Private domain live broadcast data storage and visitor authentication method and system based on blockchain

Abstract

The present invention provides a method and system for private domain live data storage and visitor authentication based on blockchain, which relates to the technical field of data storage and access control, including collecting multimodal biometric data of visitors, extracting and fusion of features using a deep neural network with a spatiotemporal attention mechanism, and combining an adversarial generative network for authenticity verification, generating a dynamic identity token, and writing its hash value into the blockchain. The live data stream is semantically analyzed by an adaptive content-aware model, a two-layer access control matrix is ​​constructed according to the data sensitivity level and credibility score, and adaptive sharding and hierarchical encryption based on federated learning are performed and then stored. After the access request is verified by identity, the optimal edge node is selected according to the access rights and network performance parameters to construct a multi-path transmission, and a transmission strategy is generated based on the quality of service score and the data sensitivity level. When the quality of service is lower than the threshold, the smart contract is triggered to perform fault migration.

Description

Technical Field

[0001] The present invention relates to data storage and access control technology, and in particular to a private domain live broadcast data storage and visitor authentication method and system based on blockchain. Background Art

[0002] With the deepening of the digitalization process, private domain live broadcasting has become an important way for enterprises and individual users to interact with the audience, but in this process, the security of live broadcast data, user privacy protection and precise access control have become key issues. The identity authentication methods of existing technologies mainly rely on passwords or single biometric recognition, which are vulnerable to counterfeit attacks and difficult to meet high security requirements. At the same time, live broadcast data is mostly stored in a centralized manner, which poses the risk of single point failure and data leakage, and traditional encryption methods are also difficult to adapt to the diversity of data sensitivity. In addition, the current access control mechanism is usually relatively fixed and cannot dynamically respond to the credibility of visitors and the sensitivity level of data, resulting in a high risk of leakage of sensitive data. The transmission process of live broadcast data also lacks adaptive capabilities and cannot guarantee efficient and stable transmission effects under different network conditions.

[0003] Therefore, in order to ensure the privacy and security of live broadcast data, an innovative solution is urgently needed to achieve efficient visitor identity authentication and data encryption storage. Summary of the invention

[0004] The embodiments of the present invention provide a method and system for storing private domain live broadcast data and authenticating visitors based on blockchain, which can solve the problems in the prior art.

[0005] According to a first aspect of the embodiments of the present invention,

[0006] A method for storing private domain live broadcast data and authenticating visitors based on blockchain is provided, including:

[0007] Collect multimodal biometric data from the visitor terminal, the multimodal biometric data including dynamic lip reading features, voiceprint features and facial micro-expression features, use a deep neural network with a spatiotemporal attention mechanism to perform feature extraction and cross-modal fusion, generate a fused feature vector, input the fused feature vector into an adversarial generative network for authenticity verification, generate a credibility score, perform differential privacy processing on the fused feature vector based on the credibility score, generate a dynamic identity token containing an elliptic curve encrypted access credential, and write the hash value of the dynamic identity token into a blockchain network;

[0008] Receive a live data stream, perform semantic analysis on the live data stream using a pre-trained adaptive content-aware model, identify the data sensitivity level, build a two-layer access control matrix based on the data sensitivity level and the credibility score, and adaptively slice and hierarchically encrypt the live data stream according to the two-layer access control matrix and the network status, wherein the hierarchical encryption adopts an encryption model based on federated learning; store the encrypted data slices in a distributed storage network, and generate a smart contract containing data fingerprints;

[0009] When a data access request is received from a visitor terminal, an identity verification is performed based on a dynamic identity token. After the verification is passed, access authorization information is generated. The access rights are obtained from the double-layer access control matrix based on the access authorization information. The network performance parameters of the transmission path are obtained according to the access rights. The pre-built service quality prediction model is used for prediction. The optimal edge node combination is selected according to the prediction analysis results to construct a multi-path transmission channel. The edge node records real-time service quality data through the blockchain protocol. The service quality score of the transmission path is calculated based on the real-time service quality data. A transmission strategy is generated according to the service quality score combined with the data sensitivity level. When the service quality score is lower than a preset threshold, the fault migration instruction in the smart contract is triggered, the multi-path transmission channel is switched to a preset backup transmission channel, and the trajectory information including access verification and transmission records is generated using zero-knowledge proof, and submitted to the blockchain network for evidence storage.

[0010] In an optional embodiment,

[0011] Selecting a base point based on a preset elliptic curve equation, using the base point to generate a key containing a private key and a public key to concatenate the privacy protection feature vector with the public key, and using the private key to digitally sign the concatenation result and the current timestamp, generating a temporary access credential containing signature information includes:

[0012] Construct a finite field cryptographic system based on an elliptic curve equation, wherein the elliptic curve equation includes a finite field parameter, a curve coefficient parameter, and a base point order parameter, generate a random private key within the range defined by the base point order parameter, and use a windowed double point fast multiplication algorithm to calculate the scalar point multiplication of the random private key and the base point coordinates to obtain the elliptic curve point coordinates as the public key;

[0013] The received privacy protection feature vector is byte-normalized to obtain a feature byte sequence, the elliptic curve point coordinates of the public key are converted into a compressed public key including a vertical axis coordinate parity mark and a horizontal axis coordinate value according to the discrete logarithm problem, and the feature byte sequence, the compressed public key and the millisecond timestamp are concatenated according to a preset byte order to obtain a message to be signed;

[0014] Generate a cryptographically secure random number as a temporary private key, calculate the scalar dot product of the temporary private key and the base point coordinates to obtain temporary point coordinates, perform a modular operation on the horizontal axis component of the temporary point coordinates to obtain a first component of the signed message, calculate a hash value of the message to be signed, and perform a modular operation on the random private key and the first component at the same time, and obtain a second component of the signed message according to the hash value of the message to be signed and the modular operation result, wherein the first component and the second component constitute a digital signature;

[0015] The characteristic byte sequence, compressed public key, millisecond timestamp and digital signature are combined to generate a temporary access credential, which contains metadata information for verifying the digital signature. The validity period of the temporary access credential is controlled based on the millisecond timestamp, and the temporary access credential is used for access control in an identity authentication system.

[0016] In an optional embodiment,

[0017] Receiving a live data stream, performing semantic analysis on the live data stream using a pre-trained adaptive content-aware model, identifying a data sensitivity level, constructing a double-layer access control matrix based on the data sensitivity level and a credibility score, and adaptively slicing and layering the live data stream according to the double-layer access control matrix and a network status, including:

[0018] Input the received live data stream into a pre-trained adaptive content-aware model, wherein the adaptive content-aware model includes a spatial pyramid pooling module with adaptive receptive field and a channel recalibration module based on compression activation, and performs feature enhancement and quantization mapping on the live data stream to obtain a unified feature representation;

[0019] The unified feature representation is input into a sensitivity recognition model, the sensitivity recognition model hierarchically combines the unified feature representation through a recursive capsule network, and uses a conditional random field model to establish a temporal dependency relationship to obtain a temporal feature; an attention-guided multi-task learning framework is used to perform task decomposition and weight allocation on the temporal feature to obtain a data sensitivity level;

[0020] A two-layer access control matrix is ​​constructed according to the data sensitivity level and the pre-acquired credibility score, wherein the first layer of the two-layer access control matrix determines the basic access rights according to the data sensitivity level, and the second layer adjusts the basic access rights according to the credibility score; network status parameters are collected, the data shard size is dynamically adjusted based on the network status parameters, and the shard boundary is determined according to the two-layer access control matrix, and the live data stream is sharded to obtain data shards;

[0021] Construct a hierarchical encryption model based on federated learning, deploy multiple computing nodes in a distributed environment, and train each computing node to obtain encryption parameters based on local historical data. Add noise to the encryption parameters through the differential privacy mechanism, and use homomorphic encryption technology to aggregate parameters and update the encryption strategy corresponding to each sensitivity level.

[0022] According to the sensitivity level of the data slice, the corresponding encryption strategy is called to perform layered encryption processing to obtain encrypted data slices.

[0023] In an optional embodiment,

[0024] Construct a hierarchical encryption model based on federated learning, deploy multiple computing nodes in a distributed environment, and train each computing node to obtain encryption parameters based on local historical data. Add noise to the encryption parameters through the differential privacy mechanism, and use homomorphic encryption technology to aggregate parameters. Update the encryption strategies corresponding to each sensitivity level, including:

[0025] Construct a hierarchical encryption model based on federated learning, including an encryption function, a key generation module, an encryption module and a decryption module. The encryption function configures security parameters and random numbers according to the data sensitivity level; the key generation module generates a key pair and a key validity period; the encryption module encrypts the message in blocks based on homomorphic encryption to obtain an encrypted data block; and the decryption module decrypts the encrypted data block;

[0026] Deploy multiple computing nodes in a distributed environment for collaborative training. The number of computing nodes is dynamically adjusted according to the data scale. Each computing node trains a local model based on local historical data to obtain local encryption parameters. The central node broadcasts global parameters and training round information to each computing node. Each computing node updates the local encryption parameters based on the loss function and learning rate, and sets a parameter upload time window to upload the updated local encryption parameters to the central node.

