master station establish a secure channel using the national cryptographic SSL / SSAL protocol. The terminal's ESAM pre-installs a channel layer certificate (for SSL handshake) and a business layer certificate (for business data signing). During the SSL handshake, both parties exchange and verify their certificates, completing two-way authentication. For sensing devices with limited computing power (such as smart meters), a symmetric key + two-way challenge-response method is used, resulting in low computational overhead and fast response. For other terminals, either digital certificates or symmetric keys can be used, flexibly selected based on the configuration of both parties. The session key negotiated after successful authentication is stored in the ESAM temporary key area. The temporary key area is automatically cleared after the terminal is powered off, ensuring that the session key is not persistently leaked.

[0048] Step S103: Obtain the data to be processed, determine the security level of the data to be processed, and call the security module to process the data to be processed accordingly based on the security level to generate protected data.

[0049] Among them, the data to be processed refers to various data that the terminal needs to transmit or store during operation, including power consumption data (voltage, current, power, etc.), control commands (circuit breaker opening and closing commands, parameter setting commands), equipment status information (operating status, fault alarms), etc.

[0050] Security level refers to the level of data security protection. In this invention, it is a dynamic security level, which is determined dynamically in real time based on the current link status, device security posture, and service type. Dynamic security levels include at least three levels: ordinary level, important level, and critical level.

[0051] The corresponding processing refers to the data protection scheme corresponding to the security level, including integrity protection (MAC verification), confidentiality protection (symmetric encryption), and non-repudiation and replay protection (digital signature + random number / timestamp).

[0052] Protected data refers to data units containing security protection information generated after the data to be processed has undergone cryptographic operations, including encrypted ciphertext data, MAC checksums, digital signatures, etc.

[0053] In terms of effectiveness, through dynamic hierarchical protection strategies, terminals can select differentiated protection methods for data of different importance based on actual conditions, ensuring the security level of important data while avoiding the waste of terminal resources caused by excessive protection of ordinary data, and improving data interaction efficiency.

[0054] Specifically, the security level of the data to be processed is determined, and the security module is invoked to process the data accordingly based on the security level. This includes: obtaining the link quality parameters of the current communication link, the security status score of the terminal device, and the service type label of the data to be processed; inputting the link quality parameters, security status score, and service type label into a preset dynamic hierarchical decision model, and outputting the current dynamic security level of the data to be processed. The dynamic security level includes at least ordinary level, important level, and critical level; if the current dynamic security level is ordinary level, the security module is invoked to calculate the MAC checksum of the data to be processed; if the current dynamic security level is important level, the security module is invoked to encrypt the data to be processed using a symmetric encryption algorithm; if the current dynamic security level is critical level, the security module is invoked to append the current timestamp and a random number to the data to be processed and perform digital signature processing; when a sudden change is detected in the link quality parameters or security status score, an adaptive and seamless switching of the processing strategy is triggered, and the switching process is transparent to the upper-layer business applications.

[0055] Link quality parameters are a set of indicators that reflect the current state of the communication link, including signal strength index (RSSI), signal-to-noise ratio (SNR), bit error rate (BER), round-trip time (RTT), etc.

[0056] Among them, the security posture score is a quantitative score obtained by the terminal to comprehensively assess its own security status. The assessment factors include the number of signature verification failures, authentication failures, MAC verification failures, and frequency of abnormal events in a recent period. The higher the score, the better the security posture.

[0057] Among them, the dynamic hierarchical decision model is the decision logic that maps input parameters to security levels. It can be a rule engine (if-then rule table) or a machine learning model (such as decision tree, random forest).

[0058] Among them, adaptive seamless switching means that when the link quality or security status changes and the data security level changes, the processing strategy is automatically switched, and the switching process is completely transparent to the upper-layer business APP. The business APP does not need to be aware of the policy change and still submits data in the original way. The terminal layer automatically completes the policy switching.

[0059] The terminal security level identification module periodically (e.g., every 10 seconds) collects link quality parameters and security status scores, combines them with the service type labels of the data to be processed, inputs them into a dynamic hierarchical decision model, and outputs a dynamic security level. The levels are: Normal level (MAC verification (SM3)); Important level (symmetric encryption (SM4)); Critical level (digital signature + timestamp + random number (SM2 signature + SM3 hash)). When a sudden change in link quality or security status score is detected, the terminal automatically upgrades the data's security level. For example, under normal conditions, electricity consumption data is at the Important level (encrypted transmission); when a link anomaly is detected, it automatically upgrades to the Critical level (encryption + signature + timestamp).

[0060] When the external interaction object is an electricity meter, the security module is invoked according to the security level to process the data to be processed accordingly, including the conversion to encrypted reading strategy. Specifically, the following steps are taken: receiving the encryption key packet and at least one reading scheme issued by the main station; decrypting the encryption key packet and converting it into a local encryption key through the security module; obtaining the device model and protocol version number of the electricity meter; adaptively matching the target reading scheme from multiple reading schemes based on the device model and protocol version number; and performing session negotiation with the electricity meter using the local encryption key through the security module based on the target reading scheme to obtain a temporary session key; assembling the encrypted reading instruction using the temporary session key through the security module according to the target reading scheme and sending the encrypted reading instruction to the electricity meter; receiving the encrypted reading result returned by the electricity meter; decrypting and performing MAC verification on the encrypted reading result using the temporary session key through the security module to obtain the plaintext reading data; and monitoring the remaining valid duration of the current session in real time, dynamically extending the valid duration of the session according to the priority of the current business, or triggering a re-negotiation with the electricity meter.

