Implementation method and system of dual access control mechanism based on block chain and encryption machine

Abstract

The invention relates to the technical field of data security and access control, in particular to an implementation method and system of a dual access control mechanism based on a block chain and an encryption machine, and the implementation method comprises the steps of authority management based on a smart contract, encryption machine dynamic key generation, dual access control, and exception handling and auditing. The method has the beneficial effects that the non-tampering property of authority distribution and operation records is ensured through a distributed account book technology of the block chain, and a double-layer security barrier of logic credibility and physical isolation is formed in combination with hardware-level key protection (such as a security chip HSM) of an encryption machine. And the anti-attack capability is improved, the block chain resists data tampering and insider disintegration, the encryption machine prevents key side channel attacks, and the double mechanisms can cope with complex attack modes such as man-in-the-middle attacks, replay attacks and advanced persistent threats (APT).

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security and access control, in particular to an implementation method and system of a dual access control mechanism based on a blockchain and an encryption machine. BACKGROUND

[0002] With the deepening of digital transformation, data security and access control have become the core demand of high-sensitive fields such as finance, government affairs, and medical treatment. Traditional access control technology is mainly based on the static policy of role (RBAC) or attribute (ABAC), and the user identity is verified through an authentication method (such as password, biometric feature).

[0003] However, such mechanisms expose significant defects in complex dynamic scenarios. Single point vulnerability: relying on a single authentication credential (such as password), once stolen or cracked, an attacker can easily impersonate a legitimate user to perform unauthorized operations. Black box of permission management: the process of assigning and changing permissions lacks transparent records, and internal personnel can bypass audits through hidden operations (such as privately expanding the scope of permissions), and traditional log systems are easily tampered with or deleted due to centralized storage, making it difficult to trace responsibility. Insufficient dynamic adaptability: static rules are difficult to adapt to dynamic changes in business scenarios (such as temporary permission granting, cross-system resource access), requiring frequent manual intervention, which is inefficient and prone to errors. For example, in a cloud computing environment, the context of user access to resources (such as geographic location, device status) changes in real time, and traditional ABAC policies cannot automatically adapt.

[0004] Therefore, there is an urgent need for a dual access control mechanism that combines both, taking into account the credibility of permission management and the real-time nature of access verification. SUMMARY

[0005] The purpose of the present application is to provide an implementation method and system of a dual access control mechanism based on a blockchain and an encryption machine to solve the problems raised in the background art.

[0006] To achieve the above purpose, the present application provides the following technical solution: an implementation method of a dual access control mechanism based on a blockchain and an encryption machine, comprising:

[0007] The permission management step based on the smart contract: create user role classification in the blockchain network, assign the minimum necessary permission set to each role, and bind the user identity and role through digital certificate; use Solidity to write the permission management smart contract, define the permission granting, revoking, and querying interfaces, and deploy to the consortium chain node; all permission change operations generate transaction requests, which are written into the blockchain after being verified by multi-party node consensus;

[0008] The encryption machine dynamically generates a key, receives a user access request, extracts context information in the request, combines a preset key seed to generate a one-time dynamic key, queries a user's current permission state through a blockchain light node embedded in the encryption machine, generates a key when the permission is valid, and temporarily stores the key hash value in a blockchain cache layer. The key is valid for a single access session, and the encryption machine actively erases the key memory and destroys related temporary data when the key expires or the access ends.

[0009] Preferably, the smart contract-based permission management step specifically includes:

[0010] Role definition and registration: Create user role classifications such as administrator, ordinary user, and auditor in the blockchain network, assign a minimum necessary permission set to each role, and bind user identity and role using digital certificates;

[0011] Smart contract development and deployment: Write a permission management smart contract in Solidity language, define interfaces for permission granting, revoking, and querying in the contract, deploy the written smart contract to a consortium chain node, and ensure that the contract logic is tamper-proof;

[0012] Operation chaining and consensus verification: For all permission change operations, including adding users and modifying role permissions, generate corresponding transaction requests, which need to be verified by multiple nodes using algorithms such as PBFT for consensus, and written to the blockchain after verification to ensure transparent and reliable records.

