Data security encryption transmission and access control method and system based on block chain

Abstract

The invention relates to the field of data security transmission, and particularly discloses a data security encryption transmission and access control method and system based on a block chain. Comprising a client encryption module, a server decryption module, a dynamic access control engine and a block chain evidence storage unit. The client encryption module adopts an AES + RSA hybrid encryption algorithm to carry out encryption transmission on sensitive data such as commercial secrets and client information; the server side decryption module achieves safe decryption through a secret key management system, and a hardware security chip HSM stores an RSA secret key pair and is used for secret key decryption, and secret key rotation and life cycle management are achieved. The dynamic access control engine dynamically adjusts the user permission based on RBAC role access control and real-time behavior analysis, and prevents unauthorized access. And the block chain evidence storage unit is used for recording a data operation log and ensuring that data tracing cannot be tampered. According to the method, the problems of leakage risk and personnel permission abuse in the data transmission and storage process are solved, and the data security and compliance are remarkably improved.

Description

Technical Field

[0001] The present invention relates to the field of secure data transmission, and more specifically to a method and system for secure data encryption transmission and access control based on blockchain. Background Art

[0002] In the field of secure data transmission, data security and permission control face severe challenges. Customer business strategies, privacy information, and sensitive reports generated during enterprise data transmission need to be transmitted and shared across platforms. Traditional solutions often use one-way encryption and static permission management, which have significant flaws: on the one hand, a single encryption algorithm is susceptible to targeted cracking, and key management is lax; on the other hand, fixed role permissions cannot cope with internal unauthorized or abnormal operations, leading to data leakage risks. The Chinese patent, publication number CN112469003A, uses hybrid encryption technology to achieve two-way authentication and dual encryption, improving key management efficiency and encryption speed, and enhancing the security and efficiency of data transmission. However, single symmetric encryption suffers from difficult key management and low security.

[0003] To address the above issues, this patent proposes a technical solution that integrates hybrid encryption, dynamic behavior analysis, and blockchain evidence storage: a "one-time, one-password" key management mechanism is implemented through the AES+RSA dual algorithm, access rights are dynamically adjusted in combination with real-time user behavior scores, and the timestamp and hash chain characteristics of the blockchain are used to solidify operation logs, forming a full-chain protection from transmission, access to traceability, filling the gap in dynamic security control and trusted traceability capabilities in existing technologies. Summary of the Invention

[0004] In order to overcome the above-mentioned defects of the prior art, the present invention provides a blockchain-based data security encryption transmission and access control method and system. The technical solutions adopted are as follows: Blockchain-based data security encryption transmission and access control system, including: Client encryption module, used to encrypt user data using a hybrid encryption algorithm; The server-side decryption module is used to decrypt the received encrypted data; Hardware security module, which uses the hardware security chip HSM to store RSA key pairs for key decryption and implement key rotation and lifecycle management; Dynamic access control engine for dynamically adjusting access rights based on user roles and real-time behavioral analysis; The blockchain evidence storage unit is used to record data operation logs and generate tamper-proof traceability information.

[0005] Furthermore, the client encryption module adopts a hybrid encryption algorithm: the AES algorithm is used to encrypt user data, and the RSA algorithm is used to encrypt the AES key. The encrypted data and the encryption key are transmitted to the server through two secure channels respectively.

[0006] Furthermore, the dynamic access control engine includes: Role-based access control (RBAC) unit, used to assign initial permissions based on user roles; A real-time user behavior analysis unit monitors user operations, sends alerts to administrators when abnormal behavior is detected, and generates behavior risk scores using anomaly detection algorithms based on machine learning models. Dynamic permission adjustment unit adjusts user permissions in real time based on risk scores.

[0007] Furthermore, the blockchain evidence storage unit includes: Timestamp generation module, which binds an accurate timestamp to each data operation record; Hash chain building module, which links operation records to the blockchain network through hash values; Distributed storage nodes are used for synchronous storage on multiple nodes.

[0008] Furthermore, the user real-time behavior analysis unit of the dynamic access control engine monitors user operation behaviors including: detecting unconventional time access, high-frequency downloading and cross-role data request behaviors.

[0009] Furthermore, the machine learning model uses an ensemble learning framework combined with the following algorithms to generate a risk score: Isolation Forest detects rare operation patterns of unconventional access times to calculate the output score P1, LSTM time series network analyzes abnormal operation sequences of high-frequency downloads to calculate the output score P2, and K-means cluster analysis identifies individuals in cross-role data requests that deviate from group behavior to calculate the output score P3; Risk score = (αP 1 + βP 2 + λP 3) × 100%, where α, β, and λ are preset weight coefficients.

