Security management and retrieval method based on Internet of Vehicles data

Abstract

The invention provides a security management and retrieval method based on Internet of Vehicles data, and the method comprises the steps: carrying out the cooperative training of a global key management model through a federated learning technology on the premise of not leaking the original data of all parties, and achieving a security key management scheme under the participation of multiple parties through a model parameter aggregation and updating mechanism; when data retrieval is needed, a user submits a retrieval request and identity authentication information, and after a system verifies the identity of the user, a ciphertext data identifier meeting conditions is matched in an attribute index according to a keyword and an authorization attribute of the request; the system acquires corresponding ciphertext data from a distributed database according to the ciphertext data identifier, and directly performs keyword matching calculation on the ciphertext data through a secure multi-party computing protocol under the condition of not decrypting the data; and according to the mined security threats and abnormal modes, a data encryption strategy and an access control strategy are dynamically adjusted, authority limitation or access blocking is performed on suspicious users, and the security protection capability of the system is improved.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a security management and retrieval method based on Internet of Vehicles data. Background Art

[0002] The storage process of Internet of Vehicles data faces the contradiction between privacy protection and efficient retrieval. On the one hand, sensitive Internet of Vehicles data needs to be encrypted and stored to prevent unauthorized access and leakage; on the other hand, frequent data retrieval and query operations require data to be efficiently matched and located. Although traditional encryption schemes can protect data privacy, encrypted data cannot be directly searched and matched. The data must be decrypted before query operations are performed, which greatly reduces the efficiency of data retrieval.

[0003] In addition, the encryption of Internet of Vehicles data involves multiple parties, including data providers, encryption service providers, key managers, etc. How to achieve collaborative encryption among all parties while ensuring data privacy is an urgent problem to be solved. Collaborative encryption needs to consider the division of authority and responsibility of each party, as well as the communication and synchronization mechanisms during the encryption process. Improper division of authority may lead to participants' unauthorized access to data; and imperfect communication and synchronization mechanisms may cause delays and blockages in the encryption process. How to design a secure and efficient multi-party collaborative encryption solution that protects data privacy while not affecting the performance of the encryption process is a technical challenge facing Internet of Vehicles data storage. Summary of the invention

[0004] The present invention provides a security management and retrieval method based on Internet of Vehicles data, which mainly includes:

[0005] According to the sensitivity and access frequency of Internet of Vehicles data, the attribute encryption algorithm is used to encrypt the data. The attribute information of the data is used as the encryption parameter to generate the corresponding ciphertext data and attribute index, which are stored in the distributed database.

[0006] Through federated learning technology, the global key management model is collaboratively trained without leaking the original data of each party. The model parameter aggregation and update mechanism is used to implement a secure key management solution with the participation of multiple parties.

[0007] When data needs to be retrieved, the user submits a search request and identity authentication information. After the system verifies the user's identity, it matches the ciphertext data identifier that meets the conditions in the attribute index based on the requested keywords and authorized attributes.

[0008] The system obtains the corresponding ciphertext data from the distributed database according to the ciphertext data identifier, and directly performs keyword matching calculations on the ciphertext data without decrypting the data through the secure multi-party computing protocol;

[0009] If the matching result meets the set relevance threshold, the ciphertext data is returned to the user as a candidate result, and the relevance threshold is dynamically adjusted according to the user's access rights to achieve fine-grained data retrieval under permission control;

[0010] The system records the user's search behavior and access pattern, and uses a privacy-preserving data mining algorithm to analyze the user's behavior without obtaining the user's privacy information, thereby mining potential security threats and abnormal access patterns.

[0011] Dynamically adjust data encryption and access control policies based on discovered security threats and abnormal patterns, restrict permissions or block access to suspicious users, and improve the security protection capabilities of the system;

[0012] Blockchain technology is used to record and verify key operations such as data encryption, key management, and user access, forming an unalterable security audit log, achieving traceability and auditability of data throughout its entire life cycle, and ensuring the credibility and controllability of the system.

[0013] The technical solution provided by the embodiment of the present invention may have the following beneficial effects:

[0014] The present invention discloses a security management and retrieval system based on Internet of Vehicles data. The system adopts attribute encryption algorithm, federated learning, secure multi-party computing protocol and blockchain technology to achieve efficient data protection and accurate retrieval. Unique business scenario problems include how to achieve effective retrieval and access control of sensitive Internet of Vehicles data while ensuring data security. To address this problem, the present invention solves it through the following steps:

[0015] 1. Data encryption and storage: Using attribute encryption algorithms, the attribute information of data is used as encryption parameters to generate ciphertext data and attribute indexes, and store them in a distributed database. This ensures the security of data during storage and transmission.

[0016] 2. Key management and federated learning: Federated learning technology is used to collaboratively train the global key management model. Different participants can jointly optimize and update the key management strategy without leaking their original data.

[0017] 3. Secure data retrieval: After the user submits a retrieval request, the present invention matches and obtains ciphertext data from the attribute index through identity authentication and attribute authorization checks. Using the secure multi-party computing protocol, keyword matching calculations are performed directly on the ciphertext without decrypting the data, ensuring privacy and security during data use.

[0018] 4. Fine-grained access control: Dynamically adjust the relevance threshold based on the user's access rights and the relevance of the search results to achieve fine-grained data access control.

[0019] 5. Data mining and security policy adjustment: Use privacy-preserving data mining algorithms to analyze user behavior, identify potential security threats and abnormal access patterns, and dynamically adjust data encryption and access control policies accordingly.

[0020] 6. Security Audit and Blockchain Technology: All key operations, such as data encryption, key management, user access, etc., are recorded and verified through blockchain technology to form a security audit log to ensure the immutability and traceability of data operations.

[0021] The overall technical effect or function can be summarized as follows: The present invention provides a comprehensive solution for ensuring the security and privacy of Internet of Vehicles data. Through advanced encryption technology and smart contracts, it realizes secure storage, accurate retrieval, fine-grained access control and effective security supervision of data, greatly improving the system's security protection capabilities and management efficiency, while ensuring the privacy of user data. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 The present invention is a flow chart of a method for secure management and retrieval based on Internet of Vehicles data.

[0023] Figure 2 A schematic diagram of a security management and retrieval method based on Internet of Vehicles data according to the present invention.

