Decentralized network access authority management system based on block chain

Abstract

The invention relates to the technical field of block chain security, and discloses a decentralized network access authority management system based on a block chain, and the system comprises a data collection module which is used for collecting and preprocessing multi-dimensional attribute data, and then outputting the data to a dynamic tensor processing module; the dynamic tensor processing module receives the data of the data acquisition module, constructs a three-dimensional attribute tensor and is used for executing dynamic rank decomposition and then outputting a nuclear tensor to the strategy generation module; and the strategy generation module is connected with the dynamic tensor processing module and the cross-chain synchronization module and is used for generating an access control strategy matrix based on the kernel tensor. A dynamic strategy matrix with environment perception capability is constructed by fusing real-time network situation data and a global reference strategy generated by federal learning, and balance optimization of a local strategy and a network consensus is realized by adopting a gradient correction fusion algorithm, so that the problem that a traditional static strategy is difficult to cope with complex network environment changes is solved.

Description

Technical Field

[0001] The present invention relates to the field of blockchain security technology, and in particular to a decentralized network access rights management system based on blockchain. Background Art

[0002] With the rapid development of blockchain technology and the widespread deployment of decentralized applications, network access control faces unprecedentedly complex challenges. Traditional permission management systems based on centralized authoritative institutions present single-point-of-failure risks and struggle to adapt to the dynamic trust requirements of distributed network environments. Existing blockchain access control solutions often utilize static smart contract strategies, lacking real-time awareness of environmental threats and exhibiting significant lags in responding to emerging security threats such as zero-day attacks and cross-chain coordinated attacks.

[0003] While current mainstream attribute-based encryption schemes support fine-grained access control, their policy update mechanisms rely on centralized policy management nodes, resulting in long policy adjustment cycles and inefficient cross-domain collaboration. Furthermore, existing systems face an irreconcilable conflict between privacy protection and audit tracking: over-reliance on zero-knowledge proofs weakens behavior traceability, while strengthening audit capabilities could potentially leak sensitive user information. This imbalance between security and privacy severely constrains the scalability of distributed networks.

[0004] In the area of ​​dynamic policy optimization, existing research has largely relied on centralized machine learning models for policy generation, which carries the dual risks of model parameter leakage and single points of failure. While the introduction of federated learning technology can alleviate data privacy concerns, existing solutions lack effective cross-chain policy alignment mechanisms, resulting in poor policy compatibility across heterogeneous networks. Furthermore, the rapid development of quantum computing technology poses a serious threat to traditional encryption systems. Existing access control systems generally lack the ability to resist quantum attacks, posing long-term security risks.

[0005] Faced with increasingly sophisticated cyberattacks, traditional anomaly detection methods rely on fixed rule bases and threshold settings, making it difficult to effectively identify new attack patterns. While machine learning-based detection solutions have seen some improvements, their model updates rely on centralized data aggregation, leading to data silos in distributed scenarios. Furthermore, existing systems lack intelligent, adaptive recovery mechanisms after detecting an anomaly, often employing simple rollback strategies, which can easily lead to service interruptions or secondary security risks.

[0006] These defects seriously restrict the security protection level of decentralized networks and hinder the in-depth application of blockchain technology in critical infrastructure fields. Summary of the Invention

[0007] In response to the shortcomings of the existing technology, the present invention provides a decentralized network access permission management system based on blockchain, which solves the problems of poor static policy adaptability, low cross-domain collaboration efficiency, difficulty in balancing privacy protection and audit traceability, and insufficient resistance to quantum attacks in existing blockchain access control systems.

[0008] To achieve the above objectives, the present invention is implemented through the following technical solutions: a decentralized network access rights management system based on blockchain, comprising:

[0009] The data acquisition module is used to collect multi-dimensional attribute data and pre-process it, and then output it to the dynamic tensor processing module;

[0010] A dynamic tensor processing module receives data from the data acquisition module and constructs a three-dimensional attribute tensor, which is used to perform dynamic rank decomposition and then output a core tensor to the strategy generation module;

[0011] A policy generation module, connected to the dynamic tensor processing module and the cross-chain synchronization module, generates an access control policy matrix based on the core tensor and transmits the policy matrix in parallel to the quantum verification module and the policy evolution module;

[0012] The quantum verification module communicates bidirectionally with the strategy generation module and the data acquisition module to implement strategy verification and feed back the verification results to the data acquisition module to adjust the attribute acquisition parameters;

[0013] The policy evolution module includes a key management unit, which is used to receive the output of the policy generation module and realize the dynamic update of the policy matrix;

[0014] The cross-chain synchronization module connects the strategy generation module and the external blockchain node respectively, is used to perform cross-chain consistency maintenance of the strategy matrix, and transmits the synchronization results back to the strategy generation module to trigger strategy reconstruction.

[0015] Preferably, the multi-dimensional attribute data in the data acquisition module includes subject attributes, object attributes and environmental attribute data; the data preprocessing includes performing normalization processing on the subject attribute data, performing one-hot encoding on the object attributes and performing quantum random number generation operations on the environmental attribute data.

[0016] Preferably, the step of constructing a three-dimensional attribute tensor by the dynamic tensor processing module includes:

[0017] Establish tensor space according to subject attribute dimension, object attribute dimension and environment attribute dimension:

[0018]

[0019] Among them, D s D is the subject attribute dimension; oD is the object attribute dimension; e is the environmental attribute dimension;

[0020] Injection of quantum noise-resistant terms:

[0021]

[0022] Where q is the modulus; χ is the error distribution; is the lattice cryptographic noise tensor; is the original attribute tensor; LWE is the encrypted sampling operation based on the error learning problem.

[0023] Preferably, the step of dynamic rank decomposition includes:

[0024] Obtain network delay coefficient and dimension cardinality in real time;

[0025] Calculate the dynamic decomposition rank, the calculation formula is:

[0026]

[0027] Among them, α i and β i is the preset dimension weight parameter; i (t) is the network delay coefficient obtained in real time; D i The dimension base of the network delay coefficient obtained in real time;

[0028] The obtained dynamic decomposition rank is subjected to constrained Tucker decomposition, and the decomposition formula is:

[0029]

[0030] Where μ is the regularization coefficient, is the core tensor; U (s) 、U (o) and U (e) is the factor matrix of subject, object and environment dimensions; is the original three-dimensional attribute tensor; i is the dimension index variable.

