Network security compliance data security protection system based on block chain

Abstract

The invention provides a network security compliance data security protection system based on a block chain, comprising: a block chain node module for storing data blocks in a distributed manner and verifying the data blocks based on a consensus algorithm, the block chain node module adopting a collaborative storage mechanism combining on-chain storage and off-chain storage; the data encryption module is used for carrying out encryption processing on the original data by adopting an encryption algorithm before the data is stored or transmitted by the block chain node module, and managing an encryption key; the access control module is integrated in the smart contract of the block chain node module and is used for performing permission verification on the data access request of the user according to a predefined access rule; and a compliance verification module. According to the invention, data is effectively prevented from being tampered or leaked, and the data security is improved; the consensus mechanism of the block chain and the intelligent contract technology are utilized to realize automatic verification of compliance, and the verification efficiency is improved; and under-chain destruction of data is supported, and tampering resistance and forgotten right are balanced.

Description

Technical Field

[0001] This application relates to the field of data security technology, specifically a blockchain-based network security compliance data security protection system. Background Technology

[0002] With the deepening of digital transformation, enterprises and institutions face increasingly severe security and compliance challenges when handling online data. Data breaches, tampering, and violations of laws and regulations (such as GDPR and CCPA) can not only lead to significant economic losses but also potentially trigger serious legal consequences and reputational risks. Therefore, the field of cybersecurity compliance places extremely high demands on the secure storage, controlled access, and automated compliance verification of data.

[0003] Currently, this field mainly relies on the following traditional technical solutions: Centralized data storage and encryption technology: The current mainstream approach is to store data on centralized servers or cloud storage platforms and use traditional encryption algorithms (such as AES and RSA) to encrypt data both at rest and in transit. However, this centralized architecture has the risk of a single point of failure; once the storage server is compromised, it may lead to a large-scale data leak. In addition, if the encrypted data itself is stolen at the centralized node, it is still at risk of being cracked offline, and the centralized management of encryption keys is itself a security weakness.

[0004] Policy-based access control mechanisms: Systems typically use models such as Access Control Lists (ACLs) or Role-Based Access Control (RBAC) to manage data permissions. These models rely on a centralized permission management server. Their drawbacks include the fact that policy formulation and enforcement are concentrated in a single entity, potentially making the policies inflexible and ill-suited for complex access scenarios involving multiple organizations and roles. Furthermore, the centralized permission server itself can be tampered with or bypassed, leading to unauthorized access, and all access logs depend on this centralized system, raising questions about their authenticity and completeness.

[0005] Manual or semi-automated compliance verification: In existing systems, verifying whether data complies with relevant regulations often relies on manual audits or external compliance inspection tools. This process is typically periodic, ex-post, inefficient, and costly. Due to the lack of technological enforcement, real-time, transparent compliance monitoring of data processing (such as collection, storage, use, and cross-border transfer) is difficult to achieve. Audit trails are also easily modified or deleted in centralized systems, leading to insufficient credibility of audit results.

[0006] In summary, existing technologies generally suffer from the following core defects: Lack of trust and transparency: Reliance on a single centralized institution results in low system transparency and makes it difficult for participants to establish trust.

[0007] Insufficient data integrity protection: Data stored in a centralized manner is easily tampered with by internal or external attackers and is difficult to prove its innocence.

[0008] Inflexible and unreliable access control: permission management is not flexible enough, and the reliability of access decisions and logs depends on the security of a single entity.

[0009] Compliance verification is inefficient and unreliable: manual auditing is lagging, and automated tools lack an immutable consensus basis, resulting in unsatisfactory credibility and efficiency of verification results.

[0010] While there have been technological attempts to introduce blockchain into data management, these have typically only been used to store data hashes, failing to systematically address issues such as the security of raw off-chain data, the flexibility and trusted enforcement of access controls, and the automated verification of complex compliance rules. In particular, how to ensure data immutability while simultaneously protecting data privacy (such as the "right to be forgotten") and responding to dynamically changing compliance requirements remains a key challenge that current technologies have not adequately addressed. Summary of the Invention

[0011] The problem addressed by this invention is how to provide a systematic solution that integrates data security, trusted access control, and efficient compliance verification.

