Energy financial data hierarchical encryption and dynamic authorization control method and system

Abstract

The invention provides an energy financial data hierarchical encryption and dynamic authorization control method and system, and relates to the technical field of energy financial data security management, and the method comprises the steps: carrying out the security level division of energy financial data, employing different encryption algorithms to generate secret keys, and carrying out the fragmentation storage of the secret keys; a user trust authorization system is constructed based on a block chain and an intelligent contract, a user identity is verified in combination with zero-knowledge proof, and a hierarchical authorization strategy is dynamically constructed according to a user credit score, so that the data security is effectively guaranteed, refined access control is realized, and the security and flexibility of energy financial data sharing and application are improved.

Description

Technical Field

[0001] This invention relates to the field of energy financial data security management technology, and in particular to a method and system for hierarchical encryption and dynamic authorization control of energy financial data. Background Technology

[0002] As the digital transformation of the energy industry deepens, energy companies have accumulated a large amount of financial data, which includes core information such as corporate operations, financial decisions, and strategic planning. Energy financial data has high commercial value and sensitivity, making its security protection an increasingly prominent issue. Traditional energy financial data management systems mainly adopt centralized data storage and fixed access control models, lacking flexibility and security in data encryption and access control.

[0003] Existing energy financial data encryption methods generally employ a uniform encryption strategy, failing to provide tiered protection based on the sensitivity and importance of the data. This results in insufficient security for critical data, while general data suffers from inefficient access due to over-protection. Traditional key management mechanisms are susceptible to single points of failure, as keys are typically stored centrally on a single server or database. If this storage point is compromised, the security of all encrypted data is completely lost, failing to effectively address the increasingly complex risks of cyberattacks and data breaches. Existing data access control models are mostly static authorization mechanisms, unable to dynamically adjust access permissions based on user behavior and credit status. They lack reliable user identity verification capabilities, hindering refined and personalized data sharing and collaboration, thus limiting the effective utilization and value extraction of energy financial data. Summary of the Invention

[0004] The present invention provides a method and system for hierarchical encryption and dynamic authorization control of energy financial data, which can solve the problems in the prior art.

[0005] In a first aspect, the present invention provides a method and system for hierarchical encryption and dynamic authorization control of energy financial data, which can at least solve some of the problems existing in the prior art.

[0006] A first aspect of the present invention provides a method for hierarchical encryption and dynamic authorization control of energy financial data, comprising: A security level score is generated for energy financial data. Energy financial data with a security level score greater than a preset security threshold is classified as high security level, and the rest are classified as low security level. Different encryption algorithms are used to generate a first encryption key for the high-security-level data and a second encryption key for the low-security-level data. The first encryption key and the second encryption key are distributed and stored in multiple security nodes using a sharding storage technology, and a key sharding index table is established. A user trust authorization blockchain is constructed based on smart contracts, and the key sharding index table is written into the user trust authorization blockchain; When a user's data access request is received, the authenticity of the user's identity is verified based on a zero-knowledge proof protocol. After the authenticity verification is passed, the user's credit score is calculated based on a multi-attribute decision algorithm. Based on the user credit score and combined with a multi-level permission tree, a hierarchical authorization strategy matching the user credit score is dynamically constructed to obtain authorized execution transaction data. The authorized execution transaction data is submitted to the user trust authorization blockchain for consensus verification. After the consensus verification is successful, the corresponding key shard location information is obtained from the key shard index table. Based on the key shard location information, an available key shard is obtained and the decryption key is reconstructed. The decryption key is used to decrypt the energy financial data and send it to the user.

[0007] Generating a first encryption key for the high-security-level data and a second encryption key for the low-security-level data using different encryption algorithms includes: The high-security data is constructed into a lattice basis matrix and orthogonalized to obtain orthogonal basis vectors. Random vectors are obtained by sampling using a discrete Gaussian distribution. The random vectors are used as the fully homomorphic encryption private key, and the linear combination of the orthogonal basis vectors and the random vectors is used as the fully homomorphic encryption public key to obtain the first encryption key. For low-security data, a prime-order elliptic curve is selected and its coefficients are determined using complex multiplication. A large prime-order base point is selected on the prime-order elliptic curve using a probability point counting algorithm. A random integer that satisfies the difficulty of the discrete logarithm of the elliptic curve is generated as the elliptic curve encryption private key. The scalar product of the elliptic curve encryption private key and the large prime-order base point is used as the elliptic curve encryption public key to obtain the second encryption key.

[0008] The first encryption key and the second encryption key are distributed and stored across multiple secure nodes using a sharding storage technique, and a key sharding index table is established, including: The first encryption key and the second encryption key are serialized into a key sequence. The length of the key sequence is divided by a preset unit fragment length to obtain the number of fragments. Based on a preset reconstruction threshold and the number of fragments, a key interpolation parameter is generated through a secret sharing algorithm. Based on the number of fragments, construct the same number of non-zero fragment identifiers, calculate the fragment value by performing Lagrange interpolation on the key sequence and the key interpolation parameters, and combine the non-zero fragment identifiers and the fragment value to generate key fragments; Select candidate security nodes with the same number of key fragments as target storage nodes, and construct a key fragment index table with the same length as the number of key fragments; transmit the key fragments to the corresponding target storage nodes for storage, and record the storage location information of the key fragments in the key fragment index table.

[0009] When a user's data access request is received, the authenticity of the user's identity is verified based on a zero-knowledge proof protocol. After the authenticity verification is successful, the user's credit score is calculated based on a multi-attribute decision algorithm, including: Upon receiving a user's data access request, an authentication random number and a verification challenge random value are generated and sent to the user; the user's private key is extracted from the data access request, and the user's private key and the authentication random number are exponentially calculated to generate an identity commitment value. The system receives a response value returned by the user. The response value is obtained by multiplying the authentication random number by the user's private key and the authentication challenge random value, and then adding them together. The response value is used as an exponent in the exponentiation formula to obtain a first verification value. The user's public key's authentication challenge random value is raised to the power of the identity commitment value to obtain a second verification value. When the first verification value is equal to the second verification value, the user's authenticity verification result is that the verification is successful. After the user's authenticity is verified, the user's transaction behavior data within a preset time period is obtained to form a user behavior feature vector and normalized. The maximum value of each dimension in the user behavior feature vector is used to form an ideal solution vector, and the minimum value is used to form a negative ideal solution vector. The Euclidean distance from the user behavior feature vector to the ideal solution vector and to the negative ideal solution vector are calculated and added together to obtain the user credit score.

[0010] Based on the user's credit score and combined with a multi-level permission tree, a hierarchical authorization strategy that dynamically matches the user's credit score is constructed, including: The range of the user credit score is divided into multiple consecutive score intervals, each of which has an upper limit and a lower limit; the score interval to which the user credit score belongs is determined as the current score interval. A multi-level permission tree is constructed, where the root node corresponds to the highest permission, the leaf nodes correspond to specific operation permissions, and the intermediate nodes correspond to permission categories. The score value range is mapped to a preset permission threshold range, and a corresponding permission threshold is set for each node. Based on a depth-first traversal strategy, nodes whose permission thresholds are less than the user's credit score are selected, added to the available permission set, and grouped according to their level to obtain a hierarchical authorization strategy.

