Block chain-based key generation and issuing method and device, electronic equipment, medium and program product

Abstract

The invention provides a key generation and issuing method and device based on a block chain, electronic equipment, a medium and a program product, relates to application of a large model in a financial science and technology scene, and can be applied to the technical field of artificial intelligence and the technical field of block chains. The method comprises the following steps: acquiring key application information, and performing multi-modal analysis on the key application information to obtain key analysis data; submitting a block chain evidence containing the key analysis data to a target block chain network, and obtaining returned evidence reference information; quoting the key analysis data based on the evidence quoting information, performing security policy and environmental risk analysis on the key analysis data, and constructing a target encryption scheme based on an analysis result; and generating target key data by using the target encryption scheme, performing key negotiation with a target terminal based on the target key data, and establishing a secure session key.

Description

Technical Field

[0001] This application relates to the application of large-scale models in fintech scenarios, and to the fields of artificial intelligence and blockchain technology. More specifically, it relates to a blockchain-based key generation and distribution method, apparatus, device, medium, and program product. Background Technology

[0002] As financial services become increasingly digital and intelligent, the approval and management mechanisms of keys, as the core of transaction and data security, are crucial to the security and compliance of the system. Current mainstream solutions rely on hierarchical authorization and static rules, and are widely used in high-security scenarios such as banking and e-commerce payments. They use preset algorithms to generate keys and store them through physical media such as cryptographic cards, combined with written applications, hierarchical manual approval, and two-factor authentication to ensure separation of permissions and operational security.

[0003] However, with the development of emerging business models such as open banking and cross-border payments, traditional mechanisms have exposed problems such as low approval efficiency, slow risk response, and rigid key strategies. They lack the ability to automatically detect and dynamically adjust to abnormal environments, and it is difficult to switch encryption algorithms in real time according to data sensitivity. They also have single-point failure risks and weak audit traceability capabilities. In addition, the compliance of encryption modules still relies on paper-based inspections and lacks runtime verification methods. Traditional physical media are also unable to meet the lightweight and efficient key negotiation requirements of mobile terminals, the Internet of Things, and other scenarios, making it difficult to support the security management needs of complex financial ecosystems. Summary of the Invention

[0004] In view of the above problems, this application provides a method, apparatus, device, medium and program product for key generation and distribution based on blockchain.

[0005] According to a first aspect of this application, a blockchain-based key generation and distribution method is provided. The method includes: obtaining key application information; performing multimodal parsing on the key application information to obtain key parsing data; submitting blockchain notarization containing the key parsing data to a target blockchain network and obtaining returned notarization reference information; referencing the key parsing data based on the notarization reference information, performing security policy and environmental risk analysis on the key parsing data, and constructing a target encryption scheme based on the analysis results; and generating target key data using the target encryption scheme, and negotiating a key with a target terminal based on the target key data to establish a secure session key.

[0006] According to an embodiment of this application, obtaining key application information and performing multimodal parsing on the key application information to obtain key parsing data includes: using a multimodal parsing model to perform semantic recognition and contextual understanding on the key application information, extracting business scenario information and abnormal access information, wherein the key application information includes at least application work order scenario information, identity identification information, and access source information; based on the business scenario information and the abnormal access information, labeling the key application information with risk levels to obtain risk labeling information; and generating the key parsing data based on the risk labeling information and the key application information.

[0007] According to an embodiment of this application, the step of using a multimodal parsing model to perform semantic recognition and contextual understanding on the key application information, and extracting business scenario information and abnormal access information, includes: performing natural language processing and / or computer vision processing on the application work order scenario information to extract the business scenario information; and performing behavioral pattern analysis on the access source information to obtain the abnormal access information.

[0008] According to an embodiment of this application, the step of submitting blockchain evidence containing the key parsing data to the target blockchain network and obtaining the returned evidence reference information includes: performing cryptographic digest processing on the key parsing data to generate a data digest value; binding the data digest value with the identity information to form evidence request data; submitting the evidence request data to multiple blockchain nodes of the target blockchain network for on-chain evidence storage; and obtaining the evidence reference information returned by the target blockchain network.

[0009] According to an embodiment of this application, the step of referencing the key parsing data based on the evidence citation information, performing security policy and environmental risk analysis on the key parsing data, and constructing a target encryption scheme based on the analysis results includes: obtaining an industry encryption template corresponding to the key parsing data based on the security policy analysis results; obtaining a basic encryption scheme based on the key parsing data and the industry encryption template; and optimizing the basic encryption scheme through reinforcement learning based on the environmental risk analysis results to obtain the target encryption scheme.

[0010] According to an embodiment of this application, generating target key data using the target encryption scheme includes: generating initial key data based on the encryption algorithm type and key strength requirements in the target encryption scheme; determining whether to enable a key enhancement scheme based on the environmental risk analysis results, wherein the key enhancement scheme includes an encryption encapsulation algorithm type and / or algorithm parameter configuration; and, in response to enabling the key enhancement scheme, enhancing the initial key data based on the key enhancement scheme to generate the target key data.

[0011] According to an embodiment of this application, the method further includes: collecting key usage logs in real time, fixing the key usage logs to the target blockchain network based on timestamps, and generating corresponding audit record identifiers; and referencing the key usage logs based on the audit record identifiers, using a multimodal parsing model to identify anomalies in the key usage logs, and performing anomaly response operations in response to the identified anomaly information.

[0012] According to an embodiment of this application, the method further includes: detecting a lifecycle end event based on the lifecycle management strategy information of the target key data; in response to detecting the lifecycle end event, physically clearing the target key data and generating a corresponding destruction credential; and broadcasting the destruction credential to the target blockchain network to update the corresponding global key status information.

[0013] According to an embodiment of this application, the step of labeling the key application information with a risk level based on the business scenario information and the abnormal access information to obtain risk labeling information includes: locating the corresponding industry node in a preset dynamic knowledge graph based on the business scenario information to obtain the corresponding compliance policy clauses; labeling the key application information with sensitivity based on the compliance policy clauses to obtain a business sensitivity level; and determining the risk level of the key application information based on the business sensitivity level and the abnormal access information to generate the risk labeling information.

[0014] A second aspect of this application provides a blockchain-based key generation and distribution apparatus, the apparatus comprising: a data acquisition module, configured to: acquire key application information, perform multimodal parsing on the key application information, and obtain key parsing data; a blockchain notarization module, configured to: submit blockchain notarization containing the key parsing data to a target blockchain network, and obtain returned notarization reference information; an analysis module, configured to: reference the key parsing data based on the notarization reference information, perform security policy and environmental risk analysis on the key parsing data, and construct a target encryption scheme based on the analysis results; and a generation and distribution module, configured to: generate target key data using the target encryption scheme, and conduct key negotiation with a target terminal based on the target key data to establish a secure session key.

[0015] A third aspect of this application provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0016] A fourth aspect of this application also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0017] The fifth aspect of this application also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method.