[0027] Injecting Laplace noise into the local encryption parameter to perform differential privacy protection, where the size of the Laplace noise is determined by the data sensitivity level and the privacy budget, to obtain a noise encryption parameter;

[0028] The noise encryption parameters are aggregated using a homomorphic encryption protocol, the computing nodes encrypt the noise encryption parameters using homomorphic encryption, and the central node performs a homomorphic addition operation on the encrypted parameters and obtains an aggregated parameter through hierarchical decryption;

[0029] The global parameters are updated based on the aggregation parameters and the aggregation weights, and iterations are repeated until a preset number of convergences is met to obtain a final encryption policy set, wherein the encryption policy set includes encryption strength, key update cycle, and access control rules.

[0030] In an optional embodiment,

[0031] Obtaining access rights from the double-layer access control matrix based on the access authorization information, and obtaining network performance parameters of the transmission path according to the access rights, using a pre-built service quality prediction model to make predictions, and selecting the optimal edge node combination to construct a multi-path transmission channel according to the prediction analysis results includes:

[0032] Obtain the credibility score in the access authorization information and the sensitivity level of the target data in the data access request, input the credibility score and the sensitivity level into a pre-built adaptive threshold mapping model to obtain access trust, build a multi-dimensional attribute access policy tree based on the access trust, and extract the access permission set that satisfies the multi-dimensional attribute access policy tree from a preset two-layer access control matrix;

[0033] Determine a candidate edge node that can be used to build a transmission link based on the access permission set, collect performance parameters of the candidate edge node, the performance parameters include transmission delay value, bandwidth occupancy rate and link load value, and build a time series feature sequence of the performance parameters;

[0034] Input the time series feature sequence into a long short-term memory network to extract time dimension features, input the extracted time dimension features into a graph convolutional network to extract topology dimension features, construct a state-action value function based on the time dimension features and the topology dimension features, obtain a service quality prediction model through deep Q learning algorithm training, input the performance parameters into the service quality prediction model, and obtain the service quality prediction value of each candidate transmission path based on the policy gradient method;

[0035] Sort the candidate edge nodes in descending order according to the service quality prediction scores, select N candidate edge nodes with the highest prediction scores to form an edge node combination, distribute key shards to the edge node combination through a blockchain smart contract, and receive a decryption capability certificate returned by the edge node combination based on the key shards;

[0036] The validity of the decryption capability certificate is verified, a node connection relationship of the edge node combination is determined according to the verified decryption capability certificate, and a multi-path transmission channel is constructed based on the node connection relationship.

[0037] In an optional embodiment,

[0038] The service quality score of the transmission path is calculated based on the real-time service quality data, and a transmission strategy is generated according to the service quality score combined with the data sensitivity level. When the service quality score is lower than the preset threshold, the fault migration instruction in the smart contract is triggered, the multi-path transmission channel is switched to the preset backup transmission channel, and the track information including access verification and transmission record is generated by using zero-knowledge proof, and submitted to the blockchain network for evidence storage, including:

[0039] Acquire real-time service quality data, the real-time service quality data including end-to-end delay, packet loss rate and throughput, multiply the ratio of the end-to-end delay to a preset maximum allowable delay, the packet loss rate, and the ratio of the throughput to a preset maximum throughput by corresponding weight coefficients respectively, and sum them to obtain a service quality score of the transmission path;

[0040] Obtaining a sensitivity level coefficient of the data to be transmitted, performing weighted correction on a preset benchmark service quality threshold according to the sensitivity level coefficient to obtain a service quality threshold and a minimum service quality threshold, and calculating a resource utilization score using a pre-built transmission link resource consumption model, using the comparison result of the service quality score with the service quality threshold and the minimum service quality threshold, and the resource utilization score as input parameters to generate a transmission strategy including a path selection strategy and a resource allocation strategy;

[0041] When it is detected that the service quality score is less than the minimum service quality threshold, the transmission strategy triggers fault migration. When the transmission strategy triggers fault migration, the fault migration function in the smart contract is called, and the topological structure of the candidate transmission path is analyzed based on the graph neural network. The comprehensive evaluation value is calculated by combining the service quality score and the path overlap, and the candidate transmission path with the highest comprehensive evaluation value and the lowest path overlap is selected as the target transmission channel;

[0042] A distributed state synchronization mechanism is used to switch the multipath transmission channel to a target transmission channel, and a cache queue mechanism is used during the switching process to ensure the continuity of data transmission;

[0043] A zero-knowledge proof circuit is constructed that includes the hash value of access verification information, the signature of the transmission path node, the timestamp, and the quality of service data. A hierarchical commitment scheme is used to perform a trusted setup to generate a proof key and a verification key. Based on the proof key, the hash value of the access verification information, the signature of the transmission path node, the timestamp, and the quality of service data are used to generate a transmission trajectory proof, and the transmission trajectory proof is submitted to the blockchain network for storage.

[0044] According to a second aspect of the embodiments of the present invention,

[0045] Provided is a private domain live broadcast data storage and visitor authentication system based on blockchain, including:

[0046] The first unit is used to collect multimodal biometric data of the visitor terminal, wherein the multimodal biometric data includes dynamic lip reading features, voiceprint features and facial micro-expression features, and use a deep neural network with a spatiotemporal attention mechanism to perform feature extraction and cross-modal fusion to generate a fused feature vector, input the fused feature vector into an adversarial generative network for authenticity verification, generate a credibility score, perform differential privacy processing on the fused feature vector based on the credibility score, generate a dynamic identity token containing an elliptic curve encrypted access credential, and write the hash value of the dynamic identity token into a blockchain network;

[0047] The second unit is used to receive the live data stream, perform semantic analysis on the live data stream using a pre-trained adaptive content-aware model, identify the data sensitivity level, build a two-layer access control matrix based on the data sensitivity level and the credibility score, and adaptively slice and hierarchically encrypt the live data stream according to the two-layer access control matrix and the network status, wherein the hierarchical encryption adopts an encryption model based on federated learning; store the encrypted data slices in a distributed storage network, and generate a smart contract containing data fingerprints;

[0048] The third unit is used for performing identity verification based on the dynamic identity token when receiving a data access request sent by a visitor terminal, generating access authorization information after the verification is passed, obtaining access rights from the double-layer access control matrix based on the access authorization information, and obtaining network performance parameters of the transmission path according to the access rights, using a pre-built service quality prediction model to perform predictions, and selecting the optimal edge node combination according to the prediction analysis results to construct a multi-path transmission channel. The edge node records real-time service quality data through a blockchain protocol, calculates a service quality score for the transmission path based on the real-time service quality data, and generates a transmission strategy based on the service quality score combined with the data sensitivity level. When the service quality score is lower than a preset threshold, the fault migration instruction in the smart contract is triggered, the multi-path transmission channel is switched to a preset backup transmission channel, and trajectory information including access verification and transmission records is generated using zero-knowledge proof, and submitted to the blockchain network for evidence storage.

[0049] According to a third aspect of the embodiments of the present invention,

[0050] An electronic device is provided, comprising:

[0051] processor;

[0052] a memory for storing processor-executable instructions;

[0053] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0054] A fourth aspect of the embodiments of the present invention is:

[0055] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0056] In this embodiment, through multimodal biometric recognition, adversarial generative network verification, differential privacy processing, and elliptic curve encryption, the authenticity and security of visitor identity are effectively guaranteed to prevent unauthorized access and data leakage. Data sensitivity level identification and hierarchical encryption technology based on federated learning further enhance the security of live data storage and effectively protect sensitive information. Through adaptive sharding and a two-layer access control matrix, refined access control is achieved in combination with network status, which improves the efficiency of data access. The construction of a service quality prediction model and a multi-path transmission channel ensures the stability and smoothness of live data transmission. Edge node service quality monitoring and smart contract fault migration mechanism further enhance the fault tolerance and reliability of the system. Based on blockchain-based dynamic identity token management, data fingerprint storage, and zero-knowledge proof trajectory information recording, full tracking and auditing of live data access behavior are achieved, which enhances the transparency and credibility of the system, effectively deters malicious behavior, and ensures data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 This is a flowchart of a method for storing private domain live broadcast data and authenticating visitors based on blockchain according to an embodiment of the present invention;

[0058] Figure 2 This is a structural diagram of a private domain live broadcast data storage and visitor authentication system based on blockchain in an embodiment of the present invention. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0060] The technical solution of the present invention is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0061] Figure 1 The flowchart of the private domain live broadcast data storage and visitor authentication method based on blockchain in an embodiment of the present invention is as follows: Figure 1 As shown, the method includes:

[0062] S101. Collect multimodal biometric data of the visitor terminal, the multimodal biometric data including dynamic lip reading features, voiceprint features and facial micro-expression features, use a deep neural network with a spatiotemporal attention mechanism to perform feature extraction and cross-modal fusion, generate a fused feature vector, input the fused feature vector into an adversarial generative network for authenticity verification, generate a credibility score, perform differential privacy processing on the fused feature vector based on the credibility score, generate a dynamic identity token containing an elliptic curve encrypted access credential, and write the hash value of the dynamic identity token into the blockchain network;

[0063] S102. Receive a live data stream, perform semantic analysis on the live data stream using a pre-trained adaptive content-aware model, identify data sensitivity levels, build a two-layer access control matrix based on the data sensitivity levels and credibility scores, perform adaptive sharding and hierarchical encryption on the live data stream according to the two-layer access control matrix and network status, and the hierarchical encryption adopts an encryption model based on federated learning; store the encrypted data shards in a distributed storage network, and generate a smart contract containing data fingerprints;

[0064] S103. When a data access request is received from a visitor terminal, an identity verification is performed based on a dynamic identity token. After the verification is passed, access authorization information is generated. Access rights are obtained from a two-layer access control matrix based on the access authorization information. Network performance parameters of the transmission path are obtained based on the access rights. A pre-built service quality prediction model is used for prediction. The optimal edge node combination is selected according to the prediction analysis results to construct a multi-path transmission channel. The edge node records real-time service quality data through a blockchain protocol. A service quality score of the transmission path is calculated based on the real-time service quality data. A transmission strategy is generated based on the service quality score combined with the data sensitivity level. When the service quality score is lower than a preset threshold, a fault migration instruction in the smart contract is triggered to switch the multi-path transmission channel to a preset backup transmission channel. Track information including access verification and transmission records is generated using zero-knowledge proof and submitted to the blockchain network for evidence storage.