[0010] Furthermore, the dynamic permission adjustment unit adjusts user permissions according to the risk score in the following ways: Risk score 70-85: Permission downgrade, the current account permissions will be downgraded; Risk score 85-95: Secondary authentication, requiring users to verify their identity through biometrics or OTP; Risk score greater than 95: The session is terminated, the high-risk account is forcibly logged out, and the administrator is notified.

[0011] Furthermore, a method for secure data encryption transmission and access control based on blockchain is provided, which is an implementation method of the secure data encryption transmission and access control system based on blockchain, and is characterized in that it includes the following steps: S1: The client encrypts and transmits sensitive data using a hybrid encryption algorithm; S2: The server decrypts and stores the encrypted data; S3: Dynamically controls data access permissions based on user roles and real-time behavioral analysis; S4: Use blockchain technology to store and trace the entire data operation process.

[0012] Furthermore, the blockchain-based data encryption transmission and access control method specifically includes the following steps: The client collects user data, encrypts the data using the AES algorithm, and generates a random key; Use the RSA public key to encrypt the AES key and transmit it to the server together with the encrypted data; The server decrypts the AES key using the RSA private key and decrypts the encrypted data; Dynamically authorize data access scope based on user roles and real-time behavior analysis results; The timestamp of the data operation, the operation content and the user identity hash value are written into the blockchain.

[0013] The technical effects and advantages of the present invention are as follows: This invention adopts an end-to-end encryption solution that combines the AES+RSA hybrid encryption algorithm with the hardware security chip HSM. It not only ensures the ability to resist brute force cracking and man-in-the-middle attacks during data transmission, but also avoids the risk of key leakage in traditional solutions through hardware-level key storage and regular rotation mechanism.

[0014] The dynamic access control engine of the present invention is based on real-time user behavior analysis, which can identify abnormal behaviors such as high-frequency downloads and cross-role data requests, and automatically trigger permission downgrade or secondary authentication, significantly reducing the risk of internal data abuse.

[0015] This invention uses blockchain technology to solidify data operation logs. Each record is associated with a precise timestamp and generates a unique hash value, forming an irreversible hash chain structure. This mechanism ensures that the entire process, from data generation and transmission to access, is traceable, and any tampering will be identified by the system, improving data transmission security. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 This is a diagram of the main system architecture of the present invention; DETAILED DESCRIPTION

[0017] To further illustrate the technical means and effects employed by the present invention to achieve its intended objectives, the following detailed description, along with the accompanying drawings and preferred embodiments, includes a detailed description of the specific implementations, structures, features, and effects thereof. In the following description, references to "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics of one or more embodiments may be combined in any suitable manner.

[0018] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0019] The specific solutions provided by the present invention are described in detail below with reference to the accompanying drawings.

[0020] refer to Figure 1 , which shows that the present invention provides a data security encryption transmission and access control system based on blockchain, including: Client encryption module, used to encrypt user data using a hybrid encryption algorithm; The server-side decryption module is used to decrypt the received encrypted data; Hardware security module, which uses the hardware security chip HSM to store RSA key pairs for key decryption and implement key rotation and lifecycle management; Dynamic access control engine for dynamically adjusting access rights based on user roles and real-time behavioral analysis; The blockchain evidence storage unit is used to record data operation logs and generate tamper-proof traceability information.

[0021] In Example 1, a consulting company needs to optimize customer privacy data. The entire business process relies on this system and method to achieve secure closed-loop management: First, sensitive consulting data to be analyzed, including client personal privacy data, business operations, corporate intellectual property, and trade secrets, is uploaded through a secure client channel. The client-side encryption module automatically triggers the encryption process: the file content is encrypted using the AES-256 algorithm, while a randomly generated AES key is encrypted using RSA-2048. The encrypted data packet and key are then transmitted separately to the consulting company's server.

[0022] The key generation process is as follows: The client encryption module uses a cryptographically secure random number generator (CSPRNG) to generate a 256-bit AES session key, Key_AES. This key is generated specifically for the current file, implementing the "one-time, one-pad" security principle. It also reads the server's pre-configured RSA-2048 public key, Pub_RSA. This public key certificate is authenticated by the PKI system and stored in the client's TEE trusted execution environment.

[0023] The data encryption process is as follows: File content is encrypted using AES-256-CBC mode. A 16-byte initialization vector (IV) is generated and input into the encryption algorithm along with the key Key_AES. The original file is encrypted in 128-bit blocks, and the last bit of data is padded using the PKCS7 standard. The ciphertext data packet Cipher_AES and the IV vector are then output. Using the OAEP padding scheme, the key Key_AES is RSA-encrypted using the public key Pub_RSA to generate the encrypted key packet Cipher_RSA.

