WO2024139926A1 - Grading processing, encryption, and verification method for rail transit data, and system - Google Patents

Abstract

Disclosed in the present invention are a grading processing, encryption, and verification method for rail transit data, and a system. The method comprises: an original configuration file is converted into a basic seed file; data classification and grading processing are performed on the basic seed file by means of a grading and classification module to form a seed file to be encrypted and a plaintext seed file; a batch processing module performs batch processing on the plaintext seed file and the seed file to be encrypted to respectively generate a plaintext configuration file and a configuration file to be encrypted; an encryption module encrypts the configuration file to be encrypted to generate an encrypted configuration file; and configurations of the plaintext configuration file and the encrypted configuration file are uploaded to a wireless modulation and demodulation device, after the configurations are uploaded, the wireless modulation and demodulation device separately performs integrity verification on the plaintext configuration file and the encrypted configuration file, and after the verification is successful, the wireless modulation and demodulation device receives the uploaded configuration files. The advantages of the present invention are: the method improves the protection capability and security of important data in the system by means of a selection mechanism for data classification and grading.

Description

A method and system for hierarchical processing, encryption and verification of rail transit data Technical Field

The present invention relates to the field of rail transit data processing, and in particular to hierarchical processing, encryption and integrity verification of configuration file data of wireless modem equipment of rail transit signal systems, and in particular to a method for hierarchical processing, encryption of sensitive data, generation of a plaintext configuration file and an encrypted configuration file, and a method for batch generation of configuration files.

Background technique

The wireless network of the signal system in urban rail transit involves the deployment of wireless modem equipment along the line to obtain good wireless coverage. The data in the configuration files used are not classified and managed, which poses a certain risk of unauthorized access, and the sensitive parameters of the configuration files may be spied on, intercepted, or even tampered with. At present, the configuration files of wireless modem equipment only use an MD5 digest algorithm to publish data for on-site use, and no encryption algorithm is used. There is also a lack of corresponding mechanisms for the storage and update of keys, which poses a great security risk. Therefore, it is necessary to improve it to enhance data security.

It will be understood that the above statements merely provide background technology related to the present invention and do not necessarily constitute prior art.

Summary of the invention

The purpose of the present invention is to provide a method and system for hierarchical processing, encryption and integrity verification of rail transit data. The method makes it possible to use different data protection methods in the same original configuration file through a selection mechanism for data classification and grading, thereby improving the protection capability of important system data; at the same time, it also provides a method for generating configuration files in batch processing when the line is implemented, thereby increasing the convenience of project data production; finally, by flexibly setting the storage and update mechanism of the key, the validity of the key is enhanced, which is conducive to protecting the security of important system configuration data, preventing data leakage, interception and tampering from causing significant impact on the system, and achieving high security and high reliability of the configuration data of wireless equipment in the signal system.

In order to achieve the above object, the present invention is implemented by the following technical solutions:

A method for hierarchical processing, encryption and integrity verification of rail transit data, comprising:

Convert the original configuration file into a base seed file suitable for all wireless modem devices;

The data in the basic seed file is classified and processed by a classification module to be classified and divided into sensitive parameters and general parameters. The sensitive parameters form a seed file to be encrypted, and the general parameters form a plaintext seed file.

The batch processing module batch processes the plain text seed file and the seed file to be encrypted respectively, and generates the plain text configuration file and the configuration file to be encrypted of each wireless modem device respectively. The encryption module encrypts the configuration file to be encrypted to generate an encrypted configuration file.

The plain text configuration file and the encrypted configuration file are uploaded to the wireless modem device. After the configuration is uploaded, the wireless modem device performs integrity verification on the plain text configuration file and the encrypted configuration file respectively, and accepts the upload after the verification is successful.

Optionally, the values of the data applicable to the corresponding project in the original configuration file are replaced with wildcards to generate a basic seed file.

Optionally, the general parameters include one or more of transmit power, switching threshold, and device name;

The sensitive parameters include one or more of an access password of a wireless modem device, a login password of http, an authentication and encryption password of SNMP, and a shared secret key of an 802.1x authentication server.

Optionally, before uploading the plaintext configuration file and the encrypted configuration file to the wireless modem device, a summary calculation module needs to be used to perform summary calculations respectively. The wireless modem device performs integrity checks on the plaintext configuration file and the encrypted configuration file after summary processing respectively, and they can be loaded on the device after verification.

Optionally, a digest calculation is performed on the plaintext configuration file using a SHA384 algorithm of a hash algorithm to obtain a hash value thereof.

Optionally, the seed file to be encrypted is digested while being encrypted;

The seed file to be encrypted is digested using the SHA384 algorithm of the hash algorithm, and the key http password is stored in ciphertext using a salted hash algorithm.