[0061] The encrypted key packet is an encrypted data packet containing the original key information of the electricity meter, generated by the cryptographic machine at the master station. This key packet is encrypted using the public key of the terminal's ESAM and can only be decrypted by the terminal's ESAM.

[0062] Among them, the local encryption key is a key stored locally on the terminal after the terminal ESAM decrypts the encryption key packet, and is used for session negotiation with the electricity meter.

[0063] The meter reading scheme comprises a predefined set of reading parameters, including the data items to be read (voltage, current, power, etc.), data format, communication protocol parameters, etc. This invention supports up to 60 different meter reading schemes to adapt to different types and models of electricity meters.

[0064] Among them, session validity: the secure session between the terminal and the electricity meter has a validity period (e.g., 10 minutes), and the session key needs to be renegotiated after the session expires.

[0065] The master station distributes the encrypted key packet via an encrypted link. The terminal's ESAM uses its internal private key to decrypt the original key, then converts it into a locally suitable encrypted key. The terminal reads the energy meter's device model and protocol version number, matching the optimal solution from 60 reading schemes. It then uses the encrypted key to negotiate a session with the energy meter, obtaining a temporary session key. The terminal uses the session key to assemble the encrypted reading command and sends it to the energy meter; upon receiving the encrypted result, it decrypts it using the same key and verifies the MAC address. The terminal monitors the remaining session duration in real time. If there is a high-priority reading task (such as an emergency call from the master station), the terminal automatically requests an extension of the session duration from the energy meter; if it is a low-priority task, the session is allowed to expire normally and be renegotiated.

[0066] Step S104: The protected data is stored in the terminal data center, and the corresponding integrity verification information is generated based on the security module for associated storage.

[0067] The terminal data center refers to the local data storage system within the terminal, typically composed of Flash memory or eMMC storage chips, used for persistent storage of various business data collected by the terminal. In this invention, the data center is logically divided into two independent areas: a data area and a backup area.

[0068] The data area is the main storage area in the data center used to store protected data (ciphertext data).

[0069] The backup area is an auxiliary storage area in the data center used to store protected copies of data and integrity verification information. The backup area and the data area use different physical storage address ranges, and may even use different storage media, to prevent simultaneous failure.

[0070] Among them, integrity verification information refers to the verification value used to verify the integrity of data. In this invention, it is preferred to use the MAC value calculated by the SM3 algorithm on the protected data.

[0071] Among them, associated storage refers to the establishment of a one-to-one mapping relationship between the copies of protected data and integrity verification information based on the same data index, and storage in the corresponding location of the backup area.

[0072] The terminal's data storage protection module calls ESAM and uses the SM4 symmetric encryption algorithm to encrypt each record of the data to be processed row by row. Row-by-row encryption means encrypting each record in the relational data table as an independent data block, rather than encrypting the entire data table as a whole. The advantage of row-by-row encryption is that it supports random access; when reading a particular row, only that row needs to be decrypted, without needing to decrypt the entire table. After ESAM completes the data encryption, it continues to use the SM3 algorithm to calculate the MAC value of the encrypted ciphertext data. After the calculation is complete, the terminal stores the ciphertext data in the corresponding location in the data area, and stores a copy of the ciphertext data and the MAC value in the corresponding location in the backup area using the same data index (such as the primary key ID or timestamp of the data record), forming a one-to-one dual storage mapping relationship.

[0073] In terms of effectiveness, the dual storage mode of data area + backup area, combined with ESAM's hardware encryption and MAC verification, achieves confidentiality protection and verifiable integrity of data storage. Even if the data area is physically attacked and tampered with, the MAC value stored in the backup area can be used to detect tampering and trigger data recovery.

[0074] Specifically, the security module is the ESAM hardware security module; it stores the protected data in the terminal data center and generates corresponding integrity verification information based on the security module for associated storage, including: calling ESAM to encrypt each data record of the data to be processed line by line using the SM4 symmetric encryption algorithm to generate ciphertext data as protected data; calling ESAM to calculate the MAC value of the ciphertext data using the SM3 hash algorithm as integrity verification information; storing the ciphertext data in the corresponding location of the data area of ​​the data center, and storing a copy of the ciphertext data and the MAC value in the corresponding location of the backup area of ​​the data center according to the same data index, forming a dual storage mapping relationship.

[0075] Among them, the SM4 symmetric encryption algorithm is a symmetric block cipher algorithm released by the State Cryptography Administration, with a block length of 128 bits and a key length of 128 bits. The SM4 algorithm is similar in function to the international AES algorithm, but the algorithm structure is different, and it has independent intellectual property rights.

[0076] Row-by-row encryption involves encrypting each row of a record in the data table independently, rather than encrypting the entire table as a whole. The advantage of row-by-row encryption is that it supports random access—when reading a specific row, only that row needs to be decrypted, without needing to decrypt the entire table.

[0077] The dual-storage mapping relationship establishes a one-to-one correspondence between the storage locations in the data area and the backup area. For example, if row N in the data area corresponds to row N in the backup area, the corresponding data copy and MAC value can be quickly found using the same index value.

[0078] The terminal invokes ESAM to encrypt each data record using the SM4 algorithm. The encryption mode can be either CBC (Cryptographic Block Chaining) or CTR (Cryptographic Counter) mode. ESAM calculates the SM3 hash value of the encrypted ciphertext data as the MAC. The ciphertext is stored in the data area, and a copy of the ciphertext and the MAC value are stored in the backup area using the same index.

[0079] Step S105: During the data interaction process, collect operation behavior information, generate the current audit record based on the operation behavior information and the chain structure of the current audit chain, and append the current audit record to the current audit chain to form an anti-tampering audit chain.