[0024] The encrypted ciphertext data and key are transmitted to the server, and a transmission message is constructed through the two-way authenticated channel established by TLS 1.3. The encrypted data and encryption key are transmitted separately. The ciphertext data packet Cipher_AES and IV vector are transmitted through the main data channel, and the encryption key packet Cipher_RSA is transmitted through the dedicated key channel. The two channels use different network routes to achieve physical isolation.

[0025] Only after the hardware security module on the server side completes key decryption can the correct AES key be used to decrypt the original data, ensuring that data leakage will not occur even if a network attack occurs during the transmission process.

[0026] The server-side receiving and processing flow is as follows: After receiving the key package Cipher_RSA, the server decrypts it using the RSA private key Pri_RSA in the hardware security chip HSM of the hardware security module to obtain the key Key_AES, and immediately injects the key Key_AES into the secure memory area of the hardware security chip HSM, prohibiting external access.

[0027] The key Key_AES in the hardware security chip HSM decrypts the ciphertext data packet Cipher_AES. First, the validity of the IV vector is verified to prevent IV reuse attacks. The AES decryption operation is completed inside the hardware security chip HSM, and the decryption result is directly input into the security sandbox.

[0028] The transport layer implements security enhancement measures. The client encryption module uses the sender's private key RSA-PSS to generate a signature for the metadata. The server hardware security module verifies the signature with the public key to ensure that the metadata has not been tampered with. It also implements an anti-replay attack mechanism and verifies the real-time nature of the message through the timestamp and random number nonce.

[0029] Key_AES is destroyed immediately after use in the hardware security chip HSM. RSA key pairs are rotated every 90 days, and old keys are automatically archived and encrypted for storage. When a key transmission timeout (>2s) is detected, the key revocation process is triggered to implement key lifecycle management and exception handling.

[0030] During the data analysis phase, the dynamic access control engine implements refined permission control based on preset roles: for example, consultants can view the data of individual customers, managers can view the summary of all customer data, and financial personnel can only view expense statistics reports. When the system detects that the consultant's account frequently accesses customer data in the early morning, the dynamic access control engine immediately triggers the security mechanism, simultaneously sends an alert to the manager, and generates a behavioral risk score through the anomaly detection algorithm of the machine learning model. The dynamic permission adjustment unit adjusts the account permissions based on the risk score. All data operation behaviors, including the consultant's analysis process, query records, etc., are recorded in real time by the timestamp generation module of the blockchain evidence storage unit and generate a timestamp operation log. The hash chain construction module forms a data fingerprint through the hash algorithm and writes it to the blockchain node.

[0031] After the consulting firm completes its analysis, the client-side encryption module re-encrypts the generated consulting report. After passing multi-factor authentication, administrators can access the report within their authorized scope. When managers need to trace internal operation records, they can directly retrieve the immutable operation records from the blockchain evidence unit to quickly verify any illegal access. Throughout the entire business process, customer privacy data remains encrypted, and permission controls are dynamically adjusted based on operational behavior. All data flow traces are fully documented, providing comprehensive security protection from data collection, analysis, and delivery.

[0032] In Example 2, a company commissioned a professional organization to conduct a business secret layout analysis to achieve full-process data security management and control. The specific implementation process is as follows: The company first uploads the technical data to be analyzed through the client-side encryption module, such as developed software code, risk assessment reports, intelligent machinery under development, or other trade secrets and reference materials. The client-side encryption module immediately initiates a hybrid encryption process: the file content is encrypted using the AES-256 algorithm and a randomly generated AES key is encrypted using RSA-2048. The encrypted data packet and key are transmitted to a dedicated server via a separate channel, ensuring that sensitive data will not be leaked even in the event of a cyberattack.

[0033] During the data analysis phase, the dynamic access control engine's role-based access control (RBAC) unit implements hierarchical permission management based on pre-defined roles: account managers can view complete customer asset information, risk control personnel can only access risk assessment data, and finance personnel can only review customer asset-related data. If the real-time user behavior analysis unit detects that an account frequently downloads large amounts of customer asset data during non-business hours, a security mechanism is immediately triggered. The dynamic permission adjustment unit automatically adjusts the account's permissions, such as downgrading it to "view only desensitized data," and simultaneously sends a security alert to the administrator.