[0013] Preferably, the encryption machine dynamically generates a key, receives a user access request, extracts context information in the request, combines a preset key seed to generate a one-time dynamic key, queries a user's current permission state through a blockchain light node embedded in the encryption machine, generates a key when the permission is valid, and temporarily stores the key hash value in a blockchain cache layer. The key is valid for a single access session, and the encryption machine actively erases the key memory and destroys related temporary data when the key expires or the access ends.

[0014] Context-aware key generation: After receiving a user access request, the encryption machine extracts context information from the request, which includes IP address, device fingerprint, and timestamp. Combine these context information with a preset key seed to generate a one-time dynamic key;

[0015] Key and blockchain permission association: Query the user's current permission state in the blockchain through the blockchain light node embedded in the encryption machine. Only when the user's permission is valid, a dynamic key is generated, and the hash value of the key is temporarily stored in the blockchain cache layer;

[0016] Key life cycle management: Set the key's validity period to a single access session duration, such as 5 minutes. When the validity period is exceeded or the access ends, the encryption machine actively erases the key stored in the memory and destroys all temporary data related to the key.

[0017] Preferably, it also includes a dual access control process, with the following steps:

[0018] Access request processing: the user access request needs to carry the dynamic key generated by the encryption machine, digital signature and target resource identifier, and the request is submitted to the control center through the API gateway;

[0019] Blockchain permission verification: the smart contract parses the user role and resource identifier in the request, matches them with the permission rules stored in the blockchain, and returns the "allow / deny" status code according to the matching result;

[0020] Encryption machine key verification: the encryption machine decrypts the dynamic key, verifies whether the decrypted key is consistent with the hash value stored in the blockchain cache, and checks whether the key is within the valid period. Only when both verifications pass, the access request is allowed.

[0021] Preferably, it also includes an exception handling and auditing step, specifically including:

[0022] Real-time exception detection: if there is a failure in the permission verification or key verification process, an alarm rule is triggered immediately, for example, if the verification fails for 3 consecutive times, the alarm event is pushed to the security operation and maintenance platform through the message queue;

[0023] Log encryption and chain storage: use the SM4 national encryption algorithm to encrypt the access log, which contains successful and failed access records, store the encrypted log in a special audit chain, and use zero-knowledge proof technology to realize privacy protection;

[0024] Traceability and root cause analysis: based on the operation log stored in the audit chain, construct a user behavior graph, analyze user behavior with a machine learning model, identify abnormal patterns such as misuse of permissions, generate a root cause report and chain store the report.

[0025] A system for implementing a dual access control mechanism based on blockchain and encryption machine, comprising:

[0026] A permission management module based on a smart contract, used to create fine-grained user roles in a blockchain network, bind user identity and role through digital certificate, assign minimum necessary permission set to each role, write permission management logic and define core function interface using smart contract programming language, deploy the contract to a consortium chain node, ensure non-tamperability and transparent execution through multi-node consensus, handle permission change operations and synchronize the global permission state table;

[0027] A hardware encryption machine cooperation module, which interacts with the permission management module, extracts relevant information to generate a one-time dynamic key after receiving an access request, queries user permission status through a blockchain light node, temporarily stores key hash value in a blockchain cache layer, and manages dynamic key life cycle;

[0028] The access request processing module receives an access request of a user carrying a dynamic key, a digital signature and a target resource identifier, parses the request and matches a permission rule, checks a historical operation record, and cooperates with the hardware encryption machine to perform double verification;

[0029] The security response and audit module detects a permission or key verification failure condition, triggers a hierarchical alarm rule and pushes an alarm event, stores an access log into a special audit chain in an encrypted manner, constructs a user behavior graph and generates a root cause analysis report.

[0030] Preferably, the permission management module based on the smart contract specifically comprises:

[0031] The role creation and binding unit creates fine-grained user roles such as administrators, auditors and ordinary users in the blockchain network, binds the user identity and the corresponding role through a digital certificate, and guarantees the identity uniqueness;

[0032] The permission allocation unit allocates a minimum necessary permission set to each created user role, for example, an administrator can modify a permission rule, and an ordinary user can only access a specified resource;

[0033] The smart contract writing and deployment unit writes a permission management logic using a smart contract programming language, defines permission granting, revoking and querying core function interfaces, deploys the written contract to a consortium chain node, and ensures that the contract code is tamper-proof and transparent through multi-node consensus;

[0034] The permission change processing unit processes all permission change operations such as adding a user and adjusting a permission, generates a digital signature transaction, writes it into a blockchain after being verified by a consortium chain node consensus, and synchronously updates a global permission state table, thereby ensuring the data consistency of each node and realizing the whole life cycle management of the permission.