[0065] Among them, multimodal biometric data includes dynamic lip reading features, voiceprint features, and facial micro-expression features. Dynamic lip reading features refer to the changes in the visitor's lip movements within a specific period of time, voiceprint features are used to identify the visitor's voice characteristics, and facial micro-expression features record the subtle changes in the visitor's facial expressions during the interaction process. The deep neural network with spatiotemporal attention mechanism is used to extract features and cross-modally fuse the above multimodal feature data to generate a fused feature vector to integrate the visitor's multi-dimensional biometric information.

[0066] The adaptive content-aware model is a trained model that can adaptively perceive the semantics of live content and automatically identify and assign sensitivity levels to the content. This model enables the system to automatically identify sensitive information in live data streams and take corresponding encryption measures.

[0067] The data fingerprint is a unique identifier for the encrypted data shard, which is unique and cannot be tampered with. The generated data fingerprint is used to mark the encrypted data shard and is used in smart contracts to verify the integrity of the data.

[0068] The service quality prediction model is a model used to predict the performance of a data transmission path. Based on network performance parameters, it can predict the service quality score of the transmission path to ensure the efficiency and stability of the transmission process.

[0069] Edge node: A node in the network close to the user end, used to accelerate data transmission. The service quality prediction model selects the optimal edge node combination and builds a multi-path transmission channel to ensure the efficiency of data transmission.

[0070] Real-time service quality data: The performance data of the current transmission channel recorded by the edge node through the blockchain protocol is used to dynamically adjust the transmission strategy to ensure that the service quality of the transmission process meets the requirements.

[0071] In an optional implementation, inputting the fused feature vector into an adversarial generative network for authenticity verification, generating a credibility score, performing differential privacy processing on the fused feature vector based on the credibility score, generating a dynamic identity token including an elliptic curve encrypted access credential, and writing a hash value of the dynamic identity token into a blockchain network includes:

[0072] Constructing an adversarial generative network, which includes a discriminator and a generator, wherein the discriminator includes a multi-layer fully connected network structure with an activation function and receives a pseudo feature vector generated by the generator based on random noise; the generator adopts a symmetric encoder-decoder structure, wherein the encoder maps the fused feature vector to a latent space learning feature distribution, and the decoder restores the feature vector based on the feature distribution; the fused feature vector is input into the discriminator of the adversarial generative network, and the discriminator generates a credibility score by maximizing the discrimination loss between real features and pseudo features;

[0073] constructing an adaptive differential privacy budget function according to the credibility score, wherein the differential privacy budget function monotonically increases with the credibility score, calculating a sensitivity function value of an adjacent data set based on the differential privacy budget function, taking a ratio of the sensitivity function value to the differential privacy budget function as a scale parameter of Laplace noise, and using the scale parameter to add Laplace noise to a fused feature vector to generate a privacy-preserving feature vector;

[0074] Select a base point based on a preset elliptic curve equation, use the base point to generate a key containing a private key and a public key to concatenate the privacy-preserving feature vector with the public key, and use the private key to digitally sign the concatenation result and the current timestamp to generate a temporary access credential containing signature information;

[0075] The temporary access credential, the public key and the current timestamp are combined in a preset format to generate a dynamic identity token, a cryptographic hash operation is performed on the dynamic identity token to obtain a token hash value, and the token hash value is submitted to the blockchain network for evidence storage.

[0076] Exemplarily, first, an adversarial generative network is constructed for feature vector credibility assessment. The network includes a discriminator and a generator. The discriminator is a multi-layer fully connected network, and each layer uses an activation function (such as ReLU, sigmoid, etc.) to introduce nonlinearity. The role of the discriminator is to distinguish between real feature vectors and pseudo feature vectors generated by the generator. The generator adopts a symmetric encoder-decoder structure. The encoder maps the input fused feature vector to a low-dimensional latent space to learn the distribution of features. The decoder restores the vector in the latent space to a feature vector. During the training process, the generator tries to generate pseudo feature vectors that are sufficient to deceive the discriminator, while the discriminator strives to improve its own discriminative ability. Through this adversarial training, the discriminator can learn the distribution of real features and give a credibility score to the input fused feature vector. For example, 1000 real feature vectors and 1000 pseudo feature vectors generated by the generator are input into the discriminator for training, and finally the discriminator outputs a credibility score of 0.8 for a new fused feature vector.

[0077] Next, differential privacy processing is performed based on the credibility score. An adaptive differential privacy budget function is designed, whose value increases monotonically with the credibility score. The higher the credibility score, the more credible the feature vector is, and the larger the privacy budget allowed is. The sensitivity function value of the adjacent data set is calculated according to the differential privacy budget function, for example, using global sensitivity or local sensitivity. The ratio of the sensitivity function value to the differential privacy budget function is used as the scale parameter of the Laplace noise. Then, the scale parameter is used to sample noise from the Laplace distribution and add it to the fused feature vector to generate a privacy-preserving feature vector. For example, assuming that the credibility score is 0.8, the corresponding differential privacy budget is 0.5, and the sensitivity is 1, then the scale parameter of the Laplace noise is 2. Sample a noise value, such as 0.5, from the Laplace distribution (mean 0, scale parameter 2) and add it to the fused feature vector.

[0078] Then, a dynamic identity token containing an elliptic curve encrypted access credential is generated. A preset elliptic curve equation and a base point are selected, and a key pair including a private key and a public key is generated using the base point. The privacy-preserving feature vector is concatenated with the public key. The concatenated result and the current timestamp are digitally signed using the private key to generate a temporary access credential containing the signature information. For example, the secp256k1 elliptic curve and the corresponding base point are selected to generate a private key and a public key. The "secp" in its name stands for Secure Elliptic Curve Parameters, "256" indicates that the order of the curve is 256 bits, and "k1" indicates that the characteristic of the curve is that the Koblitz elliptic curve type is used. The privacy-preserving feature vector [0.1, 0.2, 0.3] is concatenated with the public key, and assuming that the current timestamp is 1678886400, the concatenated result and the timestamp are signed to obtain a temporary access credential.

[0079] Finally, the temporary access credentials, public key and current timestamp are combined in a preset format to generate a dynamic identity token. A cryptographic hash operation is performed on the dynamic identity token, such as SHA256SecureHashAlgorithm256-bit), to obtain the token hash value. The token hash value is submitted to the blockchain network for evidence storage, such as writing it to the blockchain in the form of a transaction. For example, the temporary access credentials, public key and timestamp 1678886400 are combined into a dynamic identity token, its SHA256 hash value is calculated, and the hash value is written to the blockchain.

[0080] In this embodiment, elliptic curve encryption and digital signature technology are used to ensure the anti-counterfeiting and non-tampering of the identity token, effectively preventing identity theft and fraud. The fused feature vector is processed by differential privacy technology to effectively prevent the leakage of user sensitive information and protect user privacy while ensuring data availability. The fused feature vector is evaluated for credibility using an adversarial generative network, and the differential privacy budget is dynamically adjusted according to the credibility to improve the reliability and accuracy of identity authentication.

[0081] In an optional implementation, a base point is selected based on a preset elliptic curve equation, a key including a private key and a public key is generated using the base point to concatenate the privacy protection feature vector with the public key, and the concatenation result and the current timestamp are digitally signed using the private key, and generating a temporary access credential including signature information includes:

[0082] Construct a finite field cryptographic system based on an elliptic curve equation, wherein the elliptic curve equation includes a finite field parameter, a curve coefficient parameter, and a base point order parameter, generate a random private key within the range defined by the base point order parameter, and use a windowed double point fast multiplication algorithm to calculate the scalar point multiplication of the random private key and the base point coordinates to obtain the elliptic curve point coordinates as the public key;

[0083] The received privacy protection feature vector is byte-normalized to obtain a feature byte sequence, the elliptic curve point coordinates of the public key are converted into a compressed public key including a vertical axis coordinate parity mark and a horizontal axis coordinate value according to the discrete logarithm problem, and the feature byte sequence, the compressed public key and the millisecond timestamp are concatenated according to a preset byte order to obtain a message to be signed;

[0084] Generate a cryptographically secure random number as a temporary private key, calculate the scalar dot product of the temporary private key and the base point coordinates to obtain temporary point coordinates, perform a modular operation on the horizontal axis component of the temporary point coordinates to obtain a first component of the signed message, calculate a hash value of the message to be signed, and perform a modular operation on the random private key and the first component at the same time, and obtain a second component of the signed message according to the hash value of the message to be signed and the modular operation result, wherein the first component and the second component constitute a digital signature;

[0085] The characteristic byte sequence, compressed public key, millisecond timestamp and digital signature are combined to generate a temporary access credential, which contains metadata information for verifying the digital signature. The validity period of the temporary access credential is controlled based on the millisecond timestamp, and the temporary access credential is used for access control in an identity authentication system.