[0024] Figure 3 This is another schematic diagram of a security management and retrieval method based on Internet of Vehicles data according to the present invention. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0026] like Figure 1-3 In this embodiment, a security management and retrieval method based on Internet of Vehicles data may specifically include:

[0027] Step S101, according to the sensitivity and access frequency of the Internet of Vehicles data, an attribute encryption algorithm is used to encrypt the data, and the attribute information of the data is used as an encryption parameter to generate corresponding ciphertext data and attribute indexes, which are stored in a distributed database.

[0028] According to the sensitivity and access frequency of IoV data, the attribute-based encryption algorithm (ABE) is used to encrypt the data. First, the attribute information of IoV data, including data type, generation time, and vehicle to which it belongs, is obtained, and these attribute information is used as the encryption parameters of the ABE algorithm. Then, the original IoV data is encrypted by the ABE algorithm to generate the corresponding ciphertext data. At the same time, the corresponding attribute index is generated according to the attribute information for subsequent data retrieval and access control. Next, the encrypted ciphertext data and attribute index are uploaded to a distributed database system, such as Apache Cassandra or MongoDB, to achieve distributed storage and management of data. During the data storage process, the data is distributed and stored in different data nodes through the consistent hashing algorithm to ensure data load balancing and high availability. When accessing IoV data, the user first submits a data access request and provides the corresponding attribute information. The system searches for matching data records in the attribute index based on the attribute information provided by the user. If the user has the corresponding access rights, the system obtains the corresponding ciphertext data from the distributed database, decrypts it using the ABE algorithm, and finally returns the plaintext data to the user. Throughout the data encryption and storage process, multi-layer security protection mechanisms are used, such as secure communication protocols and access control strategies, to ensure the confidentiality and integrity of data. In addition, regular data backup and recovery drills are conducted to improve the system's disaster tolerance and data recoverability. Finally, the encryption and storage processes are optimized for performance, such as using parallel computing, caching mechanisms, and other technologies to improve data processing and retrieval efficiency. At the same time, through real-time monitoring and log analysis, potential security threats and performance bottlenecks are discovered and handled in a timely manner to ensure the security and availability of Internet of Vehicles data.

[0029] Specifically, when obtaining the attribute information of the Internet of Vehicles data, the data attributes can be encapsulated in XML or JSON format. For example, the data type is represented as "dataType":"sensor" in JSON format, the generation time is represented as "timestamp":"2023-06-20T09:30:00Z", and the vehicle is represented as "vehicleID":"CN_AB1234". Then, the SHA-256 algorithm is used to perform a hash operation on the attribute information to generate a 256-bit hash value as one of the encryption parameters of the ABE algorithm, and then the original data is encrypted with a 256-bit random key to ensure the confidentiality of the data. When generating an attribute index, the inverted index technology can be used to establish a mapping relationship between keywords and data IDs based on the attribute values ​​to achieve efficient data retrieval. When uploading the encrypted ciphertext data to the Apache Cassandra distributed database, three copies can be set, and the data can be evenly distributed to different storage nodes through the consistent hashing algorithm, and the Gossip protocol can be used to synchronize data between nodes to ensure high data availability. When performing data access control, the system can dynamically generate access control policies based on the user's role and permissions based on the RBAC model. For example, ordinary users can only access data within the last 24 hours, and administrators can access all historical data. At the same time, the TLS encrypted transmission protocol is used to prevent data from being stolen or tampered with during transmission. When performing data backup and recovery drills, a full backup can be automatically triggered at 2 a.m. every day. The backup data is stored in an independent disaster recovery center, and cross-regional disaster recovery of data is achieved through a multi-active architecture in different locations. When performing performance optimization, multi-threaded parallel computing can be used to improve data processing efficiency by utilizing the multi-core characteristics of the CPU; at the same time, combined with caching technologies such as Redis, hot data can be cached to reduce the query pressure on the database. The ELK log analysis platform monitors the system's operating status in real time, intelligently identifies abnormal behaviors based on machine learning algorithms, and warns and handles potential security threats to maximize the security of Internet of Vehicles data.

[0030] Step S102, through federated learning technology, without leaking the original data of each party, collaboratively train the global key management model, and use the model parameter aggregation and update mechanism to implement a secure key management solution with the participation of multiple parties.

[0031] According to the basic principle of federated learning technology, the federated average algorithm (FedAvg) is used to perform weighted average aggregation on the local key management model parameters trained by each party to obtain the global key management model parameters. The differential privacy algorithm is used to add random noise to the aggregated global model parameters to ensure the privacy of the model parameters. The secure multi-party computing protocol is used to achieve secure communication and data exchange between multiple parties to ensure that the original data of each party will not be leaked. In the iterative process of federated learning, the homomorphic encryption algorithm is used to encrypt the local model parameters uploaded by each party to ensure the confidentiality of the parameters during transmission and aggregation. A decentralized federated learning network is constructed through blockchain technology, and smart contracts are used to control parameter updates and aggregation in the federated learning process to ensure the fairness and verifiability of the process. In the training process of the key management model, the long short-term memory network (LSTM) is used to model the time series characteristics of the key to capture the dynamic change law of the key. The key features of different time steps are weighted and fused through the attention mechanism to extract the key information of the key. The Gated Recurrent Unit (GRU) is used to encode the context information of the key to enhance the model's ability to understand the key context. The local features of the key are extracted through the Convolutional Neural Network (CNN) to capture the spatial relationship and local pattern of the key. The output features of LSTM, GRU and CNN are spliced ​​to construct a multi-view key representation vector as the input of the key management model. The Cross-Entropy Loss function is used as the optimization target of the model, and the model parameters are updated and optimized through the backpropagation algorithm. In each iteration of federated learning, each party calculates the local gradient based on the local data and uploads the gradient to the central server for aggregation. The central server uses the Gradient Descent optimization algorithm to update the aggregated global gradient to obtain the new global model parameters. The updated global model parameters are distributed to each party, and each party updates the local model according to the global parameters and starts a new round of local training. Repeat the above iterative process until the preset convergence condition or iteration round is reached to obtain the final global key management model. Using the trained global key management model, we can conduct security assessment and risk prediction on new keys, dynamically adjust the key usage strategy and update frequency according to the prediction results, and realize intelligent key management. Through federated learning technology, we can collaboratively build a global key management model while protecting the data privacy of all parties, and effectively realize a secure key management solution with multi-party participation.

