A liquid rocket engine test stand data encryption system and method thereof

Abstract

The present application relates to the technical field of liquid rocket engine testing, and discloses a liquid rocket engine test stand data encryption system and method, the liquid rocket engine test stand data encryption system comprising a key management module, a distributed acquisition module, a centralized encryption module and a decryption verification module; the distributed acquisition module is used for acquiring and transmitting multi-source test data; the key management module is used for generating a master key based on a hardware security module, and obtaining a session key bound to a test task in combination with the master key and test task information; the centralized encryption module is used for calling the session key to perform initial encryption on test configuration information to generate a ciphertext configuration package, and performing parallel encryption operations on the multi-source test data based on the ciphertext configuration package; and the decryption verification module is used for calling the corresponding session key to decrypt the encrypted data. The present application can improve the real-time performance and security of test data encryption processing, and enhance the standardization and reliability of key management.

Description

Technical Field

[0001] This invention relates to the field of liquid rocket engine testing technology, and in particular to a liquid rocket engine test stand data encryption system and method. Background Technology

[0002] Liquid rocket engine testing is a crucial step in the rocket engine development process. During testing, the test stand collects large-scale data on multiple parameters, including pressure, flow rate, temperature, and vibration, at multiple measurement points. The obtained data directly reflects the engine's performance status and potential faults, serving as the core basis for engine design optimization, fault diagnosis, and performance verification. Some of the data involves core technological secrets in the aerospace field and has extremely high confidentiality requirements.

[0003] However, existing liquid rocket engine test stand data processing systems mostly focus on data acquisition, transmission, and storage, with insufficient emphasis on end-to-end data encryption protection. Regarding encryption capabilities, test data is characterized by massive volumes and high concurrency. Traditional encryption methods are inefficient and cannot meet the real-time requirements of the test process, easily leading to data backlog and transmission delays, affecting the normal progress of the test process. In terms of key management, existing systems lack a comprehensive key management system. The generation, distribution, and update processes of keys are not standardized, and there is a problem of fixed key reuse, which can easily lead to key leakage or invalidation, resulting in the risk of encrypted data being illegally stolen and tampered with. Regarding the overall security architecture, existing systems have failed to form end-to-end security protection from data acquisition and transmission to encryption processing and decryption verification. Security vulnerabilities exist between each link, failing to comprehensively guarantee the security and controllability of test data from generation to use.

[0004] Therefore, there is an urgent need to propose a data encryption system and method for liquid rocket engine test stands to solve the above problems. Summary of the Invention

[0005] The purpose of this invention is to propose a liquid rocket engine test stand data encryption system and method, which can improve the real-time performance and security of test data encryption processing, and enhance the standardization and reliability of key management.

[0006] To address the aforementioned technical problems, this invention provides a liquid rocket engine test stand data encryption system, comprising: a key management module, a distributed acquisition module, a centralized encryption module, and a decryption verification module; The distributed acquisition module is used to collect and transmit multi-source test data; The key management module is used to generate a master key based on the hardware security module, and to obtain a session key bound to the test task by combining the master key and the test task information. The centralized encryption module is used to call the session key to initially encrypt the test configuration information to generate a ciphertext configuration package, and to perform parallel encryption operations on the multi-source test data based on the ciphertext configuration package to obtain encrypted data; The decryption verification module is used to call the corresponding session key to decrypt the encrypted data, and to verify and validate the decrypted data.

[0007] Furthermore, the distributed acquisition module includes a data distributed acquisition unit, a transmission unit, and multiple sensors connected to each other; the sensors are set at various measuring points on the test bench to collect corresponding parameter information; the data distributed acquisition unit is used to receive the parameter information and encode the parameter information to generate multiple multi-source test data; the transmission unit has multiple independent transmission channels corresponding to each measuring point to independently transmit the corresponding multi-source test data.

[0008] Furthermore, it also includes a data preprocessing module, which sequentially performs classification processing, noise reduction processing, and formatting processing on the multi-source test data to output a valid data stream; the centralized encryption module is used to perform parallel encryption operations on the valid data stream based on the ciphertext configuration package to obtain the encrypted data.