[0018] According to embodiments of this application, structuring key application information through multimodal parsing reduces reliance on manual approval resources, lowers approval delays, and improves the automation level of the key processing flow. Simultaneously, leveraging the immutability of blockchain to achieve decentralized storage of critical data effectively distributes the computational load and storage bottlenecks of traditional centralized systems, improving the overall system's response speed and stability. Furthermore, employing an encryption scheme built based on risk analysis results intelligently matches encryption algorithms and key strength according to business sensitivity, avoiding computational redundancy caused by over-encryption, optimizing terminal-side computing efficiency, and improving performance in resource-constrained environments. Attached Figure Description

[0019] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0020] Figure 1 The illustration shows an application scenario of a blockchain-based key generation and distribution method, apparatus, device, medium, and program product according to embodiments of this application.

[0021] Figure 2 The flowchart illustrating a blockchain-based key generation and distribution method according to an embodiment of this application is shown in the illustration.

[0022] Figure 3 The flowchart illustrates a method for multimodal parsing of key request information according to some exemplary embodiments of this application.

[0023] Figure 4 The illustration shows a schematic diagram of a method for performing security policy and environmental risk analysis on key parsing data according to some exemplary embodiments of this application;

[0024] Figure 5 This schematically illustrates a structural block diagram of a blockchain-based key generation and distribution apparatus according to an embodiment of this application; and

[0025] Figure 6 A block diagram schematically illustrates an electronic device suitable for implementing a blockchain-based key generation and distribution method according to an embodiment of this application. Detailed Implementation

[0026] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0027] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0028] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0029] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0030] First, the technical terms used in this article are explained and clarified as follows.

[0031] The Chinese cryptographic algorithm (SM algorithm) refers to the domestic commercial cryptographic algorithm system released and promoted by the State Cryptography Administration. It mainly includes symmetric encryption algorithms SM1 and SM4, asymmetric encryption algorithm SM2, hash algorithm SM3, as well as algorithms related to identity authentication and key exchange.

[0032] Post-quantum cryptography (PQC) is a class of cryptographic algorithms designed to resist attacks from future quantum computers. It does not rely on currently quantum-vulnerable mathematical problems (such as large integer factorization and elliptic curve discrete logarithms). Common PQC algorithms include lattice cryptography, hash signatures, and code-based cryptography.

[0033] Zero-Knowledge Proof (ZKP) is a cryptographic protocol that allows one party to prove to another that they possess certain knowledge (such as passwords, identities, assets, etc.) without revealing the specific content of that knowledge. ZKP ensures that the verifier cannot obtain any information other than "declared true" during the verification process, and is suitable for scenarios such as blockchain notarization, privacy computing, and identity authentication. In multi-chain collaboration and privacy protection, ZKP can unify the principles of data authenticity verification and minimum data exposure, providing important technical support for achieving a balance between compliance and security.

[0034] Reinforcement learning (RL) is a machine learning method that uses an agent to learn the optimal policy through trial and error in interaction with the environment, based on reward signals. Unlike supervised learning, reinforcement learning does not require predefined labels and is suitable for complex decision-making problems with goal-oriented and delayed feedback. It has significant advantages in security-sensitive areas such as key policy optimization, resource scheduling, and automatic control.

[0035] As financial services become increasingly digitalized and intelligent, the approval and management mechanisms of keys, as the foundation of financial transactions and data protection, play a decisive role in the overall system's security and compliance. Current mainstream key approval technologies are generally based on hierarchical authorization and static rule control, and are widely used in high-security financial scenarios such as banking, e-commerce payments, and securities settlement.

[0036] Traditional solutions typically rely on internal bank equipment or dedicated devices (such as payment password devices) to statically generate keys using preset algorithms during the blockchain-based key generation and distribution process. These keys are then stored and secured using physical media (such as USB tokens or password cards). Key usage procedures require written applications, tiered manual approvals, and separation of responsibilities among multiple parties to allocate permissions. For example, in high-risk operations such as fund transfers and interbank transfers, operators and reviewers often need to carry different physical media and undergo two-factor authentication to ensure the keys are not misused by a single point of failure. Furthermore, critical operations must be recorded in operation logs for later auditing and traceability. Some banks also require that the physical media for keys be stored in a safe and used collaboratively by multiple employees.

[0037] However, as the financial industry gradually expands towards diversified integration models such as "open banking" and "cross-border payments," traditional key approval mechanisms have gradually exposed a series of limitations that make them difficult to adapt to dynamic business needs and complex security threats.

[0038] Specifically, current key approval mechanisms heavily rely on human experience and written procedures, leading to bottlenecks when rapid responses are needed (such as immediate opening of overseas data channels or temporary escalation of authority to handle abnormal funds). Furthermore, they lack the ability to perceive real-time environmental changes (such as abnormal addresses, regional changes, or abnormal access frequencies), and cannot automatically trigger approval escalation or key policy changes based on operational risks. Existing solutions mostly use fixed encryption algorithms, lacking dynamic encryption policy switching based on sensitivity levels (such as switching to homomorphic encryption) when dealing with highly sensitive data (such as financial and government data). Moreover, the system architecture has single-point risks; an attack on the centralized key repository or approval node could paralyze the entire financial business, and traditional log recording methods are insufficient for cross-platform traceability and joint supervision. Currently, the compliance of encryption modules (such as whether they are in a valid hardware certification state) relies heavily on periodic paper-based inspections, failing to achieve runtime verification through interfaces, resulting in delayed responses to compliance issues. In addition, some physical media, such as mobile banking, edge payment terminals, and IoT payment devices, place higher demands on the lightweight and low-power characteristics of key negotiation, making traditional USB tokens and password cards costly and inefficient in deployment and collaborative operation.

[0039] Based on this, embodiments of this application provide a blockchain-based key generation and distribution method. The method includes: acquiring key application information; performing multimodal parsing on the key application information to obtain key parsing data; submitting blockchain evidence containing the key parsing data to a target blockchain network and obtaining returned evidence reference information; referencing the key parsing data based on the evidence reference information, performing security policy and environmental risk analysis on the key parsing data, and constructing a target encryption scheme based on the analysis results; and generating target key data using the target encryption scheme, and negotiating a key with a target terminal based on the target key data to establish a secure session key. By using multimodal parsing to structure key application information, reliance on manual approval resources can be reduced, approval delays can be decreased, and the automation level of the key processing flow can be improved. Simultaneously, relying on the immutability of blockchain to achieve decentralized evidence storage of key data can effectively distribute the computational load and storage bottlenecks of traditional centralized systems, improving the overall system response speed and stability. Furthermore, by adopting an encryption scheme based on risk analysis results, encryption algorithms and key strength can be intelligently matched according to business sensitivity, avoiding computational redundancy caused by over-encryption, optimizing terminal-side computing efficiency, and improving operating performance in resource-constrained environments.

[0040] It should be noted that the blockchain-based key generation and distribution method, apparatus, device, medium, and program products identified in this application involve large-scale applications in fintech scenarios. They can be used in the fields of artificial intelligence technology, blockchain technology, and fintech technology, and can also be used in various other fields besides artificial intelligence technology, blockchain technology, and fintech technology. The application fields of the blockchain-based key generation and distribution method, apparatus, device, medium, and program products provided in the embodiments of this application are not limited.