[0031] Preferably, generating the access control policy matrix comprises the following steps:

[0032] The core tensor Expanded into matrix G (n) , where mode n corresponds to the strategic decision dimension;

[0033] Calculate the strategy weight matrix, the calculation formula is:

[0034] W=G (n) Φ+B;

[0035] Among them, Φ is the policy template matrix; B is the bias matrix;

[0036] Perform a policy activation operation on the obtained policy weight matrix:

[0037]

[0038] Among them, σ(.) is the quantum activation function; ⊙ is the Hadamard product; P ij is the access permission value of the i-th subject to the j-th object in the policy matrix, W ik is the element in the i-th row and k-th column of the policy weight matrix; is the element in the j-th column of the k-th dimensional factor matrix.

[0039] Preferably, the policy verification is implemented through a quantum-classical hybrid protocol, and the specific steps include:

[0040] Construct a uniform superposition state based on the dimension of the policy matrix, and the construction formula is:

[0041]

[0042] Among them, N is the dimension of the policy matrix; |x> is the computational basis state; |0> is the initial state of the auxiliary qubit;

[0043] Encode the access control policy matrix P into a quantum Hamiltonian, and the encoding formula is:

[0044]

[0045] Among them, P ij is the policy matrix element; |i><j| is the subject-object correlation projection operator; σ <​​​​​​​​​​​​​​​​​​​​​​​​​​​​​

[0051] Where q is the LWE modulus parameter; is the rounding operation; L is the LWE level parameter; LWE.Dec is the decryption algorithm based on the LWE problem.

[0052] Preferably, the dynamic update of the policy matrix is ​​achieved by the following steps:

[0053] receiving a verification feedback signal;

[0054] Construct the increment tensor;

[0055] Perform incremental factorization with forgetting factor;

[0056] Generate an updated policy matrix.

[0057] Preferably, cross-chain consistency maintenance of the policy matrix is ​​achieved through a quantum consensus protocol, and the specific steps include:

[0058] The consensus node hashes the local policy matrix with the random number and generates a quantum coherent state that carries the node identity information.

[0059] Based on orthogonal constraints, each participating node performs a joint low-rank decomposition of the cross-chain strategy tensor and outputs a unified factor matrix;

[0060] The verification node measures the fidelity of the received quantum state with the local copy and marks it as valid when it exceeds a dynamic threshold;

[0061] The main chain node performs Kronecker product operation on the verified factor matrix to generate a global consistency policy matrix.

[0062] Preferably, the step of strategy reconstruction includes:

[0063] The strategy evolution module calculates a composite threshold including a variance term and a maximum network delay based on the historical verification results of the quantum verification module, wherein the weight of the historical data decays exponentially;

[0064] When the number of verification failures continuously recorded by the quantum verification module exceeds the composite threshold, the strategy evolution module generates a full reconstruction instruction;

[0065] The dynamic tensor processing module performs time-weighted fusion of the historical core tensor and the incremental update tensor, and performs high-order singular value decomposition with orthogonal constraints;

[0066] The policy generation module regenerates the access control policy matrix from the reconstructed core tensor and synchronously updates it to the quantum verification module and the cross-chain synchronization module.

[0067] Preferably, the key management unit of the strategy evolution module implements a quantum key distribution mechanism, specifically including:

[0068] At the beginning of the strategy update cycle, an EPR entangled pair is generated by a quantum random number generator;

[0069] Transmitting the first quantum bit in the entangled pair to the quantum verification module through a quantum channel, and retaining the second quantum bit in the strategy evolution module;

[0070] When policy reconstruction is triggered, both parties perform a joint measurement on the stored qubits to generate a shared key;

[0071] The reconstructed policy matrix is ​​quantum-safely encrypted using a shared key.

[0072] The present invention provides a decentralized network access rights management system based on blockchain. It has the following beneficial effects:

[0073] 1. This invention constructs a dynamic policy matrix with environmental perception capabilities by integrating real-time network situation data with the global benchmark policy generated by federated learning, and adopts a gradient correction fusion algorithm to achieve balanced optimization of local policies and network consensus, solving the problem that traditional static policies are difficult to cope with changes in complex network environments. It then quantifies the matching degree of access requests through tensor inner product operations, supports fine-grained permission determination based on multi-dimensional attributes, and significantly improves the accuracy and scenario adaptability of access control.

[0074] 2. The cross-chain synchronization mechanism based on blockchain realizes the secure sharing and collaborative optimization of multi-network policy matrices. Through the difference-driven policy fusion algorithm and atomic exchange protocol, the reliability and consistency of policy updates between heterogeneous networks are ensured. By introducing quantum-resistant signatures and homomorphic encryption technologies, the confidentiality of policy transmission is guaranteed while improving the efficiency of cross-domain collaboration, effectively responding to collusion attacks and quantum computing threats in distributed networks.

[0075] 3. This invention adopts Byzantine fault-tolerant consensus and smart contract automated execution mechanism to eliminate the single point failure risk of traditional centralized authority management, and realizes distributed decision-making with privacy protection through zero-knowledge proof and secure multi-party computing, ensuring that sensitive identity information is not leaked during the verification process. It then combines Merkle tree evidence storage with quantum random number generation technology to provide tamper-proof audit tracking capabilities and enhance the transparency and credibility of the system decision-making process.

[0076] 4. The present invention integrates a dynamic threshold adjustment mechanism based on deep reinforcement learning, which can automatically optimize the alarm strategy according to the real-time network load and threat level. Combined with the temporal pattern analysis of the long-short-term memory network, it can achieve early and accurate identification of abnormal behavior. At the same time, the adaptive rollback mechanism quickly recovers to a stable strategy version through exponential decay weighting, and cooperates with the multi-node collaborative defense of the gossip protocol to greatly shorten the response time of security incidents and effectively curb the spread of attacks.