[0080] Among them, operation behavior information refers to various operation records generated during the operation of the terminal, including but not limited to: data interaction operations (who, when, and what data was read / written), interface operations (which interface was opened / closed), APP running events (which APP started / stopped / crashed), user login events (who and when logged in), and maintenance operations (parameter settings, firmware updates), etc.

[0081] An audit chain is a chain-like data structure composed of multiple audit records linked together in chronological order. Each audit record contains the hash value of the previous record, forming a chain that connects the beginning and end of the chain.

[0082] Among them, the chain structure refers to the fact that each audit record contains the block hash value of the previous audit record, forming a chain binding relationship of block hash value → next block hash value.

[0083] The tamper-proof audit chain refers to an audit record chain built locally on the terminal, drawing on the data structure concept of blockchain. Each record is bound to the previous record through a hash value. Any tampering with the historical record will invalidate the hash values ​​of all subsequent records, thus achieving tamper-proof protection.

[0084] The terminal's audit monitoring module listens for operational events at each stage of the system in real time. When any operation occurs, the audit monitoring module captures the event and extracts the following information: operation time (system timestamp accurate to milliseconds), operation type (e.g., parameter setting, data reading, APP installation, user login, etc.), operation object identifier (name of the data table being operated on, file name, parameter name, etc.), operator identifier (operator certificate serial number for remote operation records, login user ID for local operation records), and operation result (success or failure and return code). The audit monitoring module reads the block hash value of the previous audit record in the current audit chain from the ESAM secure storage area. For the first audit record, the previous hash value is preset to all zeros (i.e., the genesis block). The audit monitoring module serializes all fields of the above operation behavior information into a data string according to a fixed format, calculates the SM3 hash value of the data string, and obtains the operation fingerprint. The operation fingerprint, the block hash value of the previous audit record, and the current timestamp are concatenated (seminated) in sequence to form a complete data string. The audit monitoring module sends the concatenated data string to ESAM, which uses the terminal's private key to perform an SM2 digital signature on the data string. The digital signature, the concatenated data string, the operation fingerprint, and the previous hash value together constitute the current audit block. The terminal stores the current audit block in the local audit log area (a dedicated partition in the Flash memory) and updates the block hash value of the current audit block to the secure storage area of ​​ESAM, using it as the previous hash value for the next audit record. After the current audit block has been protected by ESAM's integrity, it is uploaded to the main station's audit center via an encrypted link for remote viewing and auditing by administrators.

[0085] In terms of effectiveness, the blockchain-style audit chain ensures the immutability and traceability of all operational records. Any modification to historical audit records will break the integrity of the hash chain and thus be detected. Combined with ESAM's digital signatures, the audit records also possess non-repudiation capabilities.

[0086] Step S106: Monitor security events in the entire link in real time. When data anomalies are detected, perform data recovery based on integrity verification information. If local recovery is unavailable, initiate a cross-device recovery request to the adjacent terminal through the security module, receive the encrypted backup data returned by the adjacent terminal, and reconstruct the local data after decryption through the security module.

[0087] Among them, security incidents refer to various security anomalies that occur during terminal operation, including but not limited to: data tampering (MAC verification failure), communication link anomalies (connection interruption, excessive bit error rate), device impersonation (identity authentication failure), and illegal opening of interfaces (unauthorized access to external interfaces).

[0088] Among them, data anomaly refers to a mismatch between the data in the data area and its corresponding integrity verification information, or physical damage to the data area / backup area that makes the data unreadable.

[0089] Local recovery refers to the recovery of data that has been tampered with or damaged in the data area by using protected data copies and integrity verification information stored in the local backup area of ​​the terminal.

[0090] Cross-device recovery refers to a mechanism that, when neither the local data area nor the backup area of ​​the terminal can provide valid data, obtains backup data from a neighboring terminal of the same type through a secure communication channel to achieve data reconstruction.

[0091] Adjacent terminals refer to other intelligent converged terminals located in the same distribution area or the same communication network as the current terminal. These terminals can communicate directly with each other through local communication interfaces (such as power line carrier, low-power wireless, etc.).

[0092] The terminal's audit and monitoring module runs continuously, monitoring various security events in real time: data tampering detection (each time data is read from the data area, the corresponding MAC value is read from the backup area, the MAC value of the data in the data area is recalculated and compared), link anomaly detection (monitoring the signal strength, bit error rate, heartbeat response time, etc. of the communication link), device spoofing detection (monitoring the frequency and source of identity authentication failures), and illegal interface opening detection (monitoring whether the opening status of each communication interface is consistent with the authorization policy). When the monitoring module detects that the MAC verification of a certain piece of data in the data area fails, it determines that the data has been tampered with. The recovery process is as follows: the corresponding backup MAC value and backup encrypted data are read from the backup area according to the data index; the terminal calls ESAM to recalculate the MAC value of the backup encrypted data and compares it with the backup MAC value. If they match, it proves that the backup data is intact; the backup encrypted data is overwritten to the corresponding position in the data area to complete the data recovery; the data recovery log is recorded and included in the blockchain-based audit chain. When the local backup area is detected to be completely unavailable (physical damage to the storage chip) and the data area is damaged, the terminal initiates a cross-device recovery process: A cross-device recovery request message is generated via ESAM (containing the terminal's device identifier, the requested data range, and a timestamp), and the message is digitally signed using the terminal's private key in ESAM using SM2. The signed request message is broadcast to adjacent terminals within the area via the local communication interface. Upon receiving the request, the adjacent terminal initiates an authentication challenge. The current terminal completes two-way authentication with the adjacent terminal via ESAM, establishing a temporary secure recovery channel. The adjacent terminal reads the backup ciphertext for the corresponding data range from its data center and sends it to the current terminal via the temporary secure recovery channel. The current terminal decrypts and performs MAC verification on the received encrypted backup data block using ESAM, and reconstructs the target data in the local data area using the decrypted data.