[0041] In the technical solution of this application, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0042] In scenarios involving automated decision-making using personal information, the methods, devices, and systems provided in this application all offer users corresponding entry points for choosing to agree to or reject the automated decision-making results. If the user chooses to reject, the process proceeds to the expert decision-making stage. Here, "automated decision-making" refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests, or economic, health, and credit status through computer programs, and then making a decision. Here, "expert decision-making" refers to the activity of making decisions by personnel who specialize in a particular field, possess specialized experience, knowledge, and skills, and have reached a certain level of professional expertise.

[0043] Figure 1 The illustration schematically depicts an application scenario of a blockchain-based key generation and distribution method, apparatus, device, medium, and program product according to embodiments of this application.

[0044] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0045] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0046] In the embodiments of this application, the first terminal device 101 can be an example of the first device, and the second terminal device 102 and / or the third terminal device 103 can be an example of at least one second device. The first device and the second device can communicate collaboratively through an internal client mechanism to implement the data distribution and rendering logic described in the blockchain-based key generation and distribution method.

[0047] In some embodiments, the first device and at least one second device may be different display modules, windows or screens on the same computing terminal (such as a host), or multiple physical devices that work together through a network, such as different client instances deployed on a desktop computer, tablet terminal or mobile device respectively.

[0048] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smart mobile terminals, tablet computers, laptop computers, and desktop computers.

[0049] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0050] It should be noted that the blockchain-based key generation and distribution method provided in this application embodiment can generally be executed by server 105. Correspondingly, the blockchain-based key generation and distribution device provided in this application embodiment can generally be located in server 105. The blockchain-based key generation and distribution method provided in this application embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the blockchain-based key generation and distribution device provided in this application embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0051] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0052] The following will be based on Figure 1 The described scene, through Figures 2-4 The blockchain-based key generation and distribution method of the disclosed embodiments is described in detail.

[0053] Figure 2 A flowchart illustrating a blockchain-based key generation and distribution method according to an embodiment of this application is shown.

[0054] like Figure 2 As shown, the blockchain-based key generation and distribution method 200 of this embodiment includes operations S210 to S240.

[0055] In operation S210, key request information is obtained, and multimodal parsing is performed on the key request information to obtain key parsing data.

[0056] In embodiments of this application, the key application information may include user identity information, device identification information, network connection parameters, service type indication information, and contextual behavior trajectory. The system can perform joint analysis of structured parameters, semi-structured logs, and unstructured data (such as images, voice, or behavior trajectories) by accessing multimodal perception.

[0057] Specifically, the multimodal parsing process is not limited to text field extraction; it also includes voice command recognition, image authentication material analysis, and normalization processing of device sensor data. For example, in a remote financial service key application scenario, when a user submits an application request, their facial image, biometric authentication information, and geographic location data can also be uploaded simultaneously. The system can utilize the facial recognition model in the multimodal parsing model to perform liveness detection and face matching on the uploaded image, while transcribing the voice command into structured request content, forming a more comprehensive key application context.

[0058] For example, in medical scenarios, the system can identify entities and intentions related to medical image transmission in work orders; in cross-border financial scenarios, it can extract semantic information involving cross-border transactions, international accounts, or large-amount transfers.

[0059] Furthermore, the system can combine multi-dimensional parameters such as the terminal's operating status (e.g., operating system version, runtime security component loading status) and network environment (e.g., public / internal network, presence of man-in-the-middle agents) to perform environmental awareness modeling, improving the ability to assess the authenticity and integrity of key requests. The multi-modal parsing model can adopt a fusion-based feature extraction structure to convert multi-source data into a unified representation space and perform vectorized encoding to construct key parsing data containing multi-dimensional information such as identity, intent, and device status.

[0060] In some embodiments, multimodal parsing may also include historical behavior comparison. The system can construct a user behavior profile based on historical key application records, and extract timestamps and behavior paths from the current application request and match them with historical records to identify potential spoofing behavior or atypical request patterns, thereby providing a basis for decision-making for subsequent security policy generation and encryption path selection.

[0061] In some embodiments, multimodal parsing not only includes the extraction of fields explicitly provided in the key request information, but also supports in-depth mining of latent semantics, behavioral patterns, and intent signals implicit in the interaction data. The system integrates a cross-modal alignment and semantic fusion model, which can uniformly model structured fields, semi-structured data, and unstructured data, and generate a high-dimensional key request context representation vector through collaborative modeling of pre-trained networks and graph neural networks.

[0062] In some embodiments, to enhance adaptability to application scenarios, a dynamic tagging system based on industry semantic graphs can be used to annotate semantic scenario categories in real time during the parsing process. For example, when a terminology entity related to medical image uploading is identified, the system automatically categorizes it as a medical data scenario; if financial semantics such as "international settlement" or "currency lock-in" are parsed, it is classified as a cross-border transaction business type and matched with the corresponding compliance strategy and encryption level preset.

[0063] In some embodiments, the runtime status summary returned by the terminal's local security trust component can also be invoked, and combined with network layer characteristics to jointly model an environment trust score. This environment trust score can be used as part of the key parsing data to participate in subsequent security decision-making processes, intervening in dynamic risk assessment from the application source.

[0064] In operation S220, a blockchain certificate containing the key parsing data is submitted to the target blockchain network, and the returned certificate reference information is obtained.

[0065] In the embodiments of this application, the core fields in the key parsing data can be generated into a data digest and stored on the blockchain based on the built-in blockchain component or by accessing an enterprise-level consortium blockchain platform, so as to ensure that the entire key application process has a verifiable timestamp and source evidence chain.

[0066] To improve the efficiency of evidence storage and data privacy protection, the original key parsing data can be stored indirectly during the on-chain process. Instead, it can be mapped using hash digests, national cryptographic algorithm digests, post-quantum encryption algorithms, homomorphic encryption, ZKP, and other technologies. For example, for sensitive fields containing biometric features or user behavior trajectories, the system can generate a data fingerprint using algorithms such as SM3, and then encapsulate this fingerprint along with the application time, applicant's identity, and key usage as part of the blockchain evidence storage transaction before submission. In industry scenarios with high compliance requirements, such as cross-border medical imaging systems or financial institution key management platforms, the system can also introduce verifiable privacy protection mechanisms to ensure compliance authentication and on-chain evidence storage are completed without disclosing the original data.

[0067] In terms of the design of the evidence storage chain, different chain structures and evidence storage granularities can be selected according to business attributes. For example, for temporary key applications in high-frequency scenarios, a lightweight fast chain or a sidechain system supporting post-quantum encryption algorithms can be used to improve concurrency and confirmation speed. In scenarios requiring long-term retention and audit traceability, such as government classified systems or large enterprise internal control platforms, the system can synchronously record key parsing data in the consortium blockchain main chain, supporting cross-domain collaborative verification and audit supervision by multiple institutions.