[0011] Submitting the authorized execution transaction data to the user-trusted authorization blockchain for consensus verification includes: The basic permission value corresponding to each level of authorization strategy is calculated based on the preset hierarchical weight; the difference between the upper limit and the lower limit of the current scoring interval is calculated, and the dynamic adjustment factor is obtained by subtracting the lower limit of the interval from the user credit score and dividing by the difference; the dynamic adjustment factor is multiplied by the basic permission value, and the product is added to the basic permission value to obtain the actual authorized permission value; The user credit score, the current authorization policy level, the actual authorization permission value, and the timestamp are packaged to generate authorization execution transaction data. The authorization execution transaction data is then submitted to multiple consensus nodes in the user trust authorization blockchain to verify the correctness of the data and the compliance of the actual authorization permission, thereby obtaining a consensus verification result.

[0012] After consensus verification is successful, the corresponding key fragment location information is obtained from the key fragment index table. The process of obtaining available key fragments and reconstructing the decryption key based on the key fragment location information includes: After consensus verification is passed, the location information of available key shards is obtained from the key shard index table. Based on the location information, the available key shards are obtained in parallel. The access response latency of the available key shards is obtained. The ratio of the number of successful responses from the storage node to the total number of requests is used as the node response rate. The access response latency and the node response rate are weighted and calculated to obtain the credibility score of the available key shards. Determine the minimum number of fragments required to reconstruct the decryption key based on the current authorization policy level. Select the minimum number of available key fragments with the highest credibility score. Calculate the modulus and corresponding modulus quotient of all selected available key fragments. Calculate the multiplicative inverse of each modulus quotient under the corresponding modulus. Multiply the fragment value of all selected available key fragments by the corresponding modulus quotient and multiplicative inverse, sum the products, and take the remainder of the product of all moduli to obtain the decryption key.

[0013] A second aspect of the present invention provides a hierarchical encryption and dynamic authorization control system for energy financial data, comprising: The first unit is used to generate a security level score for energy financial data, classifying energy financial data with a security level score greater than a preset security threshold as high security level, and the rest as low security level. The second unit is used to generate a first encryption key for the high-security-level data and a second encryption key for the low-security-level data using different encryption algorithms. The first encryption key and the second encryption key are distributed and stored in multiple security nodes using a sharding storage technology, and a key sharding index table is established. The third unit is used to construct a user trust authorization blockchain based on smart contracts and write the key sharding index table into the user trust authorization blockchain. The fourth unit is used to verify the authenticity of the user's identity based on the zero-knowledge proof protocol when a user's data access request is received. After the authenticity verification is passed, the user's credit score is calculated based on the multi-attribute decision algorithm. The fifth unit dynamically constructs a hierarchical authorization strategy that matches the user's credit score based on the user's credit score and a multi-level permission tree. This yields authorized transaction data, which is then submitted to the user-trusted authorization blockchain for consensus verification. After successful consensus verification, the corresponding key shard location information is retrieved from the key shard index table. Available key shards are obtained based on the key shard location information, and the decryption key is reconstructed. The decryption key is then used to decrypt the energy financial data and send it to the user.

[0014] A third aspect of the embodiments of the present invention, An electronic device is provided, comprising: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0015] Fourth aspect of the present invention, A computer-readable storage medium is provided, having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0016] The beneficial effects of this application are as follows: This invention achieves intelligent assessment and classification management of data security levels through a hierarchical encryption and dynamic authorization control method for energy financial data. Differentiated encryption strategies are adopted for data with different security levels to effectively prevent the risk of data leakage.

[0017] By distributing key fragments across multiple secure nodes and combining them with blockchain technology to build a user trust and authorization system, a decentralized key management mechanism is formed, which significantly enhances the system's security and resistance to attacks, and avoids the risk of overall system collapse due to a single point of failure.

[0018] This invention implements user identity verification and credit assessment based on zero-knowledge proof and multi-attribute decision algorithm, and dynamically generates hierarchical authorization strategies that match user credit, establishing a flexible and efficient access control mechanism that not only ensures the security of high-value energy financial data, but also improves system resource utilization efficiency and user experience. Attached Figure Description

[0019] Figure 1 This is a flowchart illustrating the energy financial data hierarchical encryption and dynamic authorization control method according to an embodiment of the present invention; Figure 2 A schematic diagram of the user authentication and credit score calculation process. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0022] Figure 1 This is a flowchart illustrating the hierarchical encryption and dynamic authorization control method for energy financial data according to an embodiment of the present invention. Figure 1 As shown, the method includes: A security level score is generated for energy financial data. Energy financial data with a security level score greater than a preset security threshold is classified as high security level, and the rest are classified as low security level. Different encryption algorithms are used to generate a first encryption key for the high-security-level data and a second encryption key for the low-security-level data. The first encryption key and the second encryption key are distributed and stored in multiple security nodes using a sharding storage technology, and a key sharding index table is established. A user trust authorization blockchain is constructed based on smart contracts, and the key sharding index table is written into the user trust authorization blockchain; When a user's data access request is received, the authenticity of the user's identity is verified based on a zero-knowledge proof protocol. After the authenticity verification is passed, the user's credit score is calculated based on a multi-attribute decision algorithm. Based on the user credit score and combined with a multi-level permission tree, a hierarchical authorization strategy matching the user credit score is dynamically constructed to obtain authorized execution transaction data. The authorized execution transaction data is submitted to the user trust authorization blockchain for consensus verification. After the consensus verification is successful, the corresponding key shard location information is obtained from the key shard index table. Based on the key shard location information, an available key shard is obtained and the decryption key is reconstructed. The decryption key is used to decrypt the energy financial data and send it to the user.

[0023] In one optional implementation, generating a first encryption key for the high-security-level data using different encryption algorithms, and generating a second encryption key for the low-security-level data, includes: The high-security data is constructed into a lattice basis matrix and orthogonalized to obtain orthogonal basis vectors. Random vectors are obtained by sampling using a discrete Gaussian distribution. The random vectors are used as the fully homomorphic encryption private key, and the linear combination of the orthogonal basis vectors and the random vectors is used as the fully homomorphic encryption public key to obtain the first encryption key. For low-security data, a prime-order elliptic curve is selected and its coefficients are determined using complex multiplication. A large prime-order base point is selected on the prime-order elliptic curve using a probability point counting algorithm. A random integer that satisfies the difficulty of the discrete logarithm of the elliptic curve is generated as the elliptic curve encryption private key. The scalar product of the elliptic curve encryption private key and the large prime-order base point is used as the elliptic curve encryption public key to obtain the second encryption key.

[0024] Energy financial data is categorized based on data sensitivity and business importance. High-security data includes core financial information such as electricity trading contract amounts, renewable energy subsidy fund flows, bulk energy futures trading records, and financial budgets for power grid investment projects. Low-security data includes general financial data such as monthly electricity bills, electricity consumption statistics reports, equipment maintenance cost details, and daily office electricity costs. A data tagging mechanism automatically determines the security level of energy financial data, providing a foundation for subsequent differentiated encryption processing.

[0025] The construction of a lattice basis matrix for high-security-level energy financial data transforms sensitive financial information into a mathematical structure. Taking electricity trading contract data as an example, key values ​​such as contract amount of 58 million yuan, traded electricity volume of 12,000 MWh, contract term of 36 months, and risk deposit of 5.8 million yuan constitute a data set. These values ​​are arranged in a predefined order to form a four-dimensional vector [58000000, 12000, 36, 5800000], and then expanded into a 4×4 lattice basis matrix. The first row of the matrix is ​​the original data vector, and the second to fourth rows generate relevant vectors through linear transformations, ensuring that the matrix has full rank.