[0032] Specifically, in the process of federated learning, each party uses the FedAvg algorithm to perform weighted average aggregation on the parameters of the local key management model. Assuming that there are three parties involved, with weights of 3, 4, and 3 respectively, the global model parameters are obtained by weighted average. Then, the Laplace mechanism is used to add Gaussian noise with a mean of 0 and a standard deviation of 5 to the global parameters to achieve differential privacy protection. The parties use Paillier homomorphic encryption to achieve secure communication, encrypt the uploaded local model parameters, and the central server cannot obtain the original parameter values. The Ethereum platform is used to build a federated learning blockchain network, and the smart contract is written in Solidity to specify the conditions for parameter update and aggregation, reward and punishment mechanisms, etc. During model training, a two-layer LSTM network is used to model the time series characteristics of the key, with a hidden layer dimension of 128. The weights of the features at different time steps are calculated through the Attention mechanism to extract key information. The GRU network is used to encode the context information of the key, with an embedding dimension of 256. The CNN network uses 3 convolutional layers and 2 pooling layers to extract the local features of the key. The outputs of LSTM, GRU, and CNN are concatenated to form a key representation vector of length 512. The model is trained using the Adam optimizer with a cross entropy loss function and a learning rate of 0.01. In each iteration, each party calculates and uploads the local gradient, and the central server updates the global parameters using the gradient descent algorithm with a learning rate of 0.1. The updated global parameters are distributed to each party for local training for 10 epochs. The iterative process is repeated for 50 rounds to obtain a converged global key management model. Based on the model, the security of the new key is scored, and keys with a score below 6 are marked as high risk, triggering an update mechanism. Through federated learning, a robust and intelligent key management system is built without leaking the privacy of each party.

[0033] Step S103, when data needs to be retrieved, the user submits a search request and identity authentication information. After the system verifies the user's identity, it matches the ciphertext data identifier that meets the conditions in the attribute index according to the keywords and authorization attributes of the request.

[0034] When data needs to be retrieved, the user submits a search request and identity authentication information. After the system verifies the user's identity, it uses the inverted index algorithm to match the ciphertext data identifier that meets the conditions in the attribute index according to the keywords and authorization attributes of the request. The specific implementation process is as follows: the user submits a search request, which contains the search keywords and user identity authentication information. After receiving the search request submitted by the user, the system verifies the legitimacy of the user's identity information through the identity authentication algorithm. If the user's identity authentication is passed, the keyword is segmented by the word segmentation algorithm according to the search keywords in the user's request to obtain a keyword list. According to each keyword in the keyword list, the inverted index algorithm is used to search for a document list containing the keyword in the attribute index to obtain a set of document lists containing the keyword. For the document list set obtained by the attribute index search, the intersection operation of the set operation is used to obtain a document list containing all keywords as a candidate result set. According to the data access permission attribute corresponding to the user's identity, for each document in the candidate result set, it is determined whether the user has the permission to access the document, and the documents that the user does not have the permission to access are filtered out to obtain the document result set that the user has the permission to access. According to the ciphertext data identifier corresponding to each document in the document result set, the data retrieval algorithm is used to obtain the ciphertext data corresponding to the ciphertext data identifier. The ciphertext data that the user has the right to access is returned to the user to complete the data retrieval request.

[0035] Specifically, the user submits a search request through the client application, and the request contains the search keyword "cloud computing" and the user's identity authentication information. After receiving the search request submitted by the user, the system performs a hash operation on the user's identity information through the SHA-256 identity authentication algorithm, and compares the operation result with the user's identity hash value stored in the database to verify the legitimacy of the user's identity. If the user's identity authentication is passed, the Jieba Chinese word segmentation algorithm is used to segment the keyword according to the search keyword "cloud computing" in the user's request, and a keyword list ["cloud", "compute"] is obtained. According to each keyword in the keyword list, the inverted index algorithm is used to search for a document list containing the keyword in the attribute index. For example, the document list corresponding to the keyword "cloud" is [Doc1, Doc3, Doc5], and the document list corresponding to the keyword "compute" is [Doc2, Doc3, Doc4], and a set of document lists containing the keyword is obtained. For the document list set obtained by the attribute index search, the intersection operation of the set is used to obtain the document list [Doc3] containing all keywords as the candidate result set. According to the data access permission attribute corresponding to the user identity, for each document in the candidate result set, it is determined whether the user has the permission to access the document. For example, if the user role is "Administrator", then the user has the permission to access the Doc3 document, and finally the document result set [Doc3] that the user has the right to access is obtained. According to the ciphertext data identifier "0x7a91b3f" corresponding to the Doc3 document in the document result set, the AES-256 data retrieval algorithm is used to obtain the ciphertext data corresponding to the ciphertext data identifier. The ciphertext data corresponding to the retrieved Doc3 document is returned to the user to complete the data retrieval request. During the entire retrieval process, through the application of a series of algorithms and technologies such as identity authentication, keyword segmentation, inverted index, set operation, and permission judgment, the accuracy, security and efficiency of data retrieval are guaranteed, providing users with high-quality data retrieval services.

[0036] In step S104, the system obtains the corresponding ciphertext data from the distributed database according to the ciphertext data identifier, and directly performs keyword matching calculation on the ciphertext data without decrypting the data through a secure multi-party computing protocol.

[0037] The system obtains the corresponding ciphertext data from the distributed database according to the ciphertext data identifier. The secure multi-party computing protocol is used to directly perform keyword matching calculation on the ciphertext data without decrypting the data. The specific implementation process is as follows: According to the ciphertext data identifier, the corresponding ciphertext data is located and obtained in the distributed database. Through the secure multi-party computing protocol, the ciphertext data and keywords are used as input parameters to build a ciphertext keyword matching calculation model. The model uses the homomorphic encryption algorithm to perform keyword matching operations in the ciphertext space to obtain the ciphertext form of the matching result. According to the characteristics of the homomorphic encryption algorithm, the matching result in the ciphertext form is homomorphically decrypted to obtain the matching result in the plaintext form. Through threshold comparison, it is judged whether the matching result meets the preset conditions. If the matching result meets the preset conditions, the ciphertext data is marked as a successful match; otherwise, it is marked as a failed match. According to the marking of the matching result, the ciphertext data is classified and sorted to obtain a subset of ciphertext data that successfully matches and a subset of ciphertext data that failed to match. The differential privacy algorithm is used to perform privacy protection processing on the matching result to ensure that individual privacy is not leaked. Through the secure multi-party computing protocol, the processed matching results are returned to the data requester to complete the keyword matching calculation process of the ciphertext data. During the entire calculation process, the ciphertext data is always encrypted to ensure the confidentiality and privacy of the data.