[0086] Choose a suitable elliptic curve equation as the basis for the cryptosystem. For example, you can choose the secp256k1 curve, which is defined by specific finite field parameters, curve coefficients, and base point order parameters. These parameters determine the size of the finite field, the shape of the elliptic curve, and the order of the base points.

[0087] Generate a random number as the private key within the range specified by the base order parameter. For example, if the base order is n, the private key is a random integer between 1 and n-1. Suppose the generated private key is 23.

[0088] Use the windowed double point fast multiplication algorithm to perform scalar multiplication of the private key and the base point coordinates. This algorithm can efficiently calculate the multiples of the private key and the base point to obtain a new elliptic curve point coordinate as the public key. Assuming the base point coordinates are (Gx, Gy), the public key is 23*(Gx, Gy)=(Px, Py). Assume that the calculation result is Px=115, Py=78.

[0089] The received privacy-preserving feature vector is byte-normalized. For example, the feature vector can be converted into a byte sequence using UTF-8 encoding. Assuming that the feature vector is "user123", the corresponding UTF-8 encoded byte sequence is [117, 115, 101, 114, 49, 50, 51].

[0090] According to the characteristics of the discrete logarithm problem, the elliptic curve point coordinates of the public key can be converted into a compressed form. The compressed public key contains the parity flag of the vertical axis coordinate and the horizontal axis coordinate value. For example, if Py is an even number, the parity flag is 0; if Py is an odd number, the parity flag is 1. In this example, Py=78 is an even number, so the parity flag is 0. The compressed public key is [0, 115].

[0091] The characteristic byte sequence, compressed public key and millisecond timestamp are concatenated according to the preset byte order to obtain the message to be signed. For example, assuming the current timestamp is 1678886400000, the message to be signed is [117, 115, 101, 114, 49, 50, 51, 0, 115, 1678886400000].

[0092] Generate a cryptographically secure random number as a temporary private key. Calculate the scalar multiplication of the temporary private key and the base point coordinates to obtain a temporary public key. Assuming the temporary private key is 17 and the base point coordinates are (Gx, Gy), the temporary public key is 17*(Gx, Gy)=(Rx, Ry). Assume that the calculation result is Rx=42, Ry=95.

[0093] Perform a modular operation on the horizontal axis component Rx of the temporary public key to obtain the first component of the signed message. Assuming the base point order is n, the first component is 42modn. Assume that the calculation result is 42. Calculate the hash value of the message to be signed. Use a cryptographic hash function (such as SHA-256) to calculate the hash value of the message to be signed. Assume that the calculation result is h. Perform a modular operation on the temporary private key and the first component, and calculate the second component of the signed message based on the hash value of the message to be signed and the result of the modular operation. The calculation method of the second component depends on the specific signature algorithm, such as ECDSA. Assume that the calculation result is s. Then the digital signature is (42, s).

[0094] The characteristic byte sequence, compressed public key, millisecond timestamp and digital signature are combined to generate a temporary access credential. The temporary access credential contains metadata information for verifying the digital signature, such as the elliptic curve parameters and hash algorithm used. The validity period of the temporary access credential is controlled by the millisecond timestamp.

[0095] In this embodiment, elliptic curve cryptography and digital signature technology are used to effectively prevent data tampering and forgery, and ensure the security of identity authentication. The privacy protection feature vector is byte-normalized, and a compressed public key is used to reduce the risk of privacy information leakage. A windowed double-point fast multiplication algorithm is used to improve the efficiency of public key calculation and shorten the identity authentication time.

[0096] In an optional implementation, receiving a live data stream, performing semantic analysis on the live data stream using a pre-trained adaptive content-aware model, identifying a data sensitivity level, constructing a two-layer access control matrix based on the data sensitivity level and a credibility score, and adaptively slicing and hierarchically encrypting the live data stream according to the two-layer access control matrix and a network status includes:

[0097] Input the received live data stream into a pre-trained adaptive content-aware model, wherein the adaptive content-aware model includes a spatial pyramid pooling module with adaptive receptive field and a channel recalibration module based on compression activation, and performs feature enhancement and quantization mapping on the live data stream to obtain a unified feature representation;

[0098] The unified feature representation is input into a sensitivity recognition model, the sensitivity recognition model hierarchically combines the unified feature representation through a recursive capsule network, and uses a conditional random field model to establish a temporal dependency relationship to obtain a temporal feature; an attention-guided multi-task learning framework is used to perform task decomposition and weight allocation on the temporal feature to obtain a data sensitivity level;

[0099] A two-layer access control matrix is ​​constructed according to the data sensitivity level and the pre-acquired credibility score, wherein the first layer of the two-layer access control matrix determines the basic access rights according to the data sensitivity level, and the second layer adjusts the basic access rights according to the credibility score; network status parameters are collected, the data shard size is dynamically adjusted based on the network status parameters, and the shard boundary is determined according to the two-layer access control matrix, and the live data stream is sharded to obtain data shards;

[0100] Construct a hierarchical encryption model based on federated learning, deploy multiple computing nodes in a distributed environment, and train each computing node to obtain encryption parameters based on local historical data. Add noise to the encryption parameters through the differential privacy mechanism, and use homomorphic encryption technology to aggregate parameters and update the encryption strategy corresponding to each sensitivity level.

[0101] According to the sensitivity level of the data slice, the corresponding encryption strategy is called to perform layered encryption processing to obtain encrypted data slices.

[0102] Exemplarily, first, a live data stream is received, which may be a real-time data stream from a camera, a sensor or other data source, for example, a live stream containing video and audio information, whose data format is H.264 video encoding and AAC audio encoding.

[0103] Then, semantic analysis and sensitivity recognition are performed on the live data stream. The received live data stream is input into the pre-trained adaptive content-aware model. The model contains a spatial pyramid pooling module that can adaptively adjust the perception range according to the content, and a channel recalibration module based on compression activation that can enhance the feature expression capability. The model performs feature enhancement and quantization mapping on the live data stream to obtain a unified feature representation. For example, video frames are converted into feature vectors, and audio clips are converted into feature vectors. These feature vectors constitute a unified feature representation.

[0104] The unified feature representation is input into the sensitivity recognition model. The model uses a recursive capsule network to hierarchically combine the unified feature representation to capture semantic information of different granularities, and uses a conditional random field model to establish temporal dependencies to obtain temporal features containing temporal information. For example, through a recursive capsule network, the feature vectors of video frames and audio clips are combined into a higher-level feature representation, and the conditional random field model is used to learn the temporal dependencies between video frames and audio clips, such as the correspondence between the actions of the characters in the video and the speech in the audio.

[0105] The attention-guided multi-task learning framework is used to decompose the time series features and assign weights to obtain the data sensitivity level. For example, the sensitivity recognition task is decomposed into subtasks such as identifying people, objects, and scenes, and weights are dynamically assigned according to the importance of each subtask, and finally the data sensitivity level is obtained, such as "public", "internal", "confidential", etc. Assuming that a live data stream contains facial information of a person, the sensitivity level of this part of the data is "internal".

[0106] Next, a two-layer access control matrix is ​​constructed. A two-layer access control matrix is ​​constructed based on the data sensitivity level and the pre-acquired credibility score. The first layer determines the basic access rights based on the data sensitivity level. For example, data at the "public" level can be accessed by all users, data at the "internal" level can be accessed by internal network users, and data at the "confidential" level can only be accessed by specific authorized users. The second layer adjusts the basic access rights based on the credibility score. For example, even if a user has the permission to access "internal" data, if his credibility score is low, the access rights will be reduced, for example, only some "internal" data can be accessed or only in read-only mode. Assuming that a user's credibility score is 0.8, he can access "internal" data but not "confidential" data.

[0107] Then, the live data stream is adaptively segmented and hierarchically encrypted. Collect network status parameters, such as bandwidth, latency, etc. Dynamically adjust the data segment size based on the network status parameters, and determine the segment boundaries according to the double-layer access control matrix to segment the live data stream to obtain data segments. For example, when the network bandwidth is low, adjust the data segment to a smaller size to ensure transmission efficiency. Assume that the live data stream is divided into multiple data segments, each of which contains 1 second of video and audio data.

