Data encryption system

Abstract

The invention discloses a data encryption system, which is applied to the field of legal data security, and comprises a data encryption service platform, a block chain node and a supervision system, the platform communicates with the latter two and provides a password service, a configuration key management module, an encryption strategy module and an authorization auditing module, and the modules are in data interaction linkage. The key management module constructs a three-level dispersion mechanism through a data root key, a service mother key and a case ID, dynamically generates a case independent key, and associates the case ID with authorization information, a data protection strategy and a key storage platform. And the encryption strategy module calls a case key, carries out point-to-point encryption on the structured data, carries out secondary encryption, stores the encrypted structured data in the block chain, carries out end-to-end encryption on the unstructured data of the audition certificate, stores the encrypted unstructured data in the platform in a distributed manner, and associates the two types of data through a ciphertext index and allows a supervision system to download the two types of data. And the authorization auditing module controls data downlink decryption. The legal case data security can be guaranteed.

Description

Technical Field

[0001] This application relates to the field of legal data security technology, and in particular to a data encryption system. Background Technology

[0002] Data processing in the legal field (including administrative law enforcement, criminal punishment execution, notary services, and appraisal services) needs to go through the entire process of "data collection-storage-sharing-supervision". The core data includes structured case information (such as case number, party information, and processing results) and unstructured information (such as evidence documents and audio and video recordings).

[0003] The main disadvantages of existing technologies include the following: The lack of a specific "one case, one secret" strategy in the legal field: Existing technologies use a unified key or a fixed key pool to encrypt all case data. The leakage of a single key will lead to the loss of a batch of case data, which cannot meet the security requirement of "independent isolation of case data" in the legal field. Inadequate key management: ① Lack of full lifecycle management: Existing solutions only support key generation and storage, lacking automatic update, archiving, and destruction mechanisms. Keys that are not updated for a long time are easily cracked; ② Lack of distributed storage protection: Keys are mostly stored centrally on a central server or a single encryption machine, posing a single point of failure risk; ③ Lack of access control: Administrators can directly access all keys, which does not comply with the "least privilege" principle. Data upload and authorization are disconnected: Data decryption on the blockchain lacks a strict review process (such as the existing judicial system which only requires identity authentication for decryption), making it impossible to trace data access behavior, which does not meet the management requirements of "supervision and traceability" in the legal field; Imbalance between structured and unstructured data processing: Existing solutions use the same encryption and storage strategies for both types of data (such as storing both on-chain or locally), resulting in low efficiency in accessing structured data and high cost in storing unstructured data (such as large-size evidence documents) on-chain. Insufficient business adaptability: There is no encrypted service interface for legal business processes (such as administrative law enforcement data collection and criminal penalty execution data supervision). Interaction with front-end systems and supervision systems requires the development of additional adaptation modules, resulting in poor compatibility. Lack of security auditing and visualization: Existing solutions lack monitoring of the cryptographic service's operational status and key usage logs, making it impossible to detect abnormal encryption / decryption behavior in a timely manner, resulting in high operational and maintenance difficulties. Summary of the Invention

[0004] The main purpose of this application is to provide a data encryption system that aims to achieve "one case, one secret" in the legal field, with each case's data being encrypted independently to avoid mass data loss.

[0005] To achieve the above objectives, this application provides a data encryption system, comprising: Data encryption service platform, blockchain nodes and monitoring system; The data encryption service platform is connected to both the blockchain node and the monitoring system. The data encryption service platform is used to provide cryptographic services to blockchain nodes and the supervision system. It is configured with a key management module, an encryption strategy module and an authorization review module. The modules interact with each other through data to achieve functional linkage. The key management module is used to construct a three-level key distribution mechanism based on the data root key, the business master key and the case ID. The three-level key distribution mechanism is used to dynamically generate an independent key for each legal case based on the case ID, and associate the case ID with the authorization information policy and the data protection policy. The independent key is stored in the data encryption service platform. The encryption strategy module is used to call the case key generated by the key management module, to encrypt the structured data point-to-point, and then to encrypt the structured data a second time before storing it on the blockchain node. The unstructured data is encrypted end-to-end, and the encrypted structured data is stored on the data encryption service platform using a distributed strategy. Both the structured and unstructured data are downloaded through the supervision system and associated through a ciphertext index. The unstructured data is the hearing evidence data. The authorization review module is used to build a closed-loop mechanism based on the encrypted structured and unstructured data output by the encryption strategy module, so as to control the authorization of data decryption on the blockchain. The closed-loop mechanism includes four stages: receiving application data for decryption from the supervision system, multi-person review, encrypted distribution, and usage traceability.

[0006] Optionally, it also includes: Interface adaptation module and visual auditing module; The interface adaptation module is used to provide a standardized encryption service interface. By calling the key generation function of the key management module, the encryption and decryption function of the encryption strategy module, and the token generation function of the authorization and review module, seamless integration between the blockchain node, the supervision system, and the data encryption service platform can be achieved. The visualization audit module is used to collect key operation logs from the key management module, encryption / decryption logs from the encryption strategy module, and audit logs from the authorization audit module in real time, and dynamically display the cryptographic service operation status on a large screen to trace the entire encryption process.

[0007] Optionally, the data encryption service platform includes a cryptographic module, and the blockchain node has a hardware cryptographic module; The key management module includes: Key lifecycle management unit, distributed storage unit, access control isolation unit, cryptographic device management unit; The key lifecycle management unit is used for symmetric key management and the generation, storage, activation, update, archiving, cancellation and destruction of asymmetric keys. The generated case key is transmitted to the encryption strategy module for the encryption of structured and unstructured data. The distributed storage unit is used to store the data root key in the hardware cryptographic module, and to store the business master key and case ID key in the cryptographic module of the data encryption service platform front-end system. The permission isolation unit is used to assign differentiated operation permissions to system administrators, front-end administrators, and business administrators. These differentiated permissions include: The system administrator is responsible for generating the data root key and configuring the pre-whitelist; The front-end administrator is responsible for registering the front-end system, importing front-end certificates, and setting password module attributes. Attributes include no password module, password module without key storage function, and password module with key storage function. Business administrators are responsible for configuring data protection policies; Furthermore, all three jointly manage the operation permissions of the key lifecycle management unit and the distributed storage unit.