[0077] 5. This invention is based on the incremental knowledge update framework of federated learning. It continuously optimizes the policy model through actual combat feedback data collected by edge nodes, and then adopts the forgetting factor mechanism and clustering algorithm to realize the dynamic expansion of the policy library and the elimination of outdated knowledge, forming an access control system with self-evolution capability. At the same time, it uses the cross-chain semantic alignment layer to ensure the rapid dissemination and coordinated defense of new security threat characteristics, significantly improving the system's generalization ability to deal with unknown attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0078] Figure 1 Schematic diagram of the system architecture of the present invention. DETAILED DESCRIPTION

[0079] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0080] The following is a detailed description of each component in the system of the present invention.

[0081] In this embodiment, the data acquisition module utilizes a multi-source heterogeneous data fusion architecture, specifically comprising a subject attribute acquisition unit, an object attribute parsing unit, and an environmental state perception unit. This module leverages the collaboration of a physical sensor network and a logical data interface to extract full-dimensional features of the access control triple (subject-object-environment).

[0082] In this embodiment, the subject attribute collection unit is deployed on the user terminal device and is equipped with a digital certificate parser and a behavior pattern learner. The digital certificate parser decodes user identity information based on the X.509 standard and extracts structured data including but not limited to user role identifiers, permission level codes, and validity period timestamps. The behavior pattern learner uses a sliding time window to count user operation characteristics. In this embodiment, a Hamming window function is used to window the operation sequence:

[0083]

[0084] Where N is the window length; n is the current sampling point number, which is used to suppress spectrum leakage.

[0085] In this embodiment, the object attribute parsing unit is integrated into the resource node and includes a metadata extraction engine and a sensitivity evaluator. The metadata extraction engine uses deep packet inspection technology to analyze the attribute characteristics of the accessed resource, including but not limited to file type identification codes, data classification labels, and access mode flags. The sensitivity evaluator calculates resource weight coefficients based on a predefined policy table. Its core algorithm is:

[0086]

[0087] Among them, ω i is the weight parameter of the i-th rule in the strategy table; s i Score the matching degree between the current resource and the rule.

[0088] In this embodiment, the environmental state perception unit is composed of a distributed sensor network, including network quality probes and threat detection agents. The network quality probes periodically measure end-to-end transmission delay, bandwidth utilization, and packet loss rate, and perform noise suppression through a Kalman filter:

[0089]

[0090] Among them, F k is the state transfer matrix, K k is the Kalman gain coefficient; is the estimated value of the state at the kth moment; is the estimated value of the state at the k-1th moment; B k is the control input matrix; u k is the control input vector at the kth moment; z k is the actual observation value at the kth moment; H k is the observation matrix.

[0091] The threat detection agent analyzes network traffic characteristics in real time, and in the implementation mode, a convolutional neural network is used to extract attack behavior fingerprints.

[0092] In this embodiment, the data preprocessing subsystem is connected to the three acquisition units and is provided with a normalization processor and a feature fusion unit. The normalization processor performs Min-Max normalization processing on heterogeneous data:

[0093]

[0094] Among them, x is the original input data value; x min is the minimum value under the current data dimension; x max : is the maximum value under the current data dimension; x′ is the normalized output value.

[0095] And one-hot encoding conversion is used for enumerated data. The feature fusion device generates a three-dimensional feature vector through tensor splicing operation:

[0096]

[0097] Among them, s, o and e represent the subject, object and environment feature subvectors respectively; is the original tensor space.

[0098] In this embodiment, the secure data transmission channel utilizes a layered encryption mechanism, implementing quantum key distribution at the physical layer and deploying attribute-based encryption (ABE) at the application layer. In a preferred embodiment, the channel's transmission protocol stack complies with the IETF RFC8446 TLS1.3 standard and incorporates a lattice-based quantum-resistant signature algorithm during the handshake phase.

[0099] In this embodiment, the data acquisition module and the dynamic tensor processing module are connected via a high-throughput message queue. In a preferred embodiment, Apache Kafka middleware is used to implement the data pipeline. This module features a feedback control interface that receives verification result packets from the quantum verification module and dynamically adjusts the attribute acquisition frequency and feature extraction granularity.

[0100] In this embodiment, the dynamic tensor processing module uses an adaptive high-order tensor decomposition architecture, specifically comprising a tensor construction engine, a rank optimization controller, and a core tensor generation unit. This module transforms multi-source heterogeneous data into interpretable semantic tensor representations through spatiotemporal feature fusion and dynamic dimensionality reduction techniques.

[0101] In this embodiment, the tensor construction engine receives the three-mode feature vector stream from the data acquisition module and constructs a third-order dynamic tensor of subject (S) × object (O) × environment (E). In a preferred embodiment, the tensor element values ​​are calculated by combining feature similarity and spatiotemporal attenuation factors:

[0102]

[0103] Among them; i represents the eigenvector of the i-th subject; o j is the jth object feature vector; e k is the k-th environment state vector; λ is the attenuation coefficient; cos(·) calculates the cosine similarity; ||·||2 represents the Euclidean norm.

[0104] The tensor is stored in the compressed sparse row (CSR) format, and non-zero elements are quickly located through hash mapping.

[0105] In this embodiment, the rank optimization controller is provided with a dynamic dimension analysis unit, which realizes the adaptive selection of tensor rank based on the Akaike Information Criterion (AIC). The specific calculation process is:

[0106] AIC = 2k-2ln(L);

[0107] Where k = r s r o r e +d s r s +d o r o +d e r e is the total number of model parameters; r s ,r o ,r e Represent the decomposition rank of each mode; L is the likelihood function value.

[0108] The controller solves the optimal rank combination by alternating direction method of multipliers (ADMM) to satisfy:

[0109]

[0110] Among them, r s ,r o ,r e Represents the decomposition rank of each mode; d s , d o , d e are the original dimensions of subject characteristics, object characteristics, and environment characteristics respectively; AIC is the Akaike information criterion.

[0111] In this embodiment, the core tensor generation unit performs high-order singular value decomposition (HOSVD) with forgetting factor, and its mathematical model is expressed as follows:

[0112]

[0113] in, is the core tensor; is the modal factor matrix; n Represents an n-module product operation.