[0108] Build a hierarchical encryption model based on federated learning. Deploy multiple computing nodes in a distributed environment, and each computing node obtains encryption parameters based on local historical data training. Add noise to encryption parameters through differential privacy mechanism to protect data privacy, and use homomorphic encryption technology to aggregate parameters and update encryption strategies corresponding to each sensitivity level. For example, for "confidential" level data, use a stronger encryption algorithm, such as AES-256 encryption algorithm.

[0109] Finally, the corresponding encryption strategy is called according to the sensitivity level of the data slice to perform hierarchical encryption processing to obtain encrypted data slices. For example, the data slice marked as "internal" is encrypted using the AES-128 encryption algorithm, and the data slice marked as "confidential" is encrypted using the AES-256 encryption algorithm.

[0110] In this embodiment, through adaptive content perception, multi-level encryption and access control, refined security management of live data streams is achieved, effectively preventing data leakage and unauthorized access. The two-layer access control matrix combined with the credibility score realizes a more flexible access control strategy, which can dynamically adjust access rights according to user identity and credibility. The adaptive sharding and layered encryption mechanism can dynamically adjust the data processing strategy according to the network status, ensuring the smooth transmission and efficient encryption of live data streams.

[0111] In an optional implementation, a hierarchical encryption model based on federated learning is constructed, multiple computing nodes are deployed in a distributed environment, each computing node obtains encryption parameters based on local historical data training, noise is added to the encryption parameters through a differential privacy mechanism, and homomorphic encryption technology is used to aggregate parameters. The encryption strategy corresponding to each sensitivity level is updated, including:

[0112] Construct a hierarchical encryption model based on federated learning, including an encryption function, a key generation module, an encryption module and a decryption module. The encryption function configures security parameters and random numbers according to the data sensitivity level; the key generation module generates a key pair and a key validity period; the encryption module encrypts the message in blocks based on homomorphic encryption to obtain an encrypted data block; and the decryption module decrypts the encrypted data block;

[0113] Deploy multiple computing nodes in a distributed environment for collaborative training. The number of computing nodes is dynamically adjusted according to the data scale. Each computing node trains a local model based on local historical data to obtain local encryption parameters. The central node broadcasts global parameters and training round information to each computing node. Each computing node updates the local encryption parameters based on the loss function and learning rate, and sets a parameter upload time window to upload the updated local encryption parameters to the central node.

[0114] Injecting Laplace noise into the local encryption parameter to perform differential privacy protection, where the size of the Laplace noise is determined by the data sensitivity level and the privacy budget, to obtain a noise encryption parameter;

[0115] The noise encryption parameters are aggregated using a homomorphic encryption protocol, the computing nodes encrypt the noise encryption parameters using homomorphic encryption, and the central node performs a homomorphic addition operation on the encrypted parameters and obtains an aggregated parameter through hierarchical decryption;

[0116] The global parameters are updated based on the aggregation parameters and the aggregation weights, and iterations are repeated until a preset number of convergences is met to obtain a final encryption policy set, wherein the encryption policy set includes encryption strength, key update cycle, and access control rules.

[0117] Exemplarily, first, an encryption function is defined. The input of the encryption function includes the data to be encrypted and the security parameters and random numbers preset according to the sensitivity level of the data. The value range of the security parameter is, for example, 128 bits to 256 bits, and the length of the random number is the same as the length of the security parameter. The higher the sensitivity level, the larger the number of bits of the security parameter. For example, for public data, the security parameter can be set to 128 bits; for confidential data, the security parameter can be set to 256 bits.

[0118] Next, build the key generation module. This module is responsible for generating the public and private key pairs of the asymmetric encryption algorithm and setting the validity period of the key. For example, the key validity period can be set to one year. After the key is generated, the public key is distributed to each computing node, and the private key is securely stored by the central node.

[0119] Then, an encryption module is constructed. This module uses homomorphic encryption technology to encrypt messages. First, the message is divided into blocks according to the preset block size, for example, each data block size is 1KB. Then, each data block is homomorphically encrypted using the public key generated previously to obtain an encrypted data block.

[0120] At the same time, a decryption module is constructed. This module uses the private key to decrypt the encrypted data block and restore the original message. The decryption process is the opposite of the encryption process. First, each encrypted data block is decrypted using the private key, and then the decrypted data blocks are spliced ​​together to restore the original message.

[0121] The steps for computing node deployment and training in a distributed environment are as follows: multiple computing nodes are deployed in a distributed environment, and the number of computing nodes is dynamically adjusted according to the data scale. Assuming that the initial data scale is 1TB, 10 computing nodes are deployed. If the data scale increases to 2TB, the number of computing nodes is dynamically increased to 20.

[0122] Each computing node trains a local model based on local historical data to obtain local encryption parameters. For example, local historical data can be user behavior logs. The training process can use machine learning algorithms such as logistic regression.

[0123] The central node regularly broadcasts global parameters and training round information to each computing node. For example, after each round of training, the central node broadcasts the updated global parameters.

[0124] Each computing node updates the local encryption parameters according to the global parameters broadcast by the central node, the local loss function and the learning rate. The learning rate can be set to 0.01.

[0125] Each computing node sets a parameter upload time window, for example, once every hour. Within the time window, the updated local encryption parameters are uploaded to the central node.

[0126] Before uploading local encrypted parameters, the computing node first injects Laplace noise into the parameters for differential privacy protection. The noise level is determined by the data sensitivity level and the privacy budget. For example, for data with high sensitivity level, the privacy budget is set to 0.1, then the noise amplitude is large; for data with low sensitivity level, the privacy budget is set to 1, then the noise amplitude is small. Assuming that a local parameter value is 10 and the added noise value is 2, the noise encryption parameter is 12.

[0127] The central node uses the homomorphic encryption protocol to perform privacy aggregation on the noise encryption parameters uploaded by each computing node. The computing node encrypts the noise encryption parameters using homomorphic encryption and then uploads them. The central node performs homomorphic addition operations on the encrypted parameters, for example, performing homomorphic addition operations on three encryption parameters. Then, the private key is used for hierarchical decryption to obtain the aggregated parameters.

[0128] The central node updates the global parameters based on the aggregation parameters and aggregation weights. The aggregation weights can be set based on the amount of data for each computing node. For example, computing nodes with large amounts of data are assigned larger weights.

[0129] Repeat the above steps until the preset convergence number is met, for example, 100 iterations. Finally, an encryption policy set is obtained, including encryption strength, key update cycle, and access control rules. For example, for sensitive data, the encryption strength is set to 256 bits, the key update cycle is set to one month, and the access control rule is set to only authorized users can access.

[0130] In this embodiment, the layered encryption model and homomorphic encryption technology are used to achieve data security protection during transmission and processing, effectively preventing data leakage and tampering. The differential privacy mechanism is used to add noise to local parameters to effectively protect user privacy and prevent sensitive information from being inferred. Based on the federated learning framework, multiple computing nodes are allowed to perform collaborative training without sharing data, which improves the efficiency of model training and avoids the problem of data islands.

[0131] In an optional implementation, obtaining access rights from a double-layer access control matrix based on the access authorization information, obtaining network performance parameters of a transmission path according to the access rights, using a pre-built service quality prediction model for prediction, and selecting an optimal edge node combination to construct a multi-path transmission channel according to the prediction analysis results includes:

[0132] Obtain the credibility score in the access authorization information and the sensitivity level of the target data in the data access request, input the credibility score and the sensitivity level into a pre-built adaptive threshold mapping model to obtain access trust, build a multi-dimensional attribute access policy tree based on the access trust, and extract the access permission set that satisfies the multi-dimensional attribute access policy tree from a preset two-layer access control matrix;

[0133] Determine a candidate edge node that can be used to build a transmission link based on the access permission set, collect performance parameters of the candidate edge node, the performance parameters include transmission delay value, bandwidth occupancy rate and link load value, and build a time series feature sequence of the performance parameters;

[0134] Input the time series feature sequence into a long short-term memory network to extract time dimension features, input the extracted time dimension features into a graph convolutional network to extract topology dimension features, construct a state-action value function based on the time dimension features and the topology dimension features, obtain a service quality prediction model through deep Q learning algorithm training, input the performance parameters into the service quality prediction model, and obtain the service quality prediction value of each candidate transmission path based on the policy gradient method;

[0135] Sort the candidate edge nodes in descending order according to the service quality prediction scores, select N candidate edge nodes with the highest prediction scores to form an edge node combination, distribute key shards to the edge node combination through a blockchain smart contract, and receive a decryption capability certificate returned by the edge node combination based on the key shards;

[0136] The validity of the decryption capability certificate is verified, a node connection relationship of the edge node combination is determined according to the verified decryption capability certificate, and a multi-path transmission channel is constructed based on the node connection relationship.