[0034] All user operations, such as querying, downloading, and modifying, are captured in real time by the user real-time behavior analysis unit, which extracts key features: such as the frequency of multiple requests for sensitive data in a short period of time; the time characteristics of system access during non-working hours; the data range characteristics of attempts to view unauthorized information across roles; and contextual features such as comparison of user roles with historical behavior baselines and operations of people in the same group.

[0035] The real-time user behavior analysis unit uses a machine learning model's anomaly detection algorithm to calculate a risk score and assess whether the current operation is suspicious. When the risk score exceeds the threshold, the dynamic permission adjustment unit automatically triggers a response. The model is trained using historical normal operation data and injected with simulated attack samples to enhance robustness. It also automatically filters out non-human anomalies such as brief network jitter. For example, repeated operations within 5 seconds will only be counted once.

[0036] The anomaly detection algorithm of the machine learning model implements dynamic risk score calculation through the following process: An ensemble learning framework is used in conjunction with the following algorithms: Isolation Forest detects rare operation patterns. For example, an employee suddenly accesses data that has never been queried before, with a query frequency of 12 times / minute. The current frequency exceeds the historical 99th percentile. 1,000 isolation trees are constructed, and the path length of the current operation in each tree is calculated. The average path length in the isolation trees is 2.1. The anomaly score is calculated. The historical normal average is 3 times / minute, and the calculated output score P1 is 0.87.

[0037] The LSTM timing network analyzes operation sequence anomalies. For example, when an abnormal user operation sequence is detected, the query → filter → download frequency is 20 times / minute, which is highly similar to the preset "data theft" pattern. The operation sequence encoding vector is input, and the timing features are extracted through a three-layer LSTM unit. The output anomaly score P2 is 0.92.

[0038] K-means cluster analysis identifies individuals who deviate from group behavior. For example, a client manager's operational characteristics differ significantly from those of his or her peers. Based on the distance between the current action and the behavior of managers at the same level, the Mahalanobis distance from the current action to the nearest cluster center is calculated, resulting in a final P3 score of 0.78.

[0039] When a user initiates an operation, each sub-model calculates the abnormal probability in parallel, and weighted fusion is used to form the final risk score. The judgment criteria are automatically optimized according to the current system load and time period to adjust the dynamic threshold.

[0040] Assign weights based on the model's performance on the validation set: Risk score = (αP1 + βP2 + λP3) × 100%, where α, β, and λ are preset weighting coefficients. Substituting the values here: (0.4 × 0.87 + 0.5 × 0.92 + 0.1 × 0.78) × 100% = 89.4 points.

[0041] Risk scoring triggers three levels of response: 70-85 points: Permission downgrade, the current account permissions will be downgraded; 85-95 points: Secondary authentication, requiring users to verify their identity through biometrics or OTP; Greater than 95 points: The session is terminated, high-risk accounts are forcibly logged out, and the administrator is notified; The above response types are pre-set by the administrator. After the dynamic permission adjustment unit triggers a response, the adjusted permissions take effect immediately and the reason for the operation is recorded in the log.

[0042] After the professional institution completes the analysis, the client-side encryption module re-encrypts the generated asset allocation recommendation report. Managers can access the report content within their authorized scope. All data operations, including analyst query records and modification traces, are recorded in real time by the blockchain evidence unit, generating a timestamped operation hash value that is stored across distributed storage nodes.

[0043] The timestamp generation module of the blockchain evidence storage unit captures key operation events, such as file access, permission changes, and data modification, and extracts the following information: operation content, timestamp (UTC time accurate to milliseconds), operator identity (digital signature or unique ID), and calculates the hash value of the operation record (such as SHA-256) as a data fingerprint.

[0044] The Hash Chain building block utilizes Hyperledger Fabric, a private or consortium blockchain architecture, with multiple trusted nodes jointly maintaining the ledger. Transactions are packaged with hash values, timestamps, and related metadata, which are then verified through the PBFT consensus mechanism and written to blocks. Each new block includes the hash of the previous block, forming a hash chain to ensure that historical data cannot be tampered with. This information is ultimately stored by distributed storage nodes.

[0045] During later tracing, regulators or administrators can query the complete operation history through a blockchain browser. To verify the authenticity of the data, the hash value is recalculated and compared with the on-chain record. Any tampering will cause the hash to mismatch. Support for privacy protection technologies such as zero-knowledge proof (ZKP) verifies operational compliance without leaking sensitive information.

[0046] The dynamic permission control system of this invention blocks risky operations in real time, while blockchain-based evidence storage ensures that all operations, including permission changes, are permanently recorded. The combination of these two forms a complete security closed loop of "real-time protection + post-event traceability," meeting the requirements for data access control and data record traceability in real-life production.