[0114] The decomposition process introduces exponential decay weights:

[0115] w t =exp(-η(t current -t gen ));

[0116] Where η is the forgetting factor; t gen Generate timestamps for data to achieve gradual forgetting of historical data, tcurrent The current system timestamp.

[0117] In this embodiment, the incremental update interface is connected to the strategy evolution module and receives the output gradient from the differential coupling equation. When the strategy matrix reconstruction instruction is detected, the interface performs weighted fusion of the core tensors:

[0118]

[0119] Among them, ω is the historical weight coefficient; Update the tensor incrementally; is the history kernel tensor.

[0120] The fusion process maintains dimensional consistency through tensor contraction operations. In the preferred embodiment, the Einstein summation convention is used to achieve efficient calculation. In this embodiment, the orthogonality constraint checker ensures that the column vectors of the factor matrix meet the orthogonality condition. Specifically, the decomposition results are post-processed through the Gram-Schmidt process. The check index is calculated as:

[0121]

[0122] Wherein, orthogonalization recalculation is triggered when ∈>τ; τ is the preset threshold; ||·|| F represents the Frobenius norm; U (s) , U (o) , U (e) are the modal factor matrices respectively; I is the unit matrix.

[0123] In this embodiment, the dynamic tensor processing module and the strategy generation module are connected via a low-latency bus, and the core tensor transmission adopts a block pipeline mechanism. In a preferred embodiment, the data encapsulation format complies with the IEEE 754 standard, and a cyclic redundancy check (CRC) code is added to the packet header to ensure transmission integrity.

[0124] In this embodiment, the policy generation module utilizes a tensor-driven policy synthesis architecture, specifically comprising a policy matrix builder, a quantum cryptography unit, and a distributed transmission controller. This module integrates high-order tensor operations with quantum cryptography to dynamically generate and securely distribute access control policies.

[0125] In this embodiment, the policy matrix constructor receives the core tensor from the dynamic tensor processing module Perform a three-module product operation to generate the basic policy matrix:

[0126]

[0127] Among them, U (s) 、U (o)、U (e) They are the subject, object, and environment factor matrices output by the dynamic tensor processing module respectively.

[0128] The constructor further normalizes the policy matrix through a nonlinear activation function:

[0129] P=σ(P base W+b);

[0130] Among them, P base is the basic strategy matrix; W is the weight matrix; b is the bias vector; σ(.) is the activation function.

[0131] In the implementation mode, the activation function σ(·) adopts a piecewise linear rectifier unit (PReLU), and its mathematical expression is:

[0132]

[0133] Among them, α is a learnable parameter, which is dynamically adjusted through the feedback signal of the strategy evolution module; x is the input value.

[0134] In this embodiment, the quantum encryption unit is provided with a key injection interface and a confusion operator. AB The unit performs quantum-safe encryption when:

[0135]

[0136] Where Nonce is a one-time random number, which is periodically updated by the differential equation generator of the strategy evolution module; P is the original strategy matrix; Hash(.) is a cryptographic hash function; It is a bitwise exclusive OR operation.

[0137] The obfuscation operator adopts a Feistel network structure and enhances the ciphertext diffusion characteristics through multiple rounds of iteration.

[0138] In this embodiment, the policy distribution controller includes a dual-channel transmission engine, which is connected to the quantum verification module and the policy evolution module respectively. The controller implements differentiated transmission strategies:

[0139] The quantum verification channel uses a lightweight UDP protocol to encapsulate the policy matrix, and the packet header is attached with a quantum fingerprint signature:

[0140] The strategy evolution channel uses a reliable TCP connection, and the data packet has a forward error correction code (FEC) embedded in it. In a preferred embodiment, a Reed-Solomon encoding scheme is used.

[0141] In this embodiment, the version management subsystem is equipped with a policy snapshot storage area to save the historical policy matrix in time series. When a reconstruction instruction of the cross-chain synchronization module is detected, the subsystem performs a policy rollback operation:

[0142]

[0143] Among them, β t is the time decay weight, satisfying ∑β t =1, k is the rollback window size; is the weighted sum of the most recent k+1 policy versions; P t It is the historical strategy matrix stored at the tth moment.

[0144] The weight calculation adopts the exponential moving average method:

[0145]

[0146] Among them, γ is the decay rate parameter, which is positively correlated with the network threat index; T is the current system timestamp; t is the historical moment identifier; k is the rollback window size; and i is the sum index.

[0147] In this embodiment, the metadata appending unit injects dimension description information, including but not limited to the tensor rank parameter, timestamp sequence, and data source identification code, into the policy matrix during encapsulation. The description information is encoded in ASN.1 format and integrity protected using the Elliptic Curve Digital Signature Algorithm (ECDSA).

[0148] In this embodiment, the policy generation module and the cross-chain synchronization module are connected through the blockchain smart contract interface. In the preferred embodiment, Hyperledger Fabric chain code is used to implement version consistency verification of the policy matrix. When a policy divergence between chains is detected, the module triggers a consensus protocol based on zero-knowledge proof:

[0149] Π zk =(Commit(P),Challenge,Response(P));

[0150] Among them, Πzk is the triple structure of the zero-knowledge proof protocol; Commit(P) is the commitment phase of the policy matrix P, which generates the Merkle tree root hash; Challenge is the random challenge value generated by the verifier; Response(P) is the response proof generated according to P.

[0151] In this embodiment, the quantum verification module utilizes a collaborative architecture of quantum state teleportation and classical post-processing, specifically comprising a quantum key distribution unit, a Bell state meter, and a CHSH inequality verifier. By combining the properties of quantum entanglement with classical cryptographic protocols, this module enables unconditional security verification of cross-chain access control policies.

[0152] In this embodiment, the quantum key distribution unit implements cross-node key negotiation based on the BB84 protocol and prepares a sequence of polarization state photons as information carriers. The sender randomly selects a basis vector to encode the quantum state:

[0153] |ψ>=cosθ|0>+e iφ sinθ|1>;

[0154] Among them, |0> and |1> are the ground states of the quantum bit; θ is the polarization angle parameter; φ is the phase angle parameter; e iφ is the phase factor.