[0038] Specifically, the system first locates and obtains the corresponding ciphertext data in the distributed database according to the unique identifier of the ciphertext data, such as the data ID or hash value. For example, the system can use a consistent hashing algorithm to map the data identifier to the corresponding database shard, and then retrieve the ciphertext data in the shard. After obtaining the ciphertext data, the system uses a secure multi-party computing protocol, such as Yao's Garbled Circuit or Goldreich-Micali-Wigderson protocol, to take the ciphertext data and keywords as input parameters to build a ciphertext keyword matching calculation model. The model uses the Paillier homomorphic encryption algorithm to perform keyword matching operations in the ciphertext space. For example, the keyword is converted into a binary vector and homomorphically added to the ciphertext data to obtain the ciphertext form of the matching result. Then, the system uses the private key of the Paillier algorithm to homomorphically decrypt the matching result in ciphertext form to obtain a matching metric value in plaintext form, such as Jaccard similarity or cosine similarity. Next, the system compares the matching metric value with a preset threshold (such as 8) to determine whether the matching condition is met. For ciphertext data that successfully matches, the system marks it as 1; otherwise, it marks it as 0. Based on the marking results, the system divides the ciphertext data into two subsets: successful matches and failed matches. To protect individual privacy, the system applies the Laplace mechanism differential privacy algorithm to the matching results, adding random noise to the matching metric, such as Gaussian noise with a mean of 0 and a standard deviation of 1, to ensure that sensitive information is not leaked. Finally, the matching results that have been processed with privacy protection are returned to the data requester through the secure multi-party computing protocol to complete the privacy protection keyword matching calculation of the ciphertext data.

[0039] Step S105: If the matching result meets the set relevance threshold, the ciphertext data is returned to the user as a candidate result, and the relevance threshold is dynamically adjusted according to the user's access rights to achieve fine-grained data retrieval under authority control.

[0040] According to the search keywords input by the user, the inverted index technology is used to match and search the ciphertext data in the encrypted database to obtain a set of candidate ciphertext data sets. The relevance score between each candidate ciphertext data and the search keyword is calculated by the cosine similarity algorithm. It is judged whether the relevance score of each candidate ciphertext data meets the preset relevance threshold. If it does, the ciphertext data is returned to the user as a candidate result. The access right level of the current user is obtained, and the relevance threshold is dynamically adjusted according to the access right level. The higher the access right level, the lower the relevance threshold, and the more candidate results are returned. The hierarchical linear discriminant analysis method is used to model the user's access right, and the relevance threshold adjustment coefficient under different access levels is obtained. The adjusted relevance threshold is applied to the screening process of candidate ciphertext data, and the candidate ciphertext data that does not meet the adjusted relevance threshold is filtered, and finally the fine-grained retrieval results under permission control are obtained. The confidence of the retrieval results is evaluated by the Markov chain Monte Carlo method, and the confidence score of each retrieval result is calculated. The retrieval results are reordered according to the confidence score, and the results with high confidence scores are ranked first and the results with low confidence scores are ranked later. The re-ranked search results are returned to the user to achieve dynamic optimization of the search results based on confidence.

[0041] Specifically, when the user enters the search keyword "encrypted database", the system first performs word segmentation on the keyword to obtain two keywords "encryption" and "database". Then, the inverted index technology is used to perform matching retrieval in the encrypted database. In the inverted index, each keyword corresponds to a ciphertext data ID list containing the keyword. By finding the intersection of the ID lists corresponding to the two keywords "encryption" and "database", a candidate ciphertext data set containing both keywords is obtained, totaling 1024 items. Next, the cosine similarity algorithm is used to calculate the correlation score between each candidate ciphertext data and the search keyword. The calculation formula for cosine similarity is: cos(θ)=(A·B) / (||A||×||B||), where A and B represent the ciphertext data vector and the search keyword vector respectively. The calculation results show that the correlation scores of 85% of the candidate ciphertext data exceed the preset correlation threshold of 75, and these ciphertext data are returned to the user as candidate results. At the same time, the system uses the hierarchical linear discriminant analysis method to dynamically adjust the correlation threshold according to the current user's access permission level. The current user's permission level is 3, and the corresponding relevance threshold adjustment coefficient is 9. The original threshold of 75 is adjusted to 675. According to the adjusted threshold, the candidate results are filtered, and finally a fine-grained search result that meets the permission control is obtained, totaling 918 results. In order to further improve the quality of the search results, the system uses the Markov chain Monte Carlo method to evaluate the confidence of each search result. After 5000 iterative calculations, the confidence score of each result is obtained. The search results are re-sorted according to the confidence score, with the result with the highest confidence score ranked first and the result with the lowest confidence score ranked last. Finally, the search results with optimized sorting are returned to the user, realizing dynamic optimization based on confidence and effectively improving the user's search experience.

[0042] In step S106, the system records the user's search behavior and access pattern, and analyzes the user's behavior through a privacy-preserving data mining algorithm without obtaining the user's privacy information, thereby mining potential security threats and abnormal access patterns.

[0043] The system records the user's search behavior and access pattern, and performs privacy protection processing on the user behavior data through the differential privacy algorithm to obtain the user behavior data after privacy protection. The density-based clustering algorithm (DBSCAN) is used to perform cluster analysis on the privacy-protected user behavior data to obtain the user behavior clustering results. According to the user behavior clustering results, the association rules between user behaviors are mined through the association rule mining algorithm (Apriori) to determine the user behavior pattern. According to the mined user behavior association rules, the anomaly detection algorithm (Isolation Forest) is used to perform anomaly detection on the user behavior pattern to determine whether there is an abnormal access pattern. If an abnormal access pattern is detected, the support vector machine algorithm (SVM) is used to classify the abnormal access pattern to determine the potential security threat type. According to the determined security threat type, the decision tree algorithm (C5) is used to generate security threat judgment rules to obtain the judgment result of the potential security threat.