[0026] The orthogonalization of the lattice basis matrix employs an improved Gram-Schmidt algorithm to eliminate linear dependence between vectors. After orthogonalization, the row vectors of the original lattice basis matrix are mutually orthogonal, forming a standard orthogonal basis. Taking the lattice basis matrix of electricity trading data as an example, the orthogonal basis vector set obtained after orthogonalization maintains the mathematical properties of the original data and provides a stable mathematical foundation for subsequent key generation. The magnitude of the orthogonal basis vectors is controlled within a reasonable range to avoid numerical overflow or precision loss.

[0027] Discrete Gaussian distribution sampling provides randomness assurance for high-security encryption. Sampling parameters are set according to the accuracy requirements of energy financial data, with the standard deviation parameter set to 4.2 to ensure the generated random vector has good statistical properties. For electricity trading contract data, a random vector [-7, 3, -12, 8] is generated as the fully homomorphic encryption private key.

[0028] The fully homomorphic encryption public key is generated through a linear combination of orthogonal basis vectors and a random private key. During computation, each orthogonal basis vector is inner-producted with the private key vector, and an error term sampled from a narrow Gaussian distribution is added to the result. For electricity trading data, the linear combination yields the public key vector [245760, -18400, 144, -23200]. The addition of the error term enhances key security, making it difficult for attackers to deduce the private key information from the public key.

[0029] Low-security-level energy financial data is processed using elliptic curve cryptography. Monthly electricity bill data includes information such as electricity consumption of 1250 kWh, basic electricity fee of 85 yuan, electricity consumption charge of 312 yuan, and power factor adjustment fee of -15 yuan. This type of data is relatively low in sensitivity, but still requires appropriate encryption protection. Elliptic curve cryptography, while ensuring security, has high computational efficiency and is suitable for processing large amounts of daily financial data.

[0030] The choice of prime-order elliptic curves considers the computational power and security requirements of the energy finance system. A 256-bit prime number p = 2 is chosen. 256 - 2 224 +2 192 +2 96 -1, this prime number possesses excellent cryptographic properties. The elliptic curve equation takes the standard form y 2 = x 3 + ax + b, where parameters a and b are generated through complex multiplication to ensure that the curve has no known mathematical weaknesses. The curve parameters generated by complex multiplication are a = -3 and b = 5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B.

[0031] The base point of the elliptic curve is determined using a probabilistic point counting algorithm. The algorithm searches for points of large prime order on the elliptic curve and selects the point with coordinates G = (6B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296, 4FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5) as the base point. The order of this base point, n = FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551, is a 256-bit prime number.

[0032] Elliptic curve private key generation employs a cryptographically secure pseudo-random number generator. For monthly electricity bill data, the generated private key is d = A2B4C6D8E0F1A3B5C7D9E1F3A5B7C9D1E3F5A7B9C1D3E5F7A9B1C3D5E7F9A1B3C5D7E9F1. The randomness of the private key ensures the security of the encryption system, preventing key cracking through statistical analysis or other methods. The private key length matches the security parameters of the elliptic curve, providing 256 bits of security strength.

[0033] The elliptic curve public key is calculated using scalar multiplication. The private key *d* is multiplied by the base point *G* to obtain the public key *Q* = *d* *G*. The scalar multiplication is implemented using binary expansion and a doubling-add algorithm, resulting in *Q* = (8F68B9D2C3E4F5A6B7C8D9E0F1A2B3C4D5E6F7A8B9C0D1E2F3A4B5C6D7E8F9A0B1, C2D3E4F5A6B7C8D9E0F1A2B3C4D5E6F7A8B9C0D1E2F3A4B5C6D7E8F9A0B1C2D3E4F5). The computational complexity of the public key is based on the difficulty of the elliptic curve discrete logarithm problem, providing sufficient cryptographic protection for low-security energy financial data.

[0034] In one optional implementation, the first encryption key and the second encryption key are distributed and stored across multiple secure nodes using a sharding storage technique, and a key sharding index table is established, including: The first encryption key and the second encryption key are serialized into a key sequence. The length of the key sequence is divided by a preset unit fragment length to obtain the number of fragments. Based on a preset reconstruction threshold and the number of fragments, a key interpolation parameter is generated through a secret sharing algorithm. Based on the number of fragments, construct the same number of non-zero fragment identifiers, calculate the fragment value by performing Lagrange interpolation on the key sequence and the key interpolation parameters, and combine the non-zero fragment identifiers and the fragment value to generate key fragments; Select candidate security nodes with the same number of key fragments as target storage nodes, and construct a key fragment index table with the same length as the number of key fragments; transmit the key fragments to the corresponding target storage nodes for storage, and record the storage location information of the key fragments in the key fragment index table.

[0035] The serialization process for energy financial data encryption keys converts fully homomorphic encryption keys and elliptic curve encryption keys into a unified data format. For example, converting the first encryption key (private key) and the second encryption key (public key) of RSA-2048 bits into a sequence of byte streams yields a key sequence with a total length of 512 bytes.

[0036] Next, the number of key fragments is determined. Assuming the preset unit fragment length is 128 bytes, dividing the total key sequence length of 512 bytes by 128 bytes yields a fragment number of 4. At this point, a preset reconstruction threshold is also set; for example, setting the reconstruction threshold to 3 means that at least 3 key fragments are needed to reconstruct the complete key.

[0037] Key interpolation parameters are generated based on a secret sharing algorithm. A finite field is chosen, for example, a large prime number p=2. 256 -189, and randomly generate two random coefficients a1=75826 and a2=94103 on this finite field to represent the reconstruction threshold minus one (i.e., two) as key interpolation parameters. These parameters, together with the original key sequence, constitute a polynomial f(x), where the key sequence is the constant term and a1 and a2 are the coefficients of the first and second terms, respectively.

[0038] Construct the same number of non-zero fragment identifiers based on the number of fragments. For example, assign identifier values ​​1, 2, 3, and 4 to the four fragments respectively. These identifier values ​​ensure that each key fragment is unique and non-zero, to meet the requirements of subsequent Lagrange interpolation calculations.

[0039] Lagrange interpolation is used to calculate the fragment values. For each fragment identifier x, the value of f(x) is calculated. For example, for the fragment with identifier 1, f(1) is calculated; for the fragment with identifier 2, f(2) is calculated; and so on. The result is the corresponding fragment value. Specifically, if the original key sequence value is S, then f(x) = S + a1·x + a2·x 2 The calculation is performed over a finite field p. For example, the fragment value corresponding to fragment identifier 1 is f(1) = S + a1·1 + a2·1 2= S + 75826 + 94103 = S + 169929.

[0040] The non-zero fragment identifier and fragment value are combined to generate key fragments. For example, the first key fragment consists of identifier 1 and the corresponding fragment value f(1); the second key fragment consists of identifier 2 and the corresponding fragment value f(2); and so on. Each key fragment contains two parts of information: an identifier and the corresponding fragment value.

[0041] Select candidate security nodes as target storage nodes. Choose four nodes from the available security node pool, ensuring that these nodes have sufficient security and reliability. For example, you can select four servers with IP addresses 192.168.1.101, 192.168.1.102, 192.168.1.103, and 192.168.1.104 as target storage nodes.

[0042] Construct a key fragment index table. This index table contains 4 records, each corresponding to the storage information of a key fragment. The structure of the index table includes fields such as fragment ID, node identifier, and storage path. For example, the first record of the index table contains: fragment ID=1, node identifier=192.168.1.101, and storage path= / secure / keys / fragment1.bin.

[0043] The key fragments are transmitted to their respective target storage nodes for storage. The first key fragment is transmitted to node 192.168.1.101, the second to node 192.168.1.102, and so on, via a secure communication channel (such as a TLS encrypted connection). An encrypted transmission protocol is used during transmission to ensure the security of the fragments during the process.