[0068] In some embodiments, the evidence storage data can also be bound to a storage purpose tag and a backtracking priority weight to identify the type of encryption scheme served by the record and its importance level in future anomaly investigation and risk control analysis. For example, if a key parsing involves a suspected man-in-the-middle attack or unauthorized access by a device, the system can mark it with "high backtracking priority" before uploading it to the blockchain, so that subsequent compliance systems or security centers can quickly retrieve and locate the evidence storage node and reconstruct the event chain.

[0069] After blockchain notarization is completed, a notarization reference information containing block index information, transaction hash, timestamp, and on-chain location identifier can be generated. This information is used for traceability and consistency verification when resolving data using the key. The notarization reference information can be embedded in the data context of the encryption policy generation module and provided with a trusted verification basis through the on-chain consensus mechanism during the key negotiation process. This ensures that all key nodes in the key lifecycle have chain-structured support, preventing information rollback or replay attacks.

[0070] In operation S230, the key parsing data is referenced based on the evidence storage reference information, and a security policy and environmental risk analysis is performed on the key parsing data. Based on the analysis results, a target encryption scheme is constructed.

[0071] In the embodiments of this application, the key resolution data has been stored on the blockchain in operation S220, with corresponding notarization reference information. At this point, the data already possesses tamper-proof and auditable properties. Therefore, when operation S230 requires the use of key resolution data, by tracing back, locating, and verifying the data record on the chain through the notarization reference information, it can be ensured that the currently referenced data is completely consistent with the previously notarized data, fundamentally eliminating the possibility of the data being modified or rolled back afterward.

[0072] In the embodiments of this application, information such as identity elements, business semantic tags, and data sensitivity levels can be extracted from the key parsing data, and the built-in encryption policy rule base can be invoked to perform matching and policy combination. For example, for business scenarios determined to be "highly sensitive / cross-border transmission", the system can construct a comprehensive encryption scheme that includes multi-layer encryption, key period shortening, session binding, and two-factor authentication mechanisms; for scenarios of "trusted terminals / local access", a lightweight symmetric key policy can be adopted to improve execution efficiency.

[0073] In the embodiments of this application, multi-source context data can be further integrated for dynamic modeling to analyze information such as the security status of the current terminal device, the trustworthiness of the network environment, and the degree of deviation in user behavior. For example, if the current application originates from a historically trusted device but exhibits unusual geographical location drift or abnormal access time, the system can dynamically increase encryption strength, add operation audit points, or introduce auxiliary authentication processes. Furthermore, when the possibility of a man-in-the-middle risk is detected in the network path, the system can switch to an end-to-end encryption channel strategy and temporarily increase the key negotiation complexity to enhance anti-hijacking capabilities.

[0074] In some embodiments, a knowledge graph-driven policy adaptation mechanism can be used to semantically align the currently parsed data with predefined compliance graph nodes to automatically identify whether specific industry standard encryption requirements are triggered. For example, in financial transactions, standard policy graphs can be invoked to ensure that the constructed target encryption scheme meets industry-standard requirements for encryption algorithm type, key distribution method, and key update cycle.

[0075] Optionally, it can also incorporate artificial intelligence analysis models to predict the risk resistance and operational efficiency of different strategy combinations based on the similarity between the effectiveness of historical encryption strategies and the current context, thereby optimizing the structure of the target encryption scheme. For example, the system can predict the execution latency, negotiation success rate, or attack probability of a certain type of key generation structure on a specific terminal based on graph neural networks or Bayesian decision graph models, thus automatically balancing security and system load and outputting the optimal decryption path structure.

[0076] In operation S240, target key data is generated using the target encryption scheme, and a key negotiation is performed with the target terminal based on the target key data to establish a secure session key.

[0077] Specifically, it can analyze information such as the encryption algorithm type, key length, key scope (e.g., temporary, session-based, or persistent), interaction mode (symmetric or asymmetric), and environmental adaptation requirements contained in the target encryption scheme, and automatically generate key data that meets the constraints based on this scheme. This key generation process can call local encryption modules, secure hardware modules, or trusted execution environments to securely generate and encapsulate key materials.

[0078] In the embodiments of this application, the method of generating target key data can be flexibly adjusted in different application scenarios. For example, in a financial payment scenario for mobile terminals, the system can generate a short-cycle, high-entropy symmetric key and negotiate it using a pre-shared key or dynamic QR code mechanism; as another example, in an enterprise data encryption communication scenario, an asymmetric key pair can be generated, and key negotiation and identity binding can be completed through a certificate chain verification mechanism; as yet another example, in a multi-tenant environment for cloud services, the system can also construct derived keys based on multi-factor parameters (such as tenant identity identifier, service identifier, and time window) to support key isolation and independent encryption between different tenants and different sessions.

[0079] To ensure the security and tamper resistance of the negotiation process, a ZKP mechanism or a two-way authentication process can be introduced. Before key negotiation, the target terminal must complete identity verification and device trustworthiness assessment before entering the key exchange process. During the negotiation process, the system can adopt a dynamic encryption channel strategy for encoding and transmitting negotiation messages based on the capabilities of the target terminal. For example, it can automatically select whether to enable the transmission encryption layer, or switch communication details such as encryption frame size, fragmentation method, and number of handshake rounds to improve the negotiation success rate and anti-interference capability.

[0080] After successful negotiation, the system can synchronize the generated secure session key with the target terminal, and at the same time record the key negotiation context, negotiation parameter digest and key activation window information locally to support subsequent key update, revocation and lifecycle management operations.

[0081] In some embodiments, if the target encryption scheme sets a "short time limit, high frequency update" strategy, the system can also start a key snapshot mechanism to automatically monitor key usage during the session and trigger a key rotation process when the threshold is reached, ensuring that the key is always in a secure and valid state during the session.

[0082] In some high-security systems, the generation process of target key data can also embed key tamper-proof tags or negotiation context binding parameters. For example, the unique hardware fingerprint of the terminal device can be bound to the key data, so that the key can only be decrypted and used in the bound terminal, thereby achieving multiple protection goals of preventing leakage, preventing man-in-the-middle attacks and resisting migration.

[0083] According to the embodiments of this application, by constructing a multi-stage key processing flow, a closed-loop management of the entire process of key application semantic understanding, trusted storage, security analysis and dynamic negotiation is realized, and a secure session key with traceability, adaptability and high reliability is established, thereby improving the intelligence level, security assurance capability and compliance controllability of the key management system.

[0084] The following describes the blockchain-based key generation and distribution method of this application in detail by way of preferred embodiments.

[0085] In the embodiments of this application, in order to enhance the system's intelligent processing capability and security awareness capability for key lifecycle management, a multimodal large model with cross-modal semantic alignment and reasoning capabilities can be used to perform multimodal parsing of key application information.

[0086] Figure 3 The flowchart illustrating a method for multimodal parsing of key request information according to some exemplary embodiments of this application is shown schematically.

[0087] like Figure 3As shown, the method for multimodal parsing of key request information includes operations S310 to S330.

[0088] In operation S310, a multimodal parsing model is used to perform semantic recognition and contextual understanding on the key application information, and to extract business scenario information and abnormal access information.

[0089] Specifically, key application information may include application work order scenario information, identity identification information, and access source information.