[0047] For example, when regulators conduct compliance reviews, they can directly retrieve immutable operation logs from the blockchain evidence storage unit to quickly verify any illegal access. Throughout the entire business process, customer sensitive data remains encrypted, access control is dynamically adjusted based on operational behavior, and all traces of data flow are fully documented, forming a full lifecycle security protection system from data collection and analysis to delivery.

[0048] The above contents are merely examples and explanations of the concept of the present invention. Those skilled in the art may make various modifications or additions to the described specific embodiments or replace them in a similar manner. As long as they do not deviate from the concept of the invention or exceed the scope defined by the present invention, they should all fall within the scope of protection of the present invention.

Claims

1. The data security encryption transmission and access control system based on blockchain is characterized by: include: Client encryption module, used to encrypt user data using a hybrid encryption algorithm; The server-side decryption module is used to decrypt the received encrypted data; Hardware security module, which uses the hardware security chip HSM to store RSA key pairs for key decryption and implement key rotation and lifecycle management; Dynamic access control engine for dynamically adjusting access rights based on user roles and real-time behavioral analysis; The blockchain evidence storage unit is used to record data operation logs and generate tamper-proof traceability information.

2. The data security encryption transmission and access control system based on blockchain according to claim 1 is characterized in that: The client encryption module adopts the hybrid encryption algorithm: AES algorithm is used to encrypt user data, and RSA algorithm is used to encrypt AES key. The encrypted data and encryption key are transmitted to the server through two secure channels respectively.

3. The data security encryption transmission and access control system based on blockchain according to claim 1 is characterized in that: The dynamic access control engine includes: Role-based access control (RBAC) unit, used to assign initial permissions based on user roles; A real-time user behavior analysis unit monitors user operations, sends alerts to administrators when abnormal behavior is detected, and generates behavior risk scores using anomaly detection algorithms based on machine learning models. Dynamic permission adjustment unit adjusts user permissions in real time based on risk scores.

4. The data security encryption transmission and access control system based on blockchain according to claim 1 is characterized in that: The blockchain evidence storage unit includes: Timestamp generation module, which binds an accurate timestamp to each data operation record; Hash chain building module, which links operation records to the blockchain network through hash values; Distributed storage nodes are used for synchronous storage on multiple nodes.

5. The data security encryption transmission and access control system based on blockchain according to claim 3 is characterized in that: The user real-time behavior analysis unit of the dynamic access control engine monitors user operation behaviors including: detecting unconventional time access, high-frequency downloading and cross-role data request behaviors.

6. The data security encryption transmission and access control system based on blockchain according to claim 3 is characterized in that: The machine learning model uses an integrated learning framework combined with the following algorithms to generate risk scores: Isolation Forest detects rare operation patterns of unconventional access times and calculates the output score P1; LSTM time series network analyzes abnormal operation sequences of high-frequency downloads and calculates the output score P2; K-means cluster analysis identifies individuals who deviate from the group behavior of cross-role data requests and calculates the output score P3; Risk score = (αP1+βP2+λP3) × 100%, where α, β, and λ are preset weight coefficients.

7. The data security encryption transmission and access control system based on blockchain according to claim 6 is characterized in that: The dynamic permission adjustment unit adjusts user permissions based on risk scores in the following ways: Risk score 70-85: Permission downgrade, the current account permissions will be downgraded; Risk score 85-95: Secondary authentication, requiring users to verify their identity through biometrics or OTP; Risk score greater than 95: The session is terminated, the high-risk account is forcibly logged out, and the administrator is notified.

8. A method for secure data encryption transmission and access control based on blockchain, wherein the method is an implementation method of the secure data encryption transmission and access control system based on blockchain according to claim 1, characterized in that: The following steps are involved: S1: The client encrypts and transmits sensitive data using a hybrid encryption algorithm; S2: The server decrypts and stores the encrypted data; S3: Dynamically controls data access permissions based on user roles and real-time behavioral analysis; S4: Use blockchain technology to store and trace the entire data operation process.

9. The data security encryption transmission and access control method based on blockchain according to claim 8 is characterized in that: The blockchain-based data encryption transmission and access control method specifically includes the following steps: The client collects user data, encrypts the data using the AES algorithm, and generates a random key; Use the RSA public key to encrypt the AES key and transmit it to the server together with the encrypted data; The server decrypts the AES key using the RSA private key and decrypts the encrypted data; Dynamically authorize data access scope based on user roles and real-time behavior analysis results; The timestamp of the data operation, the operation content and the user identity hash value are written into the blockchain.

Images