[0008] Optionally, the key lifecycle management unit supports both symmetric and asymmetric key management and is linked with the distributed storage unit and the visual audit module. The symmetric key uses the SM4 algorithm, supports CBC and ECB padding modes, is generated based on the data root key or imported from an external source, and is automatically and periodically updated to multiple versions. The asymmetric key uses the SM2 algorithm. The key pair is generated by the platform by default or imported from outside. It is used for the signature generation and verification of the authorization token in the authorization audit module, and the key usage record is synchronized to the visual audit module. The generation, updating, and destruction of the data root key for both the nominal key and the asymmetric key are all completed within the hardware cryptographic module, and the data root key cannot be exported.

[0009] Optionally, the encryption strategy module includes a data classification unit and an encryption rule configuration unit; The data classification unit is used to classify the data sources of the database accessed by the front-end system, distinguish between structured data and unstructured data, and the classification results are transmitted to the encryption rule configuration unit. The structured data includes case number, party information, and processing results, while the unstructured data includes evidence documents and audio and video recordings. The encryption rule configuration unit is used for encrypting the entire data or encrypting at the field level; The rules for field-level encryption are as follows: Sensitive fields are encrypted using the SM4-FPE algorithm while preserving their format. The encryption rules for encrypting the entire data are as follows: Structured data is encrypted twice using SM4 / CBC mode before being uploaded to the blockchain; Unstructured data is encrypted using the SM4 algorithm and stored in the front-end system. The encryption rule configuration results are then synchronized to the data on-chain task management module.

[0010] Optionally, the data owner is the business system; The authorization review module includes a key application unit, a review unit, and an encrypted transmission unit; The key application unit is used to receive key applications submitted by the supervision system. The application information includes a ciphertext index, a ciphertext description, and a reason for the application. The application information is also synchronized to the visual audit module. The audit unit is used to audit key applications through the business system, and to log the audit pass / fail results and synchronize them to the visual audit module. After the review is approved, the case key output by the key management module is encrypted using the SM2 asymmetric encryption algorithm and sent to the supervision system in a point-to-point manner to decrypt the ciphertext data encrypted by the encryption strategy module.

[0011] Optionally, the visual audit module includes a status monitoring unit and a log management unit; The status monitoring unit dynamically displays operating indicators on a large screen. These indicators include system information, cryptographic service trends over the past seven days, encryption service throughput rate, total number of keys, total number of applications, top 5 cryptographic service applications, recent accesses, total number of cryptographic service visits, total number of keys, total number of applications, encryption service throughput rate, MAC-SM3 throughput rate, signature verification rate, and timestamp rate. The log management unit records key usage logs, encryption task logs, and authorization review logs. All logs can be queried by case ID and time range.

[0012] Optionally, the data encryption service platform further includes a distributed encrypted storage management module, which includes a storage rule configuration unit and an encrypted storage unit; The storage rule configuration unit configures parameters such as the ciphertext storage location and storage structure. The encrypted storage unit connects to various heterogeneous cryptographic machines and encryption machines through a cryptographic application middleware. The key generation, encryption, and decryption functions all call the unified interface provided by the cryptographic service middleware, which is linked to heterogeneous cryptographic devices and data encryption service platforms respectively.

[0013] Optionally, the data encryption service platform further includes a data uplink task management module, which includes: Task creation unit, task editing unit, and task execution unit; The task creation unit configures the data source, on-chain API, and task execution cycle parameters for data uploading to the blockchain. The task editing unit supports modification of the data source, on-chain API, and task execution cycle parameters; The task execution unit performs data encryption, ciphertext storage, and data upload operations according to the encryption configuration and storage rules, and supports task execution, pause, termination, and viewing of execution logs.

[0014] Optionally, the data encryption service platform is deployed on the political and legal affairs network and the government extranet, and the platform deployed on the political and legal affairs network includes: The system consists of a first data encryption service platform, a first cryptographic service middleware, two first encryption machines, a signature verification server, and a timestamp server. The platforms deployed on the government extranet include: A second data encryption service platform, a second cryptographic service middleware, and a second encryption machine; The data encryption service platform's multi-factor authentication methods include IP whitelist, username and password authentication, and digital certificate authentication.

[0015] This application proposes a data encryption system comprising a data encryption service platform, blockchain nodes, and a monitoring system. The data encryption service platform is communicatively connected to both the blockchain nodes and the monitoring system. The platform provides cryptographic services to both the blockchain nodes and the monitoring system and includes a key management module, an encryption strategy module, and an authorization review module. These modules interact via data to achieve functional linkage. The key management module constructs a three-level key distribution mechanism based on the data root key, the business master key, and the case ID. This mechanism dynamically generates an independent key for each legal case based on the case ID and associates the case ID with the authorization information strategy and data protection strategy. The independent key is stored on the data encryption service platform. The strategy module is used to call the case key generated by the key management module, perform point-to-point encryption on structured data, and then perform secondary encryption on the structured data before storing it on the blockchain node. Unstructured data is also encrypted end-to-end. The encrypted structured data is then stored on a distributed strategy-based data encryption service platform. Both structured and unstructured data are downloaded through a monitoring system and linked via a ciphertext index. The unstructured data serves as trial hearing data. The authorization and review module is used to construct a closed-loop mechanism based on the encrypted structured and unstructured data output by the encryption strategy module. This mechanism controls the authorization of data decryption on the blockchain. The closed-loop mechanism includes four stages: receiving application data for decryption from the monitoring system, multi-person review, encrypted distribution, and usage tracking. This application has the following technical effects: 1. The security and isolation of case data are significantly improved. This system is designed with a three-level distribution strategy of data root key - business master key - case key for the legal field. Combined with the case ID, an independent key is dynamically generated to achieve one key per case. This completely solves the problem that unified keys or fixed key pools in existing technologies can easily lead to the loss of confidentiality of batch case data. It meets the security requirements of independent isolation of case data and ensures the confidentiality of case data in scenarios such as administrative law enforcement and criminal punishment.

[0016] 2. The security and controllability of key management are comprehensively enhanced. Through full lifecycle management of keys (supporting generation, update, archiving, and destruction), distributed storage (root key stored in HSM, case key stored in the pre-cryptography module), and the separation of powers between system administrator, pre-administration administrator, and business administrator, the risk of single point of failure in centralized key storage is avoided, and the abuse of administrator privileges is prevented. It conforms to the principle of least privilege and solves the problems of lack of full-process control and loss of control over permissions in existing key management.