[0035] Preferably, the hardware encryption machine cooperation module specifically comprises:

[0036] The request receiving and information extracting unit extracts a user identity, a device fingerprint, a timestamp and a target resource identifier after receiving an access request;

[0037] The dynamic key generation unit generates a one-time dynamic key in the physical isolation environment of the encryption machine in combination with a preset key seed, thereby preventing side channel attacks;

[0038] The permission query unit inlines a blockchain light node, queries a current permission state of a user in real time, and triggers the dynamic key generation only when the permission is valid;

[0039] Key storage and management unit: temporarily store the hash value of the dynamic key to the blockchain cache layer for subsequent verification, set the dynamic key validity period as a single session duration, and immediately erase the key memory and destroy related temporary data after timeout or access ends, thereby preventing key reuse and unauthorized access.

[0040] Preferably, the access request processing module specifically comprises:

[0041] Request receiving and transmission protection unit: receive the access request of the user carrying the dynamic key, digital signature and target resource identifier, the request message uses an asymmetric encryption algorithm to protect the safety of the transmission process, and is submitted to the control center through an API gateway;

[0042] Permission matching and risk early warning unit: the smart contract analyzes the user role and resource identifier in the request, matches the permission rule library in the blockchain, returns the "allow / deny" status code, and checks the user historical operation record, if high-frequency abnormal request is detected, triggers the risk early warning;

[0043] Dual verification unit: the encryption machine decrypts the dynamic key, verifies the consistency with the hash value in the blockchain cache, and checks the key validity period, after the dual verification result passes, the target resource is authorized to be accessed; any failure immediately blocks the request and marks it as an abnormal event, realizes parallel verification of the blockchain and the encryption machine, and gives consideration to safety and efficiency in a high-concurrency scenario.

[0044] Preferably, the security response and audit module specifically comprises:

[0045] Alarm triggering and pushing unit: after detecting that the permission or key verification fails, triggering the hierarchical alarm rule, such as single failure record for low risk, 3 consecutive failures upgrade to high risk, the alarm event is pushed to the security operation and maintenance platform in real time through the message queue, and repair suggestions are generated;

[0046] Log encryption and storage unit: use the national secret algorithm SM4 to encrypt the access log, store it to the special audit chain, realize the privacy protection of the log content through the zero-knowledge proof technology, and ensure that the audit party can only verify the integrity of the log but cannot obtain the plaintext information;

[0047] Behavior analysis and report generation unit: construct a user behavior graph based on the audit chain data, identify abnormal patterns by using a machine learning model, generate a root cause analysis report and chain archive, support administrators to quickly locate vulnerabilities and develop repair strategies, and build a full-link trusted security system from alarm to repair.

[0048] Compared with the prior art, the present application has the following advantages:

[0049] The implementation method and system of the double access control mechanism based on the blockchain and the encryption machine provided by the application ensure the non-tamperability of the permission allocation and the operation record through the distributed ledger technology of the blockchain, and form a double security barrier of "logical trust + physical isolation" in combination with the hardware-level key protection (such as a secure chip HSM) of the encryption machine. The anti-attack capability is improved, the blockchain resists data tampering and internal personnel malpractice, the encryption machine prevents key side channel attacks, and the double mechanism can cope with complex attack modes such as man-in-the-middle attacks, replay attacks and APT (advanced persistent threat).

[0050] Dynamic key anti-cracking and context awareness: the encryption machine generates a one-time dynamic key based on the user identity, the timestamp, the device fingerprint and the access context, and the dynamic key is encrypted by using an SM4 or AES-GCM algorithm, and the key generation process is completed in a physically isolated environment, so that the risk of memory leakage is eliminated. Scene adaptability: the effective period of the dynamic key is a single session (such as 5 minutes), and the dynamic key is automatically destroyed after the effective period, so that the dynamic key can adapt to high dynamic business requirements such as temporary permission granting and cross-domain resource access, and the security hidden danger of long-term exposure of static credentials is avoided.