[0009] Furthermore, the data preprocessing module includes a classification processing unit, a noise reduction processing unit, and a formatting processing unit; the classification processing unit is used to divide the multi-source test data into core test parameters and general test parameters according to the importance of the data, and into high-frequency test parameters and low-frequency test parameters according to the data acquisition frequency, and to adapt differentiated preprocessing rules for different categories of data. The noise reduction processing unit is used to adapt the optimal noise reduction algorithm for different types of noise and different frequency parameters, so as to retain the effective features of the data to the maximum extent and remove redundant interference information. The formatting processing unit is used to format and process the heterogeneity of multi-source data, and output a normalized effective data stream.

[0010] Furthermore, the key management module includes: a master key generation unit, a true random number generator, and a key derivation algorithm unit; the master key generation unit generates a master key through the true random number generator, and the master key is stored in the internal encryption area of ​​the hardware security module; the key derivation algorithm unit is used to obtain a session key bound to the test task based on the key derivation algorithm combined with the master key and the test task information, the session key corresponds one-to-one with a single test task and automatically expires after the task ends, and also performs hierarchical management and dynamic updating of the master key and the session key.

[0011] Furthermore, the centralized encryption module includes a first-layer encryption unit and a second-layer encryption unit; the first-layer encryption unit is used to call the session key to perform initial encryption on the test configuration information to generate a ciphertext configuration package, and the second-layer encryption unit is used to perform parallel encryption operations on the multi-source test data based on the ciphertext configuration package to obtain encrypted data.

[0012] Furthermore, it also includes an encrypted data storage module, which is used to perform distributed redundant storage of the encrypted data output by the centralized encryption module, and to perform evidence storage operations on the data access operations of the decryption verification module.

[0013] Furthermore, the decryption verification module includes an authorization verification unit and a decryption unit; the authorization verification unit is used to perform user identity authentication and permission level verification before obtaining the encrypted data stored in the encrypted storage module, and to determine whether the authorization verification is successful; the decryption unit is used to call the corresponding session key to decrypt the encrypted data after the authorization verification is successful, and to perform integrity verification and authenticity verification on the decrypted data.

[0014] Furthermore, this invention also proposes a method for encrypting liquid rocket engine test stand data, using the liquid rocket engine test stand data encryption system described above, specifically including the following: Acquisition and transmission of multi-source test data; A master key is generated based on the hardware security module, and a session key bound to the test task is obtained by combining the master key and the test task information. The session key is used to initially encrypt the test configuration information to generate a ciphertext configuration package, and parallel encryption operations are performed on the multi-source test data based on the ciphertext configuration package to obtain encrypted data; The encrypted data is decrypted by calling the corresponding session key, and the decrypted data is then verified and validated.

[0015] Furthermore, after the step of collecting and transmitting multi-source test data is completed, the multi-source test data is sequentially processed by classification, noise reduction, and formatting to output a valid data stream. Then, the session key is used to initially encrypt the test configuration information to generate a ciphertext configuration package. Based on the ciphertext configuration package, parallel encryption is performed on the valid data stream to obtain the encrypted data. The encrypted data is then stored in a distributed redundant manner, and data access operations are documented. For the stored encrypted data, before decryption, user authentication and permission level verification are sequentially performed. If verification fails, the decryption request is rejected. If authorization is granted, the corresponding session key is used to complete decryption. The decrypted data undergoes integrity and authenticity verification. If verification fails, an alarm is triggered and the corresponding access permissions are locked.