[0137] Access authorization information acquisition and access trust evaluation. First, the system obtains the user's access authorization information, which includes a trust score. For example, the user's trust score can be calculated based on factors such as its historical access behavior and identity authentication level. Assume that the user's trust score is 0.8. At the same time, the system obtains the sensitivity level of the target data in the user's data access request. For example, the target data may be marked as "public", "internal", "confidential" and other different levels. Assume that the sensitivity level of the target data in this request is "internal". The system inputs the user's trust score and the sensitivity level of the target data into a pre-built adaptive threshold mapping model. The model can be a machine learning-based model, such as a decision tree or a support vector machine, which is used to dynamically adjust the trust threshold according to different sensitivity levels. Assume that the model maps a trust score of 0.8 to an access trust of 0.9 based on the "internal" level data. Based on the access trust, the system constructs a multi-dimensional attribute access policy tree. For example, if the access trust is greater than or equal to 0.9, access to the data is allowed; if the access trust is less than 0.9, access is denied. Finally, the system extracts the access rights set that satisfies the multidimensional attribute access policy tree from the preset two-layer access control matrix. Assuming that the first layer of the two-layer access control matrix defines the access rights of user roles and the second layer defines the access rights of data objects, the system will extract the access rights that match both the user roles and the target data.

[0138] Determination of candidate edge nodes and collection of performance parameters. Based on the access permission set, the system determines the candidate edge nodes that can be used to build the transmission link. For example, if the access permission allows the user to access the data located at edge nodes A, B, and C, then these three nodes will be determined as candidate edge nodes. The system collects the performance parameters of the candidate edge nodes, including transmission delay value, bandwidth occupancy rate, and link load value. Assume that the transmission delay of node A is 10ms, the bandwidth occupancy rate is 50%, and the link load value is 0.6; the transmission delay of node B is 15ms, the bandwidth occupancy rate is 60%, and the link load value is 0.7; the transmission delay of node C is 20ms, the bandwidth occupancy rate is 70%, and the link load value is 0.8. The system constructs these performance parameters into a time series feature sequence. For example, the performance parameters of each node in the past hour can be arranged in chronological order.

[0139] Construction and prediction of service quality prediction model. The system inputs the time series feature sequence of the performance parameters of the candidate edge nodes into the long short-term memory network (LSTM) to extract the time dimension features. The LSTM network can capture the trend and pattern of performance parameters changing over time. Then, the time dimension features extracted by the LSTM network are input into the graph convolutional network (GCN) to extract the topological dimension features. The GCN network can capture the impact of the topological relationship between edge nodes on performance. Based on the time dimension features and topological dimension features, the system constructs a state-action value function. The state represents the current network state, the action represents the selection of different edge node combinations, and the value function represents the expected service quality after selecting the action. The service quality prediction model is obtained by training the deep Q learning algorithm. During the training process, the system continuously adjusts the model parameters so that it can accurately predict the service quality of different edge node combinations. The performance parameters of the candidate edge nodes are input into the trained service quality prediction model, and the service quality prediction value of each candidate transmission path is obtained based on the policy gradient method. For example, suppose the service quality score of the combination of nodes A and B is predicted to be 0.9, the service quality score of the combination of nodes B and C is 0.8, and the service quality score of the combination of nodes A and C is 0.7.

[0140] Optimal edge node combination selection and multi-path transmission channel construction. The system sorts the candidate edge nodes in descending order according to the service quality prediction score. For example, according to the previous prediction results, the sorting results are A and B combination, B and C combination, and A and C combination. Select the N candidate edge nodes with the highest prediction scores to form an edge node combination. Assuming N=2, select two nodes A and B. The system distributes key shards to the selected edge node combination through blockchain smart contracts. For example, divide the key into two parts and distribute them to nodes A and B respectively. Nodes A and B return a decryption capability certificate based on the received key shards. The system verifies the validity of the decryption capability certificate. If the certificate is valid, the connection relationship between nodes A and B is determined, for example, it is determined that a direct connection is established between A and B. Based on the determined node connection relationship, the system constructs a multi-path transmission channel to achieve parallel transmission of data between nodes A and B.

[0141] In this embodiment, through access trust evaluation and a two-layer access control matrix, the access rights of data can be effectively controlled to prevent unauthorized access. At the same time, by using blockchain smart contracts and key sharding technology, the security of key distribution and the identity authentication of edge nodes can be guaranteed, further enhancing the security of data transmission. Through the quality of service prediction model and deep reinforcement learning algorithm, the optimal edge node combination can be intelligently selected to build a multi-path transmission channel, thereby reducing transmission delay, improving bandwidth utilization, and improving the overall efficiency of data transmission. The design of the multi-path transmission channel can effectively avoid the impact of single point failures on data transmission. Even if an edge node fails, data can still be transmitted through other paths, thereby improving the fault tolerance and reliability of the network.

[0142] In an optional implementation, a service quality score of a transmission path is calculated based on the real-time service quality data, and a transmission strategy is generated according to the service quality score combined with the data sensitivity level. When the service quality score is lower than a preset threshold, a fault migration instruction in a smart contract is triggered, and the multi-path transmission channel is switched to a preset backup transmission channel. Track information including access verification and transmission records is generated using zero-knowledge proof, and submitted to the blockchain network for evidence storage, including:

[0143] Acquire real-time service quality data, the real-time service quality data including end-to-end delay, packet loss rate and throughput, multiply the ratio of the end-to-end delay to a preset maximum allowable delay, the packet loss rate, and the ratio of the throughput to a preset maximum throughput by corresponding weight coefficients respectively, and sum them to obtain a service quality score of the transmission path;

[0144] Obtaining a sensitivity level coefficient of the data to be transmitted, performing weighted correction on a preset benchmark service quality threshold according to the sensitivity level coefficient to obtain a service quality threshold and a minimum service quality threshold, and calculating a resource utilization score using a pre-built transmission link resource consumption model, using the comparison result of the service quality score with the service quality threshold and the minimum service quality threshold, and the resource utilization score as input parameters to generate a transmission strategy including a path selection strategy and a resource allocation strategy;

[0145] When it is detected that the service quality score is less than the minimum service quality threshold, the transmission strategy triggers fault migration. When the transmission strategy triggers fault migration, the fault migration function in the smart contract is called, and the topological structure of the candidate transmission path is analyzed based on the graph neural network. The comprehensive evaluation value is calculated by combining the service quality score and the path overlap, and the candidate transmission path with the highest comprehensive evaluation value and the lowest path overlap is selected as the target transmission channel;

[0146] A distributed state synchronization mechanism is used to switch the multipath transmission channel to a target transmission channel, and a cache queue mechanism is used during the switching process to ensure the continuity of data transmission;

[0147] A zero-knowledge proof circuit is constructed that includes the hash value of access verification information, the signature of the transmission path node, the timestamp, and the quality of service data. A hierarchical commitment scheme is used to perform a trusted setup to generate a proof key and a verification key. Based on the proof key, the hash value of the access verification information, the signature of the transmission path node, the timestamp, and the quality of service data are used to generate a transmission trajectory proof, and the transmission trajectory proof is submitted to the blockchain network for storage.

[0148] Exemplarily, first, obtain real-time service quality data of the transmission path. These data include end-to-end delay, packet loss rate and throughput. For example, through the network detection tool, collect real-time service quality data of path A every 1 second, and obtain end-to-end delay of 20 milliseconds, packet loss rate of 0.1%, and throughput of 100Mbps.

[0149] Then, the service quality score of the transmission path is calculated. The ratio of the obtained end-to-end delay to the preset maximum allowable delay (for example, 50 milliseconds), the packet loss rate, and the ratio of the throughput to the preset maximum throughput (for example, 200 Mbps) are multiplied by the corresponding weight coefficients (for example, 0.5, 0.3, and 0.2, respectively), and the sum is obtained to obtain the service quality score of path A, which is 0.4+0.003+0.1=0.503.

[0150] Next, obtain the sensitivity level coefficient of the data to be transmitted. Assume that the data to be transmitted is medical imaging data, and its sensitivity level coefficient is 0.8. According to the sensitivity level coefficient, the preset benchmark service quality threshold (for example, 0.6) is weighted and corrected to obtain a service quality threshold of 0.6*(1+0.8)=1.08 and a minimum service quality threshold of 0.6*(1+0.8*0.5)=0.84. At the same time, the resource utilization score is calculated using the pre-built transmission link resource consumption model. Assume that the resource utilization score of the current path A is 0.7. The service quality score (0.503), service quality threshold (1.08), minimum service quality threshold (0.84) and resource utilization score (0.7) are used as input parameters to generate a transmission strategy including a path selection strategy and a resource allocation strategy.

[0151] If the service quality score (0.503) is detected to be less than the minimum service quality threshold (0.84), the transmission policy triggers fault migration. At this time, the fault migration function in the smart contract is called. Assume that there are two candidate transmission paths B and C. The topological structure of candidate transmission paths B and C is analyzed based on the graph neural network, and the comprehensive evaluation value is calculated by combining the service quality score and path overlap. Assume that the comprehensive evaluation value of path B is 0.9 and the path overlap is 0.1; the comprehensive evaluation value of path C is 0.8 and the path overlap is 0.2. Select the candidate transmission path B with the highest comprehensive evaluation value and the lowest path overlap as the target transmission channel.

[0152] A distributed state synchronization mechanism is used to switch the multipath transmission channel to the target transmission channel B, and a cache queue mechanism is used during the switching process to ensure the continuity of data transmission. For example, the data packets on path A are cached in the queue, and after switching to path B, the data packets are taken out of the queue and continued to be transmitted.