[0012] To address the aforementioned issues, this invention provides a blockchain-based network security compliance data security protection system.

[0013] In a first aspect, the present invention provides a blockchain-based network security compliance data security protection system, comprising: The blockchain node module is used to store data blocks in a distributed manner and verify the data blocks based on a consensus algorithm. The blockchain node module adopts a collaborative storage mechanism that combines on-chain storage and off-chain storage. The data encryption module is used to encrypt the original data using an encryption algorithm before the data is stored or transmitted by the blockchain node module, and to manage the encryption key. An access control module, integrated into the smart contract of the blockchain node module, is used to verify the user's data access requests according to predefined access rules. The compliance verification module is used to automatically check the compliance of uploaded or accessed data based on predefined compliance rules that have been encoded into smart contracts.

[0014] Optionally, the blockchain node module stores metadata on-chain for storing data, and the metadata includes at least the key hash value, digital fingerprint, or Merkle root of the audit log for the data. The off-chain storage is used to store the encrypted original data after it has been processed by the data encryption module.

[0015] Optionally, the system is configured to: when data integrity verification is required, perform the verification by comparing whether the hash value recalculated from the original data retrieved from off-chain storage is consistent with the corresponding hash value stored on-chain.

[0016] Optionally, the blockchain node module adopts a layered architecture, including: The first layer of the blockchain network is a consortium blockchain, used to store compliance metadata and process verification operations that require broad consensus. The second-layer blockchain network is a private chain that connects to the first-layer blockchain network via cross-chain technology. It is used to store highly sensitive raw data and perform complex calculations. The second-layer blockchain network adopts the PBFT consensus mechanism.

[0017] Optionally, the data encryption module specifically includes: The key management unit is used to generate, store, and distribute encryption keys, and utilizes the blockchain to store the hash value of the keys or key fragments. An encryption execution unit is used to encrypt data using symmetric or asymmetric encryption algorithms.

[0018] Optionally, the operation flow of the access control module includes: Access rules based on user identity, role, and permission level are defined through smart contracts; Receive data access requests initiated by users, which include their identity credentials; The smart contract is invoked to verify whether the identity credentials comply with the access rules. The data access request will be approved or rejected based on the verification results, and the access behavior will be recorded on the blockchain.

[0019] Optionally, the operation process of the compliance verification module includes: Encode external compliance requirements into executable logic within smart contracts; When data upload or access is triggered, the logic in the smart contract is automatically executed to check whether the data meets compliance requirements; If the inspection fails, a compliance alert will be triggered and related operations will be blocked, while the violation will be logged.

[0020] Optionally, the compliance verification module integrates a zero-knowledge proof mechanism, which is configured as follows: Data providers are allowed to generate a certificate that verifies their data processing procedures comply with specific compliance requirements without disclosing any sensitive data content. The verifier is allowed to verify the validity of the proof, thereby confirming the compliance of the data processing.

[0021] Optionally, the system further includes a dynamic adaptive engine for enabling the compliance verification module to adapt to changes in compliance requirements. This engine is implemented in the following ways: The upgradeable contract model, which adopts a proxy contract design, enables the smart contract code for compliance verification logic to be upgraded without interrupting service. The rule-logic separation design stores specific compliance rule parameters separately from the contract execution logic, allowing rule parameters to be updated independently through authorized operations.

[0022] Optionally, the consensus algorithm includes a proof-of-stake or proof-of-work algorithm, used to reach an agreement on the validity of data blocks among multiple nodes of the blockchain node module.