[0155] After receiving the photon through the quantum channel, the receiver (Bob) randomly selects a measurement basis for projection measurement. The unit compares the basis vectors through the classical channel and selects the measurement results of the matching basis vectors as the original key.

[0156] In this embodiment, a Bell state measurement device is deployed at the verification relay node to perform a joint measurement of the transmitted quantum state. When an entangled pair is received from the requester and the resource party, a Bell basis measurement is performed:

[0157]

[0158] Among them, |0> and |1> are the quantum bit ground states; |Φ ± > and |Ψ ± >The maximum entangled state in the Bell state in the spatial mode symmetric state and the spatial mode antisymmetric state respectively

[0159] The measurement results are broadcast to participating nodes via classical channels to verify the integrity of the quantum state.

[0160] In this embodiment, the CHSH inequality verifier is provided with a correlation calculation unit to calculate the joint probability distribution of the measurement results. The verification index is calculated as:

[0161] S=|E(a,b)-E(a,b′)+E(a′,b)+E(a′,b′)|;

[0162] Where E(a,b) is the quantum correlation expectation value of measurement bases a and b; a and a′ are the two sets of measurement bases of the sender; b and b′ are the two sets of measurement bases of the receiver.

[0163] When the conditions are met, it is determined that the quantum entanglement characteristic exists, confirming that the transmission process is not subject to a man-in-the-middle attack.

[0164] In this embodiment, the quantum-classical hybrid signature unit receives the encryption policy matrix from the policy generation module and performs a layered signature operation. The quantum signature layer uses the quantum fingerprint algorithm:

[0165]

[0166] Where N is the total number of bits in the strategy matrix; P x is the binary value of the x-th bit of the strategy matrix; |x> is the ground state of the quantum register.

[0167] The classic signature layer adopts a lattice-based digital signature scheme, and the Dilithium algorithm is implemented in the preferred embodiment.

[0168] In this embodiment, the anti-interference relay subsystem is equipped with a quantum memory and a decoherence compensator. E(a, b) is the quantum correlation expectation value of the measurement bases a and b; a′ and the above quantum memory use rare earth doped crystals to realize photon state storage, and the storage time satisfies:

[0169]

[0170] Among them, L max is the maximum transmission distance of the quantum channel; c is the speed of light in vacuum; Δt process is the classic data processing delay.

[0171] The decoherence compensator maintains quantum state fidelity through dynamic phase correction technology.

[0172] In this embodiment, the verification result fusion unit receives the local judgment results from each verification node and adopts the Byzantine fault tolerance algorithm P x is the binary value of the xth bit of the strategy matrix; |x> is the quantum register ground state; N is the total number of bits in the strategy matrix to reach a global consensus. When more than the threshold proportion of nodes report that the verification is passed, a global confirmation signal is generated:

[0173]

[0174] Among them, N pass N is the number of nodes that have passed local verification; total is the total number of nodes participating in the verification; f is the Byzantine fault tolerance threshold.

[0175] In this embodiment, the quantum verification module and the strategy evolution module are connected through an in-band telemetry channel, and the verification success rate indicator is fed back in real time. The indicator serves as an adaptive adjustment parameter in the strategy evolution differential equation:

[0176] α t=α0·tanh(η·SuccessRate t );

[0177] Among them, η is the adjustment rate coefficient; SuccessRate t is the verification pass rate within the time window t; α0 is the initial adjustment coefficient; tanh(.) is the hyperbolic tangent function.

[0178] In this embodiment, the policy evolution module utilizes a differential equation-driven architecture integrated with reinforcement learning. Specifically, it includes a dynamic feedback regulator, a policy gradient calculation unit, and an evolutionary stability controller. This module analyzes feedback signals from the quantum verification module in real time to achieve autonomous optimization and adaptive adjustment of access control policies.

[0179] In this embodiment, the dynamic feedback regulator receives the verification success rate indicator SuccessRate from the quantum verification module t , construct the time-varying differential equation:

[0180]

[0181] Among them, W is the weight matrix of the strategy generation module; η is the learning rate parameter, is the loss function.

[0182] The loss function is defined as:

[0183]

[0184] Among them, λ1 and λ2 are balance coefficients, which are dynamically adjusted through the covariance matrix adaptive mechanism.

[0185] In this embodiment, the policy gradient calculation unit uses the Monte Carlo tree search algorithm to generate the policy optimization direction. For the current policy matrix, the policy gradient is calculated:

[0186]

[0187] Among them, θ represents the policy parameter; π θ is the policy function; R(τ) is the cumulative reward of trajectory τ; a t is the action at time t; s t is the state at time t; E is the expectation operator.

[0188] In one embodiment, the reward function R(τ) integrates verification latency, strategy execution success rate, and resource consumption indicators.

[0189] In this embodiment, the evolutionary stability controller is equipped with a Lyapunov function verification unit to ensure that the policy update process meets the stability conditions. Construct the energy function:

[0190]

[0191] Where ΔP=P t -P t-1 is the change of the strategy matrix; H is the Hessian matrix; ∈ is the damping coefficient; ΔP T is the transpose of the variation matrix.

[0192] When satisfied The policy update is allowed when the policy is updated, otherwise the rollback mechanism is triggered.

[0193] In this embodiment, the noise injection subsystem adds adaptive Gaussian noise during the policy update process:

[0194]

[0195] Among them, σ t is the noise intensity coefficient, which is negatively correlated with the strategy evolution speed; P t is the current strategy matrix; is the standard Gaussian distribution noise matrix.

[0196] The noise covariance matrix is ​​estimated in real time through a Kalman filter to ensure exploration-exploitation balance.

[0197] In this embodiment, the version backtracking unit works in conjunction with the version management subsystem of the policy generation module. When k consecutive verification failures are detected, a weighted backtracking of the policy matrix is ​​performed:

[0198]

[0199] Among them, P t-i is the strategy matrix of the i-th historical version; ω i is the weight coefficient of the i-th historical strategy; k is the size of the lookback window; i is the index of the historical strategy.

[0200] Among them, the weight ω i Calculated according to exponential decay distribution:

[0201]

[0202] Among them, the attenuation factor γ is positively correlated with the current network threat level and is obtained in real time through the threat intelligence interface; i is the index of the historical strategy; k is the size of the lookback window; j is the summation index; exp(.) is the exponential decay function.