[0044] Specifically, the system records the user's search keywords, access time, access pages and other behavioral data, and uses the Laplace mechanism in the differential privacy algorithm to perturb the original user behavior data, adding Gaussian noise with a mean of 0 and a standard deviation of 1 to obtain the privacy-protected user behavior data set. Then, the DBSCAN clustering algorithm is used to perform cluster analysis on the 5,000 user behavior data after privacy protection, setting the radius parameter eps to 5 and the minimum number of samples minPts to 10, and finally 8 user behavior clusters are obtained. Next, the Apriori association rule mining algorithm is used to mine the association rules between user behaviors with a minimum support of 3 and a minimum confidence of 7 as thresholds. For example, the confidence of the association rule "browse news page → search for related keywords" is 85% and the support is 40%. Based on the obtained association rules, the IsolationForest anomaly detection algorithm is used to construct multiple isolated forests, calculate the anomaly scores of sample points, and determine the user behavior patterns with anomaly scores greater than the threshold of 6 as abnormal. The detected abnormal access patterns are classified using the SVM support vector machine algorithm, and the RBF kernel function is selected. The optimal parameters C = 10, gamma = 1 are obtained through cross-validation to identify the security threat types of abnormal access patterns, and potential threats such as "SQL injection" and "XSS cross-site scripting" are found. Finally, the C5 decision tree algorithm is used to generate security threat judgment rules based on threat type, access time, access frequency and other features, such as "access frequency > 100 times / minute and contains sensitive keywords → high-risk SQL injection threat", which is used to determine potential security threats in real time and form a complete user behavior security analysis process.

[0045] Step S107, dynamically adjust the data encryption strategy and access control strategy according to the mined security threats and abnormal patterns, restrict the authority or block the access of suspicious users, and improve the security protection capability of the system.

[0046] According to the mined security threats and abnormal patterns, the dynamic encryption policy adjustment algorithm is used to dynamically adjust the data encryption policy. The algorithm identifies potential security threats and abnormal behavior patterns by analyzing historical access logs and behavior patterns, and dynamically adjusts the encryption strength and granularity of the data according to the threat level. On the basis of dynamic encryption policy adjustment, the role-based access control model (RBAC) is further adopted to dynamically adjust the user's access rights. Through continuous evaluation of user behavior and roles, the user's access rights are adjusted in real time to restrict suspicious users from accessing sensitive data and key functions. For suspicious users identified as high-risk, the system automatically triggers the access blocking mechanism, and blocks the access requests of suspicious users by modifying firewall rules and access control lists (ACLs) to prevent potential security threats. At the same time as access blocking, user behavior analysis and anomaly detection algorithms such as support vector machines (SVMs) and isolation forest algorithms are started to conduct in-depth analysis of the behavior of suspicious users and identify potential threat behaviors and attack patterns. According to the results of the anomaly detection algorithm, security policy rules are dynamically generated, and security protection policies are deployed and updated in real time by modifying the configuration of security devices to improve the overall security protection capabilities of the system. Through continuous data mining and machine learning algorithms, we continuously optimize and improve the security threat identification and abnormal behavior detection models, improve the accuracy and real-time performance of the models, and enable the system to quickly respond to new security threats and attack methods. Finally, we apply the optimized security protection strategy to various security protection links such as data encryption, access control, and user authentication to form a multi-level, dynamically adaptive security protection system, comprehensively improve the system's security protection capabilities, and effectively resist various security threats and attacks.

[0047] Specifically, the system analyzes historical access logs and behavior patterns and uses association rule mining algorithms such as the Apriori algorithm to identify potential security threats and abnormal behavior patterns. The encryption strength and granularity of the data are dynamically adjusted according to the threat level. For example, AES-128-bit encryption is used for low-risk data, AES-192-bit encryption is used for medium-risk data, and AES-256-bit encryption is used for high-risk data. The system adopts a role-based access control model (RBAC) and uses a user behavior scoring model to comprehensively consider factors such as the user's historical behavior and role permissions to calculate the user's risk score in real time. When the user's risk score exceeds the preset threshold, the system automatically triggers the access blocking mechanism and blocks the access request of the suspicious user by modifying the firewall rules and access control list (ACL). At the same time, the system starts user behavior analysis and anomaly detection algorithms, such as support vector machine (SVM) and isolation forest algorithm, to conduct in-depth analysis of the behavior of suspicious users. By extracting user behavior feature vectors and training SVM models, real-time detection of abnormal behavior is achieved, and the detection accuracy can reach more than 95%. Based on the anomaly detection results, the system dynamically generates security policy rules, such as limiting the access frequency of suspicious IP addresses, banning malicious user accounts, etc., and deploys and updates security protection strategies in real time through automated scripts. The system continuously collects user behavior data, optimizes the anomaly detection model using incremental learning algorithms, and continuously improves the accuracy and real-time performance of the model. The optimized security protection strategy is applied to various security protection links such as data encryption, access control, and user authentication to form a deep defense system, comprehensively improve the system's security protection capabilities, and effectively resist various security threats and attacks.

[0048] Step S108, using blockchain technology to record and verify key operations such as data encryption, key management, and user access, forming an unalterable security audit log, achieving traceability and auditability of the entire life cycle of data, and ensuring the credibility and controllability of the system.

[0049] Blockchain technology is used to encrypt data using the elliptic curve digital signature algorithm (ECDSA) to generate a public-private key pair. The private key is used for signing, and the public key is used to verify the signature. The encrypted data, signature, public key and other information are packaged into blocks. Blocks are linked according to hash pointers to build a Merkle tree. The hash value of each block is calculated by the SHA-256 hash algorithm, and the hash value is stored in the block header to form a blockchain. The authorized access control model (ABAC) is used to manage user access, and whether the user has the right to access the data is determined based on user attributes and access policies. The access request information is recorded in the blockchain. The consensus mechanism of the blockchain network is implemented through the Byzantine Fault Tolerance algorithm (PBFT). Nodes reach consensus through message passing and voting to ensure the consistency and immutability of the blockchain. Obtain user operation requests for data, such as create, read, update, delete, etc., package the operation request information into transactions, sign the transactions through the ECDSA algorithm, and broadcast them to the blockchain network. Nodes in the blockchain network verify and confirm transactions through the PBFT algorithm, package legal transactions into blocks, link them to the blockchain, and update the blockchain status. Merkle Proof is used to verify the integrity and existence of data. By reconstructing the Merkle tree root hash and comparing it with the Merkle root hash stored in the block header, it is determined whether the data has been tampered with. According to the transaction information recorded in the blockchain, an audit log of the entire life cycle of the data is constructed, including operations such as data creation, access, modification, and deletion, as well as information such as the time and user of the operation, to form a traceable security audit log. Using smart contract technology, data access policies and audit rules are encoded into smart contracts, and access control and audit log records are automatically executed through smart contracts to ensure consistent policy execution and automated audits. 1 Using the immutability and traceability of the blockchain, the audit log is stored and verified to ensure the integrity and non-repudiation of the audit log, providing guarantees for the trustworthiness and controllability of the system.