[0023] The beneficial effects of the blockchain-based network security compliance data security protection system of the present invention are as follows: By leveraging the distributed ledger and immutability of blockchain, along with encryption algorithms, data tampering or leakage can be effectively prevented, enhancing data security. The consensus mechanism and smart contract technology of blockchain enable automated compliance verification, improving verification efficiency. Based on blockchain smart contract technology, fine-grained access control policies can be implemented to meet security needs in various scenarios. Through an on-chain-off-chain collaborative storage design, data immutability and verifiability are achieved while supporting off-chain data destruction, balancing immutability and the right to be forgotten. An upgradeable contract model and a "rule-logic" separation design allow for secure upgrades to compliance logic and modifications to rule parameters, adapting to changes in laws and regulations. Attached Figure Description

[0024] Figure 1 This is an architecture diagram of a blockchain-based network security compliance data security protection system in an embodiment of the present invention; Figure 2 This is a schematic diagram of a blockchain-based network security compliance data security protection system in an embodiment of the present invention. Detailed Implementation

[0025] To better understand the purpose, technical solution, and advantages of this application, the application is described and explained below in conjunction with the accompanying drawings and embodiments.

[0026] Unless otherwise defined, the technical or scientific terms used in this application shall have the general meaning understood by one of ordinary skill in the art to which this application pertains. Words such as “a,” “an,” “an,” “the,” “the,” and “these” used in this application do not indicate quantitative limitation and may be singular or plural. The terms “comprising,” “including,” “having,” and any variations thereof used in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that comprises a series of steps or modules (units) is not limited to the listed steps or modules (units) but may include steps or modules (units) not listed, or may include other steps or modules (units) inherent to these processes, methods, products, or devices. Words such as “connected,” “linked,” and “coupled” used in this application are not limited to physical or mechanical connections but may include electrical connections, whether direct or indirect. “Multiple” used in this application refers to two or more. “And / or” describes the relationship between related objects, indicating that three relationships may exist; for example, “A and / or B” can represent: A alone, A and B simultaneously, and B alone. Normally, the character " / " indicates that the objects before and after it are in an "or" relationship. The terms "first," "second," "third," etc., used in this application are merely to distinguish similar objects and do not represent a specific order of objects.

[0027] like Figure 1 and Figure 2 As shown in the figure, an embodiment of the present invention provides a blockchain-based network security compliance data security protection system, comprising: The blockchain node module is used to store data blocks in a distributed manner and verify the data blocks based on a consensus algorithm. The blockchain node module adopts a collaborative storage mechanism that combines on-chain storage and off-chain storage. The on-chain storage of the blockchain node module is used to store metadata for the data. The metadata includes at least the key hash value, digital fingerprint, or Merkle root of the audit log. Off-chain storage is used to store the encrypted raw data after it has been processed by the data encryption module.

[0028] The system is configured to perform data integrity verification by comparing the hash value recalculated from the original data retrieved from off-chain storage with the corresponding hash value stored on-chain when data integrity verification is required.

[0029] The blockchain node module adopts a layered architecture, including: The first layer of the blockchain network is a consortium blockchain, used to store compliance metadata and process verification operations that require broad consensus. The second-layer blockchain network is a private chain that connects to the first-layer blockchain network via cross-chain technology. It is used to store highly sensitive raw data and perform complex calculations. The second-layer blockchain network adopts the PBFT consensus mechanism.

[0030] Specifically, the blockchain node module is responsible for storing and verifying data blocks, ensuring data integrity and immutability. First, data storage is performed. The blockchain node module adopts a distributed storage architecture (HyperledgerFabric / Corda), where each node maintains a complete or partial copy of the data, ensuring high availability and redundancy. Data is stored in the form of data blocks, each containing a certain amount of data and linked to the previous data block via hash values, forming a chain structure to ensure data continuity. Then, data verification is performed. When a new data block is created and attempted to be added to the blockchain, the node module rigorously verifies it. This includes verifying the data's integrity, legality, and compliance with the blockchain's consensus rules.

[0031] It should be noted that consensus algorithms include proof-of-stake or proof-of-work algorithms, which are used to reach a consensus on the validity of data blocks among multiple nodes in the blockchain node module.