[0203] In this embodiment, the cross-chain synchronization adapter receives the benchmark strategy matrix P from other chains. ref , calculate the strategy difference:

[0204]

[0205] in, <P,P ref > F is the Frobenius inner product of the matrix; ||P|| F is the Frobenius norm of the matrix.

[0206] When the difference exceeds the threshold δ, the strategy fusion based on federated learning is triggered:

[0207]

[0208] Among them, α is the local strategy retention coefficient; β is the fusion step size, which is dynamically optimized through the game theory model; P is the local current strategy matrix; is the gradient matrix of the policy difference D.

[0209] In this embodiment, the policy evolution module and quantum verification module exchange data via a timestamped verification result queue. In a preferred embodiment, Apache Kafka messaging middleware is used to achieve high-throughput asynchronous communication. Each verification result packet is appended with a quantum signature and policy version hash to ensure data integrity and traceability.

[0210] In this embodiment, the cross-chain synchronization module uses a federated learning framework to achieve collaborative optimization of multi-chain policy matrices. The module obtains the benchmark policy matrices of other chains in real time through the blockchain network and dynamically adjusts the local policy based on the policy difference index. The difference is calculated using the Frobenius inner product normalization method, and the specific formula is:

[0211]

[0212] Among them, <·,·> F represents the Frobenius inner product operation of the matrix, ||·|| F is the Frobenius norm.

[0213] This indicator effectively quantifies the similarity of policy matrices between different chains, and triggers the fusion mechanism when the difference exceeds the preset threshold δ.

[0214] In this embodiment, the strategy fusion adopts the gradient-corrected weighted fusion algorithm. By calculating the gradient of the strategy difference Combine the local retention coefficient α and the fusion step size β to generate a new strategy matrix:

[0215]

[0216] Among them, α is dynamically adjusted through the game theory model to balance the preservation of local features and the need for global consistency. Calculated by the automatic differentiation framework, it guides the strategy to evolve in the direction of reducing cross-chain differences.

[0217] In this embodiment, the federated learning process uses secure multi-party computation technology to protect the privacy of policy parameters. Each chain node exchanges an encrypted form of the policy matrix through homomorphic encryption and performs aggregation operations in a ciphertext state. The aggregation result is threshold decrypted to obtain the global baseline policy, ensuring that the original policy data is not leaked. Preferably, the Paillier homomorphic encryption algorithm is used to implement additive homomorphic operations.

[0218] In this embodiment, cross-chain communication uses an improved gossip protocol for efficient dissemination. Nodes encapsulate policy updates into packets with timestamps and digital signatures, broadcasting them to randomly selected neighboring nodes. After verifying the signature validity and timestamp freshness, the receiving nodes use a conflict resolution algorithm to process multiple policy versions, prioritizing the version with the highest hash value.

[0219] In this embodiment, policy version management uses a Merkle tree structure to achieve fast verification. Each policy update generates a corresponding Merkle proof, and other chain nodes can confirm the integrity of the policy by verifying the Merkle root hash. The version rollback mechanism is implemented through a weighted historical policy matrix:

[0220]

[0221] Among them, the weight coefficient ω i Calculated according to exponential decay distribution, ensuring that recent strategies have higher weights; P t-i is the strategy matrix of the i-th historical version; ω i is the weight coefficient of the i-th historical strategy; k is the size of the lookback window; i is the index of the historical strategy.

[0222] The attenuation factor γ is positively correlated with the network threat level, and the attenuation rate automatically increases when the threat level increases.

[0223] In this embodiment, the difference threshold uses an adaptive adjustment mechanism. The monitoring module collects the mean and variance of the historical difference sequence in real time. When changes in network environment stability are detected, the threshold is dynamically adjusted through a PID controller. Preferably, maximum and minimum threshold boundaries are set to prevent over-adjustment.

[0224] In this embodiment, the gradient correction term introduces a momentum acceleration mechanism. The exponential moving average of the historical gradient direction is retained, effectively suppressing local oscillations and accelerating convergence. The momentum coefficient is adaptively adjusted based on the frequency of strategy updates. The more frequent the update, the smaller the momentum value.

[0225] In this embodiment, cross-chain identity authentication utilizes an attribute-based encryption scheme. Each chain node maintains a set of attributes describing its own characteristics, and policy synchronization requests must satisfy the access control policy established by the target chain. Once verified, the policy matrix employs an identity-based encryption algorithm for end-to-end protection.

[0226] In this embodiment, the heterogeneous chain adaptation layer implements protocol conversion between different blockchain platforms. This layer includes a matrix normalization module that converts each chain's native policy matrix into a standardized floating-point tensor format. The semantic alignment module uses an attention mechanism to extract common features of cross-chain policies, eliminating the impact of different chain terminology systems.

[0227] In this embodiment, the strategy evolution process introduces Lyapunov stability constraints. Define the Lyapunov function:

[0228]

[0229] Where ΔP=P t -P t-1 is the change of the strategy matrix; H is the Hessian matrix; ∈ is the damping coefficient; ΔP T is the transpose of the variation matrix.

[0230] When it is detected that the negative definite condition is not met, the rollback mechanism is automatically triggered to load the historical stable version. The damping coefficient ∈ is dynamically adjusted according to the condition number of the Hessian matrix H.

[0231] In this embodiment, federated aggregation employs differential privacy protection. Before publishing the global baseline policy, noise with a Gaussian distribution is added to the aggregated results. The noise intensity is negatively correlated with the policy update frequency. A privacy budget allocation mechanism ensures that the overall privacy loss remains within a predetermined range.

[0232] In this embodiment, cross-chain verification uses quantum signature technology to ensure immutability. The policy matrix hash value is signed using a digital signature algorithm based on quantum random numbers, and the recipient verifies the signature validity using a quantum key distribution protocol. Preferably, the NIST post-quantum cryptography standard algorithm is used to achieve anti-quantum attack protection.