[0016] Through the above technical solution, the present invention has the following beneficial effects: By adopting a layered architecture that combines distributed acquisition with centralized encryption, the efficiency of encryption processing of massive amounts of high-concurrency test data can be improved, encryption latency can be reduced, and the real-time requirements of the test process can be met. By generating a master key based on a hardware security module and dynamically deriving session keys bound to the test tasks, the security and standardization of key management can be enhanced, and the risk of key leakage can be reduced. Through a two-layer encryption mechanism of configuration information pre-encryption and data parallel encryption, the data encryption throughput can be improved while ensuring the security of core configuration parameters. By verifying and checking the encrypted data through a decryption verification module, the availability and credibility of the decrypted data can be improved. Attached Figure Description

[0017] Figure 1 This is a block diagram of a liquid rocket engine test stand data encryption system according to an embodiment of the present invention; Figure 2 This is a flowchart illustrating a method for encrypting liquid rocket engine test stand data in one embodiment of the present invention. Detailed Implementation

[0018] Based on the teachings of this specification, those skilled in the art can form new technical solutions through cross-combination of different implementation methods without creating technical contradictions. Such variations should all be considered to fall within the protection scope of this invention.

[0019] The following is a more detailed description of a liquid rocket engine test stand data encryption system and method according to the present invention, with reference to the accompanying drawings, which illustrate preferred embodiments of the invention. It should be understood that those skilled in the art can modify the invention described herein while still achieving its advantageous effects. Therefore, the following description should be understood as being of general knowledge to those skilled in the art and is not intended to limit the invention.

[0020] The invention is described more specifically by way of example in the following paragraphs with reference to the accompanying drawings. The advantages and features of the invention will become clearer from the following description. It should be noted that the drawings are in a very simplified form and use non-precise proportions, and are only used to facilitate and clarify the illustration of the embodiments of the invention.

[0021] like Figure 1 As shown in the figure, this embodiment of the invention proposes a liquid rocket engine test stand data encryption system, including: a key management module, a distributed acquisition module, a centralized encryption module, and a decryption verification module.

[0022] Specifically, the distributed acquisition module is used to collect and transmit multi-source test data; the key management module is used to generate a master key based on the hardware security module (HSM), and obtain a session key bound to the test task by combining the master key and the test task information; the centralized encryption module is used to call the session key to perform initial encryption on the test configuration information to generate a ciphertext configuration package, and perform parallel encryption operation on the multi-source test data based on the ciphertext configuration package to obtain encrypted data; the decryption and verification module is used to call the corresponding session key to decrypt the encrypted data, and verify and validate the decrypted data.

[0023] In one embodiment, the distributed acquisition module includes a data distributed acquisition unit, a transmission unit, and multiple sensors connected to each other; the sensors are installed at various measuring points on the test bench to collect corresponding parameter information; the data distributed acquisition unit is used to receive the parameter information and encode the parameter information to generate multiple multi-source test data; the transmission unit has multiple independent transmission channels corresponding to each measuring point to independently transmit the corresponding multi-source test data.

[0024] The transmission unit utilizes the inherent confidentiality of electrical signals to achieve encrypted transmission from the data acquisition end to the central end. Each measurement point has an independent transmission channel, and a single point failure does not affect the overall data acquisition task. At the same time, it is adapted to the bandwidth requirements of synchronous transmission of large data streams. After receiving the data, the central end uniformly completes the restoration of physical quantity information.

[0025] Preferably, the multi-source test data includes at least one of the following: pressure parameters, flow parameters, temperature parameters, vibration parameters, noise parameters, heat flow parameters, liquid level parameters, impact parameters, rotational speed parameters, thrust parameters, pulsating pressure parameters, and strain parameters. As will be known to those skilled in the art, the multi-source test data may also include other types of parameters besides those mentioned in this embodiment, such as displacement parameters and acceleration parameters, which can be selected and set according to the actual test conditions and the layout of the measuring points.

[0026] In addition, this embodiment also includes a data preprocessing module, which is used to perform classification processing, noise reduction processing and formatting processing on the multi-source test data in sequence to output a valid data stream; the centralized encryption module is used to perform parallel encryption operation on the valid data stream based on the ciphertext configuration package to obtain the encrypted data.

