Scheme for data encryption and tamper protection in coal mine safety monitoring within information technology application innovation ecosystem

To address challenges in implementing data encryption for industrial safety monitoring, including efficient queries over ciphertext, control of storage expansion, application-layer intrusiveness, adaptation to information technology application innovation hardware, and semantic leakage from metadata, a scheme for data encryption and tamper protection in coal mine safety monitoring within the information technology application innovation ecosystem was proposed. The scheme adopted a collaborative five-layer architecture comprising a business integration layer, a cryptographic transformation layer, an obfuscation policy engine, a metadata obfuscator, and a key management center. The business integration layer used runtime interception with HarmonyLib to integrate transparent encryption without code changes. The cryptographic transformation layer employed SM4-GCM for authenticated encryption to ensure data confidentiality and integrity. It combined blind indexes based on HMAC, order-preserving bucketing, and obfuscation flags encoded in individual bits to support equality and range queries over ciphertext. The obfuscation policy engine injected statistically indistinguishable simulated data into genuine data to enhance resistance to analysis. The metadata obfuscator used .NET Source Generators to replace semantically meaningful table and column names with deterministic identifiers at compile time and combined this mechanism with field aggregation in a unified encrypted table schema to limit storage expansion. The key management center secured keys using envelope encryption bound to hardware fingerprints. Tests on an ARM platform within the information technology application innovation ecosystem showed that equality queries, range queries, and bulk inserts in ciphertext mode took 2.25, 1.6–4.4, and 1.94 times as long as those in plaintext mode, respectively. The ciphertext data size did not exceed 2.82 times the plaintext data size. The SM4-GCM encryption and decryption time was only 2.30 μs per record, and encryption throughput exceeded 660 000 operations/s. The proposed scheme meets the cryptographic algorithm compliance requirements of the Cryptography Law of the People's Republic of China and GB/T 22239-2019 Information security technology—Baseline for classified protection of cybersecurity, while accommodating the real-time requirements of industrial monitoring, and is feasible for engineering applications.