[0051] Millisecond-level real-time verification and intelligent risk control: parallel verification of the blockchain and the encryption machine: the intelligent contract quickly checks the legality of the permission by using a lightweight consensus algorithm (such as PBFT), and the encryption machine synchronously verifies the validity of the dynamic key, and the response time of the double process is less than 50 milliseconds, so that the high-concurrency scene requirements such as financial transactions and real-time monitoring are met. Active defense is enhanced: the intelligent contract integrates a historical behavior analysis module, and if high-frequency unauthorized requests (such as 10 abnormal attempts within 1 minute) are detected, the risk warning is automatically triggered and the account is temporarily frozen, so that the intelligent active defense is realized. BRIEF DESCRIPTION OF DRAWINGS

[0052] Figure 1 The method flowchart of the application. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical scheme of the application clear, complete and the advantages more clear and obvious, the embodiments of the application are further described in detail below with reference to the drawings. It should be understood that the specific embodiments described herein are part of the embodiments of the application, rather than all the embodiments, and are used to explain the embodiments of the application, and do not limit the embodiments of the application, and all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the application.

[0054] Embodiment one, the application provides a technical scheme: an implementation method of a double access control mechanism based on a blockchain and an encryption machine, comprising:

[0055] S1, permission allocation and blockchain record

[0056] S101、The permission management module based on the smart contract.

[0057] S10101, Role definition and registration. Create user role categories (such as administrator, ordinary user, auditor) in the blockchain network, assign a minimum necessary permission set to each role, and bind user identity and role through digital certificate.

[0058] S10102, Smart contract development and deployment. Write the permission management smart contract using Solidity, define permission granting, revoking, and query interfaces, and deploy to the consortium chain node to ensure that the contract logic is tamper-proof.

[0059] S10103, Operation on-chain and consensus verification. All permission change operations (such as adding users, modifying role permissions) generate transaction requests, which are verified by multi-party node consensus (such as PBFT algorithm) and written to the blockchain to ensure transparent and reliable record.

[0060] S2, Encryption machine dynamic key generation

[0061] S201, Hardware encryption machine coordination module.

[0062] S20101, Context-aware key generation. After receiving the user access request, the encryption machine extracts the context information (such as IP address, device fingerprint, timestamp) in the request, combines it with the pre-set key seed to generate a one-time dynamic key.

[0063] S20102, Key and blockchain permission association. Query the user's current permission status through the embedded blockchain light node in the encryption machine, generate the key only when the permission is valid, and store the key hash value in the blockchain cache layer.

[0064] S20103, Key life cycle management. The key validity period is set to the length of a single access session (such as 5 minutes), and after the timeout or access ends, the encryption machine actively erases the key memory and destroys related temporary data.

[0065] S3, Dual access control process

[0066] S301, Access request processing module.

[0067] S30101, Request packaging and submission. User access requests must carry the dynamic key generated by the encryption machine, digital signature, and target resource identifier, and be submitted to the control center through the API gateway.

[0068] S30102, Blockchain permission verification. The smart contract analyzes the user role and resource identifier in the request, matches the permission rules in the blockchain, and returns the "allow / deny" status code.

[0069] S30103, encryption key verification, encryption machine decryption dynamic key, verify its consistency with the hash value in the blockchain cache, and check the validity period of the key, and release the request after passing the double verification.

[0070] S4, abnormal processing and auditing

[0071] S401, security response and audit module.

[0072] S40101, real-time anomaly detection, if the permission verification or key verification fails, immediately trigger the alarm rule (such as 3 consecutive failures), and push the alarm event to the security operation and maintenance platform through the message queue (Kafka).

[0073] S40102, log encryption and chain, access logs (including success / failure records) are encrypted using the SM4 national encryption algorithm, stored in a special audit chain, and privacy protection is achieved through zero-knowledge proof technology.

[0074] S40103, traceability and root cause analysis, based on the operation log in the audit chain, build a user behavior graph, identify abnormal patterns (such as permission abuse) combined with machine learning models, generate root cause reports and chain archives.