[0050] Specifically, when using the elliptic curve digital signature algorithm (ECDSA) to encrypt data, you can select the secp256k1 curve to generate a 256-bit public-private key pair. The private key is used to sign the data. The signing process uses the SHA-256 hash algorithm to calculate the hash value of the data, and then the private key is used to encrypt the hash value. The public key is used to verify the validity of the signature. The verification process decrypts the signature using the public key to obtain the hash value, which is then compared with the hash value of the data. If they are the same, the verification is passed. The encrypted data, signature, public key and other information are packaged into blocks. The block size is set to 1MB, and each block can store about 4,000 transactions. The blocks are linked through hash pointers to build a Merkle tree. The SHA-256 hash algorithm is used to calculate the hash value of each transaction, and then the hash values ​​are calculated in pairs until the root hash value is obtained, and the root hash is stored in the block header. In the Authorized Access Control Model (ABAC), access policies are formulated based on the user's role, department, security level and other attributes, combined with the sensitivity of the data, the department to which it belongs and other attributes, such as "only employees of the Finance Department with a high security level can access financial data". The user's access request information, including user ID, timestamp, request type, data ID, etc., is recorded in the blockchain to form a traceable access log. The blockchain network uses the Byzantine Fault Tolerance (PBFT) algorithm to achieve consensus. Assuming that there are n nodes in the network, it can tolerate f nodes to do evil. When n≥3f+1, the network can reach a consensus. Nodes confirm the validity and order of blocks by broadcasting messages and multiple rounds of voting to reach a consensus. When a user operates on data, the operation request is packaged into a transaction. The transaction contains information such as the operation type, data ID, and timestamp, and is signed by the user using a private key. The transaction is broadcast to the blockchain network through the P2P network. The node verifies the transaction by verifying the signature, checking the operation authority, etc., packages the legal transaction into a block, links it to the blockchain, and updates the data status. In order to verify the integrity of the data, Merkle Proof can be used. By reconstructing the Merkle tree, the root hash value is calculated and compared with the root hash value stored in the block header. If they are consistent, it means that the data has not been tampered with. The audit log records the complete life cycle of the data, including operations such as creation, reading, updating, and deletion, as well as information such as the user, time, and IP address of the operation, forming a traceable security audit chain. Smart contracts can encode data access policies and audit rules into the blockchain. For example, the function check_access(user_id, data_id) is defined to determine whether the user has the right to access the data based on the user attributes and data attributes, and automatically record the audit log. Smart contracts ensure the consistent execution of policies and the automation of audits, improving the credibility and controllability of the system.The immutability and traceability of blockchain ensure the integrity and non-repudiation of audit logs. Any modification or deletion of audit logs will be recorded in the blockchain, and the time, user and other information of the operation can be traced, providing a solid foundation for the security and credibility of the system.

[0051] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A security management and retrieval method based on Internet of Vehicles data, It is characterized in that The method comprises: According to the sensitivity and access frequency of Internet of Vehicles data, the attribute encryption algorithm is used to encrypt the data. The attribute information of the data is used as the encryption parameter to generate the corresponding ciphertext data and attribute index, which are stored in the distributed database. Through federated learning technology, the global key management model is collaboratively trained without leaking the original data of each party. The model parameter aggregation and update mechanism is used to implement a secure key management solution with the participation of multiple parties. When data needs to be retrieved, the user submits a search request and identity authentication information. After the system verifies the user's identity, it matches the ciphertext data identifier that meets the conditions in the attribute index based on the requested keywords and authorized attributes. The system obtains the corresponding ciphertext data from the distributed database according to the ciphertext data identifier, and directly performs keyword matching calculations on the ciphertext data without decrypting the data through the secure multi-party computing protocol; If the matching result meets the set relevance threshold, the ciphertext data is returned to the user as a candidate result, and the relevance threshold is dynamically adjusted according to the user's access rights to achieve fine-grained data retrieval under permission control; The system records the user's search behavior and access pattern, and uses a privacy-preserving data mining algorithm to analyze the user's behavior without obtaining the user's privacy information, thereby mining potential security threats and abnormal access patterns. Dynamically adjust data encryption and access control policies based on discovered security threats and abnormal patterns, restrict permissions or block access to suspicious users, and improve the security protection capabilities of the system; Blockchain technology is used to record and verify key operations, forming a tamper-proof security audit log, achieving traceability and auditability of data throughout its life cycle, and ensuring the credibility and controllability of the system; the key operations include data encryption, key management, and user access.

2. The method according to claim 1, in, According to the sensitivity and access frequency of the Internet of Vehicles data, the attribute encryption algorithm is used to encrypt the data, the attribute information of the data is used as the encryption parameter, the corresponding ciphertext data and attribute index are generated, and stored in the distributed database, including: According to the sensitivity and access frequency of the Internet of Vehicles data, the data is encrypted using an attribute-based encryption algorithm; First, the attribute information of the Internet of Vehicles data is obtained, including the data type, generation time, and the vehicle to which it belongs, and these attribute information are used as encryption parameters of the ABE algorithm; Then, the original Internet of Vehicles data is encrypted using the ABE algorithm to generate corresponding ciphertext data; At the same time, the corresponding attribute index is generated according to the attribute information for subsequent data retrieval and access control; Next, the encrypted ciphertext data and attribute index are uploaded to a distributed database system, such as Apache Cassandra or MongoDB, to achieve distributed storage and management of data. During the data storage process, the consistent hashing algorithm is used to distribute data to different data nodes to ensure data load balancing and high availability. When accessing IoV data is needed, the user first submits a data access request and provides the corresponding attribute information; The system searches for matching data records in the attribute index based on the attribute information provided by the user; If the user has the corresponding access rights, the system obtains the corresponding ciphertext data from the distributed database, decrypts it using the ABE algorithm, and finally returns the plaintext data to the user; During the entire data encryption and storage process, multi-layer security protection mechanisms are adopted, including secure communication protocols and access control strategies, to ensure the confidentiality and integrity of data; In addition, by regularly conducting data backup and recovery drills, the system's disaster tolerance and data recoverability can be improved; Finally, the encryption and storage processes are optimized, including the use of parallel computing and caching mechanisms to improve data processing and retrieval efficiency. At the same time, through real-time monitoring and log analysis, potential security threats and performance bottlenecks can be discovered and handled in a timely manner to ensure the security and availability of Internet of Vehicles data.