[0233] In this embodiment, the policy conflict detection module uses a formal verification method. Each chain's policy matrix is ​​converted into a linear temporal logic formula, and the compatibility of the policy combination is verified using a model checking tool. When a conflict is detected, the multi-chain negotiation protocol is initiated to regenerate a compatible policy.

[0234] In this embodiment, the resource adaptation module monitors network bandwidth and computational load. When resource constraints are detected, it automatically switches to a lightweight policy matrix format, employing tensor decomposition techniques to reduce data dimensionality. During synchronization, the synchronization prioritizes transmission of policy differences rather than the complete matrix, reducing communication overhead.

[0235] In this embodiment, a trusted execution environment (TEE) protects critical computing processes. Policy variance calculation and fusion algorithms are executed within the TEE secure enclave, ensuring that even if the host system is compromised, the original policy data will not be leaked. Preferably, the Intel SGX architecture is used for secure isolation.

[0236] In this embodiment, the threat intelligence interface acquires external security situation data in real time. As the threat level increases, the baseline policy's integration weight is automatically increased, enhancing cross-chain collaborative defense capabilities. This intelligence data is stored reliably through blockchain smart contracts to prevent tampering.

[0237] In this embodiment, the backtracking mechanism uses a sliding window to manage historical versions. The window size is dynamically adjusted based on the stability of the policy update, and when the update variance increases, the window is expanded to retain more historical versions. Version snapshots are regularly and persistently stored in the IPFS distributed file system to ensure traceability.

[0238] In this embodiment, the performance monitoring module collects metrics such as policy synchronization latency and computing resource consumption. When it detects that a node's load exceeds a threshold, it automatically offloads some computing tasks to edge nodes. The load balancing algorithm comprehensively considers node computing power, network latency, and energy consumption to allocate tasks.

[0239] In general, the workflow of the system of the present invention can be described as follows:

[0240] During the system initialization phase, each network node establishes its identity through a distributed key generation protocol, generating a blockchain account containing a public key hash. A quantum random number generator assigns a unique device fingerprint to each node, and an initial access policy matrix is ​​generated using an attribute-based encryption algorithm. After verification by a Byzantine Fault Tolerant consensus, the policy matrix is ​​written to the blockchain as the genesis block.

[0241] During network operation, the access control engine captures resource request events in real time. Once a request is triggered, the policy parsing unit extracts the requester's attribute certificate, behavioral characteristics, and environmental context, and verifies the certificate's validity through zero-knowledge proof. Once verified, the request parameters are mapped to the query vector of the policy matrix, and a tensor inner product operation is performed to calculate the access rights match.

[0242] The dynamic policy generation module is launched simultaneously to collect network threat intelligence, node reputation scores, and resource load status. It uses a federated learning framework to aggregate local policy gradients from multiple nodes, protecting parameter privacy through homomorphic encryption, and generates a global baseline policy matrix.

[0243] The access decision unit receives the match calculation results and the real-time policy matrix and uses a fuzzy logic engine for comprehensive evaluation. When the match exceeds a dynamic threshold, a multi-factor authentication process is triggered: a secondary verification process is performed using a combination of device biometrics, behavioral patterns, and geographic location. Verification data is decentralized and processed using a secure multi-party computing protocol to prevent sensitive information from being exposed.

[0244] During the policy execution phase, fine-grained access rules are automatically deployed through smart contracts. The resource gateway uses sandbox isolation technology to enforce policies and record complete operation traces. Sensitive operations trigger blockchain evidence storage, and operation logs are aggregated through a Merkle tree and written to a new block, providing an unalterable audit trail.

[0245] The anomaly detection module continuously monitors policy execution deviations and uses a long-short-term memory network to analyze the temporal characteristics of access patterns. When an anomaly is detected, an adaptive rollback mechanism is activated: historical policies are loaded based on exponentially decaying weights, and the anomaly event is broadcast via the gossip protocol, triggering coordinated defenses among neighboring nodes. Rollback decisions are validated by a practical Byzantine Fault Tolerance consensus to prevent interference from malicious nodes.

[0246] During the policy optimization loop, the reinforcement learning agent receives network status assessment reports and adjusts threshold parameters using a deep deterministic policy gradient algorithm. An experience pool stores historical state-action-reward tuples, and a prioritized experience replay mechanism accelerates convergence. The optimized parameters are updated across all nodes in the network via blockchain transactions to ensure policy consistency.

[0247] The cross-chain synchronization module periodically obtains benchmark policies from other blockchain networks, converts them into a unified representation through the semantic alignment layer, and then updates the local policy using a difference-driven fusion algorithm. Cross-chain interactions use the atomic swap protocol to ensure transaction atomicity, and failures automatically trigger a compensating transaction rollback.

[0248] The system's self-evolution mechanism collects policy execution feedback from edge computing nodes and employs an incremental clustering algorithm to identify new access patterns. Unknown patterns are trained using the federated learning framework to generate supplementary policy fragments, which are then incorporated into the main policy matrix after majority vote, completing the dynamic expansion of the knowledge base.

[0249] Throughout the entire process, quantum key distribution channels ensure secure inter-node communications, and quantum-resistant signature algorithms ensure the non-repudiation of policy update instructions. A resource load balancer dynamically allocates policy computation tasks, combining node computing power with network topology to optimize task scheduling and maintain efficient system operation.

[0250] Each functional module achieves decentralized collaboration through blockchain smart contracts, and policy changes require multi-party authorization through threshold signatures. A context-aware engine incorporates dynamic parameters such as network threat levels and node reputation into the decision-making process, forming a risk-adaptive and flexible access control system.

[0251] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A decentralized network access rights management system based on blockchain, characterized in that: include: The data acquisition module is used to collect multi-dimensional attribute data and pre-process it, and then output it to the dynamic tensor processing module; A dynamic tensor processing module receives data from the data acquisition module and constructs a three-dimensional attribute tensor, which is used to perform dynamic rank decomposition and then output a core tensor to the strategy generation module; A policy generation module, connected to the dynamic tensor processing module and the cross-chain synchronization module, generates an access control policy matrix based on the core tensor and transmits the policy matrix in parallel to the quantum verification module and the policy evolution module; The quantum verification module communicates bidirectionally with the strategy generation module and the data acquisition module to implement strategy verification and feed back the verification results to the data acquisition module to adjust the attribute acquisition parameters; The policy evolution module includes a key management unit, which is used to receive the output of the policy generation module and realize the dynamic update of the policy matrix; The cross-chain synchronization module connects the strategy generation module and the external blockchain node respectively, is used to perform cross-chain consistency maintenance of the strategy matrix, and transmits the synchronization results back to the strategy generation module to trigger strategy reconstruction.