[0044] The storage location information of the key fragments is recorded in the key fragment index table. After each fragment is successfully stored, the status field of the corresponding record in the index table is updated and marked as "stored". At the same time, the timestamp of storage completion is recorded, such as "2023-05-15 14:30:22", as the basis for fragment management and maintenance.

[0045] When the complete key is needed, at least three key fragments (i.e., the number of reconstruction thresholds) can be found according to the key fragment index table. The identifiers and fragment values ​​of these fragments can be obtained, and the original key sequence can be reconstructed using the Lagrange interpolation algorithm. For example, if three key fragments with identifiers 1, 2, and 4 are obtained, Lagrange interpolation can be performed on these three points (1, f(1)), (2, f(2)), and (4, f(4)) to restore the original polynomial f(x), and the constant term is the original key sequence.

[0046] To ensure system fault tolerance, the status of each node is checked periodically when a storage node fails. If node 192.168.1.103 is found to be inaccessible, a new node (such as 192.168.1.105) is selected from the backup node pool, the corresponding key fragment is regenerated, and the relevant information in the key fragment index table is updated to ensure that the availability of key fragments is not affected by a single point of failure.

[0047] Through the above technical means, highly secure distributed storage of keys is achieved. Even if some storage nodes are compromised or fail, the security and availability of keys can be guaranteed, effectively preventing key leakage and single point of failure risks.

[0048] In one optional implementation, when a user's data access request is received, the authenticity of the user's identity is verified based on a zero-knowledge proof protocol. After the authenticity verification is successful, the user's credit score is calculated based on a multi-attribute decision algorithm, including: Upon receiving a user's data access request, an authentication random number and a verification challenge random value are generated and sent to the user; the user's private key is extracted from the data access request, and the user's private key and the authentication random number are exponentially calculated to generate an identity commitment value. The system receives a response value returned by the user. The response value is obtained by multiplying the authentication random number by the user's private key and the authentication challenge random value, and then adding them together. The response value is used as an exponent in the exponentiation formula to obtain a first verification value. The user's public key's authentication challenge random value is raised to the power of the identity commitment value to obtain a second verification value. When the first verification value is equal to the second verification value, the user's authenticity verification result is that the verification is successful. After the user's authenticity is verified, the user's transaction behavior data within a preset time period is obtained to form a user behavior feature vector and normalized. The maximum value of each dimension in the user behavior feature vector is used to form an ideal solution vector, and the minimum value is used to form a negative ideal solution vector. The Euclidean distance from the user behavior feature vector to the ideal solution vector and to the negative ideal solution vector are calculated and added together to obtain the user credit score.

[0049] like Figure 2 As shown, the method includes: The receipt of energy financial data access requests triggers a user authentication process. When a power trader requests access to large-scale power contract financial data or a financial analyst inquires about the flow of renewable energy subsidy funds, a zero-knowledge proof authentication mechanism is automatically initiated. The data access request includes information such as the user's identity, the requested data type, the access permission level, and a timestamp. The request content is parsed to determine whether the energy financial data the user is attempting to access belongs to a high-security or low-security level, and appropriate parameters are set for the strength of subsequent authentication.

[0050] The authentication random number and authentication challenge random value are generated using a cryptographically secure random number generator. For requests to access electricity trading contract data, a 256-bit authentication random number r = 0x7A8B9C2D3E4F5A6B7C8D9E0F1A2B3C4D5E6F7A8B9C0D1E2F3A4B5C6D7E8F9A0B1C2 is generated, ensuring uniqueness for each authentication process. The authentication challenge random value c = 0x9F8E7D6C5B4A39281726354A3B2C1D0E9F8E7D6C5B4A39281726354A3B2C1D0E is generated using a different random seed to avoid the security risks associated with reusing random numbers. Both random values ​​are sent to the user through a secure channel to initiate the authentication process.

[0051] The user's private key is retrieved from the authentication information of the data access request. The power trader's private key, sk = 0x2B1A3C5D7E9F1B3D5F7A9C1E3A5C7E9B1D3F5A7C9E1B3D5F7A9C1E3A5C7E9B, is stored in a secure hardware token and included in the access request via a digital signature. After verifying the validity of the digital signature, the user's private key is retrieved. The exponentiation of the private key and the authentication random number is performed within a finite field to calculate the commitment value, commitment = g. sk×r mod p, where g is the preset generator and p is the modulus of a large prime number. The calculation result is commitment = 0x4F2E8D1C5A9B7E6F3D8C2A1E7B9F4D2A8E1C5F9B3D7E2A8F1C5B9E3D7A2F8C.

[0052] The calculation of the user's response value follows the standard procedure of a zero-knowledge proof protocol. The user multiplies the authentication random number r by the private key sk and the authentication challenge random value c, respectively, and then adds the two products to obtain the response value response = rsk + ck, where k is a temporary random number chosen by the user. For the power trader's authentication, the temporary random number k = 0x8A7B6C5D4E3F2A1B9C8D7E6F5A4B3C2D1E0F9A8B7C6D5E4F3A2B1C0D9E8F7A6B, and the calculated response value response = 0x1E9D8C7B6A594837261504392837465019283746502837465192837465028374666.

[0053] The first verification value is calculated by using the user's response value as the exponent in an exponential operation. The first verification value is calculated as value1 = g. response mod p, where the response value is the exponent and g is the same generator used in calculating the identity commitment value. For the power trader's verification process, the first verification value is calculated as value1 = 0x8F7E6D5C4B3A29180F1E2D3C4B5A69780F1E2D3C4B5A69780F1E2D3C4B5A6978. This value represents the mathematical proof of the user's declared identity.

[0054] The second verification value is calculated using a combination of the user's public key and an identity commitment value. User public key pk = g sk modp, a public key verification challenge, calculates the power of a random value (pk). c Then multiply it by the identity commitment value to obtain the second verification value value2 = pk c × commitment mod p. The power trader's public key is pk = 0x3D2C1B0A99887766554433221100FFEEDDCCBBAA99887766554433221100FF, and the calculated second verification value value2 = 0x8F7E6D5C4B3A29180F1E2D3C4B5A69780F1E2D3C4B5A69780F1E2D3C4B5A6978.

[0055] The authentication result is determined by comparing a first verification value with a second verification value. When value1 equals value2, it proves that the user indeed possesses the corresponding private key, and authentication is successful. In the power trader's verification process, the two verification values ​​are completely equal, confirming the user's authentic identity. The zero-knowledge proof protocol ensures that the user's private key information is not leaked during the verification process, while providing strong identity authentication protection for the system.

[0056] User transaction behavior data acquisition covers energy financial activity records within a preset time period. Data on electricity traders' transaction behavior over the past six months is collected, including dimensions such as electricity contract transaction frequency, transaction amount volatility coefficient, risk control compliance rate, fund settlement timeliness, and credit record integrity. Transaction frequency records show an average of 15 large-scale electricity transactions per month; a transaction amount volatility coefficient of 0.23 indicates relatively stable price fluctuations; a risk control compliance rate of 98.5%; an average fund settlement timeliness of 2.3 days; and a credit record integrity score of 92.

[0057] The construction of the user behavior feature vector integrates multi-dimensional data into a standardized vector. The original behavioral data of power traders [15, 0.23, 98.5, 2.3, 92] constitutes a five-dimensional feature vector, with each dimension representing different behavioral characteristic indicators. The normalization process adopts the min-max normalization method, mapping the values ​​of each dimension to the interval between 0 and 1. The normalized value of trading frequency is (15-5) / (25-5) = 0.5, the normalized value of volatility coefficient is (0.23-0.1) / (0.4-0.1) = 0.43, the normalized value of compliance rate is (98.5-85) / (100-85) = 0.9, the normalized value of settlement timeliness is (5-2.3) / (5-1) = 0.675, and the normalized value of credit record is (92-60) / (100-60) = 0.8.