[0090] In the embodiments of this application, the multimodal parsing model is preferably a large multimodal model with cross-modal semantic alignment and reasoning capabilities. This model integrates multiple technologies such as natural language processing, computer vision, speech recognition, and knowledge graphs, enabling unified modeling and semantic understanding of structured fields, unstructured text, image content, audio data, and behavioral trajectory information. Compared to traditional shallow rule parsing methods, this large multimodal model possesses stronger context awareness, intermodal collaborative reasoning capabilities, and risk behavior identification capabilities, accurately reconstructing the real business context and potential threat factors of key applications.

[0091] In some embodiments, a multimodal parsing model can be used to perform natural language processing and / or computer vision processing on the application work order scenario information in the key application information to accurately extract the business scenario information corresponding to the key application. The application work order scenario information may include structured business fields (such as operation type, target system, purpose of use) and unstructured descriptive content (such as application reason, process description, image attachments, etc.). The system can use a multimodal large model that integrates large-scale pre-trained language models and image and text understanding capabilities to perform intent recognition, entity extraction, and semantic classification processing on the text, while performing visual understanding on screenshots, document forms, identity materials, etc. in images, thereby comprehensively determining the business type (such as internal operation and maintenance, customer data export, transaction signing, etc.) and the compliance domain involved (such as finance, healthcare, cross-border business, etc.) of the key request.

[0092] In some embodiments, behavioral pattern analysis can also be performed on the access source information in the key application information to identify potential abnormal access behavior. Access source information may include multi-dimensional data such as the access terminal's device identifier, geographical location, operating system environment, and login method. The system can combine historical access behavior profiles with time-series modeling and anomaly detection algorithms to analyze whether the current access behavior deviates from its intended path, such as whether it was initiated by an infrequently used device, whether address drift occurred, whether there was a surge in access frequency, or whether the system bypassed the usual login path. For identified abnormal behavior, the system will mark it as abnormal access information.

[0093] According to the embodiments of this application, by parsing the multimodal large model, the business background and access behavior characteristics of key applications can be fully understood, which not only improves the accuracy and generalization ability of semantic recognition, but also enhances the ability to perceive complex and highly concealed abnormal behaviors, thereby providing intelligent security support for key lifecycle management.

[0094] In other embodiments, the multimodal large model can also support time series modeling and chain causal reasoning. The system can input the user's most recent operations, including input paths, operation time distribution, and access target types under different modalities. The model uses a time-series encoding mechanism and an attention sliding window mechanism to identify whether the current application is the result of policy inducement, abnormal chain access, or self-generated attack, thereby providing deep semantic evidence for risk level determination.

[0095] In operation S320, based on the business scenario information and the abnormal access information, the key application information is labeled with a risk level to obtain risk labeling information.

[0096] In the embodiments of this application, business scenario information extracted through a multimodal parsing model can be used to locate the industry node corresponding to the business scenario in a preset dynamic knowledge graph. The dynamic knowledge graph covers encryption compliance regulations and risk control requirements across multiple industries and regions, and uses an entity-relationship structure to represent the semantic connections between various business activities and their corresponding compliance policy clauses. For example, if the business scenario involves "cross-border transmission of medical image data," the system can automatically associate it with the "medical data processing" node in the knowledge graph and extract specific clauses regarding data minimization, encryption strength, and storage period.

[0097] Based on the aforementioned compliance policy provisions, the current key request information can be tagged with sensitivity levels to assess the data types, operational permissions, dissemination scope, and potential impact involved in the business process, thereby determining the business sensitivity level of the key operation. For example, if the operation will trigger the batch export of patient privacy images to a third-party platform, it can be tagged as "highly sensitive"; if it is limited to internal review and approval processes, it can be tagged as "medium sensitive" or "low sensitive." This sensitivity level reflects the basic security requirements of the current key request in terms of compliance and business risk.

[0098] After completing the business sensitivity labeling, this level can be further integrated and evaluated with the aforementioned extracted abnormal access information. For example, if the business sensitivity level is high, and the access behavior exhibits high-risk characteristics such as abnormal source, unregistered terminal, or a behavior path that deviates significantly from historical patterns, the system can classify the key application information as "high-risk" overall. If the business sensitivity is medium but the behavior is trustworthy, it may be classified as "medium-risk" or "low-risk." The system combines a scoring mechanism, a risk policy rule table, or a machine learning model to generate corresponding risk labeling information, which will be used to drive subsequent encryption policy construction and key lifecycle management decisions.

[0099] Through the above methods, the system has implemented a risk level assessment mechanism driven by multimodal parsing results, compliance knowledge graphs, and behavioral modeling. This ensures that every key application is accurately, auditably, and traceably labeled based on a full understanding of the business scenario and behavioral security situation, providing a reliable basis for dynamic encryption decisions and security resource scheduling.

[0100] In operation S330, the key parsing data is generated based on the risk labeling information and the key application information.

[0101] In the embodiments of this application, key parsing data, as one of the core contents of subsequent blockchain notarization, directly determines the establishment of the data trust chain through its structure and semantics, and also provides input basis for the accurate matching of subsequent dynamic encryption strategies. By integrating the parsing process from a risk perspective and business context, the system can transform complex and multi-source application data into measurable, auditable, and traceable structured information units.

[0102] In the embodiments of this application, the process of "submitting blockchain evidence containing the key parsing data to the target blockchain network and obtaining the returned evidence reference information" aims to perform immutable and traceable evidence storage processing on the core content of the key parsing data through blockchain technology, providing a reliable basis for security analysis and key negotiation.

[0103] Specifically, the generated key parsing data can first undergo cryptographic digest processing, using a hash algorithm to calculate its data digest value. This data digest value serves as a unique fingerprint of the key parsing data, containing no original plaintext information, effectively protecting the privacy of sensitive data.

[0104] Subsequently, the data digest value can be bound to the identity information extracted from the key application information (such as user identity, terminal identity, authentication credentials, etc.) to construct structured evidence storage request data. The evidence storage request data may include fields such as data digest value, identity identifier, timestamp, business scenario tag, and trust score, used to fully express the basic semantics and uniqueness of the current key application behavior. The system can submit this evidence storage request data to a preset target blockchain network and broadcast it to multiple blockchain nodes for consensus processing and on-chain operations. Depending on implementation requirements, the target blockchain network can be an enterprise private chain, an industry consortium chain, or a multi-party trusted evidence storage chain supporting cross-domain supervision.

[0105] After the evidence is stored and uploaded to the target blockchain network, the system can receive evidence reference information returned by on-chain nodes. This evidence reference information may include block height, transaction hash, on-chain location identifier, and upload time, uniquely identifying the evidence storage location of the key resolution data within the blockchain. The evidence reference information will be recorded by the system and bound to the current key processing flow, allowing for rapid retrieval and verification in subsequent operations such as key policy verification, historical behavior tracing, and compliance auditing. This ensures that the key data possesses a complete traceability chain and non-repudiation throughout its entire lifecycle.

[0106] Through the above process, the system achieves decentralized and trusted registration of sensitive key parsing data. While ensuring the privacy of the original information, it establishes a trusted data foundation based on blockchain and enhances the transparency, security, and compliance of the key management process.