[0153] Finally, a zero-knowledge proof circuit is constructed, which includes the access verification information hash value, transmission path node signature, timestamp, and service quality data. A hierarchical commitment scheme is used to perform a trusted setup to generate a proof key and a verification key. Based on the proof key, the access verification information hash value, transmission path node signature, timestamp, and service quality data are used to generate a transmission trajectory proof, and the transmission trajectory proof is submitted to the blockchain network for storage, such as submitting the proof to the Ethereum blockchain to ensure the credibility and traceability of the transmission trajectory.

[0154] In this embodiment, by real-time monitoring of service quality and automatic fault migration, data transmission interruption caused by network failure can be effectively avoided, ensuring the stability of data transmission. Using zero-knowledge proof technology to store transmission trajectory information can prevent data from being tampered with and improve the credibility of data transmission. By combining data sensitivity level and resource utilization to formulate transmission strategies, resource waste can be effectively avoided and resource utilization efficiency can be improved.

[0155] Figure 2 Schematic diagram of the structure of the private domain live data storage and visitor authentication system based on blockchain in an embodiment of the present invention. Figure 2 As shown, the system comprises:

[0156] The first unit is used to collect multimodal biometric data of the visitor terminal, wherein the multimodal biometric data includes dynamic lip reading features, voiceprint features and facial micro-expression features, and use a deep neural network with a spatiotemporal attention mechanism to perform feature extraction and cross-modal fusion to generate a fused feature vector, input the fused feature vector into an adversarial generative network for authenticity verification, generate a credibility score, perform differential privacy processing on the fused feature vector based on the credibility score, generate a dynamic identity token containing an elliptic curve encrypted access credential, and write the hash value of the dynamic identity token into a blockchain network;

[0157] The second unit is used to receive the live data stream, perform semantic analysis on the live data stream using a pre-trained adaptive content-aware model, identify the data sensitivity level, build a two-layer access control matrix based on the data sensitivity level and the credibility score, and adaptively slice and hierarchically encrypt the live data stream according to the two-layer access control matrix and the network status, wherein the hierarchical encryption adopts an encryption model based on federated learning; store the encrypted data slices in a distributed storage network, and generate a smart contract containing data fingerprints;

[0158] The third unit is used for performing identity verification based on the dynamic identity token when receiving a data access request sent by a visitor terminal, generating access authorization information after the verification is passed, obtaining access rights from the double-layer access control matrix based on the access authorization information, and obtaining network performance parameters of the transmission path according to the access rights, using a pre-built service quality prediction model to perform predictions, and selecting the optimal edge node combination according to the prediction analysis results to construct a multi-path transmission channel. The edge node records real-time service quality data through a blockchain protocol, calculates a service quality score for the transmission path based on the real-time service quality data, and generates a transmission strategy based on the service quality score combined with the data sensitivity level. When the service quality score is lower than a preset threshold, the fault migration instruction in the smart contract is triggered, the multi-path transmission channel is switched to a preset backup transmission channel, and trajectory information including access verification and transmission records is generated using zero-knowledge proof, and submitted to the blockchain network for evidence storage.

[0159] According to a third aspect of the embodiments of the present invention,

[0160] An electronic device is provided, comprising:

[0161] processor;

[0162] a memory for storing processor-executable instructions;

[0163] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0164] A fourth aspect of the embodiments of the present invention is:

[0165] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0166] The present invention may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present invention.

[0167] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A private domain live broadcast data storage and visitor authentication method based on blockchain, characterized in that: include: Collect multimodal biometric data from the visitor terminal, the multimodal biometric data including dynamic lip reading features, voiceprint features and facial micro-expression features, use a deep neural network with a spatiotemporal attention mechanism to perform feature extraction and cross-modal fusion, generate a fused feature vector, input the fused feature vector into a generative adversarial network for authenticity verification, generate a credibility score, perform differential privacy processing on the fused feature vector based on the credibility score, generate a dynamic identity token containing an elliptic curve encrypted access credential, and write the hash value of the dynamic identity token into a blockchain network; Receive a live data stream, perform semantic analysis on the live data stream using a pre-trained adaptive content-aware model, identify the data sensitivity level, build a two-layer access control matrix based on the data sensitivity level and the credibility score, and adaptively slice and hierarchically encrypt the live data stream according to the two-layer access control matrix and the network status, wherein the hierarchical encryption adopts an encryption model based on federated learning; store the encrypted data slices in a distributed storage network, and generate a smart contract containing data fingerprints; When a data access request is received from a visitor terminal, an identity verification is performed based on a dynamic identity token. After the verification is passed, access authorization information is generated. The access rights are obtained from the double-layer access control matrix based on the access authorization information. The network performance parameters of the transmission path are obtained according to the access rights. The pre-built service quality prediction model is used for prediction. The optimal edge node combination is selected according to the prediction analysis results to construct a multi-path transmission channel. The edge node records real-time service quality data through the blockchain protocol. The service quality score of the transmission path is calculated based on the real-time service quality data. A transmission strategy is generated according to the service quality score combined with the data sensitivity level. When the service quality score is lower than a preset threshold, the fault migration instruction in the smart contract is triggered, the multi-path transmission channel is switched to a preset backup transmission channel, and the trajectory information including access verification and transmission records is generated using zero-knowledge proof, and submitted to the blockchain network for evidence storage.

2. The method according to claim 1, characterized in that Inputting the fused feature vector into a generative adversarial network for authenticity verification, generating a credibility score, performing differential privacy processing on the fused feature vector based on the credibility score, generating a dynamic identity token including an elliptic curve encrypted access credential, and writing a hash value of the dynamic identity token into a blockchain network includes: A generative adversarial network is constructed, which includes a discriminator and a generator, wherein the discriminator includes a multi-layer fully connected network structure with an activation function and receives a pseudo feature vector generated by the generator based on random noise; the generator adopts a symmetric encoder-decoder structure, wherein the encoder maps the fused feature vector to a latent space learning feature distribution, and the decoder restores the feature vector based on the feature distribution; the fused feature vector is input into the discriminator of the generative adversarial network, and the discriminator generates a credibility score by maximizing the discrimination loss between real features and pseudo features; constructing an adaptive differential privacy budget function according to the credibility score, wherein the differential privacy budget function monotonically increases with the credibility score, calculating a sensitivity function value of an adjacent data set based on the differential privacy budget function, taking a ratio of the sensitivity function value to the differential privacy budget function as a scale parameter of Laplace noise, and using the scale parameter to add Laplace noise to a fused feature vector to generate a privacy-preserving feature vector; Select a base point based on a preset elliptic curve equation, use the base point to generate a key containing a private key and a public key, concatenate the privacy-preserving feature vector with the public key, and digitally sign the concatenation result and the current timestamp using the private key to generate a temporary access credential containing signature information; The temporary access credential, the public key and the current timestamp are combined in a preset format to generate a dynamic identity token, a cryptographic hash operation is performed on the dynamic identity token to obtain a token hash value, and the token hash value is submitted to the blockchain network for evidence storage.

3. The method according to claim 2, characterized in that Selecting a base point based on a preset elliptic curve equation, using the base point to generate a key containing a private key and a public key, concatenating the privacy protection feature vector with the public key, and digitally signing the concatenation result and the current timestamp using the private key, generating a temporary access credential containing signature information includes: Construct a finite field cryptographic system based on an elliptic curve equation, wherein the elliptic curve equation includes a finite field parameter, a curve coefficient parameter, and a base point order parameter, generate a random private key within the range defined by the base point order parameter, and use a windowed double point fast multiplication algorithm to calculate the scalar point multiplication of the random private key and the base point coordinates to obtain the elliptic curve point coordinates as the public key; The received privacy protection feature vector is byte-normalized to obtain a feature byte sequence, the elliptic curve point coordinates of the public key are converted into a compressed public key including a vertical axis coordinate parity mark and a horizontal axis coordinate value according to the discrete logarithm problem, and the feature byte sequence, the compressed public key and the millisecond timestamp are concatenated according to a preset byte order to obtain a message to be signed; Generate a cryptographically secure random number as a temporary private key, calculate the scalar dot product of the temporary private key and the base point coordinates to obtain temporary point coordinates, perform a modular operation on the horizontal axis component of the temporary point coordinates to obtain a first component of the signed message, calculate a hash value of the message to be signed, and perform a modular operation on the random private key and the first component at the same time, and obtain a second component of the signed message according to the hash value of the message to be signed and the modular operation result, wherein the first component and the second component constitute a digital signature; The characteristic byte sequence, compressed public key, millisecond timestamp and digital signature are combined to generate a temporary access credential, which contains metadata information for verifying the digital signature. The validity period of the temporary access credential is controlled based on the millisecond timestamp, and the temporary access credential is used for access control in an identity authentication system.