[0032] Specifically, the verification process involves the joint participation of multiple nodes. Consensus algorithms (such as Proof-of-Work and Proof-of-Stake) ensure the validity of data blocks and prevent malicious tampering. Next, it ensures data integrity and immutability. Once a data block is verified and added to the blockchain, its content and order cannot be altered. This is due to the chain structure of the blockchain and the constraints of the consensus mechanism; any attempt to tamper with data will be detected and rejected by other nodes in the network. Data integrity is guaranteed through hash values. Each data block contains the hash value of the previous data block; any small modification to the data will result in a significant change in the hash value, thus being detected by the system. Finally, communication and collaboration between nodes are crucial. Blockchain nodes transmit and synchronize data through specific communication protocols, ensuring that each node can obtain the latest blockchain state in a timely manner. Nodes coordinate the data verification and addition process through consensus algorithms, ensuring the stability and consistency of the entire blockchain system. The technical implementation method employs a P2P (peer-to-peer) distributed network architecture, where each node is equal and there is no central server control. This architecture improves the system's resistance to attacks and data reliability. Ethereum's Proof-of-Stake (PoS) consensus algorithm was selected based on the application scenarios and requirements for cybersecurity compliance. The consensus algorithm is crucial for ensuring the consistency and security of the blockchain system. During data storage and transmission, encryption algorithms are used to encrypt data, ensuring its security. Simultaneously, digital signature technology is used to verify the source and integrity of the data. Smart contract functionality is embedded in the blockchain node module to automate data verification and processing logic. Smart contracts can execute automatically based on preset conditions, reducing the risk of human intervention.

[0033] It should be further explained that the blockchain node module adopts a consortium blockchain distributed architecture, which combines the decentralized characteristics of public blockchains with the efficiency of private blockchains, providing strong support for network security and compliant data protection. The core responsibility of the blockchain node module is to store and verify data blocks, ensuring data integrity and immutability. An on-chain and off-chain collaborative storage mechanism has been designed, and optimizations have been made in node communication and collaboration.

[0034] 1. On-chain and off-chain collaborative storage design; On-chain storage of content and key hash values: Before each data block is stored off-chain, its hash value is calculated and stored on-chain. The hash value serves as a unique identifier for the data and is used for subsequent data verification and auditing. Digital fingerprints: Similar to hash values, but potentially generated using more complex algorithms to provide higher security. Digital fingerprints are also stored on-chain as an additional guarantee of data integrity.

[0035] Merkle root of the audit log: The audit log records all operations on the data, including uploads, accesses, and modifications. To save on-chain storage space, we calculate the Merkle root of the audit log and store it on-chain. The Merkle root is a root node hash value of a tree structure, which can efficiently verify the integrity of large amounts of data.

[0036] Off-chain storage of raw data: Due to limited and costly on-chain storage space, raw data is encrypted and stored off-chain. Off-chain storage can utilize distributed file systems or cloud storage services to ensure high availability and scalability. Encryption key management: To ensure the security of off-chain data, encryption keys are divided into multiple fragments, and their hash values ​​or partial fragments are stored using blockchain technology. This way, even if some key fragments are leaked, attackers cannot recover the complete key. Collaborative storage mechanism: When data needs to be verified or audited, the system first obtains the key hash value, digital fingerprint, or Merkle root from on-chain storage. Then, the system retrieves the corresponding raw data or audit logs from off-chain storage based on this metadata. Finally, the system calculates the hash value or Merkle root of the retrieved data and compares it with the value stored on-chain to verify the data's integrity and lack of tampering.

[0037] Furthermore, node communication and collaboration design; P2P Distributed Network Architecture: Each blockchain node is equal, with no central server controlling the system. This architecture improves the system's resilience to attacks because a single point of failure does not affect the overall system operation. Nodes communicate via a P2P protocol, directly exchanging data and information without intermediaries. This reduces communication latency and improves data transmission efficiency. Consensus Algorithm Selection: The Proof-of-Stake (PoS) consensus algorithm is chosen to guarantee data synchronization and consistency verification among nodes. The PoS algorithm selects block producers based on the number of tokens held by a node or the time held, reducing energy consumption and improving system scalability. In the PoS algorithm, nodes need to stake a certain number of tokens as collateral. If a node misbehaves (such as attempting to tamper with data), its staked tokens will be forfeited. This increases the cost of malicious behavior and improves system security.