[0107] Furthermore, embodiments of this application can also combine the acquired key parsing data with industry encryption knowledge to construct a dynamically optimized encryption scheme.

[0108] Figure 4 The illustration shows a schematic diagram of a method for performing security policy and environmental risk analysis on key parsing data according to some exemplary embodiments of this application.

[0109] like Figure 4 As shown, the method for performing security policy and environmental risk analysis on key parsing data may include operations S410 to S420.

[0110] In operation S410, the industry encryption template corresponding to the key parsing data is obtained based on the security policy analysis results, and a basic encryption scheme is obtained based on the key parsing data and the industry encryption template.

[0111] In the embodiments of this application, based on the aforementioned security policy analysis results, information such as the business type, sensitivity level, and risk attributes corresponding to the key parsing data can be identified, and a matching industry encryption template can be obtained from a pre-defined industry encryption template library accordingly. The industry encryption template can be a predefined set of encryption policies, formulated based on compliance standards and security requirements in different fields regarding encryption algorithm type, key length, key update frequency, and key encapsulation method. The system associates and matches the key parsing data with the industry encryption template, and, combined with the business context, compliance requirements, and policy constraints of the application request, generates a preliminary basic encryption scheme. The basic encryption scheme may include basic configuration content such as encryption algorithm combinations, key generation parameters, key lifecycle control policies, and key binding objects.

[0112] In operation S420, the basic encryption scheme is optimized by reinforcement learning based on the environmental risk analysis results to obtain the target encryption scheme.

[0113] Specifically, environmental risk analysis results can include security assessment indicators across multiple dimensions, such as endpoint trustworthiness scores, behavioral deviations, network stability levels, abnormal access path identification results, geographical location trustworthiness, and attack model prediction scores. These indicators can be represented as feature vectors in the RL environment state space, used to characterize the dynamic risk environment in which the current encryption task exists. Based on this state input, the system defines an adjustable policy parameter action space for the current basic encryption scheme, such as key length, algorithm combination methods, number of negotiation rounds, key update cycle, and identity binding policy level.

[0114] During the optimization process, RL agents can be used to select specific policy actions through a policy network to adjust the parameters in the basic encryption scheme, and the results can be evaluated based on a preset reward function. The reward function can comprehensively consider multiple target indicators, including: the improvement in encryption strength, negotiation success rate, resource overhead control, response time, attack resistance, and compliance coverage. For example, when the current environment is assessed as high-risk, the RL model may choose to enable multiple encryption, multi-factor binding, or limit key validity; in a low-risk environment, it may prefer encryption configurations with lower computational load to improve system efficiency.

[0115] After optimization, the target encryption scheme output by the system will contain a set of optimal parameter combinations evaluated and adjusted by RL. This not only meets the industry compliance requirements of the original basic encryption scheme but also provides superior security and execution adaptability in the current risk environment. The target encryption scheme will serve as the policy input for subsequent key generation and negotiation stages, ensuring that the generated key data is scenario-driven, security-resilient, and configuration-intelligent, effectively improving the system's responsiveness and reliability under complex security situations.

[0116] In the embodiments of this application, the process of generating target key data using the target encryption scheme may include initial key generation, key enhancement determination and key enhancement processing stages, thereby ensuring that the finally generated target key data has configurable, upgradable and verifiable encryption strength.

[0117] Specifically, based on the encryption algorithm type and required key strength level specified in the target encryption scheme, a security module (such as a local encryption library, trusted execution environment, hardware security module, etc.) is invoked to generate the corresponding initial key data. The initial key data may include elements such as the key master value, initialization vector, seed entropy source, and key usage label.

[0118] After generating the initial key data, the decision to enable a key enhancement scheme can be made based on the aforementioned environmental risk analysis results. Key enhancement schemes can include various encryption encapsulation algorithm types and parameter configurations, such as: introducing key segmentation storage and combination encapsulation strategies, multi-layered nested encryption structures (e.g., symmetric keys being encapsulated again using asymmetric encryption keys), key binding algorithms (e.g., binding with terminal hardware fingerprints, timestamps, and session context information), or increasing key entropy through stronger hash algorithms, multi-factor generation paths, etc. Furthermore, enhancement schemes can also support the use of customized algorithm parameters (e.g., longer key lengths, more complex round configurations), or preprocessing the key into a hardware-isolated state to enhance physical protection capabilities.

[0119] In response to enabling the key enhancement scheme, the aforementioned enhancement processing logic can be applied to the initial key data to generate target key data with higher strength, stronger binding, or better isolation. The final output target key data can contain multi-level structured fields (such as master key, encapsulation key, binding tag, key lifecycle metadata, etc.) and meta-parameters such as version number, validity period, and risk response strategy, providing a complete foundation for subsequent key negotiation, distribution, update, and revocation.

[0120] Through the above processing, it can be ensured that the generated target key data not only meets the policy constraints at the algorithm level, but also achieves dynamic enhancement in terms of environmental adaptability and security strength, thereby improving the intelligent configuration capability and risk resistance capability of the key system, and is suitable for diverse key management needs such as high-frequency changes, high security level and cross-domain applications.

[0121] Optionally, embodiments of this application may further include real-time auditing and anomaly detection of the key usage process to achieve behavior tracking and risk response in the closed loop of the key lifecycle.

[0122] Specifically, after the key is distributed to the target terminal and put into use, the system can continuously collect key usage logs in real time. These logs can include data from multiple dimensions, such as key call time, calling interface, user identifier, encryption / decryption operation type, data volume, network connection parameters, and information about the source device. To ensure the integrity and immutability of the log data, the key usage logs can be timestamped, structurally encoded, and synchronously written to the target blockchain network for on-chain notarization, forming an audit record identifier corresponding to each log entry. The audit record identifier can include information such as block index, transaction hash, on-chain location, and record summary, supporting subsequent rapid retrieval and traceability.

[0123] Based on the aforementioned audit log identifiers, the system can reference the corresponding key usage logs at any point in time to conduct targeted security analysis. Specifically, a multimodal parsing model with the same architecture as described above can be used to perform in-depth analysis and semantic modeling on the collected log information. For example, if the system detects that a certain key is frequently used within a short period of time, the source device address of the call is abnormal, the logs show frequent interface return error codes, or the behavior path deviates significantly from the expected strategy, the model can identify this behavior as potential key abuse, hijacking, or automated attack behavior.

[0124] In response to the above anomaly identification results, an anomaly response operation can be triggered immediately. This operation may include: suspending access to the key, forcibly rotating or revoking the key, freezing the corresponding terminal account, recording high-priority alarm information and pushing it to the security audit platform, or automatically rolling back access permissions for encrypted data. Simultaneously, the system can resubmit the anomaly to the blockchain network for evidence storage.

[0125] Through the above methods, the system not only achieves full traceability, verifiability, and non-repudiation of the key usage process, but also integrates the technical advantages of large-scale intelligent analysis and blockchain trusted recording, enhancing the security transparency, autonomous defense capabilities, and compliance audit capabilities of the key management system.