[0027] Specifically, the data preprocessing module includes a classification processing unit, a noise reduction processing unit, and a formatting processing unit. The classification processing unit is used to divide the multi-source test data into core test parameters and general test parameters according to the importance of the data, and further into high-frequency test parameters and low-frequency test parameters according to the data acquisition frequency, adapting differentiated preprocessing rules for different categories of data. For example, thrust parameters, chamber pressure parameters, and flow parameters are classified as core test parameters, while ambient temperature parameters and vibration parameters are classified as general test parameters. Parameters with an acquisition frequency above 1kHz are classified as high-frequency test parameters, and parameters with an acquisition frequency below 40Hz are classified as low-frequency test parameters, thereby achieving key protection for core and confidential parameters.

[0028] In this embodiment, the noise reduction processing unit is used to adapt the optimal noise reduction algorithm for different types of noise and different frequency parameters, so as to retain the effective features of the data to the maximum extent and remove redundant interference information. The formatting processing unit is used to format and process the heterogeneity of multi-source data and output a normalized effective data stream.

[0029] Preferably, the noise reduction processing unit employs a combined noise reduction method, which includes at least one of outlier removal, power frequency interference removal, low-pass filtering, moving average filtering, wavelet denoising, and Kalman filtering. The high-frequency test parameters and the low-frequency test parameters are respectively adapted to corresponding combined noise reduction methods. Specifically, the low-frequency steady-state parameters are adapted to a combined noise reduction method of moving average and low-pass filtering, while the high-frequency dynamic parameters are adapted to a combined noise reduction method of wavelet denoising and Kalman filtering, simultaneously removing outliers exceeding the range and eliminating 50Hz power frequency interference. As those skilled in the art will know, the combined noise reduction method may also include other noise reduction algorithms besides those mentioned in this embodiment, such as median filtering and adaptive filtering, which can be selected and set according to the actual noise type and parameter characteristics.

[0030] Preferably, the formatting process for handling multi-source data heterogeneity includes at least one of the following: unified data format, field specifications, time sequence identifiers, data time sequence stamps, unit systems, and storage formats. As will be known to those skilled in the art, the formatting process may also include other formatting methods besides those mentioned in this embodiment, such as data compression encoding and metadata annotation, which can be selected and set according to actual data management needs.

[0031] In one embodiment, the key management module includes: a master key generation unit, a true random number generator, and a key derivation algorithm unit. Specifically, the master key generation unit generates a master key through the true random number generator, and the master key is stored in the internal encrypted area of ​​the hardware security module, prohibiting external export and plaintext reading; the key derivation algorithm unit is used to obtain a session key bound to the test task based on the key derivation algorithm combined with the master key and test task information, wherein the key derivation algorithm uses the mainstream symmetric encryption method in industry, and the key length and working mode are selected according to the confidentiality level of the test task; the session key corresponds one-to-one with a single test task and automatically expires after the task ends, while the master key and the session key are also managed hierarchically and dynamically updated.

[0032] The session key's validity period is set to the sum of the entire trial period and the post-verification period. It is automatically destroyed after the validity period expires, realizing a dynamic management mechanism of one session key per trial. The key management module also supports hierarchical key permission management, key usage log recording, and key anomaly alarm functions, implementing full lifecycle security management of the master key and session key.

[0033] Preferably, the test mission information includes at least one of the following: test mission number, test duration, test start timestamp, unique identifier of test point, test point configuration list, and authorized personnel list. As those skilled in the art will know, the test mission information may also include other mission attribute information besides those mentioned in this embodiment, such as engine model code and test bench number, which can be selected and set according to actual mission management needs.

[0034] In one embodiment, the centralized encryption module includes a first-layer encryption unit and a second-layer encryption unit. Specifically, the first-layer encryption unit is used to call the session key to initially encrypt the test configuration information to generate a ciphertext configuration package. The second-layer encryption unit is used to perform parallel encryption operations on the multi-source test data based on the ciphertext configuration package to obtain encrypted data. The second-layer encryption unit adopts a distributed parallel encryption architecture, performing multi-threaded parallel encryption on high-frequency and low-frequency classified data streams. The encryption latency of a single batch of data is controlled at the millisecond level, meeting the real-time requirements of high throughput and low latency for the test data stream. The entire process achieves fully ciphertext closed-loop processing, controlling the conversion of naturally encrypted electrical signals in the link into artificially reinforced and encrypted physical quantity output signals. This meets the hard requirements of low latency real-time performance and high bandwidth throughput in hot test scenarios without any plaintext transmission. The encrypted data is pushed to the encrypted data storage module in real time.