[0017] 3. Data access traceability and legal supervision compliance assurance: Construct a closed loop for data off-chain authorization, including application, multi-person review, encrypted distribution, and usage traceability. Combine the SM2 algorithm to generate authorization tokens and archive blockchain logs to achieve full-process traceability of data decryption and access. This solves the problem that existing technologies only require identity authentication for data off-chain decryption and lack supervision and traceability, thus meeting the management requirements of supervision and traceability in the legal field.

[0018] 4. Optimize the balance between data processing efficiency and storage costs by differentiating between structured and unstructured data encryption storage strategies. For example, structured data is encrypted twice before being put on the blockchain to take advantage of the blockchain's immutability, while unstructured data (such as audiovisual evidence) is stored in a distributed manner in advance to avoid large files occupying block space on the blockchain. At the same time, the two types of data are linked through ciphertext indexes, which improves the access efficiency of structured data and reduces the storage cost of unstructured data, thus solving the problem of imbalance between the two types of data processing in existing technologies. Attached Figure Description

[0019] Figure 1 This is a diagram illustrating the cryptographic security system architecture of an embodiment of the data encryption system described in this application. Figure 2 A diagram showing the relationship between the data encryption service platform and the parties in an embodiment of the data encryption system of this application; Figure 3 A business architecture diagram provided for an embodiment of the data encryption system of this application; Figure 4 A technical architecture diagram provided for an embodiment of the data encryption system of this application; Figure 5 A data architecture diagram provided for an embodiment of the data encryption system of this application; Figure 6 A key data processing diagram for structured data uploading and unstructured data sharing provided in an embodiment of the data encryption system of this application; Figure 7 A key data processing diagram for acquiring shared structured and unstructured data provided in an embodiment of the data encryption system of this application; Figure 8 This is a deployment architecture diagram provided for an embodiment of the data encryption system of this application; Figure 9 This is a diagram illustrating the composition of a data encryption service system according to an embodiment of the data encryption system of this application. Figure 10 A diagram illustrating the composition of a cryptographic module provided in an embodiment of the data encryption system of this application; Figure 11 This is an architecture diagram of a key management service module provided in an embodiment of the data encryption system of this application; Figure 12 An overview diagram of the front-end management process provided for an embodiment of the data encryption system of this application; Figure 13 A logical relationship diagram between on-chain tasks and various strategies provided in an embodiment of the data encryption system of this application; Figure 14 Supplementary diagram showing the logical relationship between various strategies and on-chain tasks provided in an embodiment of the data encryption system of this application; Figure 15 This is a logical relationship diagram between various IDs provided in an embodiment of the data encryption system of this application; Figure 16 A flowchart of the pre-ID registration process provided in an embodiment of the data encryption system of this application; Figure 17 A diagram illustrating a method for generating a pre-ID according to an embodiment of the data encryption system of this application; Figure 18 A flowchart illustrating the business ID registration process provided in an embodiment of the data encryption system of this application; Figure 19 A data directory tree diagram provided for an embodiment of the data encryption system of this application; Figure 20 A case type diagram provided for an embodiment of the data encryption system of this application; Figure 21 This is a diagram illustrating the generation and operation of a symmetric key in an embodiment of the data encryption system of this application. Figure 22 A symmetric key storage diagram provided for an embodiment of the data encryption system of this application; Figure 23 This is a diagram illustrating the symmetric key transmission of an embodiment of the data encryption system of this application.

[0020] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0021] It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit this application.

[0022] Reference Figure 1 , Figure 3 and Figure 5 The first embodiment of this application provides a data encryption system, which may include: Data encryption service platform, blockchain nodes and monitoring system; The data encryption service platform communicates and connects with both the blockchain nodes and the monitoring system. The data encryption service platform is used to provide cryptographic services to blockchain nodes and monitoring systems. It is equipped with a key management module, an encryption strategy module, and an authorization and auditing module. The modules interact with each other through data to achieve functional linkage. The key management module is used to build a three-level key distribution mechanism based on the data root key, business master key and case ID. The three-level key distribution mechanism is used to dynamically generate an independent key for each legal case based on the case ID, and associate the case ID with the authorization information policy and data protection policy. The independent key is stored in the data encryption service platform. The encryption strategy module is used to call the case key generated by the key management module, to encrypt the structured data point-to-point, and then to encrypt the structured data a second time before storing it on the blockchain node. It also encrypts the unstructured data end-to-end. The encrypted structured data is then stored on the data encryption service platform using a distributed strategy. Both structured and unstructured data are downloaded through the supervision system and linked through a ciphertext index. The unstructured data is the hearing evidence data. The authorization and review module is used to build a closed-loop mechanism based on the encrypted structured and unstructured data output by the encryption strategy module, so as to authorize and control the decryption of data off the blockchain. The closed-loop mechanism includes four stages: receiving application data for off the blockchain from the supervision system, multi-person review, encrypted distribution, and usage traceability.

[0023] like Figure 1 As shown, this architecture presents the entire data flow from business system collection, front-end system encryption, blockchain on-chain storage, to off-chain decryption by the monitoring system, clarifying the interaction between the data encryption service platform, blockchain nodes, and the monitoring system; for example... Figure 2 As shown, the specific interaction logic of the platform in providing cryptographic services to the front-end system, blockchain nodes, and supervision system is intuitively demonstrated, including core links such as key distribution, encrypted transmission, and authorization verification.

[0024] Among them, the data encryption service platform is the core cryptographic service provider of the entire system, the blockchain node is responsible for the on-chain storage and secure transmission of structured data, and the supervision system undertakes the core responsibilities of data off-chain application, review and use. The three parties realize two-way communication of data and instructions through a preset secure channel.

[0025] For example, the construction of the three-level key distribution mechanism follows the hierarchical logic of "data root key - business master key - case key". The data root key, as the top-level key, is generated and stored by the hardware encryption machine (HSM). The business master key is generated based on the data root key and corresponds to different business systems (such as administrative law enforcement systems). The case key is dynamically generated by combining the business master key with a unique case ID to ensure that the key for each case is independent and unique.