[0075] Embodiment two, on the basis of embodiment one, a system for implementing a dual access control mechanism based on blockchain and encryption machine is proposed, comprising:

[0076] S1 step, provide a permission management module based on smart contract. Create fine-grained user roles (such as administrators, auditors, and ordinary users) in the blockchain network, bind the user's identity with their role through digital certificates to ensure identity uniqueness. Assign each role a minimum necessary permission set, for example, administrators can modify permission rules, and ordinary users can only access specified resources. Write permission management logic using smart contract programming language (such as Solidity), define permission granting, revoking, querying, and other core function interfaces. Deploy the contract to the consortium chain node, and use multi-node consensus (such as PBFT algorithm) to ensure that the contract code cannot be tampered with and the execution is transparent. All permission change operations (such as adding users, adjusting permissions) need to generate a digital signature transaction, which is written into the blockchain after being verified by the consortium chain node consensus. The blockchain synchronously updates the global permission state table to ensure data consistency among nodes. Through the consortium chain and smart contract, the whole life cycle of permission management is realized, ensuring transparent allocation, traceable changes, and resistance to internal tampering.

[0077] S2, a hardware encryption machine cooperation module is provided. After the encryption machine receives an access request, the user identity, device fingerprint, timestamp and target resource identifier are extracted, and a one-time dynamic key is generated by combining a preset key seed. The key generation process is completed in the physical isolation environment of the encryption machine, preventing side channel attacks. The encryption machine embeds a blockchain light node, which queries the current permission state of the user in real time and generates a key only when the permission is valid. The hash value of the dynamic key is temporarily stored in the blockchain cache layer for subsequent verification. The dynamic key is set to be valid for a single session (e.g., 5 minutes), and the encryption machine immediately erases the key memory and destroys related temporary data after the timeout or the end of access. The encryption machine generates a context-aware dynamic key, which is verified in real time in combination with the blockchain permission state, to prevent key reuse and unauthorized access.

[0078] 3, an access request processing module is provided. The user access request carries a dynamic key, a digital signature and a target resource identifier, and is submitted to the control center through the API gateway. The request message uses an asymmetric encryption algorithm (such as RSA) to protect the security of the transmission process. The smart contract analyzes the user role and resource identifier in the request, matches the permission rule library in the blockchain, and returns the "allow / deny" status code. At the same time, the user's historical operation records are checked, and if high-frequency abnormal requests (such as 10 unauthorized attempts in 1 minute) are detected, a risk warning is triggered. The encryption machine decrypts the dynamic key and verifies its consistency with the hash value in the blockchain cache, and checks the key validity period. After the double verification result is passed, the target resource is authorized to be accessed; if any of the results fails, the request is immediately blocked and marked as an abnormal event. The blockchain and the encryption machine are verified in parallel, with millisecond-level response and mutual independence, balancing security and efficiency in high-concurrency scenarios.

[0079] S4, a security response and audit module is provided. After detecting that the permission or key verification fails, a hierarchical alarm rule is triggered (such as a single failure record for low risk, and 3 consecutive failures for high risk). The alarm event is pushed to the security operation and maintenance platform in real time through the message queue (such as Kafka), and a repair suggestion (such as temporarily freezing the account) is generated. The access log (including success / failure records) is encrypted using the SM4 algorithm, and is stored in a special audit chain. The privacy protection of the log content is realized through zero-knowledge proof technology, ensuring that the auditor can only verify the integrity of the log but cannot obtain the plaintext information. Based on the audit chain data, a user behavior graph is constructed, and machine learning models are used to identify abnormal patterns (such as abuse of permissions and key brute force cracking). A root cause analysis report is generated and archived on the chain, supporting administrators to quickly locate vulnerabilities and develop repair strategies. The privacy-protected audit and intelligent analysis are linked to build a full-link trusted security system from alarm to repair.

[0080] While embodiments of the application have been shown and described, it is to be understood that the embodiments described are merely exemplary of the principles and application of the present application. Numerous modifications and adaptions can be effected without departing from the spirit and scope of the present application, which is not limited to the exact construction and arrangement described. It is intended, therefore, to cover all modifications and adaptions that fall within the scope of the claims and their equivalents.

Claims

1. A method for implementing a dual access control mechanism based on blockchain and cryptographic machines, characterized in that: include: The steps for permission management based on smart contracts are as follows: Create user role categories in the blockchain network, assign a minimum necessary set of permissions to each role, and bind user identity and role through digital certificates; use Solidity to write permission management smart contracts, define permission granting, revocation, and query interfaces, and deploy them to consortium blockchain nodes; generate transaction requests for all permission change operations, and write them to the blockchain after consensus verification by multiple nodes; The encryption machine generates a dynamic key in the following steps: The encryption machine receives a user access request, extracts the context information from the request, and generates a one-time dynamic key by combining it with a preset key seed; it queries the user's current permission status through the blockchain light node embedded in the encryption machine, generates a key when the permission is valid, and temporarily stores the key hash value in the blockchain cache layer; the key validity period is set to the duration of a single access session, and the encryption machine actively erases the key memory and destroys the relevant temporary data after the timeout or after the access ends.