And/or, the encryption algorithm used by the seed file to be encrypted is the AES256 algorithm, and a one-time pad mechanism is adopted.

Optionally, when the wireless modem device performs integrity check on the encrypted configuration file, it is necessary to first input a key for decryption and then perform integrity check;

The wireless modem device directly performs integrity verification on the plain text configuration file.

Optionally, the plain text configuration file is in a modifiable state, and after being modified, the plain text configuration file needs to undergo batch processing, summary processing, configuration upload, and integrity verification processes again.

Optionally, a system for executing the aforementioned method for hierarchical processing, encryption and integrity verification of rail transit data comprises:

A hierarchical classification module is used to divide the basic seed files into plaintext seed files and seed files that need to be encrypted;

A batch processing module connected to the grading and classification module, the batch processing module is used to batch process the plaintext seed file and the seed file to be encrypted, respectively, to generate a plaintext configuration file and a configuration file to be encrypted for each wireless modem device;

The encryption module is connected to the batch processing module, and is used to encrypt the configuration file to be encrypted to generate an encrypted configuration file; the wireless modem device performs integrity verification on the plain text configuration file and the encrypted configuration file respectively, and receives and uploads the files after the verification is successful.

Optionally, also include:

A summary calculation module is connected to the batch processing module. The summary calculation module is used to perform summary calculations on the plain text configuration file and the configuration file to be encrypted. When uploading the configuration, the wireless modem device performs integrity verification. After the verification is successful, the data loading is completed.

Optionally, after the plaintext configuration file and the encrypted configuration file are uploaded to the wireless modem device, the wireless modem device first decrypts the encrypted configuration file and then performs an integrity check; the wireless modem device directly performs an integrity check on the plaintext configuration file; after the check is correct, it can be loaded on the wireless modem device.

Compared with the prior art, the present invention has the following advantages:

In a method and system for hierarchical processing, encryption and integrity verification of rail transit data of the present invention, the method realizes confidentiality management of important data by classifying and grading various parameters in the configuration file of wireless modulation and demodulation equipment of the signal system, encrypting infrequently used sensitive parameters, and setting the remaining parameters as general parameters without encryption processing to facilitate debugging and modification; then, digest calculation is performed on the plain text configuration file and the encrypted configuration file to realize integrity protection of important data; at the same time, the method can also realize the function of batch generation of configuration files for wireless modulation and demodulation equipment.

Furthermore, the method is highly flexible, and different levels of configuration data can be processed using different methods to meet different engineering requirements.

Furthermore, the method has good robustness and avoids tampering with the configuration of important equipment in the signal system by using a high-strength encryption algorithm and integrity hash check on the configuration file of the wireless modem equipment.

Furthermore, the method has good timeliness and increases the difficulty of malicious decryption by the outside world through the key update mechanism.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a method for hierarchical processing, encryption and integrity verification of rail transit data according to the present invention;

FIG2 is a schematic diagram of a system framework of a method for performing hierarchical processing, encryption and integrity verification of rail transit data according to the present invention;

FIG3 is a schematic diagram of the system function relationship of a method for executing hierarchical processing, encryption and integrity verification of rail transit data according to the present invention.

Implementation

The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

As shown in FIG1 , a method for hierarchical processing, encryption and integrity verification of rail transit data of the present invention is shown, and the method comprises:

S1. Converting an original configuration file into a basic seed file applicable to all wireless modulation and demodulation devices, namely wireless modem devices. The original configuration file is an unprocessed configuration file in a signal system wireless network device.

Specifically, in this embodiment, the values of the data applicable to the corresponding project, ie, the present project, in the original configuration file are replaced with wildcards to generate a basic seed file for subsequent data processing.

S2. The data in the basic seed file is classified and processed by a classification module to divide it into sensitive parameters and general parameters. The sensitive parameters form a seed file to be encrypted, and the general parameters form a plaintext seed file.

Optionally, the general parameters include one or more of the transmission power, the switching threshold, and the device name. Further, the sensitive parameters include one or more of the access password of the wireless modem device, the login password of http, the authentication and encryption password of SNMP, and the shared secret key of the authentication server of 802.1x. It is understandable that the data types included in the general parameters and sensitive parameters are not limited to the above. In other embodiments, they may also include other data types, which are not limited by the present invention.