[0026] In another embodiment of this application, the association between the case ID and the authorization information policy and the data protection policy is realized through a relationship tree. One business master key can be associated with multiple case IDs, and each case ID corresponds to a unique authorization rule and encryption protection method.

[0027] It's important to note that point-to-point encryption for structured data is used throughout the entire process, from data entry, reassembly and transmission, node storage, download, and transmission to the monitoring system. Different keys are used at each stage for protection. The secondary encryption before on-chain data uses SM4 / CBC mode to ensure the confidentiality and integrity of the data. End-to-end encryption for unstructured data is performed by the front-end system and stored in its distributed storage. Decryption is only possible after downloading and authorizing the data through the monitoring system. The ciphertext index is crucial for linking the two types of data; it allows for quick location of the corresponding unstructured data storage location for structured data, and vice versa.

[0028] like Figure 4 As shown in the diagram, the point-to-point encryption mode for structured data and the end-to-end encryption mode for unstructured data are clearly distinguished. The key usage and data flow path at each encryption stage are marked, and the differentiated processing logic of uploading structured data to the blockchain and storing unstructured data in the front end is presented.

[0029] Clearly, by constructing a collaborative architecture of "platform-node-supervision system" and linking the three core modules, this embodiment achieves end-to-end encrypted protection for data in the legal field. On the one hand, the independent case keys generated by the three-level key distribution mechanism completely solve the risk of batch data loss caused by unified keys or fixed key pools in existing technologies. On the other hand, the differentiated encryption storage strategy for structured and unstructured data balances data access efficiency and storage costs, avoiding the low efficiency and high cost problems caused by traditional unified strategies. At the same time, the closed-loop mechanism fills the gap in existing technologies where there is no strict review of data decryption on the blockchain, ensuring that data access is traceable and controllable, fully meeting the supervision and traceability requirements in the legal field.

[0030] In one embodiment of this application, the data encryption system may further include: Interface adaptation module and visual auditing module; The interface adaptation module provides standardized encryption service interfaces. By calling the key generation function of the key management module, the encryption and decryption function of the encryption strategy module, and the token generation function of the authorization and review module, it achieves seamless integration between blockchain nodes, supervision systems, and data encryption service platforms. The visual audit module is used to collect key operation logs from the key management module, encryption / decryption logs from the encryption strategy module, and audit logs from the authorization audit module in real time, and dynamically display the cryptographic service operation status on a large screen to trace the entire encryption process.

[0031] Specifically, the interface adaptation module provides standardized interfaces for data encryption, decryption, password envelope conversion, and authorization token generation, supporting multi-language calls. It enables integration with front-end systems, blockchain nodes, and monitoring systems without requiring additional development of an adaptation module. For example, when a business system lacks its own cryptographic module, it can directly call the platform's key generation and encryption / decryption functions through the interface; when the business system has a cryptographic module, it can obtain the key issued by the platform through the interface, and its own cryptographic module will perform the encryption operation.

[0032] In another embodiment of this application, the log collection of the visual audit module covers the entire lifecycle of key operations, the complete process of each encryption / decryption task execution and authorization review, and the log information includes key information such as operator, operation time, case ID, and operation result. It should be noted that the dynamic display of the operating status on the large screen includes core indicators such as system information, cryptographic service trends over the past seven days, encryption service throughput rate, total number of keys, and total number of applications, intuitively presenting the operational status of the cryptographic service.

[0033] like Figure 9As shown in the diagram, the diagram includes core service units such as "General Cryptographic Services" and "Typical Scenario Cryptographic Services". The standardized interfaces of the interface adaptation module are integrated into these service units, supporting seamless integration with external systems. The log collection and status display functions of the visual audit module are implemented based on the "Audit Log" and "System Monitoring" units in the system, forming data linkage with modules such as key management and encryption strategies.

[0034] To be precise, the interface adaptation module effectively solves the problems of insufficient business adaptability and poor compatibility in existing technologies. The standardized interface reduces system integration costs and supports the reuse of heterogeneous cryptographic devices. The visual audit module fills the gap in operation and maintenance monitoring. Through full-process log recording and real-time status display, it not only makes it easier for managers to discover abnormal behavior in a timely manner, but also provides a complete basis for security auditing, greatly reducing the difficulty of operation and maintenance.

[0035] In one embodiment of this application, the data encryption service platform includes a cryptographic module, and the blockchain node has a hardware cryptographic module; The key management module includes: Key lifecycle management unit, distributed storage unit, access control isolation unit, cryptographic device management unit; The key lifecycle management unit is used for symmetric key management and the generation, storage, activation, update, archiving, cancellation and destruction of asymmetric keys. The generated case key is transmitted to the encryption strategy module for the encryption of structured and unstructured data. The distributed storage unit is used to store the data root key in the hardware cryptographic module, and to store the business master key and case ID key in the cryptographic module of the data encryption service platform front-end system; The permission isolation unit is used to assign differentiated operation permissions to system administrators, front-end administrators, and business administrators. These differentiated permissions include: The system administrator is responsible for generating the data root key and configuring the pre-whitelist; The front-end administrator is responsible for registering the front-end system, importing front-end certificates, and setting password module attributes. Attributes include no password module, password module without key storage function, and password module with key storage function. Business administrators are responsible for configuring data protection policies; Furthermore, all three jointly manage the operation permissions of the key lifecycle management unit and the distributed storage unit.

[0036] The data encryption service platform's cryptographic module includes functions for key application and reception, offline key import, secure key storage, and various cryptographic service interfaces. The hardware cryptographic module of the blockchain node primarily undertakes core cryptographic tasks such as communication decryption, data encryption, and authorization token verification. Specifically, the key lifecycle management unit covers the entire lifecycle of both symmetric and asymmetric keys, ensuring that every step from key generation to destruction is under control, thus avoiding security risks caused by oversights in key management.

[0037] like Figure 10 As shown in the diagram, this illustration details the core functions of the cryptographic module, including key request and reception, offline key import, secure key storage and cryptographic service interfaces such as hashing, encryption, and decryption, which fully match the functions of the cryptographic module on the data encryption service platform; for example... Figure 9 As shown, the key management service, as the core service unit, works in conjunction with the cryptographic service middleware and cryptographic machine cluster to support various operations of the key lifecycle management unit.