[0035] Preferably, the test configuration information includes at least one of the following: test bench KB value, thrust fitting univariate polynomial equation, and key parameter thresholds. The thrust fitting univariate polynomial equation and lookup table interpolation serve as a carrier of a high-precision encryption algorithm for encrypted calculations of core classified parameters. As those skilled in the art will know, the test configuration information may also include other configuration data besides those mentioned in this embodiment, such as sensor calibration data and sampling rate configuration parameters, which can be selected and set according to actual test configuration requirements.

[0036] In addition, this embodiment also includes an encrypted data storage module, which is used to perform distributed redundant storage of the encrypted data output by the centralized encryption module, and to perform evidence storage operations on the data access operations of the decryption verification module.

[0037] Preferably, the evidence storage operation includes at least one of the following: identity verification, permission verification, and operation recording for all data access subjects; generation of blockchain evidence storage logs for each data storage, retrieval, and modification behavior; full-process traceability; and immutability. The encrypted data storage module adopts a distributed redundant storage mode, synchronously backing up encrypted data to multiple storage nodes to avoid data loss due to single-point storage failure; it also sets access permission levels, allowing only authorized accounts on a whitelist to initiate data access requests, thus ensuring data storage security, reliability, and traceability. As those skilled in the art will know, the evidence storage operation may also include other evidence storage methods besides those mentioned in this embodiment, such as timestamp notarization evidence storage and multi-party signature evidence storage, which can be selected and set according to actual security management needs.

[0038] In this embodiment, the decryption verification module includes an authorization verification unit and a decryption unit. Specifically, the authorization verification unit performs user identity authentication and permission level verification before acquiring the encrypted data stored in the encrypted storage module, and determines whether the authorization verification passes. The decryption unit, after the authorization verification passes, calls the corresponding session key to decrypt the encrypted data, and performs integrity verification and authenticity verification on the decrypted data. The integrity verification uses a hash comparison method, calculating the hash value of the decrypted data and comparing it with the hash value of the blockchain evidence to determine whether the data is missing or tampered with. The authenticity verification combines key signature and blockchain evidence information to verify the legality of the data source, ensuring that the decrypted test data is usable, reliable, and not forged. If the verification fails, an alarm is triggered, the data is marked as abnormal, and the corresponding access permissions are locked.

[0039] In addition, such as Figure 2 As shown, this embodiment also proposes a method for encrypting liquid rocket engine test stand data, using the liquid rocket engine test stand data encryption system described above, specifically including the following steps: S1. Acquisition and transmission of multi-source test data; S2. Generate a master key based on the hardware security module, and obtain a session key bound to the test task by combining the master key and the test task information; S3. Use the session key to initially encrypt the test configuration information to generate a ciphertext configuration package, and perform parallel encryption on the multi-source test data based on the ciphertext configuration package to obtain encrypted data; S4. Call the corresponding session key to decrypt the encrypted data, and verify and validate the decrypted data.

[0040] Furthermore, after the step of collecting and transmitting multi-source test data is completed, the multi-source test data is sequentially processed by classification, noise reduction, and formatting to output a valid data stream. Then, the session key is used to initially encrypt the test configuration information to generate a ciphertext configuration package. Based on the ciphertext configuration package, parallel encryption is performed on the valid data stream to obtain the encrypted data. The encrypted data is then stored in a distributed redundant manner, and data access operations are documented. For the stored encrypted data, before decryption, user authentication and permission level verification are sequentially performed. If verification fails, the decryption request is rejected. If authorization is granted, the corresponding session key is used to complete decryption. The decrypted data undergoes integrity and authenticity verification. If verification fails, an alarm is triggered and the corresponding access permissions are locked.

[0041] In this embodiment, the entire encryption system is powered on and initialized synchronously with the test run. It operates in a closed loop in three stages: preparation before the test run, real-time processing during the test run, and storage and decryption after the test run. Each module works together to achieve full-link data security protection, as detailed below.