[0126] Optionally, embodiments of this application further include closed-loop management of the target key data's lifecycle to ensure that the key can be thoroughly, securely, and auditably destroyed according to a policy after use. Specifically, when generating the target key data, the system establishes a corresponding lifecycle monitoring mechanism based on the preset lifecycle management policy information in the target encryption scheme (such as key validity period, maximum number of uses, binding session duration, specific event triggering conditions, etc.). The system continuously monitors the key's usage status and lifecycle status through a combination of timed detection and event triggering mechanisms.

[0127] When a lifecycle end event is detected (e.g., key expiration, key revocation, usage limit reached, target task completion, or abnormal blocking triggered), the system can immediately respond and perform physical-level erasure of the target key data. Physical-level erasure may include securely erasing the key from memory, permanently deleting it from local storage media, and deregistering the key material from the security module, ensuring that the key cannot be recovered, copied, or misused at either the logical or physical level. To enhance the credibility and auditability of the key destruction process, the system can generate a structured destruction certificate simultaneously with physical destruction. The destruction certificate may include fields such as key identifier, destruction time, execution terminal identifier, destruction method, operation signature, and hash digest, serving as proof of the key's lifecycle termination.

[0128] Subsequently, the destruction certificate can be broadcast to the target blockchain network and submitted as a transaction to multiple blockchain nodes for consensus, thereby achieving immutable evidence of the key destruction process. Simultaneously, the corresponding global key status information on the chain can be updated, marking the key's status from "enabled" or "frozen" to "destroyed," forming a complete key lifecycle status record chain. On-chain status updates can not only be used for subsequent behavior auditing and compliance checks but also provide other system components with a reliable basis for key status queries, preventing the misuse or repeated use of destroyed keys.

[0129] According to embodiments of this application, a comprehensive methodology covering key application, multimodal parsing, blockchain notarization, security policy analysis, reinforcement optimization, key generation, usage auditing, and lifecycle management is constructed, achieving intelligent, trustworthy, and closed-loop management of the key lifecycle. By introducing a multimodal large-scale model for semantic understanding and risk identification of key application information, scene awareness and abnormal behavior detection accuracy are improved. Blockchain is used for multi-stage notarization of key parsing data, usage behavior, and destruction operations, ensuring that the data throughout the process is tamper-proof and traceable. Reinforcement learning is combined to adaptively optimize encryption strategies, achieving dynamic security enhancement of key configuration. Simultaneously, through real-time auditing and credential destruction mechanisms, transparency of key usage behavior and verifiability of lifecycle termination are achieved.

[0130] Corresponding to the above-described blockchain-based key generation and distribution method, embodiments of this application also provide a blockchain-based key generation and distribution apparatus.

[0131] Figure 5 The diagram illustrates a structural block diagram of a blockchain-based key generation and distribution apparatus according to an embodiment of this application.

[0132] like Figure 5As shown, the blockchain-based key generation and distribution device 500 of this embodiment includes a data acquisition module 510, a blockchain evidence storage module 520, an analysis module 530, and a generation and distribution module 540.

[0133] The data acquisition module 510 can be used to acquire key application information, perform multimodal parsing on the key application information, and obtain key parsing data. In one embodiment, the data acquisition module 510 can be used to execute the operation S210 described above, which will not be repeated here.

[0134] The blockchain evidence storage module 520 can be used to submit blockchain evidence containing the key parsing data to the target blockchain network and obtain returned evidence reference information. In one embodiment, the blockchain evidence storage module 520 can be used to perform the operation S220 described above, which will not be repeated here.

[0135] The analysis module 530 can be used to reference the key parsing data based on the evidence storage reference information, perform security policy and environmental risk analysis on the key parsing data, and construct a target encryption scheme based on the analysis results. In one embodiment, the analysis module 530 can be used to perform the operation S230 described above, which will not be repeated here.

[0136] The generation and distribution module 540 can be used to generate target key data using the target encryption scheme, and to negotiate a key with the target terminal based on the target key data to establish a secure session key. In one embodiment, the generation and distribution module 540 can be used to perform the operation S240 described above, which will not be repeated here.

[0137] According to an embodiment of this application, the data acquisition module 510 can also be used to perform semantic recognition and contextual understanding on the key application information using a multimodal parsing model, and extract business scenario information and abnormal access information, wherein the key application information includes at least application work order scenario information, identity identification information and access source information; based on the business scenario information and the abnormal access information, the key application information is labeled with a risk level to obtain risk labeling information; and based on the risk labeling information and the key application information, the key parsing data is generated.

[0138] According to an embodiment of this application, the data acquisition module 510 can also be used to perform natural language processing and / or computer vision processing on the application work order scenario information to extract the business scenario information; and to perform behavioral pattern analysis on the access source information to obtain the abnormal access information.

[0139] According to an embodiment of this application, the data acquisition module 510 can also be used to locate the corresponding industry node in a preset dynamic knowledge graph based on the business scenario information, obtain the corresponding compliance policy clauses; perform sensitivity labeling on the key application information based on the compliance policy clauses to obtain the business sensitivity level; and determine the risk level of the key application information based on the business sensitivity level and the abnormal access information, and generate the risk labeling information.

[0140] According to an embodiment of this application, the blockchain evidence storage module 520 can also be used to perform encrypted digest processing on the key parsing data to generate a data digest value; bind the data digest value with the identity information to form evidence storage request data; submit the evidence storage request data to multiple blockchain nodes of the target blockchain network for on-chain evidence storage; and obtain evidence storage reference information returned by the target blockchain network.

[0141] According to an embodiment of this application, the analysis module 530 can also be used to obtain the industry encryption template corresponding to the key parsing data based on the security policy analysis results, obtain a basic encryption scheme based on the key parsing data and the industry encryption template, and perform reinforcement learning optimization on the basic encryption scheme based on the environmental risk analysis results to obtain a target encryption scheme.

[0142] According to an embodiment of this application, the generation and distribution module 540 can also be used to generate initial key data based on the encryption algorithm type and key strength requirements in the target encryption scheme; determine whether to enable a key enhancement scheme based on the environmental risk analysis results, wherein the key enhancement scheme includes an encryption encapsulation algorithm type and / or algorithm parameter configuration; and in response to enabling the key enhancement scheme, enhance the initial key data based on the key enhancement scheme to generate the target key data.

[0143] According to an embodiment of this application, the blockchain-based key generation and distribution device 500 may further include an audit module. The audit module can be used to collect key usage logs in real time, persist the key usage logs to the target blockchain network based on timestamps, and generate corresponding audit record identifiers; and, based on the audit record identifiers, reference the key usage logs, utilize a multimodal parsing model to perform anomaly identification on the key usage logs, and execute anomaly response operations in response to identified anomaly information.

[0144] According to an embodiment of this application, the blockchain-based key generation and distribution device 500 may further include a key clearing module. The key clearing module can be used to detect lifecycle end events based on the lifecycle management strategy information of the target key data; in response to detecting a lifecycle end event, physically clear the target key data and generate a corresponding destruction credential; and broadcast the destruction credential to the target blockchain network to update the corresponding global key state information.