[0093] In terms of effectiveness, the three-level data recovery mechanism (local backup recovery - intelligent reconstruction - cross-device recovery) greatly ensures the data availability of the terminal. Even if the local storage suffers physical damage, accurate data can be obtained through cross-device recovery, achieving high reliability of power terminal data storage.

[0094] Specifically, when data anomalies are detected, data recovery is performed based on integrity verification information, including: responding to a data read command, obtaining the target integrity verification value corresponding to the target data from the backup area, and calling the security module to recalculate the current integrity verification value of the target protected data in the data area; comparing the target integrity verification value with the current integrity verification value; if they match, the data is determined to be intact, and the security module is called to decrypt the target protected data and return; if they do not match, the target protected data in the data area is determined to have been tampered with, and the backup protected data is extracted from the backup area according to the data index, overwritten by the backup protected data in the data area, and a data recovery log is recorded; if both the data area and the backup area are damaged, the pre-stored data feature template and statistical features of historically collected data in the security module are obtained, and a copy of the target data is automatically reconstructed based on the data feature template and statistical features.

[0095] The data feature template is a pre-stored set of data type definitions and business constraint rules in ESAM, containing information such as field format, legal value range, and business logic constraints. For example, the legal range for voltage values ​​is 0-500V, the legal range for current values ​​is 0-100A, and power value = voltage × current, etc.

[0096] Among them, statistical characteristics are statistical information extracted from historically collected data, such as the average, maximum, minimum, and trend of a certain data item in the last 24 hours.

[0097] Among these features, intelligent data reconstruction involves automatically reconstructing a data copy that conforms to business logic when both the data area and the backup area are damaged, based on data feature templates and statistical characteristics. While the reconstructed data may not be the original, precise values, it provides a usable data foundation in the event of complete data corruption, preventing business interruption.

[0098] Specifically, the security module initiates a cross-device recovery request to adjacent terminals and receives encrypted backup data returned by the adjacent terminals. This includes: when the local backup area is detected to be completely unavailable and the data area is corrupted, the security module generates a cross-device recovery request message containing the device identifier of the local terminal, the range of data to be recovered, and a timestamp, and digitally signs the message through the security module; broadcasting the signed cross-device recovery request message to at least one adjacent terminal through the local communication interface and receiving authentication challenges returned by the adjacent terminals; in response to the authentication challenges, completing two-way identity authentication with the adjacent terminals through the security module and establishing a temporary secure recovery channel; receiving encrypted backup data blocks sent by the adjacent terminals through the temporary secure recovery channel, decrypting and performing MAC verification on the encrypted backup data blocks through the security module, and reconstructing the target data in the local data area using the decrypted data.

[0099] The terminal generates a cross-device recovery request message via ESAM, including the device identifier, data range, and timestamp, and signs it using an SM2 private key. The signed request message is broadcast to neighboring terminals via the local communication interface, receiving authentication challenges. Two-way authentication with neighboring terminals is completed through ESAM, establishing a temporary secure recovery channel. Encrypted backup data blocks are received through this temporary channel, decrypted by ESAM, and verified using a MAC address. The decrypted data is then used to reconstruct the local data.

[0100] Furthermore, the real-time monitoring of security events across the entire link can include: real-time monitoring of data tampering events, communication link anomaly events, device spoofing access events, and illegal interface opening events; when a security event is detected, the event alarm information is reported to the main station's online security monitoring module via an encrypted link within a preset 2 minutes, and the event alarm information is digitally signed by the security module; detailed log records of the security event are locally stored for at least 72 hours, and the detailed log records are included in the anti-tampering audit chain for integrity protection; and an emergency response action corresponding to the security event is triggered, the emergency response action including: blocking the current communication link, freezing the running permissions of the business APP, or triggering the cross-device recovery.

[0101] The intelligent converged terminal end-to-end data security protection method provided in this invention can achieve the following: After the terminal is powered on, a multi-level cross-signature verification is performed on multiple software layers of the terminal based on the security module, and a secure startup is completed after all signatures are verified. The method then acquires the identity authentication request of an external interaction object, performs two-way identity authentication with the external interaction object based on the security module, and establishes a secure communication link. Next, it acquires the data to be processed, determines the security level of the data to be processed, and calls the security module to process the data to be processed accordingly based on the security level, generating protected data. The protected data is stored in the terminal data center, and corresponding integrity verification information is generated based on the security module for associated storage. During data interaction, operation behavior information is collected, and a current audit record is generated based on the operation behavior information and the chain structure of the current audit chain. This current audit record is then appended to the current audit chain to form an anti-tampering audit chain. The method also monitors security events in the end-to-end in real time. When data anomalies are detected, data recovery is performed based on the integrity verification information. If local recovery is unavailable, a cross-device recovery request is initiated to adjacent terminals through the security module, and encrypted backup data returned by the adjacent terminals is received. The local data is then decrypted by the security module and reconstructed. This approach achieves proactive defense across the entire terminal chain through mesh cross-signature verification, dynamic hierarchical self-adaptation, blockchain-style audit chain, and cross-device redundancy recovery, significantly improving the reliability of secure startup, the precision of data protection, the reliability of audit tracing, and the data disaster recovery capability.

[0102] Example 2 This invention also provides another method for end-to-end data security protection of intelligent fusion terminals; this method is implemented based on the method in the above embodiments; the method focuses on describing the specific implementation of generating the current audit record based on the chain structure of the operation behavior information and the current audit chain, and appending the current audit record to the current audit chain to form an anti-tampering audit chain.