[0042] Phase 1: System Initialization and Key Generation Before Trial Run. After the system powers on and performs a self-test, the key management module first initiates the hardware security module to initialize the key. The hardware security module generates a root-level master key using a true random number generator. This master key is stored in an encrypted area within the hardware security module, preventing external export and plaintext reading, thus ensuring the reliable establishment of a secure foundation for the key system. Based on this, the operator enters task information such as the task number, trial run duration, test point configuration list, and authorized personnel list. The key management module then combines three types of dynamic parameters—task number, trial run start timestamp, and unique test point identifier—to generate a unique session key for this trial run using a key derivation algorithm. This session key is uniquely bound to this trial run task, and the system automatically sets its validity period to the sum of the entire trial run cycle and the post-trial verification period. It is automatically destroyed upon expiration to prevent the risk of leakage due to key reuse.

[0043] After key initialization is completed, the distributed acquisition module, data preprocessing module, and centralized encryption module synchronously complete parameter configuration and link connection. The encrypted data storage module completes blockchain node synchronization, and the decryption verification module completes permission whitelist entry. At this point, the entire system completes initialization and enters standby mode, waiting for the test run command to be issued.

[0044] Phase Two: Real-time Data Acquisition, Preprocessing, and Encryption During Testing. Upon issuance of the testing command, the distributed acquisition module immediately initiates distributed measurement point acquisition: pressure sensors, flow sensors, temperature sensors, vibration sensors, etc., distributed throughout the test bench synchronously acquire corresponding parameters. The acquired signals are encoded by the front-end distributed data acquisition unit and then transmitted encrypted via independent transmission channels at each measurement point, utilizing the airtight nature of electrical signal transmission. This eliminates the risk of data leakage from the source, such as radio frequency eavesdropping and link interception, and ensures that a single point failure does not affect global data acquisition. After the signals are transmitted to the centralized terminal, physical quantity information is restored, resulting in the restored multi-source testing data, which is then transferred to the data preprocessing module for standardization. The data preprocessing module performs three levels of standardization on the multi-source testing data: first, it classifies and categorizes parameters, classifying parameters such as thrust, chamber pressure, and flow rate as core confidential parameters, and environmental temperature and vibration as general parameters; parameters with acquisition frequencies above 1kHz are classified as high-frequency testing parameters, and parameters with acquisition frequencies below 40Hz are classified as low-frequency testing parameters; data labels are added to different categories of parameters, and differentiated processing rules are applied.

[0045] Next, noise reduction processing is performed. Low-frequency steady-state parameters are processed using a combination of moving average and low-pass filtering, while high-frequency dynamic parameters are processed using a combination of wavelet denoising and Kalman filtering. Outliers exceeding the range and 50Hz power frequency interference are simultaneously removed to maximize the preservation of valid data features. Finally, formatting and normalization are performed to unify data time stamps, unit formats, and storage formats, eliminating heterogeneity of multi-source data and outputting a normalized, valid data stream. This valid data stream then enters the centralized encryption module. The system calls the session key generated in Phase One and performs real-time encryption operations using a two-layer encryption logic: The first layer performs initial symmetric encryption on core configuration information such as the test bench KB value, thrust fitting univariate polynomial equation, and key parameter thresholds to generate a ciphertext configuration package. The second layer, based on this ciphertext configuration package, uses a distributed parallel encryption architecture to perform multi-threaded parallel encryption on the high-frequency and low-frequency classified data streams. The encryption latency for a single batch of data is controlled at the millisecond level, achieving a fully ciphertext closed-loop processing throughout. The encrypted data is pushed to the encrypted data storage module in real time, completing the full-link real-time encryption processing of Phase Two.