S3, the batch processing module batch processes the plaintext seed file and the seed file to be encrypted respectively, and generates configuration files of multiple wireless modem devices in batches. Each device generates two configuration files, namely, the plaintext configuration file and the configuration file to be encrypted. The encryption and summary calculation of the configuration file to be encrypted are completed simultaneously in this step, that is, the summary calculation of the seed file to be encrypted is performed while the encryption processing is being performed. Specifically, the summary calculation of the configuration file to be encrypted is performed by the summary calculation module, and the encryption module encrypts the configuration file to be encrypted to generate an encrypted configuration file. In this embodiment, the encryption algorithm used by the seed file to be encrypted is the AES256 algorithm, which is encrypted according to the set key. The function is set to set a different key each time encryption is performed, that is, a one-time one-key mechanism, and the debugger does not have the authority to use the encryption module. At the same time, the seed file to be encrypted is calculated by the SHA384 algorithm of the hash algorithm to obtain its hash value, and the salted hash algorithm is used to store the key http password in ciphertext.

S4. Upload the plain text configuration file and the encrypted configuration file to the wireless modem device. After the configuration is uploaded, the wireless modem device will perform integrity checks on the plain text configuration file and the encrypted configuration file respectively. After the check is successful, they will be loaded on the wireless modem device.

In this embodiment, the plain text configuration file and the encrypted configuration file need to be respectively digested using a digest calculation module before being uploaded to the wireless modem device. The wireless modem device performs integrity checks on the plain text configuration file and the encrypted configuration file after digest processing (the hash values can be input for verification respectively), and after the verification is correct, they can be loaded on the wireless modem device. In this embodiment, the plain text configuration file is digested by the SHA384 algorithm of the hash algorithm to obtain its hash value. The digest calculation of the encrypted configuration file has been calculated during the aforementioned encryption.

Furthermore, in this embodiment, when the wireless modem device performs integrity check on the encrypted configuration file, it is necessary to first input the key (encryption password) for decryption, and then perform integrity check. The wireless modem device directly performs integrity check on the plain text configuration file. Then the wireless modem device loads each configuration file that has been verified to be correct, and completes the configuration upload.

In this embodiment, the plain text configuration file is in a modifiable state, and the debugger can modify the plain text configuration file according to the debugging situation. After the plain text configuration file is modified, it is necessary to re-process the batch processing, summary processing, configuration upload and integrity verification process to complete the configuration upload of the configuration file. Considering the sensitivity of the data, the debugger does not have the authority to modify the encrypted configuration file.

From the above, it can be seen that compared with the prior art, the hierarchical processing, encryption and integrity verification method of rail transit data of the present invention has the advantages of wide application range, high confidentiality and easy use, which avoids the leakage or cracking of important parameters of wireless devices, thereby better ensuring the safe operation of rail transit.

Based on the same inventive concept, the present invention also provides a system that can execute the aforementioned hierarchical processing, encryption and integrity verification method of rail transit data. As shown in Figure 2, the system can be regarded as a data processing tool, and the basic seed file can be uploaded to the wireless modem device after being processed by the data processing tool.

Specifically, as shown in combination with FIG. 2 and FIG. 3, the system includes: a hierarchical classification module, a batch processing module and an encryption module. Among them, the hierarchical classification module is used to divide the basic seed seed file into a plaintext seed file and a seed file to be encrypted. The batch processing module is connected to the hierarchical classification module, and the batch processing module is used to batch process the plaintext seed file and the seed file to be encrypted respectively, and generate a plaintext configuration file and a configuration file to be encrypted for each wireless modem device respectively. The encryption module is connected to the batch processing module, and the encryption module is used to encrypt the configuration file to be encrypted and generate an encrypted configuration file. When the plaintext configuration file and the encrypted configuration file are uploaded for configuration, the wireless modem device performs integrity verification on the plaintext configuration file and the encrypted configuration file respectively, and completes the loading of the data after the verification is successful.

Furthermore, the system further comprises a summary calculation module, which is connected to the batch processing module and is used to perform summary calculations on the plain text configuration file and the configuration file to be encrypted. The plain text configuration file and the encrypted configuration file need to be respectively summarized by the summary calculation module before being uploaded to the wireless modem device. The wireless modem device performs integrity checks on the plain text configuration file and the encrypted configuration file after summary processing, and the files can be loaded on the wireless modem device after the verification is correct.

In summary, in a method and system for hierarchical processing, encryption and integrity verification of rail transit data of the present invention, the method is mainly aimed at the configuration file of the wireless modem equipment of the signal system, and the confidentiality management of important data is realized by adopting a method of classifying and grading each parameter in the configuration file, and encrypting the infrequently used sensitive parameters. The parameters that are often modified in project debugging are classified as general parameters, and are not encrypted, which is convenient for debugging and modification; then the summary calculation of the plain text configuration file and the encrypted configuration file is performed to realize the integrity protection of important data. At the same time, the method can also realize the batch generation function of the configuration file of the wireless modem equipment, which greatly facilitates the data production process during the project implementation.