[0058] The ideal and negative ideal vectors are constructed based on the extreme values ​​of each dimension of the user behavior feature vector. The normalized feature vectors of all users are analyzed, and the maximum values ​​of each dimension are extracted to form the ideal vector ideal = [1.0, 0.1, 1.0, 1.0, 1.0], and the minimum values ​​form the negative ideal vector negative = [0.0, 1.0, 0.0, 0.0, 0.0]. The ideal vector represents the optimal user behavior pattern, and the negative ideal vector represents the worst behavior pattern; together, they form the benchmark for score calculation.

[0059] The Euclidean distance is used to quantify the similarity between user behavior feature vectors and ideal and negative ideal solutions. The Euclidean distance from the user feature vector [0.5, 0.43, 0.9, 0.675, 0.8] to the ideal solution vector is calculated by taking the square root of the sum of the squares of the differences in each dimension, with the distance value being sqrt((0.5-1)). 2 + (0.43-0.1) 2 + (0.9-1) 2 + (0.675-1) 2 + (0.8-1) 2 =0.67. The Euclidean distance to the negative ideal solution vector is calculated as sqrt((0.5-0)). 2 + (0.43-1) 2 + (0.9-0) 2 +(0.675-0) 2 + (0.8-0) 2 = 1.52.

[0060] The user credit score is calculated by adding two Euclidean distances and then standardizing the result. The power trader's credit score is calculated using the formula: score = (distance_to_negative / (distance_to_ideal + distance_to_negative)) × 1000, resulting in (1.52 / (0.67 + 1.52)) × 1000 = 694 points. The score ranges from 0 to 1000; a higher score indicates that the user's behavior is closer to the ideal pattern and their creditworthiness is better. This score will serve as an important basis for the subsequent dynamic authorization strategy.

[0061] In one optional implementation, based on the user's credit score and in conjunction with a multi-level permission tree, a hierarchical authorization strategy that matches the user's credit score is dynamically constructed, including: The range of the user credit score is divided into multiple consecutive score intervals, each of which has an upper limit and a lower limit; the score interval to which the user credit score belongs is determined as the current score interval. A multi-level permission tree is constructed, where the root node corresponds to the highest permission, the leaf nodes correspond to specific operation permissions, and the intermediate nodes correspond to permission categories. The score value range is mapped to a preset permission threshold range, and a corresponding permission threshold is set for each node. Based on a depth-first traversal strategy, nodes whose permission thresholds are less than the user's credit score are selected, added to the available permission set, and grouped according to their level to obtain a hierarchical authorization strategy.

[0062] User credit scores are divided into multiple consecutive score ranges, each with a clearly defined upper and lower limit. The score range of 0 to 1000 is divided into five intervals: the first interval covers 0 to 200 points, corresponding to very low credit level; the second interval covers 201 to 400 points, corresponding to low credit level; the third interval covers 401 to 600 points, corresponding to medium credit level; the fourth interval covers 601 to 800 points, corresponding to high credit level; and the fifth interval covers 801 to 1000 points, corresponding to very high credit level. After receiving a user's specific credit score, an interval determination algorithm is used to determine the score range to which the score belongs as the current score range. For example, if a user's credit score is 530 points, this score falls within the third interval, therefore the current score range is determined to be the medium credit level range.

[0063] The multi-level permission tree is constructed using a tree-like data structure. The root node represents the highest management authority in the system, intermediate nodes represent different permission categories, and leaf nodes correspond to specific operation permissions. The permission tree contains four main levels: the first level is the root node level, which contains system management permission nodes; the second level is the permission domain classification level, which contains three category nodes: transaction permission domain, query permission domain, and management permission domain; the third level is the permission subclass level, where the transaction permission domain includes transfer permission subclasses, payment permission subclasses, and withdrawal permission subclasses; the query permission domain includes account query subclasses and transaction record query subclasses; and the management permission domain includes user management subclasses and system configuration subclasses; the fourth level is the specific operation permission level, where the transfer permission subclass includes specific operation permission nodes such as single transfer, batch transfer, and interbank transfer.

[0064] The mapping relationship between the scoring value range and the permission threshold range is established through a preset mapping table. The first range corresponds to the permission threshold range of 0 to 200, the second range to 201 to 400, the third range to 401 to 600, the fourth range to 601 to 800, and the fifth range to 801 to 1000. Each node in the permission tree is assigned a corresponding permission threshold. The root node's permission threshold is set to 1000, the transaction permission domain node's permission threshold is set to 600, the query permission domain node's permission threshold is set to 200, and the management permission domain node's permission threshold is set to 800. The permission threshold for the transfer permission sub-category node is 500, the payment permission sub-category node's permission threshold is 400, and the withdrawal permission sub-category node's permission threshold is 700. The permission threshold for the single transfer operation permission node is 300, the batch transfer operation permission node's permission threshold is 600, and the interbank transfer operation permission node's permission threshold is 800.

[0065] A depth-first traversal strategy is applied to the node selection process in the permission tree. The traversal algorithm starts from the root node and visits each child node layer by layer, comparing the node's permission threshold with the user's credit score. For a user with a credit score of 530, the traversal process finds that the root node's permission threshold of 1000 is greater than 530, so this node is not added to the available permission set. The transaction permission domain node's permission threshold of 600 is greater than 530, so this node is not added. The query permission domain node's permission threshold of 200 is less than 530, so this node is added to the available permission set. The management permission domain node's permission threshold of 800 is greater than 530, so this node is not added. Continuing to traverse the child nodes of the query permission domain, the account query sub-node's permission threshold of 150 is less than 530, and the transaction record query sub-node's permission threshold of 250 is less than 530; both of these nodes are added to the available permission set.

[0066] Nodes in the available permission set are grouped according to their hierarchy in the permission tree. Second-level query permission domain nodes are grouped into second-level permission groups, and third-level account query subclass nodes and transaction record query subclass nodes are grouped into third-level permission groups. Continuing to traverse deeper levels, the basic account information query node under the account query subclass has a permission threshold of 100, the detailed account information query node has a permission threshold of 300, and the balance query node has a permission threshold of 150. Since the permission thresholds of these three nodes are all less than 530, they are grouped into fourth-level permission groups. Similarly, the recent transaction record query node under the transaction record query subclass has a permission threshold of 200, and the historical transaction record query node has a permission threshold of 400. Since the permission thresholds of these two nodes are both less than 530, they are also grouped into fourth-level permission groups.

[0067] The tiered authorization strategy is built upon the results of hierarchical grouping. The second-tier permission group contains the query permission domain, indicating that the user has basic query-related permissions. The third-tier permission group contains account query subclasses and transaction record query subclasses, indicating that the user has categorized permissions for account query and transaction record query within the query permission domain. The fourth-tier permission group contains specific operation permissions such as basic account information query, balance query, recent transaction record query, and historical transaction record query, indicating that the user can execute these specific query operations. The authorization strategy also includes permission inheritance rules; after a user obtains permissions at a certain level, they automatically inherit the corresponding permissions at all sub-levels under that level.