[0038] For example, the distributed storage unit adopts a distributed architecture in which the root key is stored in the hardware encryption machine and the business master key and case key are stored in the front-end cryptographic module. The data root key is stored inside the hardware encryption machine (HSM) and cannot be exported, while the business master key and case key are stored separately in the cryptographic modules of each front-end system to achieve physical isolation.

[0039] In another embodiment of this application, the three-tiered management system constructed by the permission isolation unit assigns different responsibilities for key management to different administrators, so that no single administrator can complete the entire key operation process alone.

[0040] It should be noted that the password module attributes set by the front-end administrator need to be configured according to the actual situation of the business system. For business systems without a password module, the data encryption service platform provides comprehensive password services. For systems with a password module but no key storage function, the platform issues working keys in real time. For systems with both a password module and key storage function, the platform issues front-end data root keys and storage keys distributed by the root key.

[0041] In one embodiment of this application, the key lifecycle management unit supports both symmetric and asymmetric key management and is linked with the distributed storage unit and the visual audit module. The symmetric key uses the SM4 algorithm, supports CBC and ECB padding modes, is generated based on the data root key or imported from an external source, and is automatically and periodically updated to multiple versions. The asymmetric key uses the SM2 algorithm. The key pair is generated by the platform by default or imported from outside. It is used for the signature generation and verification of the authorization token in the authorization audit module, and the key usage record is synchronized to the visual audit module. The generation, updating, and destruction of the data root keys for both symmetric and asymmetric keys are all completed within the hardware cryptographic module, and the data root keys cannot be exported.

[0042] Specifically, the SM4 algorithm used for the symmetric key is a domestically developed encryption algorithm with high-strength encryption performance. CBC, ECB, and other padding modes can be flexibly selected according to data type and application scenario. For example, the automatic periodic update of the symmetric key can be configured according to business needs. After the update, the old version key will be automatically archived, ensuring the timeliness and security of the key.

[0043] like Figure 21 As shown in the diagram, this diagram presents the three-level decentralized generation logic of the data root key, business master key, and case key, clearly defining the generation methods, functions, and usage characteristics of each type of key, which is completely consistent with the generation mechanism of symmetric keys; as shown in the diagram. Figure 22 , Figure 23 As shown, the storage location, protection method, and transmission target of each type of key are marked to support the implementation of the distributed storage unit.

[0044] In another embodiment of this application, the asymmetric key uses the SM2 algorithm, which is also a domestically developed algorithm. Its key pair is used for signing and verifying the authorization token, ensuring the authenticity and integrity of the authorization information. It should be noted that the linkage between the key lifecycle management unit and the distributed storage unit is reflected in the fact that the generated keys are stored in the corresponding locations according to preset rules, while the linkage with the visual audit module achieves real-time synchronization of key usage records, ensuring that every key operation is fully recorded.

[0045] like Figure 11 Tables 1-3 Figures 21-23 As shown, it includes core units such as key generation, key storage, key update, and audit logs, fully covering the entire key lifecycle management function. It also links with the log server through the Syslog service to synchronize key usage records to the visual audit module.

[0046] Table 1. Root Key Lifecycle Management

[0047] Table 2 Data Key Lifecycle Management

[0048] Table 3 System Protection Key Lifecycle Management

[0049] In one embodiment of this application, the encryption strategy module includes a data classification unit and an encryption rule configuration unit; The data classification unit is used to classify the data sources of the database accessed by the front-end system, distinguishing between structured data and unstructured data. The classification results are transmitted to the encryption rule configuration unit. The structured data includes case number, party information, and processing results, while the unstructured data includes evidence documents and audio and video recordings. The encryption rule configuration unit is used for encrypting the entire data or for field-level encryption; The rules for field-level encryption are as follows: Sensitive fields are encrypted using the SM4-FPE algorithm while preserving their format. The encryption rules for encrypting the entire data are as follows: Structured data is encrypted twice using SM4 / CBC mode before being uploaded to the blockchain; Unstructured data is encrypted using the SM4 algorithm and stored in the front-end system. The encryption rule configuration results are then synchronized to the data on-chain task management module.

[0050] The data classification unit categorizes data based on its storage format and purpose. Structured data consists of standardized information with a fixed format, such as case numbers, party identification numbers, and processing results. Unstructured data consists of information carriers without a fixed format, such as evidence images, audio and video recordings of interrogations, and hearing transcripts. Specifically, the classification results are transmitted to the encryption rule configuration unit in the form of data identifiers to ensure that different types of data are matched with corresponding encryption strategies.

[0051] like Figure 6 As shown in the diagram, the classification and processing path for structured and unstructured data is clearly defined. Structured data is encrypted and then uploaded to the blockchain, while unstructured data is encrypted and stored in a front-end unstructured encrypted text shared library, which is consistent with the classification logic of the data classification unit.

[0052] For example, field-level encryption is mainly used to protect sensitive fields in structured data, such as ID card numbers and mobile phone numbers. The SM4-FPE algorithm is used for format-preserving encryption, ensuring that the encrypted data format is consistent with the original data and does not affect the normal use of the business system. Optionally, whole-data encryption is suitable for highly sensitive complete structured or unstructured data. After secondary encryption of structured data and its on-chain storage, only the ciphertext is stored on the chain. Unstructured data is encrypted and stored in the distributed storage of the front-end system, avoiding excessive on-chain storage costs.

[0053] like Figure 20As shown in the figure, the relationship between case types and protection measures is presented, and the configuration logic of "full encryption" and "partial encryption" is clearly defined. It is fully matched with the function of the encryption rule configuration unit and supports flexible selection of encryption methods according to case type.

[0054] In another embodiment of this application, a data source for the data to be uploaded to the blockchain is also configured, provided by the data probes of each node. The data can be accessed through the data source to the cryptographic service platform for encrypted uploading to the blockchain.

[0055] The data source of a case indicates which business system the data belongs to, and which front-end system this business system is connected to. Therefore, the data source of a case is represented by a front-end ID and a business ID. The logical meaning is that the data indicated by the case ID belongs to which business system, and through which business front-end was the data uploaded to the blockchain.