Although the content of the present invention has been described in detail through the above preferred embodiments, it should be appreciated that the above description should not be considered as a limitation of the present invention. After reading the above content, it will be apparent to those skilled in the art that various modifications and substitutions of the present invention will occur. Therefore, the protection scope of the present invention should be limited by the appended claims.

Claims (11)

1. A method for hierarchical processing, encryption and integrity verification of rail transit data, characterized by comprising:

   Convert the original configuration file into a base seed file suitable for all wireless modem devices;

   The data in the basic seed file is classified and processed by a classification module to be classified and divided into sensitive parameters and general parameters. The sensitive parameters form a seed file to be encrypted, and the general parameters form a plaintext seed file.

   The batch processing module batch processes the plain text seed file and the seed file to be encrypted respectively, and generates the plain text configuration file and the configuration file to be encrypted of each wireless modem device respectively. The encryption module encrypts the configuration file to be encrypted to generate an encrypted configuration file.

   The plain text configuration file and the encrypted configuration file are uploaded to the wireless modem device. After the configuration is uploaded, the wireless modem device performs integrity verification on the plain text configuration file and the encrypted configuration file respectively, and accepts the upload after the verification is successful.
2. The method for hierarchical processing, encryption and integrity verification of rail transit data according to claim 1, characterized in that:

   The values of the data applicable to the corresponding project in the original configuration file are replaced with wildcards to generate a basic seed file.
3. The method for hierarchical processing, encryption and integrity verification of rail transit data according to claim 1, characterized in that:

   The general parameters include one or more of transmission power, switching threshold, and device name;

   The sensitive parameters include one or more of an access password of a wireless modem device, a login password of http, an authentication and encryption password of SNMP, and a shared secret key of an 802.1x authentication server.
4. The method for hierarchical processing, encryption and integrity verification of rail transit data according to claim 1, characterized in that:

   The plain text configuration file and the encrypted configuration file need to be respectively digested using a digest calculation module before being uploaded to the wireless modem device. The wireless modem device performs integrity checks on the plain text configuration file and the encrypted configuration file after digest processing, and they can be loaded on the device after the verification is correct.
5. The method for hierarchical processing, encryption and integrity verification of rail transit data as claimed in claim 4, characterized in that:

   The plaintext configuration file is digested using the SHA384 algorithm to obtain its hash value.
6. The method for hierarchical processing, encryption and integrity verification of rail transit data as claimed in claim 4, characterized in that:

   The seed file to be encrypted is digested while being encrypted;

   The seed file to be encrypted is digested using the SHA384 algorithm of the hash algorithm, and the key http password is stored in ciphertext using a salted hash algorithm.

   And/or, the encryption algorithm used by the seed file to be encrypted is the AES256 algorithm, and a one-time pad mechanism is adopted.
7. The method for hierarchical processing, encryption and integrity verification of rail transit data according to claim 1, characterized in that:

   When the wireless modem device performs integrity check on the encrypted configuration file, it needs to first input the key for decryption and then perform integrity check;

   The wireless modem device directly performs integrity verification on the plain text configuration file.
8. The method for hierarchical processing, encryption and integrity verification of rail transit data according to claim 1, characterized in that:

   The plain text configuration file is in a modifiable state. After being modified, the plain text configuration file needs to undergo batch processing, summary processing, configuration upload, and integrity verification again.
9. A system for executing the method for hierarchical processing, encryption and integrity verification of rail transit data as claimed in any one of claims 1 to 8, characterized in that it comprises:

   A hierarchical classification module is used to divide the basic seed files into plaintext seed files and seed files that need to be encrypted;

   A batch processing module connected to the grading and classification module, the batch processing module is used to batch process the plaintext seed file and the seed file to be encrypted, respectively, to generate a plaintext configuration file and a configuration file to be encrypted for each wireless modem device;

   The encryption module is connected to the batch processing module, and is used to encrypt the configuration file to be encrypted to generate an encrypted configuration file; the wireless modem device performs integrity verification on the plain text configuration file and the encrypted configuration file respectively, and receives and uploads the files after the verification is successful.
10. The system for executing the method for hierarchical processing, encryption and integrity verification of rail transit data according to claim 9, characterized in that it also comprises:

    A summary calculation module is connected to the batch processing module. The summary calculation module is used to perform summary calculations on the plain text configuration file and the configuration file to be encrypted. When uploading the configuration, the wireless modem device performs integrity verification. After the verification is successful, the data loading is completed.
11. The system for executing the method for hierarchical processing, encryption and integrity verification of rail transit data as claimed in claim 9, characterized in that:

    After the plain text configuration file and the encrypted configuration file are uploaded to the wireless modem device, the wireless modem device first decrypts the encrypted configuration file and then performs an integrity check; the wireless modem device directly performs an integrity check on the plain text configuration file; after the check is correct, it can be loaded on the wireless modem device.