[0068] The dynamic adjustment mechanism of permission thresholds ensures that the authorization strategy can adapt to changes in the user's credit score. When a user's credit score increases from 530 to 650, a depth-first traversal is re-executed. If the permission threshold for the transaction permission domain node is found to be less than 650 (600), this node and its child nodes are re-evaluated and added to the available permission set. For the transfer permission sub-category node (permission threshold 500 < 650) and the payment permission sub-category node (permission threshold 400 < 650), these two nodes are added to the third-level permission group. For the single transfer operation permission node (permission threshold 300 < 650) and the batch transfer operation permission node (permission threshold 600 < 650), these two nodes are added to the fourth-level permission group. However, for the interbank transfer operation permission node (permission threshold 800 > 650), this node is not added. The updated tiered authorization strategy provides users with a wider range of operational permissions, including basic transfer and payment functions, while maintaining permission boundary control that matches the credit score.

[0069] In one optional implementation, submitting the authorized execution transaction data to the user-trusted authorization blockchain for consensus verification includes: The basic permission value corresponding to each level of authorization strategy is calculated based on the preset hierarchical weight; the difference between the upper limit and the lower limit of the current scoring interval is calculated, and the dynamic adjustment factor is obtained by subtracting the lower limit of the interval from the user credit score and dividing by the difference; the dynamic adjustment factor is multiplied by the basic permission value, and the product is added to the basic permission value to obtain the actual authorized permission value; The user credit score, the current authorization policy level, the actual authorization permission value, and the timestamp are packaged to generate authorization execution transaction data. The authorization execution transaction data is then submitted to multiple consensus nodes in the user trust authorization blockchain to verify the correctness of the data and the compliance of the actual authorization permission, thereby obtaining a consensus verification result.

[0070] The difference between the upper and lower limits of the current credit score interval forms the basis for calculating the dynamic adjustment factor. A user's credit score is 530, falling within the third interval. The lower limit of this interval is 401, and the upper limit is 600, with a difference of 199. The dynamic adjustment factor is calculated by subtracting the lower limit from the user's credit score (530 - 401 = 129), then dividing 129 by the interval difference of 199, resulting in a dynamic adjustment factor of approximately 0.649. The dynamic adjustment factor reflects the relative position of the user's credit score within the current interval; a value closer to 1 indicates that the user's credit score is closer to the upper limit of the interval, and the more pronounced the dynamic adjustment effect.

[0071] The calculation of the actual authorized permission value combines the dynamic adjustment factor with the base permission value. Multiplying the base permission value of 160 (query permission domain node) by the dynamic adjustment factor 0.649 yields a dynamic adjustment increment of approximately 104. This increment is then added to the base permission value of 160, resulting in an actual authorized permission value of 264. Multiplying the base permission value of 90 (account query sub-category node) by the dynamic adjustment factor 0.649 yields a dynamic adjustment increment of approximately 58. The resulting actual authorized permission value is 148. Multiplying the base permission value of 40 (basic account information query node) by the dynamic adjustment factor 0.649 yields a dynamic adjustment increment of approximately 26. The resulting actual authorized permission value is 66. This dynamic adjustment mechanism ensures that users receive differentiated permission configurations at different rating positions within the same credit range.

[0072] The process of packaging authorized transaction data integrates the user credit score, current authorization policy level, actual authorized authority value, and timestamp into a unified data structure. The user credit score of 530 is encoded as a four-byte integer, the current authorization policy level L3 is encoded as a single-byte enumeration value, and the actual authorized authority value of 264 is encoded as a four-byte floating-point number. The timestamp records the precise time of transaction data generation using a standard time format, accurate to the millisecond level. Data packaging uses a serialization algorithm to combine various data items according to a predefined format, generating a fixed-length transaction data packet. The transaction data packet also includes a data integrity check code, which uses a hash algorithm to perform a digest calculation on the core data, ensuring data integrity during transmission.

[0073] The consensus node's verification mechanism performs multiple checks on authorized transaction data. Data correctness verification includes data format verification, numerical range verification, and timestamp validity verification. Data format verification confirms that the user's credit score is a valid numerical type within the range of 0 to 1000, the current authorization strategy level is a predefined enumerated value, and the actual authorized permission value is a positive number that meets numerical precision requirements. Numerical range verification confirms the matching relationship between the actual authorized permission value and the user's credit score, and verifies whether the calculation result of the dynamic adjustment factor is within a reasonable range. Timestamp validity verification confirms that the difference between the transaction data generation time and the current time is within the allowed time window, preventing replay attacks and the submission of expired data.

[0074] Actual authorized permission compliance verification ensures that the calculated permission values ​​conform to the system security policy. Compliance verification includes permission cap checks, permission growth rationality checks, and historical permission change trend analysis. The permission cap check verifies that the actual authorized permission value does not exceed the maximum allowed permission value corresponding to the user's credit score range. For users in the third range, the maximum allowed permission value is set to 600. The permission growth rationality check verifies that the dynamically adjusted permission growth rate is within a preset reasonable range to prevent abnormal fluctuations in permission values. Historical permission change trend analysis identifies abnormal patterns in permission changes by comparing the user's historical permission records, uncovering potential malicious behavior or system errors.

[0075] The consensus algorithm employs a proof-of-stake (PoS) consensus mechanism to confirm the verification results. Participating nodes independently verify the authorized execution transaction data, with each node performing verification calculations based on its locally stored rule base and historical data. Node verification results include three states: verification passed, verification failed, and further review required. Verification passed indicates that the transaction data fully complies with all verification rules; verification failed indicates the discovery of a clear violation or error; and further review required indicates the existence of boundary conditions necessitating human intervention. The consensus process requires more than two-thirds of the participating nodes to reach a consensus on the verification result to confirm the final consensus verification result.

[0076] The generation of consensus verification results includes verification status, verification details, and block confirmation information. Verification status records the final consensus result, including three states: passed, rejected, or pending. Verification details record the specific results of each verification stage, including the pass rate of data correctness verification, the check results of compliance verification, and the voting distribution of participating consensus nodes. Block confirmation information records the block height, block hash, and confirmation time at which the transaction data was written to the blockchain. For successfully verified transaction data, an authorization token is generated, and the permission configuration information is updated in the user permission management module. For failed verification transaction data, the reason for the failure is recorded, and the corresponding exception handling process is triggered, including user notification, audit log recording, and security monitoring alarms.

[0077] In one optional implementation, after consensus verification is successful, the corresponding key fragment location information is obtained from the key fragment index table, and the available key fragments are obtained and the decryption key is reconstructed based on the key fragment location information, including: After consensus verification is passed, the location information of available key shards is obtained from the key shard index table. Based on the location information, the available key shards are obtained in parallel. The access response latency of the available key shards is obtained. The ratio of the number of successful responses from the storage node to the total number of requests is used as the node response rate. The access response latency and the node response rate are weighted and calculated to obtain the credibility score of the available key shards. Determine the minimum number of fragments required to reconstruct the decryption key based on the current authorization policy level. Select the minimum number of available key fragments with the highest credibility score. Calculate the modulus and corresponding modulus quotient of all selected available key fragments. Calculate the multiplicative inverse of each modulus quotient under the corresponding modulus. Multiply the fragment value of all selected available key fragments by the corresponding modulus quotient and multiplicative inverse, sum the products, and take the remainder of the product of all moduli to obtain the decryption key.

[0078] After consensus verification of energy financial data is successful, the corresponding storage location information is queried from the key shard index table. Access requests for electricity trading contract data trigger location queries for the eight key shards, and the index table returns detailed information about the shard storage. The first shard is stored at the path / energy / finance / keys / shard_01.dat on the primary data center node 192.168.1.101, the second shard is located on the backup center node 192.168.2.102, and the remaining shards are distributed across cloud nodes and edge computing nodes. Each location information includes detailed parameters such as node IP address, storage path, shard size, last update time, and access permission level.