[0046] Phase Three: Post-Test Drive Data Storage, Decryption, and Verification. After receiving encrypted data, the encrypted data storage module initiates a blockchain access authentication mechanism: verifying the identity of data writing actions, recording information such as the writing node, writing time, and data hash value, and storing this information on the blockchain to generate an immutable evidence log; simultaneously, a distributed redundant storage mode is used to synchronously back up the encrypted data to multiple storage nodes to ensure that a single point of failure does not lead to data loss, and hierarchical access permissions are set, allowing only authorized accounts on the whitelist to initiate data access requests, thereby establishing a trusted storage access control system.

[0047] When test data needs to be retrieved for performance analysis or report compilation, the decryption verification module initiates multi-layered authorization verification sequentially: First, it performs operator identity authentication and permission level verification; if authorization is not passed, the decryption request is directly rejected, effectively preventing unauthorized access. After authorization, the corresponding session key bound to this test task is used to decrypt the encrypted data, and the decryption result then enters a dual verification process. For integrity verification, the hash value of the decrypted data is calculated and compared with the hash value of the blockchain evidence stored in the encrypted storage module to determine whether the data is missing or tampered with during storage and transmission. For authenticity verification, the legality of the data source is verified by combining the key signature and blockchain evidence information to confirm that the data source is legitimate and has not been forged.

[0048] After both verifications pass, the data can be used for subsequent work such as engine performance calculation and test report preparation. If verification fails, the system immediately triggers an alarm, marks the data as abnormal, and locks the corresponding access permissions to ensure that abnormal data is not misused. After all test missions are completed, the system automatically clears the temporary cache, destroys the test session key, and retains only the encrypted original test data and blockchain-based evidence logs, completing a secure closed loop throughout the entire process and laying the foundation for independent key management for subsequent test missions.

[0049] In summary, the liquid rocket engine test stand data encryption system and method proposed in this invention have the following advantages: 1. Full-link security protection: Covering the entire process of data acquisition, transmission, preprocessing, encryption, storage, decryption and verification, achieving closed-loop security management of test data from generation to use.

[0050] 2. Adaptable to test run scenarios: It adopts a distributed acquisition and transmission and parallel encryption architecture, which is suitable for test benches with multiple measurement points, large data streams and high real-time requirements. The encryption processing has no delay and does not interfere with the test run process.

[0051] 3. Secure and flexible key management: Based on a layered key architecture with hardware security modules, combined with a dynamic session key mechanism, a unique key is implemented for each vehicle, significantly reducing the risk of key leakage and enabling more precise control.

[0052] 4. Trustworthy and Traceable Storage: Relying on blockchain access authentication technology, data storage is tamper-proof and access is traceable, solving the pain points of illegal access and malicious alteration of confidential data.

[0053] 5. Highly efficient and accurate data processing: The preprocessing stage combines hierarchical classification with noise reduction, which not only improves data quality but also ensures key protection of core parameters. The encryption and decryption verification are highly efficient, ensuring a balance between data availability and security.

[0054] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A data encryption system for a liquid rocket engine test stand, characterized in that, include: Key management module, distributed acquisition module, centralized encryption module, and decryption verification module; The distributed acquisition module is used to collect and transmit multi-source test data; The key management module is used to generate a master key based on the hardware security module, and to obtain a session key bound to the test task by combining the master key and the test task information. The centralized encryption module is used to call the session key to initially encrypt the test configuration information to generate a ciphertext configuration package, and to perform parallel encryption operations on the multi-source test data based on the ciphertext configuration package to obtain encrypted data; The decryption verification module is used to call the corresponding session key to decrypt the encrypted data, and to verify and validate the decrypted data.

2. The liquid rocket engine test stand data encryption system as described in claim 1, characterized in that, The distributed acquisition module includes a data distributed acquisition unit, a transmission unit, and multiple sensors connected to each other; the sensors are set at various measuring points on the test bench to collect corresponding parameter information; the data distributed acquisition unit is used to receive the parameter information and encode the parameter information to generate multiple multi-source test data. The transmission unit has multiple independent transmission channels corresponding to each measurement point, used to independently transmit the corresponding multi-source test data.