[0056] like Figure 19 As shown, in summary, the pre-ID, business ID, and case ID logically constitute a relationship tree, such as... Figure 15 As shown, a single front-end ID can be linked to multiple business system IDs, and a single business system ID can have multiple case IDs. This establishes a unified data logic structure, supporting one front-end ID corresponding to only one business system, or one front-end ID corresponding to multiple business systems.

[0057] 1) Pre-ID Management: Includes pre-ID registration, maintenance, query, and deletion functions. Maintains pre-ID attributes (including name, remarks, etc.) and establishes a pre-ID database through methods such as input and import. (Reference) Figures 16-17 , respectively represent the pre-registration ID and the generation signal stream.

[0058] 2) Business ID Management: This includes business registration, maintenance, query, and deletion functions. Business IDs are maintained by business attributes (including name, remarks, etc.) through methods such as data entry and import to create a business ID database. Business IDs are associated with their preceding IDs, and this correspondence needs to be maintained and recorded. (Reference) Figure 18 Tables 1 and 4 show the business ID registration process and registration content, respectively.

[0059] Table 4 Business ID Registration Content

[0060] 3) Case ID Management: This includes on-chain time, status, and off-chain usage records. When case data is uploaded to the blockchain, it is automatically recorded and mapped to the corresponding preceding ID and business ID branch, while the status is recorded as registered. After the case is encrypted on the blockchain, the status is automatically changed to on-chain storage status. When the monitoring system retrieves data from the blockchain, it records the retrieval time and the retrieval user ID.

[0061] In one embodiment of this application, the data owner is the business system; The authorization and review module includes a key application unit, a review unit, and an encrypted transmission unit; The key application unit is used to receive key applications submitted by the supervision system. The application information includes the ciphertext index, ciphertext description and application reason, and synchronizes the application information to the visual audit module. The review unit is used to review key applications through the business system, and records the review results (pass / fail) in the log and synchronizes them to the visual audit module. After the review is approved, the case key output by the key management module is encrypted using the SM2 asymmetric encryption algorithm and sent to the supervision system in a point-to-point manner to decrypt the ciphertext data encrypted by the encryption strategy module.

[0062] Specifically, the data owner, i.e. the business system (such as the administrative law enforcement system), holds ownership of the original data. The key application must be initiated by the supervision system (such as the judicial bureau supervision system). The ciphertext index in the application information is used to locate the corresponding encrypted data. The ciphertext description briefly explains the data content. The application reason must meet the supervision and inspection needs in the legal field, such as regular case inspections and review of abnormal cases.

[0063] like Figure 7 As shown in the diagram, this illustrates the complete process of the supervision system acquiring data, including authorization token application, key application, decryption operation, etc., which is completely consistent with the "application-review-encrypted distribution-usage traceability" closed-loop mechanism of the authorization review module.

[0064] For example, the review process of the review unit adopts a multi-person review mechanism. The relevant person in charge of the business system needs to review the rationality of the application reasons and the relevance of the application data. The review results are divided into pass and fail. Both results will generate detailed logs, including information such as reviewer, review time, and review comments, and will be synchronized to the visual audit module in real time.

[0065] Optionally, after approval, the encrypted transmission unit uses the SM2 asymmetric encryption algorithm to encrypt the case key, ensuring the confidentiality of the key during transmission. The point-to-point transmission mode avoids the risk of leakage during intermediate key transmission. It should be noted that after receiving the encrypted key, the monitoring system needs to decrypt it using its own cryptographic module to obtain the plaintext key, which is then used to decrypt the corresponding ciphertext data.

[0066] In one embodiment of this application, the visual audit module includes a status monitoring unit and a log management unit; The status monitoring unit dynamically displays operational metrics on a large screen. These metrics include system information, cryptographic service trends over the past seven days, encryption service throughput rate, total number of keys, total number of applications, top 5 cryptographic service applications, recent accesses, total number of cryptographic service visits, total number of keys, total number of applications, encryption service throughput rate, MAC-SM3 throughput rate, signature verification rate, and timestamp rate. The log management unit records key usage logs, encryption task logs, and authorization review logs. All logs can be queried by case ID and time range.

[0067] The status monitoring unit's large-screen display uses visual charts, such as line charts showing the cryptographic service trend over the past seven days, bar charts showing the encryption service throughput rate, and pie charts showing the top 5 cryptographic service applications by percentage, intuitively presenting the system's operating status. Specifically, the MAC-SM3 throughput rate reflects the processing efficiency of hash operations, the signature verification rate reflects the computational performance of the SM2 algorithm, and the timestamp rate corresponds to the service capacity of the timestamp server. These metrics provide data support for system performance optimization.

[0068] like Figure 9 As shown, the "System Monitoring" and "Audit Log" units in the system provide core support for the visual audit module. The collection of operational indicators by the status monitoring unit and the logging by the log management unit are all achieved through these units, forming data linkage with the platform's core modules such as password service and key management.

[0069] For example, the log management unit records three types of logs covering the core operations of the system: the key usage log contains records of key generation, acquisition, update, and destruction; the encryption task log covers process information such as data encryption, on-chain processing, and storage; and the authorization review log records the complete process of key application and review in detail. Optionally, the log query function supports precise location of all relevant operations for a specific case by case ID, or filtering of all logs within a certain time period by time range, facilitating quick retrieval by administrators.

[0070] In one embodiment of this application, the data encryption service platform further includes a distributed ciphertext storage management module, which includes a storage rule configuration unit and a ciphertext storage unit. The storage rule configuration unit configures parameters such as the ciphertext storage location and storage structure. The encrypted storage unit connects to various heterogeneous cryptographic machines and encryption machines through cryptographic application middleware. The key generation, encryption, and decryption functions all call the unified interface provided by the cryptographic service middleware, which is linked to heterogeneous cryptographic devices and data encryption service platforms respectively.

[0071] Specifically, the storage location parameters configured by the storage rule configuration unit specify that structured data is stored on blockchain nodes, while unstructured data is stored in the distributed storage of the front-end system. The storage structure parameters define the storage format according to the data type; for example, structured data is stored using key-value pairs, while unstructured data is stored using file blocks. For instance, storage rules can be configured differently according to business systems or case types to ensure data storage adaptability in different scenarios.