[0079] Parallel acquisition of available key shards employs a multi-threaded concurrent access mechanism to improve retrieval efficiency. Shard acquisition requests are simultaneously sent to eight storage nodes, each request containing a shard identifier, access credentials, and a timestamp. The primary data center node returns the first shard data within 45 milliseconds, the backup center node returns the second shard in 52 milliseconds, the cloud node's response time is between 78 and 95 milliseconds, and the edge node's response time is between 120 and 135 milliseconds. This parallel acquisition mechanism reduces the original 800 milliseconds of serial acquisition time to 135 milliseconds, significantly improving the key reconstruction response speed.

[0080] Access response latency records establish a performance baseline for each storage node. The primary data center node has an average response latency of 48 milliseconds and a standard deviation of 8 milliseconds over the past 30 days, demonstrating stable performance. The backup center node has an average response latency of 55 milliseconds and a standard deviation of 12 milliseconds. The cloud node has an average response latency of 85 milliseconds, but can reach 150 milliseconds during network congestion. Edge nodes are significantly affected by network conditions, with an average response latency of 128 milliseconds and peak latency reaching 200 milliseconds. A response latency prediction model is built based on historical data to provide a reference for key sharding selection.

[0081] Node response rate is calculated based on the storage node's historical successful access records. The primary data center node successfully responded to 998 out of the last 1000 access requests, resulting in a response rate of 99.8%. The backup center node successfully responded to 995 requests, resulting in a response rate of 99.5%. Due to occasional network outages, the cloud node successfully responded to 982 requests, resulting in a response rate of 98.2%. Edge nodes, more affected by environmental factors, successfully responded to 971 requests, resulting in a response rate of 97.1%. The response rate reflects the reliability and stability of the storage node and is an important indicator for evaluating node trustworthiness.

[0082] The reliability score is calculated using a weighted algorithm that comprehensively considers response latency and node response rate. The latency weight is set to 0.4, and the response rate weight is set to 0.6, reflecting the emphasis on reliability. The reliability score for the primary data center node is calculated as (1-48 / 200)×0.4 + 99.8×0.6 / 100 = 0.304 + 0.599 = 0.903. The backup center node score is calculated as (1-55 / 200)×0.4 + 99.5×0.6 / 100 = 0.290 + 0.597 = 0.887. The cloud node score is calculated as (1-85 / 200)×0.4 + 98.2×0.6 / 100 = 0.230 + 0.589 = 0.819. The edge node score is (1-128 / 200)×0.4+ 97.1×0.6 / 100 = 0.144 + 0.583 = 0.727.

[0083] The minimum number of shards is determined based on the current authorization policy level and security requirements. Electricity trading contract data, belonging to the high security level, requires at least 5 shards to reconstruct the key. Renewable energy subsidy data, at the medium security level, requires 4 shards, while monthly electricity bill data, at the low security level, only requires 3 shards. The minimum number of shards required for key reconstruction is dynamically determined based on the user's authorization level and the security level of the accessed data, optimizing reconstruction efficiency while ensuring security.

[0084] The highest-reliability shards were selected from the eight available shards, choosing the top five with the highest scores. Based on reliability scores, the following shards were chosen: the primary data center node shard (0.903), the backup center node shard (0.887), the cloud node A shard (0.825), the cloud node B shard (0.819), and the edge node A shard (0.745). This combination of five shards satisfies both the minimum number of shards requirement and ensures the reliability of the reconstruction process. The selection algorithm also considers the geographical distribution of the shards, avoiding the selection of multiple shards from the same data center and reducing the risk of single points of failure.

[0085] The calculation of the modulus and modulo quotient adopts the mathematical framework of the Chinese Remainder Theorem. The moduli corresponding to the five selected segments are m1=251, m2=257, m3=263, m4=269, and m5=271, respectively. These moduli are all prime numbers and are pairwise coprime. The product of all moduli, M = 251×257×263×269×271 = 4,423,842,847,267. The modulus quotients of each segment are calculated as follows: M1=M / m1=17,624,072,699, M2=M / m2=17,215,345,515, M3=M / m3=16,815,365,573, M4=M / m4=16,445,029,170, M5=M / m5=16,323,071,024.

[0086] The calculation of multiplicative inverses ensures the mathematical correctness of the key reconstruction process. The multiplicative inverse of the first slice is calculated using the extended Euclidean algorithm to obtain the inverse of M1 modulo m1, resulting in y1 = 96. Similarly, the multiplicative inverses of the other slices are y2 = 123, y3 = 187, y4 = 45, and y5 = 158, respectively. The multiplicative inverses satisfy the congruence relation M_i × y_i ≡ 1 (mod m_i), which is a key parameter in the Chinese Remainder Theorem reconstruction process.

[0087] The decryption key is reconstructed through a combination of calculations using fragment values, modulo quotients, and multiplicative inverses. The fragment values ​​for the five selected fragments are a1=197, a2=156, a3=233, a4=184, and a5=205. The reconstruction calculation process multiplies each fragment value by its corresponding modulo quotient and multiplicative inverse, yielding an intermediate result: 197 × 17,624,072,699 × 96 = 333,142,515,926,048. The intermediate results for the remaining fragments are calculated similarly. The sum of the five intermediate results is obtained as a total S, and then the remainder is taken modulo the product M of all moduli, resulting in the reconstructed decryption key: key = S mod M = 3,247,859,156,423. This reconstructed key can decrypt the corresponding energy financial data, providing users with authorized data access services.

[0088] This invention relates to a hierarchical encryption and dynamic authorization control system for energy financial data, the system comprising: The first unit is used to generate a security level score for energy financial data, classifying energy financial data with a security level score greater than a preset security threshold as high security level, and the rest as low security level. The second unit is used to generate a first encryption key for the high-security-level data and a second encryption key for the low-security-level data using different encryption algorithms. The first encryption key and the second encryption key are distributed and stored in multiple security nodes using a sharding storage technology, and a key sharding index table is established. The third unit is used to construct a user trust authorization blockchain based on smart contracts and write the key sharding index table into the user trust authorization blockchain. The fourth unit is used to verify the authenticity of the user's identity based on the zero-knowledge proof protocol when a user's data access request is received. After the authenticity verification is passed, the user's credit score is calculated based on the multi-attribute decision algorithm. The fifth unit is used to dynamically construct a hierarchical authorization strategy that matches the user's credit score based on the user's credit score and in combination with a multi-level permission tree, obtain authorized execution transaction data, submit the authorized execution transaction data to the user trust authorization blockchain for consensus verification; after the consensus verification is passed, the corresponding key shard location information is obtained from the key shard index table, available key shards are obtained according to the key shard location information and the decryption key is reconstructed, and the decryption key is used to decrypt the energy financial data and send it to the user.

[0089] A third aspect of the present invention provides an electronic device, comprising: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0090] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0091] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0092] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for hierarchical encryption and dynamic authorization control of energy financial data, characterized in that, include: A security level score is generated for energy financial data. Energy financial data with a security level score greater than a preset security threshold is classified as high security level, and the rest are classified as low security level. Different encryption algorithms are used to generate a first encryption key for the high-security-level data and a second encryption key for the low-security-level data. The first encryption key and the second encryption key are distributed and stored in multiple security nodes using a sharding storage technology, and a key sharding index table is established. A user trust authorization blockchain is constructed based on smart contracts, and the key sharding index table is written into the user trust authorization blockchain; When a user's data access request is received, the authenticity of the user's identity is verified based on a zero-knowledge proof protocol. After the authenticity verification is passed, the user's credit score is calculated based on a multi-attribute decision algorithm. Based on the user credit score and combined with a multi-level permission tree, a hierarchical authorization strategy matching the user credit score is dynamically constructed to obtain authorized execution transaction data. The authorized execution transaction data is then submitted to the user trust authorization blockchain for consensus verification. After consensus verification is successful, the corresponding key fragment location information is obtained from the key fragment index table. Based on the key fragment location information, an available key fragment is obtained and the decryption key is reconstructed. The decryption key is then used to decrypt the energy financial data and send it to the user.