2. The method for implementing a dual access control mechanism based on blockchain and encryption machine according to claim 1, characterized in that: The specific steps for permission management based on smart contracts include: Role definition and registration: Create user role categories such as administrator, ordinary user, and auditor in the blockchain network, assign a minimum set of necessary permissions to each role, and use digital certificates to bind user identity to role; Smart contract development and deployment: The permission management smart contract is written in Solidity language. The interface for granting, revoking and querying permissions is clearly defined in the contract. The written smart contract is deployed to the consortium blockchain node to ensure that the contract logic cannot be tampered with. On-chain operation and consensus verification: For all permission change operations, including adding users and modifying role permissions, a corresponding transaction request is generated. This request needs to be verified by multiple nodes using an algorithm such as PBFT. After successful verification, it is written to the blockchain to ensure the transparency and trustworthiness of the record.

3. The method for implementing a dual access control mechanism based on blockchain and encryption machine according to claim 2, characterized in that: The specific steps for generating a dynamic key for an encryption machine include: Context-aware key generation: After receiving a user access request, the encryption machine extracts context information from the request. The context information includes IP address, device fingerprint, and timestamp. This context information is combined with a preset key seed to generate a one-time dynamic key. Key association with blockchain permissions: The blockchain light node embedded in the encryption machine queries the user's current permission status in the blockchain. Only when the user's permissions are valid will a dynamic key be generated and the hash value of the key be temporarily stored in the blockchain cache layer. Key lifecycle management: The validity period of the key is set to the duration of a single access session, such as 5 minutes. When the validity period expires or the access ends, the encryption machine actively erases the key stored in memory and destroys all temporary data associated with the key.

4. The method for implementing a dual access control mechanism based on blockchain and encryption machine according to claim 3, characterized in that: It also includes a dual access control process, with the following specific steps: Access Request Processing: User access requests must include the dynamic key generated by the encryption machine, the digital signature, and the target resource identifier. The request is then submitted to the control center through the API gateway. Blockchain permission verification: The smart contract parses the user role and resource identifier in the request, matches them with the permission rules stored in the blockchain, and returns an "allow / deny" status code based on the matching result; Encryption machine key verification: The encryption machine decrypts the dynamic key and verifies whether the decrypted key matches the hash value stored in the blockchain cache. It also checks whether the key is within its validity period. Only when both verifications pass can the access request be allowed.

5. The method for implementing a dual access control mechanism based on blockchain and encryption machine according to claim 4, characterized in that: It also includes exception handling and auditing steps, specifically including: Real-time anomaly detection: If a failure occurs during permission verification or key verification, an alarm rule is immediately triggered. For example, if three consecutive verifications fail, the alarm event is pushed to the security operations and maintenance platform via a message queue. Log encryption and on-chain: Access logs are encrypted using the national cryptographic algorithm SM4. The access logs contain records of successful and failed accesses. The encrypted logs are stored on a dedicated audit chain, and zero-knowledge proof technology is used to protect privacy. Source tracing and root cause analysis: Based on the operation logs stored in the audit chain, a user behavior graph is constructed, and user behavior is analyzed in combination with machine learning models to identify abnormal patterns, such as abuse of permissions, generate a root cause report, and archive the report on the chain.

6. A system for implementing the dual access control mechanism based on blockchain and encryption machine as described in claim 5, characterized in that: include: The smart contract-based permission management module is used to create fine-grained user roles in the blockchain network, bind user identities and roles through digital certificates, assign the minimum necessary permission set to each role, write permission management logic and define core functional interfaces using smart contract programming language, deploy the contract to consortium chain nodes, ensure immutability and transparent execution through multi-node consensus, handle permission change operations and synchronously update the global permission status table. The hardware encryption machine collaboration module interacts with the permission management module. After receiving an access request, it extracts relevant information to generate a one-time dynamic key. The embedded blockchain light node queries the user's permission status, temporarily stores the key hash value in the blockchain cache layer, and manages the lifecycle of the dynamic key. The access request processing module receives access requests from users carrying dynamic keys, digital signatures, and target resource identifiers, parses the requests and matches them with permission rules, checks historical operation records, and performs dual verification in collaboration with the hardware encryption machine. The security response and auditing module detects permission or key verification failures, triggers tiered alarm rules and pushes alarm events, encrypts and stores access logs to a dedicated audit chain, builds user behavior graphs and generates root cause analysis reports.