[0103] Figure 2 A flowchart of another intelligent fusion terminal end-to-end data security protection method provided in an embodiment of the present invention is shown below. Figure 2 As shown, generating a current audit record based on operational behavior information and the chain structure of the current audit chain, and appending the current audit record to the current audit chain to form a tamper-proof audit chain, may include the following steps: Step S201: Obtain operation behavior information, which includes at least the operation time, operation type, operation object identifier, operator certificate serial number, and operation result.

[0104] The audit monitoring module captures operation events and extracts operation time, operation type, operation object identifier, operator certificate serial number, and operation result.

[0105] Step S202: Generate the operation fingerprint of the current operation based on the operation behavior information. The operation fingerprint is the hash value obtained by performing a hash operation on the operation behavior information.

[0106] The operation fingerprint is a hash value obtained by performing an SM3 hash operation on the operation information; it is a unique digital digest of the operation. Any modification to the operation information will result in a change to the operation fingerprint.

[0107] Step S203: Read the block hash value of the previous audit record in the current audit chain from the secure storage area of ​​the security module, concatenate the operation fingerprint, the block hash value of the previous audit record and the current timestamp, and digitally sign it through the security module to generate the current audit block.

[0108] Among them, the block hash value is the hash value obtained by performing an SM3 hash operation on the entire audit block (including operation fingerprint, previous hash value, timestamp, digital signature, etc.), which serves as the unique identifier of the block.

[0109] Specifically, the block hash value of the previous audit record is read from ESAM, the operation fingerprint, the previous hash value, and the timestamp are concatenated, and the current audit block is generated by signing with the SM2 private key.

[0110] Step S204: Store the current audit block in the local audit log area, and update the block hash value of the current audit block to the secure storage area of ​​the security module, forming an anti-tampering audit chain with the hash values ​​of the preceding and following blocks linked together.

[0111] The audit chain is interconnected: each audit block stores the hash value of the previous block, forming a chain structure. Modifying any historical record will invalidate the hash values ​​of all blocks following that record.

[0112] Specifically, the current audit block is stored in the local audit log area, and the current block hash value is updated to ESAM.

[0113] Step S205: After the current audit block is protected for integrity by the security module, it is uploaded to the main station via an encrypted link.

[0114] The audit blocks are uploaded to the main audit center after being protected by ESAM integrity.

[0115] Example 3 Corresponding to the above method embodiments, this invention provides a full-link data security protection device for intelligent converged terminals. Figure 3 This is a schematic diagram of the structure of a smart fusion terminal end-to-end data security protection device provided in an embodiment of the present invention, as shown below. Figure 3 As shown, the intelligent fusion terminal's end-to-end data security protection device may include: The secure boot module 301 is used to perform multi-level cross-signature verification on multiple software layers of the terminal after the terminal is powered on, and completes secure boot after all signatures are verified.

[0116] The secure communication link establishment module 302 is used to obtain the authentication request of the external interaction object, perform two-way authentication with the external interaction object based on the security module, and establish a secure communication link.

[0117] The protected data generation module 303 is used to acquire the data to be processed, determine the security level of the data to be processed, and call the security module to process the data to be processed accordingly based on the security level to generate protected data.

[0118] The associated storage module 304 is used to store the protected data to the terminal data center and generate corresponding integrity verification information based on the security module for associated storage.

[0119] The tamper-proof audit chain forming module 305 is used to collect operation behavior information during data interaction, generate the current audit record based on the operation behavior information and the chain structure of the current audit chain, and append the current audit record to the current audit chain to form the tamper-proof audit chain.

[0120] The security event monitoring module 306 is used to monitor security events in the entire chain in real time. When data anomalies are detected, data recovery is performed based on integrity verification information. If local recovery is unavailable, a cross-device recovery request is initiated to the adjacent terminal through the security module. The encrypted backup data returned by the adjacent terminal is received, decrypted by the security module, and the local data is reconstructed.

[0121] The intelligent converged terminal end-to-end data security protection device provided in this embodiment of the invention can, after the terminal is powered on, perform multi-level cross-signature verification on multiple software layers of the terminal based on the security module, and complete secure startup after all signatures are verified; obtain the identity authentication request of the external interaction object, perform two-way identity authentication with the external interaction object based on the security module, and establish a secure communication link; obtain the data to be processed, determine the security level of the data to be processed, and call the security module to process the data to be processed accordingly based on the security level to generate protected data; store the protected data in the terminal data center, and generate corresponding integrity verification information based on the security module for associated storage; during the data interaction process, collect operation behavior information, generate the current audit record based on the operation behavior information and the chain structure of the current audit chain, and append the current audit record to the current audit chain to form an anti-tampering audit chain; monitor security events in the end-to-end in real time, and when data anomalies are detected, perform data recovery based on integrity verification information; if local recovery is unavailable, initiate a cross-device recovery request to the adjacent terminal through the security module, receive the encrypted backup data returned by the adjacent terminal, and reconstruct the local data after decryption by the security module. This approach achieves proactive defense across the entire terminal chain through mesh cross-signature verification, dynamic hierarchical self-adaptation, blockchain-style audit chain, and cross-device redundancy recovery, significantly improving the reliability of secure startup, the precision of data protection, the reliability of audit tracing, and the data disaster recovery capability.