[0038] Data Synchronization and Verification Process: When a new data block is created and attempted to be added to the blockchain, the node module rigorously verifies it. The verification process includes checking the data's integrity, legality, and compliance with the blockchain's consensus rules. This process involves the participation of multiple nodes. Nodes exchange verification information via a P2P protocol and use a consensus algorithm to reach agreement. If a majority of nodes consider the data block valid, it is added to the blockchain. Once a data block is verified and added to the blockchain, its content and order cannot be altered. This is due to the chain structure of the blockchain and the constraints of its consensus mechanism. Any attempt to tamper with the data will be detected and rejected by other nodes in the network.

[0039] The data encryption module is used to encrypt the original data using encryption algorithms before it is stored or transmitted by the blockchain node module, and to manage the encryption keys. The data encryption module specifically includes: The key management unit is used to generate, store, and distribute encryption keys, and utilizes the blockchain to store the hash value of the keys or key fragments. An encryption execution unit is used to encrypt data using symmetric or asymmetric encryption algorithms.

[0040] The data encryption module employs encryption algorithms to encrypt data, ensuring its security during transmission and storage. First, an encryption algorithm is selected based on the data's security requirements and application scenario, such as AES (Advanced Encryption Standard) or RSA (Asymmetric Encryption). Next, key generation and management are performed, generating key pairs (for asymmetric encryption) or a single key (for symmetric encryption). A strict key management strategy is implemented, including key storage, distribution, updating, and destruction, to ensure key security. Blockchain technology is used to store key hash values ​​or key fragments, enhancing key management security. Then, data encryption is performed before data is sent or stored, using the selected encryption algorithm and key. The encryption process ensures that all sensitive parts of the data are covered, including but not limited to user information, transaction records, and configuration files. Simultaneously, in terms of data transmission, the encrypted data is transmitted to the blockchain node module or other storage media via secure communication channels (such as HTTPS, SSL / TLS, etc.). During transmission, additional data packet security measures are implemented to further enhance data transmission security. For data storage, encrypted data is stored in a blockchain-based distributed ledger storage medium, ensuring that the storage medium has appropriate access control and backup mechanisms to prevent data loss or unauthorized access. When data decryption and access are required, the user or system must provide the correct key or meet specific access control conditions. The encrypted data is then decrypted using the appropriate decryption algorithm and key to restore its original form.

[0041] The access control module, integrated into the smart contract of the blockchain node module, is used to verify the user's data access requests according to predefined access rules. The operation process of the access control module includes: Access rules based on user identity, role, and permission level are defined through smart contracts; Receive data access requests initiated by users, which include their identity credentials; Call the smart contract to verify whether the identity credentials comply with the access rules; The data access request will be approved or rejected based on the verification results, and the access behavior will be recorded on the blockchain.

[0042] Specifically, blockchain-based smart contract technology enables a flexible access control mechanism, ensuring that only authorized users can access data. First, data access rules are explicitly defined in the smart contract. These rules can include user identity, role, permission level, and specific access conditions. Based on these access rules, smart contract code is written using the blockchain programming language Solidity. The code contains access control logic for verifying permissions when a data access request occurs. Then, when a user registers in the system, they need to submit necessary identity information and be confirmed through an authentication mechanism. This information is stored on the blockchain to ensure its immutability. Once the user's identity is confirmed, the system issues a unique identity credential, such as a private key or digital certificate. The user uses this credential to initiate a data access request; when a user needs to access data, they will use their identity credential to initiate an access request to the access control module. The request includes the user's identity information, the requested data identifier, and any necessary additional information. Upon receiving the request, the access control module verifies the request using the access rules in the smart contract. This includes checking the user's identity, role, and permission level, as well as confirming that the user meets specific access conditions; the smart contract will check the user's permissions according to the predefined access rules. If the user's permissions meet the access requirements, the request will be approved; otherwise, the request will be rejected. Once permission verification is complete, the smart contract will automatically execute the decision, allowing or denying the user's access request. This decision-making process is based on the blockchain's consensus mechanism, ensuring the credibility and immutability of the decision. Furthermore, regardless of whether the access request is approved, the access control module will record the user's access behavior, including the access time, access data identifiers, and access results. This information will be stored on the blockchain for subsequent auditing and traceability.