3. The method according to claim 1, in, The federated learning technology is used to collaboratively train the global key management model without leaking the original data of each party, and the model parameter aggregation and update mechanism is used to implement a secure key management solution with multi-party participation, including: According to the basic principle of federated learning technology, the federated average algorithm is used to perform weighted average aggregation on the local key management model parameters trained by all parties to obtain the global key management model parameters; The differential privacy algorithm is used to add random noise to the aggregated global model parameters to ensure the privacy of the model parameters. Use secure multi-party computing protocols to achieve secure communication and data exchange between multiple parties, ensuring that the original data of each party will not be leaked; In the iterative process of federated learning, the homomorphic encryption algorithm is used to encrypt the local model parameters uploaded by each party to ensure the confidentiality of the parameters during transmission and aggregation; Build a decentralized federated learning network through blockchain technology, and use smart contracts to control parameter updates and aggregation in the federated learning process to ensure the fairness and verifiability of the process; In the training process of the key management model, the long short-term memory network is used to model the time series characteristics of the key to capture the dynamic change law of the key; The key features of different time steps are weighted and fused through the attention mechanism to extract the key information; Use gated recurrent units to encode the key context information to enhance the model's ability to understand the key context; The local features of the key are extracted through convolutional neural networks to capture the spatial relationship and local patterns of the key.

4. The method according to claim 3, wherein the global key management model is collaboratively trained by using federated learning technology without leaking the original data of each party, and a secure key management solution with multi-party participation is implemented by using a model parameter aggregation and update mechanism, further comprising: The output features of LSTM, GRU and CNN are concatenated to construct a multi-view key representation vector as the input of the key management model; The cross entropy loss function is used as the optimization target of the model, and the model parameters are updated and optimized through the back propagation algorithm; In each iteration of federated learning, each party calculates local gradients based on local data and uploads the gradients to the central server for aggregation; The central server uses the gradient descent optimization algorithm to update the aggregated global gradient to obtain new global model parameters; Distribute the updated global model parameters to all parties, and each party updates the local model based on the global parameters and starts a new round of local training; Repeat the above iterative process until the preset convergence condition or iteration round is reached to obtain the final global key management model; Use the trained global key management model to conduct security assessment and risk prediction on new keys, dynamically adjust the key usage strategy and update frequency based on the prediction results, and realize intelligent key management; Through federated learning technology, a global key management model is collaboratively constructed while protecting the data privacy of all parties, effectively implementing a secure key management solution with the participation of multiple parties.

5. The method according to claim 1, in, When data needs to be retrieved, the user submits a search request and identity authentication information. After the system verifies the user's identity, it matches the ciphertext data identifier that meets the conditions in the attribute index according to the requested keywords and authorization attributes, including: When data needs to be retrieved, the user submits a search request and identity authentication information. After the system verifies the user's identity, it uses the inverted index algorithm to match the ciphertext data identifier that meets the conditions in the attribute index based on the requested keywords and authorized attributes. The specific implementation process is as follows: the user submits a search request, which contains search keywords and user identity authentication information; After the system receives the search request submitted by the user, it verifies the legitimacy of the user's identity information through the identity authentication algorithm; If the user identity authentication is passed, the keyword segmentation algorithm is used to segment the keyword according to the search keyword in the user request to obtain a keyword list; According to each keyword in the keyword list, a document list containing the keyword is searched in the attribute index through an inverted index algorithm to obtain a set of document lists containing the keyword; For the document list set obtained by the attribute index search, the document list containing all keywords is obtained as the candidate result set through the intersection operation of the set operation; According to the data access permission attribute corresponding to the user identity, for each document in the candidate result set, determine whether the user has the permission to access the document, filter out the documents that the user does not have the permission to access, and obtain the document result set that the user has the permission to access; According to the ciphertext data identifier corresponding to each document in the document result set, a data retrieval algorithm is used to obtain the ciphertext data corresponding to the ciphertext data identifier; Return the encrypted data that the user is authorized to access to the user, completing the data retrieval request.

6. The method according to claim 1, in, The system obtains the corresponding ciphertext data from the distributed database according to the ciphertext data identifier, and directly performs keyword matching calculation on the ciphertext data without decrypting the data through the secure multi-party computing protocol, including: The system obtains the corresponding ciphertext data from the distributed database according to the ciphertext data identifier; Using secure multi-party computing protocol, keyword matching calculation is performed directly on ciphertext data without decrypting the data; The specific implementation process is as follows: according to the ciphertext data identifier, locate and obtain the corresponding ciphertext data in the distributed database; Through the secure multi-party computing protocol, the ciphertext data and keywords are used as input parameters to build a ciphertext keyword matching calculation model; This model uses a homomorphic encryption algorithm to perform keyword matching operations in the ciphertext space and obtain the ciphertext form of the matching results; According to the characteristics of the homomorphic encryption algorithm, the matching results in ciphertext form are homomorphically decrypted to obtain the matching results in plaintext form; By comparing the threshold, determine whether the matching result meets the preset conditions; If the matching result meets the preset conditions, the ciphertext data is marked as a successful match; Otherwise, it is marked as a matching failure; According to the marking of the matching results, the ciphertext data is classified and sorted to obtain a subset of ciphertext data with successful matching and a subset of ciphertext data with failed matching; The differential privacy algorithm is used to protect the matching results and ensure that individual privacy is not leaked. Through the secure multi-party computing protocol, the processed matching results are returned to the data requester to complete the keyword matching calculation process of the ciphertext data; During the entire computing process, the ciphertext data is always encrypted to ensure the confidentiality and privacy of the data.