[0122] In some embodiments, the secure boot module is further configured to: call ESAM to verify the digital signature of the operating system kernel through the bootloader UBOOT; boot the operating system kernel after successful verification; call ESAM through the operating system kernel to verify the digital signatures of UBOOT, critical file system configurations, and the security chip scheduling APP; launch the security chip scheduling APP after successful verification; call ESAM through the security chip scheduling APP to reverse verify the digital signatures of UBOOT and the operating system kernel, and simultaneously call ESAM to verify the digital signatures of all business APPs; start each business APP, and verify the digital signatures of adjacent business APPs by calling ESAM among themselves, forming a mesh trust chain; after all signatures are verified, generate dynamic trust anchors for the current boot batch through ESAM, and write the dynamic trust anchors to the secure storage area of ​​ESAM for rapid comparison during the next boot.

[0123] In some embodiments, the secure communication link establishment module is further configured to: if the external interaction object is the master station, perform two-way authentication based on the national cryptographic SSL / SSAL protocol and through the channel layer and service layer digital certificates stored in the security module; if the external interaction object is a sensing device or other terminal, perform two-way challenge-response authentication based on the national cryptographic algorithm based on the symmetric key or digital certificate pre-set in the security module, and negotiate to generate the session key for this communication; after the two-way authentication is successful, establish a secure communication link and store the session key in the temporary key area of ​​the security module.

[0124] In some embodiments, the protected data generation module is further configured to obtain the link quality parameters of the current communication link, the security status score of the terminal device, and the service type label of the data to be processed; input the link quality parameters, security status score, and service type label into a preset dynamic hierarchical decision model, and output the current dynamic security level of the data to be processed, wherein the dynamic security level includes at least a normal level, an important level, and a critical level; if the current dynamic security level is a normal level, the security module is invoked to calculate the MAC checksum of the data to be processed; if the current dynamic security level is an important level, the security module is invoked to encrypt the data to be processed using a symmetric encryption algorithm; if the current dynamic security level is a critical level, the security module is invoked to append the current timestamp and a random number to the data to be processed and perform digital signature processing; when a sudden change is detected in the link quality parameters or security status score, an adaptive seamless switching of the processing strategy is triggered, and the switching process is transparent to the upper-layer service applications.

[0125] In some embodiments, the protected data generation module is further configured to receive a trans-encryption key packet and at least one set of reading schemes issued by the master station; decrypt the trans-encryption key packet and convert it into a local trans-encryption key through the security module; obtain the device model and protocol version number of the electricity meter; adaptively match the target reading scheme from multiple sets of reading schemes according to the device model and protocol version number; and perform session negotiation with the electricity meter using the local trans-encryption key through the security module based on the target reading scheme to obtain a temporary session key; assemble a ciphertext reading instruction using the temporary session key through the security module according to the target reading scheme, and send the ciphertext reading instruction to the electricity meter; receive the ciphertext reading result returned by the electricity meter; decrypt the ciphertext reading result and perform MAC verification using the temporary session key through the security module to obtain plaintext reading data; monitor the remaining valid duration of the current session in real time, dynamically extend the valid duration of the session according to the priority of the current service, or trigger a re-negotiation with the electricity meter.

[0126] In some embodiments, the associated storage module is further configured to invoke ESAM, use the SM4 symmetric encryption algorithm to encrypt each data record of the data to be processed line by line to generate ciphertext data as protected data; invoke ESAM, use the SM3 hash algorithm to calculate the MAC value of the ciphertext data as integrity verification information; store the ciphertext data in the corresponding location of the data area of ​​the data center, and store a copy of the ciphertext data and the MAC value in the corresponding location of the backup area of ​​the data center according to the same data index, forming a dual storage mapping relationship.

[0127] In some embodiments, the security event monitoring module is further configured to, in response to a data read instruction, obtain the target integrity verification value corresponding to the target data from the backup area, and call the security module to recalculate the current integrity verification value of the target protected data in the data area; compare the target integrity verification value with the current integrity verification value; if they match, the data is determined to be complete, and the security module is called to decrypt the target protected data and return; if they do not match, the target protected data in the data area is determined to have been tampered with, the backup protected data is extracted from the backup area according to the data index, the backup protected data is overwritten into the data area, and a data recovery log is recorded; if both the data area and the backup area are damaged, the pre-stored data feature template and statistical features of historically collected data in the security module are obtained, and the target data copy is automatically reconstructed according to the data feature template and statistical features.

[0128] In some embodiments, the security event monitoring module is further configured to, when detecting that the local backup area is completely unavailable and the data area is corrupted, generate a cross-device recovery request message through the security module. The message includes the device identifier of the local terminal, the data range to be recovered, and a timestamp, and digitally sign the message through the security module; broadcast the signed cross-device recovery request message to at least one adjacent terminal through the local communication interface, and receive authentication challenges returned by the adjacent terminal; in response to the authentication challenges, complete two-way identity authentication with the adjacent terminal through the security module and establish a temporary secure recovery channel; receive encrypted backup data blocks sent by the adjacent terminal through the temporary secure recovery channel, decrypt and perform MAC verification on the encrypted backup data blocks through the security module, and reconstruct the target data in the local data area using the decrypted data.

[0129] In some embodiments, the tamper-proof audit chain forming module is further configured to: acquire operation behavior information, which includes at least operation time, operation type, operation object identifier, operator certificate serial number, and operation result; generate an operation fingerprint for the current operation based on the operation behavior information, wherein the operation fingerprint is a hash value obtained by hashing the operation behavior information; read the block hash value of the previous audit record in the current audit chain from the secure storage area of ​​the security module; concatenate the operation fingerprint, the block hash value of the previous audit record, and the current timestamp; and perform digital signature through the security module to generate the current audit block; store the current audit block in the local audit log area; update the block hash value of the current audit block to the secure storage area of ​​the security module, forming a tamper-proof audit chain with consecutive block hash values; and upload the current audit block to the main station through an encrypted link after the security module has performed integrity protection.