7. The system according to claim 6, characterized in that: The smart contract-based permission management module specifically includes: Role creation and binding unit: Create fine-grained user roles such as administrator, auditor, and ordinary user in the blockchain network, and bind the user's identity to the corresponding role through digital certificates to ensure the uniqueness of the identity; Permission allocation unit: Assign the minimum necessary set of permissions to each created user role. For example, administrators can modify permission rules, while ordinary users can only access specified resources. Smart Contract Writing and Deployment Unit: Uses smart contract programming language to write permission management logic, defines core functional interfaces for granting, revoking, and querying permissions, deploys the written contracts to consortium blockchain nodes, and ensures that the contract code is immutable and the execution is transparent through multi-node consensus; Permission Change Processing Unit: Handles all permission change operations, such as adding users and adjusting permissions, generates digital signature transactions, writes them to the blockchain after consensus verification by the consortium blockchain nodes, and synchronously updates the global permission status table to ensure data consistency across all nodes and achieve full lifecycle management of permissions.

8. The system according to claim 7, characterized in that: The hardware encryption machine collaboration module specifically includes: Request receiving and information extraction unit: After receiving the access request, extract the user identity, device fingerprint, timestamp and target resource identifier; Dynamic key generation unit: Combined with a preset key seed, it generates a one-time dynamic key in the physically isolated environment of the encryption machine to prevent side-channel attacks; Permission Query Unit: Embedded blockchain light node, it queries the user's current permission status in real time, and triggers dynamic key generation only when the permission is valid; Key storage and management unit: The hash value of the dynamic key is temporarily stored in the blockchain cache layer for subsequent verification. The validity period of the dynamic key is set to the duration of a single session. After the timeout or the end of the access, the key memory is immediately erased and the relevant temporary data is destroyed to prevent key reuse and unauthorized access.

9. A system according to claim 8, characterized in that: The access request processing module specifically includes: Request Reception and Transmission Protection Unit: Receives access requests from users carrying dynamic keys, digital signatures, and target resource identifiers. The request message uses an asymmetric encryption algorithm to protect the security of the transmission process and is submitted to the control center through the API gateway. Permission matching and risk warning unit: The smart contract parses the user role and resource identifier in the request, matches it with the permission rule base in the blockchain, returns the "allow / deny" status code, and checks the user's historical operation record. If high-frequency abnormal requests are detected, a risk warning is triggered. Dual verification unit: The encryption machine decrypts the dynamic key, verifies its consistency with the hash value in the blockchain cache, and checks the key validity period. If the dual verification result is successful, access to the target resource is authorized; if either fails, the request is immediately blocked and marked as an abnormal event, realizing parallel verification by the blockchain and the encryption machine, taking into account both security and efficiency in high-concurrency scenarios.

10. A system according to claim 9, characterized in that: The security response and audit module specifically includes: Alarm Triggering and Push Unit: After detecting a failure in permission or key verification, it triggers a tiered alarm rule. For example, a single failure is recorded as low risk, and three consecutive failures are upgraded to high risk. The alarm event is pushed to the security operation and maintenance platform in real time through the message queue, and a repair suggestion is generated. Log encryption and storage unit: Access logs are encrypted using the national cryptographic algorithm SM4 and stored in a dedicated audit chain. Zero-knowledge proof technology is used to protect the privacy of log content, ensuring that the auditor can only verify the integrity of the logs and cannot obtain plaintext information. Behavioral Analysis and Report Generation Unit: Based on audit chain data, it constructs user behavior graphs, uses machine learning models to identify abnormal patterns, generates root cause analysis reports and archives them on the blockchain, supports administrators in quickly locating vulnerabilities and formulating remediation strategies, and builds a trusted security system across the entire chain from alerts to remediation.

Images