[0072] like Figure 6 As shown in the diagram, unstructured data is stored in a "pre-emptive unstructured encrypted shared library," and structured data is encrypted and then stored on the blockchain, consistent with the storage location configuration logic of the storage rule configuration unit; as shown... Figure 8 As shown, both the political and legal affairs network and the government extranet have deployed cryptographic service middleware and encryption machines, which intuitively present the interface architecture between the ciphertext storage unit and heterogeneous cryptographic devices.

[0073] Optionally, the cryptographic application middleware serves as the core hub connecting the data encryption service platform with heterogeneous cryptographic devices. It supports integration with cryptographic machines and encryption devices from different manufacturers and models, allowing for adaptation to new cryptographic devices without modifying the platform's core code. It should be noted that core cryptographic functions such as key generation, encryption, and decryption are all implemented through calls to the middleware's unified interface, ensuring the standardization and consistency of cryptographic operations.

[0074] In fact, the distributed ciphertext storage management module solves the problems of scattered and chaotic ciphertext storage in existing technologies, and the unified configuration of storage rules realizes the standardization of ciphertext storage. The introduction of cryptographic application middleware improves the system's compatibility and scalability, supports the reuse and addition of heterogeneous cryptographic devices, reduces system upgrade and maintenance costs, and ensures the stability and security of cryptographic services through a unified interface.

[0075] In one embodiment of this application, the data encryption service platform further includes a data uplink task management module, which includes: Task creation unit, task editing unit, and task execution unit; The task creation unit configures the data source, on-chain API, and task execution cycle parameters for data uploading to the blockchain. The task editing unit supports modification of data sources, on-chain APIs, and task execution cycle parameters; The task execution unit performs data encryption, ciphertext storage, and data upload operations according to the encryption configuration and storage rules, and supports task execution, pause, termination, and viewing of execution logs.

[0076] The task creation unit configures data source parameters corresponding to the database of the front-end system, clearly defining the source of the data to be uploaded to the blockchain; the on-chain API parameters define the interface specifications for uploading data to the blockchain node; the task execution cycle can be set to real-time execution, scheduled execution (e.g., daily at midnight), or periodic execution (e.g., weekly) according to business needs. Specifically, when creating a task, corresponding encryption configurations and storage rules must be associated to ensure that the data upload process complies with the preset security policy.

[0077] like Figure 12 As shown in the diagram, this illustrates the complete process from business system registration and data type configuration to on-chain task creation and execution at the front end, consistent with the "create-edit-execute" logic of the data on-chain task management module; as... Figure 13 and Figure 14 As shown in the diagram, the connection between on-chain tasks and data protection and authorization information policies is clearly defined, providing a logical basis for the operation of task execution units.

[0078] For example, the task editing unit supports modifying relevant parameters when the task is not executed or is paused, to meet configuration adjustments after changes in business needs. Modification records are synchronized to the log management unit to ensure traceability of operations. Optionally, the core function of the task execution unit is to automatically complete the entire process of data extraction, encryption, storage, and on-chain according to the configuration. Manual pause or termination is supported during execution. After execution, detailed logs are generated, including information such as task execution time, amount of data processed, encryption results, and on-chain status.

[0079] In one embodiment of this application, the data encryption service platform is deployed on the political and legal affairs network and the government extranet. The platform deployed on the political and legal affairs network includes: The system consists of a first data encryption service platform, a first cryptographic service middleware, two first encryption machines, a signature verification server, and a timestamp server. The platforms deployed on the government extranet include: A second data encryption service platform, a second cryptographic service middleware, and a second encryption machine; The data encryption service platform's multi-factor authentication methods include IP whitelist, username and password authentication, and digital certificate authentication.

[0080] Specifically, the government and legal affairs network, as an internal network, handles the processing and storage of core and sensitive data. Therefore, it is equipped with more sophisticated hardware. Two primary encryption machines provide load balancing and redundancy backup. A signature verification server specifically handles signature and verification operations using the SM2 algorithm. A timestamp server provides accurate timestamp services for cryptographic operations, ensuring the timeliness and traceability of the operations. The government extranet mainly handles non-core, low-sensitivity shared data. Therefore, its deployment and configuration are relatively simplified, with only one secondary encryption machine to meet basic encryption requirements, and no timestamp server is provided.

[0081] like Figure 8 As shown in the figure, the dual network deployment architecture of the political and legal network and the government extranet is clearly presented. The hardware components (encryption machine, signature verification server, timestamp server, etc.), network isolation method (isolation gateway), and connection relationship with business system and supervision system of the two platforms are clearly marked, which is completely consistent with the deployment scheme of this embodiment.

[0082] For example, multi-factor authentication requires simultaneous verification of IP whitelist, username / password verification, and digital certificate authentication; all three are indispensable. The IP whitelist only allows access to the platform from pre-defined legitimate IP addresses, the username / password provides basic authentication, and the digital certificate uses asymmetric encryption technology to ensure the authenticity of the visitor's identity. Optionally, the digital certificate is issued by an authoritative Certificate Authority (CA) and corresponds one-to-one with the user's identity to prevent identity theft.

[0083] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. A data encryption system, characterized in that, include: Data encryption service platform, blockchain nodes and monitoring system; The data encryption service platform is connected to both the blockchain node and the monitoring system. The data encryption service platform is used to provide cryptographic services to blockchain nodes and the supervision system. It is configured with a key management module, an encryption strategy module and an authorization review module. The modules interact with each other through data to achieve functional linkage. The key management module is used to construct a three-level key distribution mechanism based on the data root key, the business master key and the case ID. The three-level key distribution mechanism is used to dynamically generate an independent key for each legal case based on the case ID, and associate the case ID with the authorization information policy and the data protection policy. The independent key is stored in the data encryption service platform. The encryption strategy module is used to call the case key generated by the key management module, to encrypt the structured data point-to-point, and then to encrypt the structured data a second time before storing it on the blockchain node. The unstructured data is encrypted end-to-end, and the encrypted structured data is stored on the data encryption service platform using a distributed strategy. Both the structured and unstructured data are downloaded through the supervision system and associated through a ciphertext index. The unstructured data is the hearing evidence data. The authorization review module is used to build a closed-loop mechanism based on the encrypted structured and unstructured data output by the encryption strategy module, so as to control the authorization of data decryption on the blockchain. The closed-loop mechanism includes four stages: receiving application data for decryption from the supervision system, multi-person review, encrypted distribution, and usage traceability.