[0130] Example 4 This invention also provides an electronic device for running the above-described intelligent fusion terminal end-to-end data security protection method; see [link to previous document]. Figure 4 The diagram shows the structure of an electronic device, which includes a memory 500 and a processor 501. The memory 500 stores one or more computer instructions, which are executed by the processor 501 to implement the aforementioned intelligent fusion terminal full-link data security protection method.

[0131] Furthermore, Figure 4 The electronic device shown also includes a bus 502 and a communication interface 503. The processor 501, the communication interface 503, and the memory 500 are connected via the bus 502.

[0132] The memory 500 may include high-speed random access memory (RAM) and may also include non-volatile memory, such as at least one disk storage device. Communication between this system network element and at least one other network element is achieved through at least one communication interface 503 (which can be wired or wireless), such as the Internet, wide area network, local area network, metropolitan area network, etc. The bus 502 can be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 4 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0133] Processor 501 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of processor 501 or by instructions in software form. Processor 501 can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this invention can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software module can reside in a readily available storage medium in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory 500, and processor 501 reads information from memory 500 and, in conjunction with its hardware, completes the steps of the method described in the foregoing embodiments.

[0134] This invention also provides a computer-readable storage medium storing computer-executable instructions. When these computer-executable instructions are called and executed by a processor, they cause the processor to implement the aforementioned intelligent fusion terminal end-to-end data security protection method. For specific implementation details, please refer to the method embodiments, which will not be repeated here.

[0135] The computer program product for the method of providing end-to-end data security protection for intelligent converged terminals provided in this embodiment of the invention includes a computer-readable storage medium storing non-volatile program code executable by a processor. The instructions included in the program code can be used to execute the methods described in the preceding method embodiments. For specific implementation details, please refer to the method embodiments, which will not be repeated here.

[0136] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0137] In the several embodiments provided by this invention, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the coupling or direct coupling or communication connection shown or discussed may be through some communication interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0138] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0139] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0140] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0141] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for end-to-end data security protection of intelligent fusion terminals, characterized in that, The method includes: After the terminal is powered on, the security module performs multi-level cross-signature verification on multiple software layers of the terminal. After all signatures are verified, the secure boot is completed. Obtain the authentication request of the external interaction object, perform two-way authentication between the security module and the external interaction object, and establish a secure communication link; Acquire the data to be processed, determine the security level of the data to be processed, and call the security module to process the data to be processed accordingly based on the security level to generate protected data. The protected data is stored in the terminal data center, and corresponding integrity verification information is generated based on the security module for associated storage; During the data interaction process, operation behavior information is collected, and a current audit record is generated based on the operation behavior information and the chain structure of the current audit chain. The current audit record is then appended to the current audit chain to form a tamper-proof audit chain. The system monitors security events throughout the entire data chain in real time. When data anomalies are detected, data recovery is performed based on the integrity verification information. If local recovery is unavailable, a cross-device recovery request is initiated to the adjacent terminal through the security module. The system receives encrypted backup data returned by the adjacent terminal, decrypts it through the security module, and reconstructs the local data.

2. The method according to claim 1, characterized in that, The security module is an ESAM hardware security module; the multi-level cross-signature verification based on the security module for multiple software layers of the terminal includes: The bootloader UBOOT calls ESAM to verify the digital signature of the operating system kernel, and after successful verification, the operating system kernel is booted. The operating system kernel calls the ESAM to verify the digital signatures of UBOOT, key file system configurations, and the security chip scheduling APP. After successful verification, the security chip scheduling APP is launched. The security chip scheduler APP calls the ESAM to reverse verify the digital signatures of UBOOT and the operating system kernel, and simultaneously calls the ESAM to verify the digital signatures of all business APPs. Each of the aforementioned business apps is launched, and the digital signatures of adjacent business apps are verified by calling the ESAM between the business apps, thus forming a mesh trust chain. After all signatures are verified, a dynamic trust anchor point for the current startup batch is generated through the ESAM, and the dynamic trust anchor point is written to the secure storage area of ​​the ESAM for quick comparison during the next startup.

3. The method according to claim 1, characterized in that, The external interaction objects include the main station, sensing devices, or other terminals; the two-way authentication between the security module and the external interaction objects includes: If the external interaction object is the master station, then based on the national cryptographic SSL / SSAL protocol, two-way identity authentication is performed through the channel layer and business layer digital certificates stored in the security module; If the external interaction object is a sensing device or other terminal, then based on the symmetric key or digital certificate pre-set in the security module, a two-way challenge-response authentication based on the national cryptographic algorithm is performed to negotiate and generate the session key for this communication. After successful two-way authentication, the secure communication link is established, and the session key is stored in the temporary key area of ​​the security module.

4. The method according to claim 1, characterized in that, The process of determining the security level of the data to be processed and, based on the security level, invoking the security module to process the data accordingly includes: Obtain the link quality parameters of the current communication link, the security status score of the terminal device, and the service type label of the data to be processed; The link quality parameters, the security status score, and the service type label are input into a preset dynamic hierarchical decision model, and the current dynamic security level of the data to be processed is output. The dynamic security level includes at least a normal level, an important level, and a critical level. If the current dynamic security level is normal, then the security module is invoked to calculate the MAC checksum of the data to be processed. If the current dynamic security level is important, then the security module is invoked to encrypt the data to be processed using a symmetric encryption algorithm; If the current dynamic security level is critical, then the security module is invoked to append the current timestamp and a random number to the data to be processed and perform digital signature processing. When a sudden change is detected in the link quality parameters or the security status score, an adaptive and seamless switching of the processing strategy is triggered, and the switching process is transparent to upper-layer business applications.