2. The method according to claim 1, characterized in that, Generating a first encryption key for the high-security-level data and a second encryption key for the low-security-level data using different encryption algorithms includes: The high-security data is constructed into a lattice basis matrix and orthogonalized to obtain orthogonal basis vectors. Random vectors are obtained by sampling using a discrete Gaussian distribution. The random vectors are used as the fully homomorphic encryption private key, and the linear combination of the orthogonal basis vectors and the random vectors is used as the fully homomorphic encryption public key to obtain the first encryption key. For low-security data, a prime-order elliptic curve is selected and its coefficients are determined using complex multiplication. A large prime-order base point is selected on the prime-order elliptic curve using a probability point counting algorithm. A random integer that satisfies the difficulty of the discrete logarithm of the elliptic curve is generated as the elliptic curve encryption private key. The scalar product of the elliptic curve encryption private key and the large prime-order base point is used as the elliptic curve encryption public key to obtain the second encryption key.

3. The method according to claim 1, characterized in that, The first encryption key and the second encryption key are distributed and stored across multiple secure nodes using a sharding storage technique, and a key sharding index table is established, including: The first encryption key and the second encryption key are serialized into a key sequence. The length of the key sequence is divided by a preset unit fragment length to obtain the number of fragments. Based on a preset reconstruction threshold and the number of fragments, a key interpolation parameter is generated through a secret sharing algorithm. Based on the number of fragments, construct the same number of non-zero fragment identifiers, calculate the fragment value by performing Lagrange interpolation on the key sequence and the key interpolation parameters, and combine the non-zero fragment identifiers and the fragment value to generate key fragments; Select candidate security nodes with the same number of key fragments as target storage nodes, and construct a key fragment index table with the same length as the number of key fragments; transmit the key fragments to the corresponding target storage nodes for storage, and record the storage location information of the key fragments in the key fragment index table.

4. The method according to claim 1, characterized in that, When a user's data access request is received, the authenticity of the user's identity is verified based on a zero-knowledge proof protocol. After the authenticity verification is successful, the user's credit score is calculated based on a multi-attribute decision algorithm, including: Upon receiving a user's data access request, an authentication random number and a verification challenge random value are generated and sent to the user; the user's private key is extracted from the data access request, and the user's private key and the authentication random number are exponentially calculated to generate an identity commitment value. The system receives a response value returned by the user. The response value is obtained by multiplying the authentication random number by the user's private key and the authentication challenge random value, and then adding them together. The response value is used as an exponent in the exponentiation formula to obtain a first verification value. The user's public key's authentication challenge random value is raised to the power of the identity commitment value to obtain a second verification value. When the first verification value is equal to the second verification value, the user's authenticity verification result is that the verification is successful. After the user's authenticity is verified, the user's transaction behavior data within a preset time period is obtained to form a user behavior feature vector and normalized. The maximum value of each dimension in the user behavior feature vector is used to form an ideal solution vector, and the minimum value is used to form a negative ideal solution vector. The Euclidean distance from the user behavior feature vector to the ideal solution vector and to the negative ideal solution vector are calculated and added together to obtain the user credit score.

5. The method according to claim 1, characterized in that, Based on the user's credit score and combined with a multi-level permission tree, a hierarchical authorization strategy that dynamically matches the user's credit score is constructed, including: The range of the user credit score is divided into multiple consecutive score intervals, each of which has an upper limit and a lower limit; the score interval to which the user credit score belongs is determined as the current score interval. A multi-level permission tree is constructed, where the root node corresponds to the highest permission, the leaf nodes correspond to specific operation permissions, and the intermediate nodes correspond to permission categories. The score value range is mapped to a preset permission threshold range, and a corresponding permission threshold is set for each node. Based on a depth-first traversal strategy, nodes whose permission thresholds are less than the user's credit score are selected, added to the available permission set, and grouped according to their level to obtain a hierarchical authorization strategy.

6. The method according to claim 1, characterized in that, Submitting the authorized execution transaction data to the user-trusted authorization blockchain for consensus verification includes: The basic permission value corresponding to each level of authorization strategy is calculated based on the preset hierarchical weight; the difference between the upper limit and the lower limit of the current scoring interval is calculated, and the dynamic adjustment factor is obtained by subtracting the lower limit of the interval from the user credit score and dividing by the difference; the dynamic adjustment factor is multiplied by the basic permission value, and the product is added to the basic permission value to obtain the actual authorized permission value; The user credit score, the current authorization policy level, the actual authorization permission value, and the timestamp are packaged to generate authorization execution transaction data. The authorization execution transaction data is then submitted to multiple consensus nodes in the user trust authorization blockchain to verify the correctness of the data and the compliance of the actual authorization permission, thereby obtaining a consensus verification result.

7. The method according to claim 1, characterized in that, After consensus verification is successful, the corresponding key fragment location information is obtained from the key fragment index table. The process of obtaining available key fragments and reconstructing the decryption key based on the key fragment location information includes: After consensus verification is passed, the location information of available key shards is obtained from the key shard index table. Based on the location information, the available key shards are obtained in parallel. The access response latency of the available key shards is obtained. The ratio of the number of successful responses from the storage node to the total number of requests is used as the node response rate. The access response latency and the node response rate are weighted and calculated to obtain the credibility score of the available key shards. Determine the minimum number of fragments required to reconstruct the decryption key based on the current authorization policy level. Select the minimum number of available key fragments with the highest credibility score. Calculate the modulus and corresponding modulus quotient of all selected available key fragments. Calculate the multiplicative inverse of each modulus quotient under the corresponding modulus. Multiply the fragment value of all selected available key fragments by the corresponding modulus quotient and multiplicative inverse, sum the products, and take the remainder of the product of all moduli to obtain the decryption key.

8. A hierarchical encryption and dynamic authorization control system for energy financial data, used to implement the method as described in any one of claims 1-7, characterized in that, include: The first unit is used to generate a security level score for energy financial data, classifying energy financial data with a security level score greater than a preset security threshold as high security level, and the rest as low security level. The second unit is used to generate a first encryption key for the high-security-level data and a second encryption key for the low-security-level data using different encryption algorithms. The first encryption key and the second encryption key are distributed and stored in multiple security nodes using a sharding storage technology, and a key sharding index table is established. The third unit is used to construct a user trust authorization blockchain based on smart contracts and write the key sharding index table into the user trust authorization blockchain. The fourth unit is used to verify the authenticity of the user's identity based on the zero-knowledge proof protocol when a user's data access request is received. After the authenticity verification is passed, the user's credit score is calculated based on the multi-attribute decision algorithm. The fifth unit is used to dynamically construct a hierarchical authorization strategy that matches the user's credit score based on the user's credit score and in combination with a multi-level permission tree, obtain authorized execution transaction data, and submit the authorized execution transaction data to the user trust authorization blockchain for consensus verification. After consensus verification is successful, the corresponding key fragment location information is obtained from the key fragment index table. Based on the key fragment location information, an available key fragment is obtained and the decryption key is reconstructed. The decryption key is then used to decrypt the energy financial data and send it to the user.

9. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 7.

Images