2. The data encryption system according to claim 1, characterized in that, Also includes: Interface adaptation module and visual auditing module; The interface adaptation module is used to provide a standardized encryption service interface. By calling the key generation function of the key management module, the encryption and decryption function of the encryption strategy module, and the token generation function of the authorization and review module, seamless integration between the blockchain node, the supervision system, and the data encryption service platform can be achieved. The visualization audit module is used to collect key operation logs from the key management module, encryption / decryption logs from the encryption strategy module, and audit logs from the authorization audit module in real time, and dynamically display the cryptographic service operation status on a large screen to trace the entire encryption process.

3. The data encryption system according to claim 1, characterized in that, The data encryption service platform includes a cryptographic module, and the blockchain node has a hardware cryptographic module. The key management module includes: Key lifecycle management unit, distributed storage unit, access control isolation unit, cryptographic device management unit; The key lifecycle management unit is used for symmetric key management and the generation, storage, activation, update, archiving, cancellation and destruction of asymmetric keys. The generated case key is transmitted to the encryption strategy module for the encryption of structured and unstructured data. The distributed storage unit is used to store the data root key in the hardware cryptographic module, and to store the business master key and case ID key in the cryptographic module of the data encryption service platform front-end system. The permission isolation unit is used to assign differentiated operation permissions to system administrators, front-end administrators, and business administrators. These differentiated permissions include: The system administrator is responsible for generating the data root key and configuring the pre-whitelist; The front-end administrator is responsible for registering the front-end system, importing front-end certificates, and setting password module attributes. Attributes include no password module, password module without key storage function, and password module with key storage function. Business administrators are responsible for configuring data protection policies; Furthermore, all three jointly manage the operation permissions of the key lifecycle management unit and the distributed storage unit.

4. The data encryption system according to claim 3, characterized in that, The key lifecycle management unit supports both symmetric and asymmetric key management and is linked with the distributed storage unit and the visual audit module. The symmetric key uses the SM4 algorithm, supports CBC and ECB padding modes, is generated based on the data root key or imported from an external source, and is automatically and periodically updated to multiple versions. The asymmetric key uses the SM2 algorithm. The key pair is generated by the platform by default or imported from outside. It is used for the signature generation and verification of the authorization token in the authorization audit module, and the key usage record is synchronized to the visual audit module. The generation, updating, and destruction of the data root key for both the nominal key and the asymmetric key are all completed within the hardware cryptographic module, and the data root key cannot be exported.

5. The data encryption system according to claim 1, characterized in that, The encryption strategy module includes a data classification unit and an encryption rule configuration unit; The data classification unit is used to classify the data sources of the database accessed by the front-end system, distinguish between structured data and unstructured data, and the classification results are transmitted to the encryption rule configuration unit. The structured data includes case number, party information, and processing results, while the unstructured data includes evidence documents and audio and video recordings. The encryption rule configuration unit is used for encrypting the entire data or encrypting at the field level; The rules for field-level encryption are as follows: Sensitive fields are encrypted using the SM4-FPE algorithm while preserving their format. The encryption rules for encrypting the entire data are as follows: Structured data is encrypted twice using SM4 / CBC mode before being uploaded to the blockchain; Unstructured data is encrypted using the SM4 algorithm and stored in the front-end system. The encryption rule configuration results are then synchronized to the data on-chain task management module.

6. The data encryption system according to claim 1, characterized in that, The data owner is the business system; The authorization review module includes a key application unit, a review unit, and an encrypted transmission unit; The key application unit is used to receive key applications submitted by the supervision system. The application information includes a ciphertext index, a ciphertext description, and a reason for the application. The application information is also synchronized to the visual audit module. The audit unit is used to audit key applications through the business system, and to log the audit pass / fail results and synchronize them to the visual audit module. After the review is approved, the case key output by the key management module is encrypted using the SM2 asymmetric encryption algorithm and sent to the supervision system in a point-to-point manner to decrypt the ciphertext data encrypted by the encryption strategy module.

7. The data encryption system according to claim 2, characterized in that, The visual audit module includes a status monitoring unit and a log management unit; The status monitoring unit dynamically displays operating indicators on a large screen. These indicators include system information, cryptographic service trends over the past seven days, encryption service throughput rate, total number of keys, total number of applications, top 5 cryptographic service applications, recent accesses, total number of cryptographic service visits, total number of keys, total number of applications, encryption service throughput rate, MAC-SM3 throughput rate, signature verification rate, and timestamp rate. The log management unit records key usage logs, encryption task logs, and authorization review logs. All logs can be queried by case ID and time range.

8. The data encryption system according to claim 1, characterized in that, The data encryption service platform also includes a distributed ciphertext storage management module, which includes a storage rule configuration unit and a ciphertext storage unit. The storage rule configuration unit configures parameters such as the ciphertext storage location and storage structure. The encrypted storage unit connects to various heterogeneous cryptographic machines and encryption machines through a cryptographic application middleware. The key generation, encryption, and decryption functions all call the unified interface provided by the cryptographic service middleware, which is linked to heterogeneous cryptographic devices and data encryption service platforms respectively.

9. The data encryption system according to claim 1, characterized in that, The data encryption service platform also includes a data uploading task management module, which includes: Task creation unit, task editing unit, and task execution unit; The task creation unit configures the data source, on-chain API, and task execution cycle parameters for data uploading to the blockchain. The task editing unit supports modification of the data source, on-chain API, and task execution cycle parameters; The task execution unit performs data encryption, ciphertext storage, and data upload operations according to the encryption configuration and storage rules, and supports task execution, pause, termination, and viewing of execution logs.

10. The data encryption system according to claim 1, characterized in that, The data encryption service platform is deployed on the political and legal affairs network and the government extranet. The platform deployed on the political and legal affairs network includes: The system consists of a first data encryption service platform, a first cryptographic service middleware, two first encryption machines, a signature verification server, and a timestamp server. The platforms deployed on the government extranet include: A second data encryption service platform, a second cryptographic service middleware, and a second encryption machine; The data encryption service platform's multi-factor authentication methods include IP whitelist, username and password authentication, and digital certificate authentication.

Images