7. The method according to claim 1, in, If the matching result meets the set relevance threshold, the ciphertext data is returned to the user as a candidate result, and the relevance threshold is dynamically adjusted according to the user's access rights to achieve fine-grained data retrieval under authority control, including: According to the search keywords input by the user, the inverted index technology is used to match and search the ciphertext data in the encryption database to obtain a set of candidate ciphertext data sets; The relevance score between each candidate ciphertext data and the search keyword is calculated using the cosine similarity algorithm; Determine whether the relevance score of each candidate ciphertext data meets the preset relevance threshold, and if so, return the ciphertext data as a candidate result to the user; Get the access permission level of the current user and dynamically adjust the relevance threshold according to the permission level. The higher the permission level, the lower the relevance threshold and the more candidate results are returned. The hierarchical linear discriminant analysis method is used to model the user's access rights and obtain the correlation threshold adjustment coefficients at different permission levels; The adjusted relevance threshold is applied to the screening process of candidate ciphertext data, and the candidate ciphertext data that does not meet the adjusted relevance threshold is filtered, and finally a fine-grained retrieval result under permission control is obtained; The confidence of the retrieval results is evaluated by the Markov Chain Monte Carlo method, and the confidence score of each retrieval result is calculated; Re-rank the search results according to the confidence score, with the results with higher confidence scores at the front and the results with lower confidence scores at the back; The re-ranked search results are returned to the user to achieve dynamic optimization of the search results based on confidence.

8. The method according to claim 1, in, The system records the user's search behavior and access pattern, and analyzes the user's behavior through a privacy-preserving data mining algorithm without obtaining the user's privacy information, and mines out potential security threats and abnormal access patterns, including: The system records the user's search behavior and access mode, and performs privacy protection processing on the user behavior data through the differential privacy algorithm to obtain the privacy-protected user behavior data; Use density-based clustering algorithm to perform cluster analysis on privacy-protected user behavior data to obtain user behavior clustering results; According to the user behavior clustering results, the association rules between user behaviors are mined through the association rule mining algorithm to determine the user behavior pattern; According to the mined user behavior association rules, anomaly detection algorithms are used to detect anomalies in user behavior patterns to determine whether there are abnormal access patterns; If an abnormal access pattern is detected, the abnormal access pattern is classified through the support vector machine algorithm to determine the potential security threat type; According to the determined security threat type, a decision tree algorithm is used to generate security threat determination rules to obtain the determination results of potential security threats.

9. The method according to claim 1, in, The method dynamically adjusts the data encryption strategy and access control strategy based on the mined security threats and abnormal patterns, restricts the authority of suspicious users or blocks access, and improves the security protection capability of the system, including: According to the discovered security threats and abnormal patterns, the dynamic encryption policy adjustment algorithm is used to dynamically adjust the data encryption policy; The algorithm identifies potential security threats and abnormal behavior patterns by analyzing historical access logs and behavior patterns, and dynamically adjusts the encryption strength and granularity of the data based on the threat level; On the basis of dynamic encryption policy adjustment, a role-based access control model is further adopted to dynamically adjust user access rights; Through continuous assessment of user behavior and roles, user access rights can be adjusted in real time to restrict suspicious users’ access to sensitive data and key functions; For suspicious users identified as high-risk, the system automatically triggers the access blocking mechanism to block access requests from suspicious users by modifying firewall rules and access control lists to prevent potential security threats. While blocking access, user behavior analysis and anomaly detection algorithms are activated, including support vector machines and isolation forest algorithms, to conduct in-depth analysis of suspicious user behaviors and identify potential threat behaviors and attack patterns. Based on the results of the anomaly detection algorithm, security policy rules are dynamically generated. By modifying the configuration of security devices, security protection policies are deployed and updated in real time to improve the overall security protection capabilities of the system. Through continuous data mining and machine learning algorithms, we continuously optimize and improve security threat identification and abnormal behavior detection models, improve the accuracy and real-time performance of the models, and enable the system to quickly respond to new security threats and attack methods; Finally, the optimized security protection strategy is applied to data encryption, access control and user authentication to form a multi-level and dynamically adaptive security protection system, comprehensively enhance the system's security protection capabilities, and effectively resist various security threats and attacks.

10. The method according to claim 1, in, The blockchain technology is used to record and verify key operations, form a tamper-proof security audit log, achieve traceability and auditability of the entire life cycle of data, and ensure the credibility and controllability of the system; the key operations include data encryption, key management, and user access, including: Using blockchain technology, the elliptic curve digital signature algorithm is used to encrypt data and generate a public-private key pair. The private key is used for signing, and the public key is used for verifying the signature. Pack the encrypted data, signature and public key information into blocks; Link blocks according to hash pointers, build a Merkle tree, calculate the hash value of each block through the SHA-256 hash algorithm, and store the hash value in the block header to form a blockchain; An authorized access control model is used to manage user access, and whether a user has the authority to access data is determined based on user attributes and access policies; Record access request information in the blockchain; The consensus mechanism of the blockchain network is realized through the Byzantine fault-tolerant algorithm. Nodes reach consensus through message transmission and voting to ensure the consistency and immutability of the blockchain. Obtain user operation requests for data, including creation, reading, updating, and deletion, package the operation request information into transactions, sign the transactions through the ECDSA algorithm, and broadcast them to the blockchain network; Nodes in the blockchain network verify and confirm transactions through the PBFT algorithm, package legal transactions into blocks, link them to the blockchain, and update the blockchain status; Merkle proof is used to verify the integrity and existence of the data. By reconstructing the Merkle tree root hash and comparing it with the Merkle root hash stored in the block header, it is determined whether the data has been tampered with. Based on the transaction information recorded in the blockchain, an audit log of the entire life cycle of data is constructed, including the creation, access, modification and deletion of data, as well as the time and user information of the operation, forming a traceable security audit log; Adopt smart contract technology to encode data access policies and audit rules into smart contracts, automatically execute access control and audit log records through smart contracts, and ensure consistent execution of policies and automation of audits; By leveraging the immutability and traceability of blockchain, audit logs are stored and verified to ensure the integrity and non-repudiation of audit logs, thus providing guarantees for the trustworthiness and controllability of the system.

Images