4. The method according to claim 1, characterized in that: Receiving a live data stream, performing semantic analysis on the live data stream using a pre-trained adaptive content-aware model, identifying a data sensitivity level, constructing a double-layer access control matrix based on the data sensitivity level and a credibility score, and adaptively slicing and layering the live data stream according to the double-layer access control matrix and a network status, including: Inputting the received live data stream into a pre-trained adaptive content-aware model, wherein the adaptive content-aware model includes a spatial pyramid pooling module with adaptive receptive field and a channel recalibration module based on compression activation, and performing feature enhancement and quantization mapping on the live data stream to obtain a unified feature representation; The unified feature representation is input into a sensitivity recognition model, the sensitivity recognition model hierarchically combines the unified feature representation through a recursive capsule network, and uses a conditional random field model to establish a temporal dependency relationship to obtain a temporal feature; an attention-guided multi-task learning framework is used to perform task decomposition and weight allocation on the temporal feature to obtain a data sensitivity level; A two-layer access control matrix is ​​constructed according to the data sensitivity level and the pre-acquired credibility score, wherein the first layer of the two-layer access control matrix determines the basic access rights according to the data sensitivity level, and the second layer adjusts the basic access rights according to the credibility score; network status parameters are collected, the data shard size is dynamically adjusted based on the network status parameters, and the shard boundary is determined according to the two-layer access control matrix, and the live data stream is sharded to obtain data shards; Construct a hierarchical encryption model based on federated learning, deploy multiple computing nodes in a distributed environment, and train each computing node to obtain encryption parameters based on local historical data. Add noise to the encryption parameters through the differential privacy mechanism, and use homomorphic encryption technology to aggregate parameters and update the encryption strategy corresponding to each sensitivity level. According to the sensitivity level of the data slice, the corresponding encryption strategy is called to perform layered encryption processing to obtain encrypted data slices.

5. The method according to claim 4, characterized in that Construct a hierarchical encryption model based on federated learning, deploy multiple computing nodes in a distributed environment, and train each computing node to obtain encryption parameters based on local historical data. Add noise to the encryption parameters through the differential privacy mechanism, and use homomorphic encryption technology to aggregate parameters. Update the encryption strategies corresponding to each sensitivity level, including: Construct a hierarchical encryption model based on federated learning, including an encryption function, a key generation module, an encryption module and a decryption module. The encryption function configures security parameters and random numbers according to the data sensitivity level; the key generation module generates a key pair and a key validity period; the encryption module encrypts the message in blocks based on homomorphic encryption to obtain an encrypted data block; and the decryption module decrypts the encrypted data block; Deploy multiple computing nodes in a distributed environment for collaborative training. The number of computing nodes is dynamically adjusted according to the data scale. Each computing node trains a local model based on local historical data to obtain local encryption parameters. The central node broadcasts global parameters and training round information to each computing node. Each computing node updates the local encryption parameters based on the loss function and learning rate, and sets a parameter upload time window to upload the updated local encryption parameters to the central node. Injecting Laplace noise into the local encryption parameter to perform differential privacy protection, where the size of the Laplace noise is determined by the data sensitivity level and the privacy budget, to obtain a noise encryption parameter; The noise encryption parameters are aggregated using a homomorphic encryption protocol, the computing nodes encrypt the noise encryption parameters using homomorphic encryption, and the central node performs a homomorphic addition operation on the encrypted parameters and obtains an aggregated parameter through hierarchical decryption; The global parameters are updated based on the aggregation parameters and the aggregation weights, and iterations are repeated until a preset number of convergences is met to obtain a final encryption policy set, wherein the encryption policy set includes encryption strength, key update cycle, and access control rules.

6. The method according to claim 1, characterized in that Obtaining access rights from the double-layer access control matrix based on the access authorization information, and obtaining network performance parameters of the transmission path according to the access rights, using a pre-built service quality prediction model to make predictions, and selecting the optimal edge node combination to construct a multi-path transmission channel according to the prediction analysis results includes: Obtain the credibility score in the access authorization information and the sensitivity level of the target data in the data access request, input the credibility score and the sensitivity level into a pre-built adaptive threshold mapping model to obtain access trust, build a multi-dimensional attribute access policy tree based on the access trust, and extract the access permission set that satisfies the multi-dimensional attribute access policy tree from a preset two-layer access control matrix; Determine a candidate edge node that can be used to build a transmission link based on the access permission set, collect performance parameters of the candidate edge node, the performance parameters include transmission delay value, bandwidth occupancy rate and link load value, and build a time series feature sequence of the performance parameters; Input the time series feature sequence into a long short-term memory network to extract time dimension features, input the extracted time dimension features into a graph convolutional network to extract topology dimension features, construct a state-action value function based on the time dimension features and the topology dimension features, obtain a service quality prediction model through deep Q learning algorithm training, input the performance parameters into the service quality prediction model, and obtain the service quality prediction value of each candidate transmission path based on the policy gradient method; Sort the candidate edge nodes in descending order according to the service quality prediction scores, select N candidate edge nodes with the highest prediction scores to form an edge node combination, distribute key shards to the edge node combination through a blockchain smart contract, and receive a decryption capability certificate returned by the edge node combination based on the key shards; The validity of the decryption capability certificate is verified, a node connection relationship of the edge node combination is determined according to the verified decryption capability certificate, and a multi-path transmission channel is constructed based on the node connection relationship.

7. The method according to claim 1, characterized in that The service quality score of the transmission path is calculated based on the real-time service quality data, and a transmission strategy is generated according to the service quality score combined with the data sensitivity level. When the service quality score is lower than the preset threshold, the fault migration instruction in the smart contract is triggered, the multi-path transmission channel is switched to the preset backup transmission channel, and the track information including access verification and transmission record is generated by using zero-knowledge proof, and submitted to the blockchain network for evidence storage, including: Acquire real-time service quality data, the real-time service quality data including end-to-end delay, packet loss rate and throughput, multiply the ratio of the end-to-end delay to a preset maximum allowable delay, the packet loss rate, and the ratio of the throughput to a preset maximum throughput by corresponding weight coefficients respectively, and sum them to obtain a service quality score of the transmission path; Obtaining a sensitivity level coefficient of the data to be transmitted, performing weighted correction on a preset benchmark service quality threshold according to the sensitivity level coefficient to obtain a service quality threshold and a minimum service quality threshold, and calculating a resource utilization score using a pre-built transmission link resource consumption model, using the comparison result of the service quality score with the service quality threshold and the minimum service quality threshold, and the resource utilization score as input parameters to generate a transmission strategy including a path selection strategy and a resource allocation strategy; When it is detected that the service quality score is less than the minimum service quality threshold, the transmission strategy triggers fault migration. When the transmission strategy triggers fault migration, the fault migration function in the smart contract is called, and the topological structure of the candidate transmission path is analyzed based on the graph neural network. The comprehensive evaluation value is calculated by combining the service quality score and the path overlap, and the candidate transmission path with the highest comprehensive evaluation value and the lowest path overlap is selected as the target transmission channel; A distributed state synchronization mechanism is used to switch the multipath transmission channel to a target transmission channel, and a cache queue mechanism is used during the switching process to ensure the continuity of data transmission; A zero-knowledge proof circuit is constructed that includes the hash value of access verification information, the signature of the transmission path node, the timestamp, and the quality of service data. A hierarchical commitment scheme is used to perform a trusted setup to generate a proof key and a verification key. Based on the proof key, the hash value of the access verification information, the signature of the transmission path node, the timestamp, and the quality of service data are used to generate a transmission trajectory proof, and the transmission trajectory proof is submitted to the blockchain network for storage.

8. A private domain live broadcast data storage and visitor authentication system based on blockchain, characterized in that: include: The first unit is used to collect multimodal biometric data of the visitor terminal, wherein the multimodal biometric data includes dynamic lip reading features, voiceprint features and facial micro-expression features, and use a deep neural network with a spatiotemporal attention mechanism to perform feature extraction and cross-modal fusion to generate a fused feature vector, input the fused feature vector into a generative adversarial network for authenticity verification, generate a credibility score, perform differential privacy processing on the fused feature vector based on the credibility score, generate a dynamic identity token containing an elliptic curve encrypted access credential, and write a hash value of the dynamic identity token into a blockchain network; The second unit is used to receive the live data stream, perform semantic analysis on the live data stream using a pre-trained adaptive content-aware model, identify the data sensitivity level, build a two-layer access control matrix based on the data sensitivity level and the credibility score, and adaptively slice and hierarchically encrypt the live data stream according to the two-layer access control matrix and the network status, wherein the hierarchical encryption adopts an encryption model based on federated learning; store the encrypted data slices in a distributed storage network, and generate a smart contract containing data fingerprints; The third unit is used for performing identity verification based on the dynamic identity token when receiving a data access request sent by a visitor terminal, generating access authorization information after the verification is passed, obtaining access rights from the double-layer access control matrix based on the access authorization information, and obtaining network performance parameters of the transmission path according to the access rights, using a pre-built service quality prediction model to perform predictions, and selecting the optimal edge node combination according to the prediction analysis results to construct a multi-path transmission channel. The edge node records real-time service quality data through a blockchain protocol, calculates a service quality score for the transmission path based on the real-time service quality data, and generates a transmission strategy based on the service quality score combined with the data sensitivity level. When the service quality score is lower than a preset threshold, the fault migration instruction in the smart contract is triggered, the multi-path transmission channel is switched to a preset backup transmission channel, and trajectory information including access verification and transmission records is generated using zero-knowledge proof, and submitted to the blockchain network for evidence storage.

9. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method described in any one of claims 1 to 7.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images