3. The liquid rocket engine test stand data encryption system as described in claim 1, characterized in that, It also includes a data preprocessing module, which sequentially performs classification processing, noise reduction processing, and formatting processing on the multi-source test data to output a valid data stream; the centralized encryption module is used to perform parallel encryption operations on the valid data stream based on the ciphertext configuration package to obtain the encrypted data.

4. The liquid rocket engine test stand data encryption system as described in claim 3, characterized in that, The data preprocessing module includes a classification processing unit, a noise reduction processing unit, and a formatting processing unit. The classification processing unit is used to divide the multi-source test data into core test parameters and general test parameters according to the importance of the data, and into high-frequency test parameters and low-frequency test parameters according to the data acquisition frequency, and to adapt differentiated preprocessing rules for different categories of data. The noise reduction processing unit is used to adapt the optimal noise reduction algorithm for different types of noise and different frequency parameters, so as to retain the effective features of the data to the maximum extent and remove redundant interference information. The formatting processing unit is used to format and process the heterogeneity of multi-source data, and output a normalized effective data stream.

5. The liquid rocket engine test stand data encryption system as described in claim 1, characterized in that, The key management module includes: a master key generation unit, a true random number generator, and a key derivation algorithm unit; the master key generation unit generates a master key through the true random number generator, and the master key is stored in the internal encryption area of ​​the hardware security module; the key derivation algorithm unit is used to obtain a session key bound to the test task based on the key derivation algorithm combined with the master key and the test task information, the session key corresponds one-to-one with a single test task and automatically expires after the task ends, and also performs hierarchical management and dynamic updating of the master key and the session key.

6. The liquid rocket engine test stand data encryption system as described in claim 1, characterized in that, The centralized encryption module includes a first-layer encryption unit and a second-layer encryption unit. The first-layer encryption unit is used to call the session key to perform initial encryption on the test configuration information to generate a ciphertext configuration package. The second-layer encryption unit is used to perform parallel encryption operations on the multi-source test data based on the ciphertext configuration package to obtain encrypted data.

7. The liquid rocket engine test stand data encryption system as described in claim 1, characterized in that, It also includes an encrypted data storage module, which is used to perform distributed redundant storage of the encrypted data output by the centralized encryption module and to perform evidence storage operations on the data access operations of the decryption verification module.

8. The liquid rocket engine test stand data encryption system as described in claim 7, characterized in that, The decryption verification module includes an authorization verification unit and a decryption unit. The authorization verification unit is used to perform user identity authentication and permission level verification before obtaining the encrypted data stored in the encrypted storage module, and to determine whether the authorization verification is successful. The decryption unit is used to call the corresponding session key to decrypt the encrypted data after the authorization verification is successful, and to perform integrity verification and authenticity verification on the decrypted data.

9. A method for encrypting data on a liquid rocket engine test stand, using the liquid rocket engine test stand data encryption system as described in any one of claims 1-8, characterized in that, Specifically, it includes the following: Acquisition and transmission of multi-source test data; A master key is generated based on the hardware security module, and a session key bound to the test task is obtained by combining the master key and the test task information. The session key is used to initially encrypt the test configuration information to generate a ciphertext configuration package, and parallel encryption operations are performed on the multi-source test data based on the ciphertext configuration package to obtain encrypted data; The encrypted data is decrypted by calling the corresponding session key, and the decrypted data is then verified and validated.

10. The liquid rocket engine test stand data encryption method as described in claim 9, characterized in that, After the steps of collecting and transmitting multi-source test data are completed, the multi-source test data is sequentially processed by classification, noise reduction, and formatting to output a valid data stream. Then, the session key is used to initially encrypt the test configuration information to generate a ciphertext configuration package. Based on the ciphertext configuration package, parallel encryption is performed on the valid data stream to obtain the encrypted data. The encrypted data is then stored in a distributed redundant manner, and data access operations are documented. For the stored encrypted data, before decryption, user authentication and permission level verification are sequentially performed. If verification fails, the decryption request is rejected. If authorization is granted, the corresponding session key is used to complete decryption. The decrypted data undergoes integrity and authenticity verification. If verification fails, an alarm is triggered and the corresponding access permissions are locked.

Images