2. A decentralized network access rights management system based on blockchain according to claim 1, characterized in that: The multi-dimensional attribute data in the data acquisition module includes subject attributes, object attributes and environmental attribute data; the data preprocessing includes performing normalization processing on the subject attribute data, performing one-hot encoding on the object attributes and performing quantum random number generation operations on the environmental attribute data.

3. The decentralized network access rights management system based on blockchain according to claim 1, characterized in that: The steps of constructing a three-dimensional attribute tensor by the dynamic tensor processing module include: Establish tensor space according to subject attribute dimension, object attribute dimension and environment attribute dimension: Among them, D s D is the subject attribute dimension; o D is the object attribute dimension; e is the environmental attribute dimension; Injection of quantum noise-resistant terms: Where q is the modulus; χ is the error distribution; is the lattice cryptographic noise tensor; is the original attribute tensor; LWE is the encrypted sampling operation based on the error learning problem.

4. The decentralized network access rights management system based on blockchain according to claim 1, characterized in that: The steps of dynamic rank decomposition include: Obtain network delay coefficient and dimension cardinality in real time; Calculate the dynamic decomposition rank, the calculation formula is: Among them, α i and β i is the preset dimension weight parameter; i (t) is the network delay coefficient obtained in real time; D i The dimension base of the network delay coefficient obtained in real time; The obtained dynamic decomposition rank is subjected to constrained Tucker decomposition, and the decomposition formula is: Where μ is the regularization coefficient, is the core tensor; U (s) 、U (o) and U (e) is the factor matrix of subject, object and environment dimensions; is the original three-dimensional attribute tensor; i is the dimension index variable.

5. The decentralized network access rights management system based on blockchain according to claim 1, characterized in that: Generating the access control policy matrix comprises the following steps: The core tensor Expanded into matrix G (n) , where mode n corresponds to the strategic decision dimension; Calculate the strategy weight matrix, the calculation formula is: W=G (n) F+B; Among them, Φ is the policy template matrix; B is the bias matrix; The obtained policy weight matrix performs the policy activation operation: Where σ(.) is the quantum activation function; ⊙ is the Hadamard product; P ij is the access permission value of the i-th subject to the j-th object in the policy matrix, W ik is the element in row i and column k of the strategy weight matrix; is the j-th column element in the k-th dimension factor matrix.

6. The decentralized network access rights management system based on blockchain according to claim 1, characterized in that: The strategy verification is achieved through a quantum-classical hybrid protocol, and the specific steps include: The uniform superposition state is constructed based on the strategy matrix dimension. The construction formula is: Where N is the dimension of the strategy matrix; x> is the computational basis state; |0> is the initial state of the auxiliary quantum bit; The access control policy matrix P is encoded as a quantum Hamiltonian, and the encoding formula is: Among them, P ij is an element of the strategy matrix; |i><j| is the subject-object association projection operator; σ x is the Pauli X gate operator; D s is the subject attribute dimension; D o is the object attribute dimension; The obtained uniform superposition state and quantum Hamiltonian are subjected to unitary evolution for time t and the acceptance probability is measured: Pr(accept)=||<ψ T |e -iHt |ψ0>|| 2 ; Among them, ψ T is the target quantum state; H is the strategy verification Hamiltonian; ψ0 is the initial quantum state; i is the imaginary unit; Decrypting the quantum measurement results using the forward-secure key SK Where q is the LWE modulus parameter; is the rounding operation; L is the LWE level parameter; LWE.Dec is the decryption algorithm based on the LWE problem.

7. The decentralized network access rights management system based on blockchain according to claim 1, characterized in that: The dynamic update of the policy matrix is ​​achieved by the following steps: receiving a verification feedback signal; Construct the increment tensor; Perform incremental factorization with forgetting factor; Generate an updated policy matrix.

8. The decentralized network access rights management system based on blockchain according to claim 1, characterized in that: The cross-chain consistency maintenance of the policy matrix is ​​achieved through the quantum consensus protocol. The specific steps include: The consensus node hashes the local policy matrix with the random number and generates a quantum coherent state that carries the node identity information. Based on orthogonal constraints, each participating node performs a joint low-rank decomposition of the cross-chain strategy tensor and outputs a unified factor matrix; The verification node measures the fidelity of the received quantum state with the local copy and marks it as valid when it exceeds a dynamic threshold; The main chain node performs Kronecker product operation on the verified factor matrix to generate a global consistency policy matrix.

9. The decentralized network access rights management system based on blockchain according to claim 1, characterized in that: The steps of strategy reconstruction include: The strategy evolution module calculates a composite threshold including a variance term and a maximum network delay based on the historical verification results of the quantum verification module, wherein the weight of the historical data decays exponentially; When the number of verification failures continuously recorded by the quantum verification module exceeds the composite threshold, the strategy evolution module generates a full reconstruction instruction; The dynamic tensor processing module performs time-weighted fusion of the historical core tensor and the incremental update tensor, and performs high-order singular value decomposition with orthogonal constraints; The policy generation module regenerates the access control policy matrix from the reconstructed core tensor and synchronously updates it to the quantum verification module and the cross-chain synchronization module.

10. The decentralized network access rights management system based on blockchain according to claim 1, characterized in that: The key management unit of the strategy evolution module implements a quantum key distribution mechanism, specifically including: At the beginning of the strategy update cycle, an EPR entangled pair is generated by a quantum random number generator; Transmitting the first quantum bit in the entangled pair to the quantum verification module through a quantum channel, and retaining the second quantum bit in the strategy evolution module; When policy reconstruction is triggered, both parties perform a joint measurement on the stored qubits to generate a shared key; The reconstructed policy matrix is ​​quantum-safely encrypted using a shared key.

Images