5. The method according to claim 1, characterized in that, When the external interaction object is an electricity meter, the step of calling the security module to process the data to be processed according to the security level includes converting to an encrypted data reading strategy, specifically: The system receives a decryption key packet and at least one set of copying schemes from the main station, and decrypts the decryption key packet and converts it into a local decryption key through the security module. Obtain the device model and protocol version number of the electricity meter; adaptively match the target reading scheme from multiple sets of reading schemes based on the device model and protocol version number; and perform session negotiation with the electricity meter through the security module using the local encryption key based on the target reading scheme to obtain a temporary session key. According to the target reading scheme, the security module uses the temporary session key to assemble a encrypted reading instruction, and sends the encrypted reading instruction to the electricity meter. The system receives the encrypted reading result returned by the electricity meter, and uses the temporary session key through the security module to decrypt and perform MAC verification on the encrypted reading result to obtain the plaintext reading data. The remaining validity period of the current session is monitored in real time, and the validity period of the session is dynamically extended according to the priority of the current service, or a new session negotiation with the electricity meter is triggered.

6. The method according to claim 1, characterized in that, The security module is an ESAM hardware security module; the step of storing the protected data in the terminal data center and generating corresponding integrity verification information based on the security module for associated storage includes: The ESAM is invoked, and the SM4 symmetric encryption algorithm is used to encrypt each data record of the data to be processed line by line to generate ciphertext data as the protected data. The ESAM is invoked, and the SM3 hash algorithm is used to calculate the MAC value of the encrypted data as the integrity verification information. The encrypted data is stored in the corresponding location of the data area of ​​the data center, and a copy of the encrypted data and the MAC value are stored in the corresponding location of the backup area of ​​the data center according to the same data index, forming a dual storage mapping relationship.

7. The method according to claim 1, characterized in that, When data anomalies are detected, data recovery based on the integrity verification information includes: In response to a data read command, the target integrity check value corresponding to the target data is obtained from the backup area, and the security module is invoked to recalculate the current integrity check value of the target protected data in the data area. Compare the target integrity check value with the current integrity check value; if they match, the data is determined to be complete, and the security module is invoked to decrypt the target protected data before returning the result. If there is a discrepancy, it is determined that the target protected data in the data area has been tampered with. The backup protected data is extracted from the backup area according to the data index, the backup protected data is overwritten into the data area, and a data recovery log is recorded. If both the data area and the backup area are damaged, the data feature template and statistical features of historically collected data pre-stored in the security module are obtained, and the target data copy is automatically reconstructed based on the data feature template and the statistical features.

8. The method according to claim 1, characterized in that, The step of initiating a cross-device recovery request to adjacent terminals through the security module and receiving encrypted backup data returned by the adjacent terminals includes: When the local backup area is detected to be completely unavailable and the data area is damaged, the security module generates a cross-device recovery request message. The message contains the device identifier of this terminal, the range of data to be recovered, and a timestamp. The security module also digitally signs the message. The signed cross-device recovery request message is broadcast to at least one adjacent terminal through the local communication interface, and the authentication challenge returned by the adjacent terminal is received. In response to the authentication challenge, the security module completes two-way identity authentication with the adjacent terminal and establishes a temporary security recovery channel; The system receives encrypted backup data blocks sent by the adjacent terminal through the temporary secure recovery channel, decrypts and performs MAC verification on the encrypted backup data blocks through the security module, and reconstructs the target data in the local data area using the decrypted data.

9. The method according to claim 1, characterized in that, The process of generating a current audit record based on the operation behavior information and the chain structure of the current audit chain, and appending the current audit record to the current audit chain to form a tamper-proof audit chain, includes: The operation behavior information is obtained, which includes at least the operation time, operation type, operation object identifier, operator certificate serial number, and operation result; An operation fingerprint for the current operation is generated based on the operation behavior information, wherein the operation fingerprint is a hash value obtained by performing a hash operation on the operation behavior information; The block hash value of the previous audit record in the current audit chain is read from the secure storage area of ​​the security module. The operation fingerprint, the block hash value of the previous audit record and the current timestamp are concatenated and digitally signed by the security module to generate the current audit block. The current audit block is stored in the local audit log area, and the block hash value of the current audit block is updated to the secure storage area of ​​the security module, forming a tamper-proof audit chain with the hash values ​​of the preceding and following blocks connected end to end; The current audit block is protected for integrity by the security module and then uploaded to the main station via an encrypted link.

10. A smart fusion terminal end-to-end data security protection device, characterized in that, The device includes: The secure boot module is used to perform multi-level cross-signature verification on multiple software layers of the terminal after the terminal is powered on. Secure boot is completed after all signatures are verified. A secure communication link establishment module is used to obtain the authentication request of an external interaction object, and to establish a secure communication link by performing two-way authentication between the security module and the external interaction object. The protected data generation module is used to acquire data to be processed, determine the security level of the data to be processed, and call the security module to process the data to be processed accordingly based on the security level to generate protected data. An associated storage module is used to store the protected data in the terminal data center and generate corresponding integrity verification information based on the security module for associated storage. The tamper-proof audit chain formation module is used to collect operation behavior information during data interaction, generate a current audit record based on the operation behavior information and the chain structure of the current audit chain, and append the current audit record to the current audit chain to form a tamper-proof audit chain. The security event monitoring module is used to monitor security events in the entire chain in real time. When data anomalies are detected, data recovery is performed based on the integrity verification information. If local recovery is unavailable, a cross-device recovery request is initiated to the adjacent terminal through the security module. The encrypted backup data returned by the adjacent terminal is received, and the local data is reconstructed after being decrypted by the security module.

Images