[0145] According to embodiments of this application, any multiple modules among the data acquisition module 510, blockchain evidence storage module 520, analysis module 530, and generation and distribution module 540 can be merged into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module. According to embodiments of this application, at least one of the data acquisition module 510, blockchain evidence storage module 520, analysis module 530, and generation and distribution module 540 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any one of the three implementation methods, or in a suitable combination of any of them. Alternatively, at least one of the data acquisition module 510, the blockchain evidence storage module 520, the analysis module 530, and the generation and distribution module 540 can be implemented at least partially as a computer program module, which can perform corresponding functions when the computer program module is run.

[0146] Figure 6 A block diagram schematically illustrates an electronic device suitable for implementing a blockchain-based key generation and distribution method according to an embodiment of this application.

[0147] like Figure 6 As shown, an electronic device 600 according to an embodiment of this application includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage portion 608 into a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this application.

[0148] RAM 603 stores various programs and data required for the operation of electronic device 600. Processor 601, ROM 602, and RAM 603 are interconnected via bus 604. Processor 601 executes various operations of the method flow according to embodiments of this application by executing programs in ROM 602 and / or RAM 603. It should be noted that the programs may also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 may also execute various operations of the method flow according to embodiments of this application by executing programs stored in said one or more memories.

[0149] According to embodiments of this application, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to a bus 604. The electronic device 600 may also include one or more of the following components connected to the input / output (I / O) interface 605: an input section 606 including a keyboard, mouse, etc.; an output section 607 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as needed. A removable medium 611, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 610 as needed so that computer programs read from it can be installed into the storage section 608 as needed.

[0150] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0151] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include ROM 602 and / or RAM 603 and / or one or more memories other than ROM 602 and RAM 603 described above.

[0152] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code enables the computer system to implement the blockchain-based key generation and distribution method provided in the embodiments of this application.

[0153] When the computer program is executed by the processor 601, it performs the functions defined in the system / apparatus of this application embodiment. According to the embodiments of this application, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0154] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 609, and / or installed from the removable medium 611. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0155] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, it performs the functions defined in the system of this application embodiment. According to the embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0156] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0157] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0158] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

[0159] The embodiments of this application have been described above. However, these embodiments are merely illustrative and not intended to limit the scope of this application. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. Without departing from the scope of this application, those skilled in the art can make various substitutions and modifications, all of which should fall within the scope of this application.

Claims

1. A blockchain-based key generation and distribution method, characterized in that, The method includes: Obtain key request information, perform multimodal parsing on the key request information, and obtain key parsing data; Submit blockchain evidence containing the key parsing data to the target blockchain network and obtain the returned evidence reference information; Based on the evidence storage reference information, the key parsing data is referenced, and a security policy and environmental risk analysis is performed on the key parsing data. Based on the analysis results, a target encryption scheme is constructed. The target encryption scheme is used to generate target key data, and a key negotiation is performed with the target terminal based on the target key data to establish a secure session key.

2. The method according to claim 1, characterized in that, The process of obtaining key request information and performing multimodal parsing on the key request information to obtain key parsing data includes: The key application information is semantically recognized and contextually understood using a multimodal parsing model to extract business scenario information and abnormal access information. The key application information includes at least application work order scenario information, identity identification information, and access source information. Based on the business scenario information and the abnormal access information, the key application information is labeled with a risk level to obtain risk labeling information; and The key parsing data is generated based on the risk labeling information and the key application information.

3. The method according to claim 2, characterized in that, The step of using a multimodal parsing model to perform semantic recognition and contextual understanding on the key application information, and extracting business scenario information and abnormal access information, includes: The application work order scenario information is processed by natural language processing and / or computer vision to extract the business scenario information; and Behavioral pattern analysis is performed on the access source information to obtain the abnormal access information.

4. The method according to claim 2 or 3, characterized in that, The step of submitting blockchain evidence containing the key parsing data to the target blockchain network and obtaining the returned evidence reference information includes: The key parsing data is subjected to cryptographic digest processing to generate a data digest value; The data digest value is bound to the identity information to form a notarization request data, and the notarization request data is submitted to multiple blockchain nodes of the target blockchain network for on-chain notarization; and Obtain the evidence reference information returned by the target blockchain network.

5. The method according to claim 1 or 2, characterized in that, The step of referencing the key parsing data based on the evidence storage reference information, performing security policy and environmental risk analysis on the key parsing data, and constructing a target encryption scheme based on the analysis results includes: Based on the security policy analysis results, obtain the industry encryption template corresponding to the key parsing data, and obtain the basic encryption scheme based on the key parsing data and the industry encryption template; as well as The basic encryption scheme is optimized by reinforcement learning based on the results of environmental risk analysis to obtain the target encryption scheme.

6. The method according to claim 5, characterized in that, The step of generating target key data using the target encryption scheme includes: Based on the encryption algorithm type and key strength requirements in the target encryption scheme, generate initial key data; Based on the environmental risk analysis results, a decision is made as to whether to enable a key enhancement scheme, which includes the encryption encapsulation algorithm type and / or algorithm parameter configuration; and In response to enabling the key enhancement scheme, the initial key data is enhanced based on the key enhancement scheme to generate the target key data.

7. The method according to claim 4, characterized in that, The method further includes: Real-time collection of key usage logs, and time-stamping of these logs to the target blockchain network, generating corresponding audit record identifiers; and The key usage log is referenced based on the audit record identifier, and anomalies are identified in the key usage log using the multimodal parsing model. Anomaly response operation is performed in response to the identified anomaly information.

8. The method according to claim 7, characterized in that, The method further includes: Based on the lifecycle management strategy information of the target key data, detect lifecycle end events; In response to the detection of a lifecycle end event, the target key data is physically erased, and a corresponding destruction credential is generated; and The destruction certificate is broadcast to the target blockchain network to update the corresponding global key status information.

9. The method according to claim 2, characterized in that, The step of labeling the key application information with a risk level based on the business scenario information and the abnormal access information to obtain risk labeling information includes: Based on the business scenario information, the corresponding industry node is located in the preset dynamic knowledge graph to obtain the corresponding compliance policy clauses. Based on the aforementioned compliance policy terms, the key application information is labeled with sensitivity to obtain a business sensitivity level; and Based on the business sensitivity level and the abnormal access information, the risk level of the key application information is determined, and the risk labeling information is generated.

10. A blockchain-based key generation and distribution device, characterized in that, The device includes: The data acquisition module is used to: acquire key application information, perform multimodal parsing on the key application information, and obtain key parsing data; The blockchain evidence storage module is used to: submit blockchain evidence containing the key parsing data to the target blockchain network and obtain the returned evidence storage reference information; The analysis module is used to: reference the key parsing data based on the evidence storage citation information, perform security policy and environmental risk analysis on the key parsing data, and construct a target encryption scheme based on the analysis results; and The generation and distribution module is used to: generate target key data using the target encryption scheme, and conduct key negotiation with the target terminal based on the target key data to establish a secure session key.

11. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 9.

12. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 9.

13. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 9.

Images