[0043] The compliance verification module is used to automatically check the compliance of uploaded or accessed data based on predefined compliance rules that have been encoded into smart contracts.

[0044] The operation process of the compliance verification module includes: Encode external compliance requirements into executable logic within smart contracts; When data upload or access is triggered, the logic in the smart contract is automatically executed to check whether the data meets compliance requirements; If the inspection fails, a compliance alert will be triggered and related operations will be blocked, while the violation will be logged.

[0045] The compliance verification module integrates a zero-knowledge proof mechanism, which is configured as follows: Data providers are allowed to generate a certificate that verifies their data processing procedures comply with specific compliance requirements without disclosing any sensitive data content. It allows the verifying party to validate the validity of the proof, thereby confirming the compliance of data processing.

[0046] The consensus mechanism of blockchain enables rapid verification of data compliance. First, compliance rules are defined based on relevant regulations, policies, or internal corporate compliance requirements (such as GDPR and CCPA provisions). These rules may include requirements regarding data format, content, scope of use, and storage period. These compliance rules are then encoded into smart contracts and deployed on the blockchain. The smart contracts automatically execute and verify whether the data complies with the rules. Next, compliance checks are performed on uploaded data. When a user uploads data, the compliance verification module first performs a preliminary compliance check. This includes checking whether the data format, size, and type meet basic requirements. If the data passes the preliminary check, the module triggers the smart contract for a more in-depth compliance verification. The smart contract checks the data item by item according to preset rules to ensure full compliance. Finally, compliance verification is performed on access requests. When a user initiates a data access request, the compliance verification module also performs a compliance check, primarily verifying whether the user has permission to access the data and whether the access method complies with compliance requirements. Smart contracts comprehensively assess the compliance of access requests based on user identity, roles, permissions, data sensitivity, and access history. They then monitor data usage for compliance, with the compliance verification module continuously monitoring data usage to ensure it always complies with requirements. If abnormal or non-compliant data usage is detected, the module immediately triggers alerts and takes appropriate measures, such as blocking data access and recording violations. Finally, a compliance report is generated, summarizing the data's compliance status, including compliance check results and the handling of violations. This provides enterprises with strong proof of data compliance, helping them better meet regulatory requirements and reduce compliance risks. Furthermore, through the blockchain's consensus mechanism, the compliance verification process can quickly reach agreement among multiple nodes, ensuring efficiency and accuracy. Consensus algorithms (such as Proof-of-Work and Proof-of-Stake) ensure the fairness and immutability of the compliance verification results, enhancing data credibility.

[0047] The system also includes a dynamic adaptive engine to enable the compliance verification module to adapt to changes in compliance requirements. The engine is implemented in the following ways: The upgradeable contract model, which adopts a proxy contract design, enables the smart contract code for compliance verification logic to be upgraded without interrupting service. The rule-logic separation design stores specific compliance rule parameters separately from the contract execution logic, allowing rule parameters to be updated independently through authorized operations.

[0048] For example, the implementation process of the present invention is as follows: Initialization Phase: Deploy the consortium blockchain network and configure node parameters (such as the number of nodes, consensus algorithm type, etc.). Initialize on-chain storage space and define the types of metadata to be stored (such as key hash values, digital fingerprints, Merkle roots, etc.). Set up an off-chain storage solution, selecting a distributed file system or cloud storage service as the storage medium for the raw data.

[0049] Data Upload Phase: Users encrypt their data and upload it to off-chain storage. Simultaneously, the hash value, digital fingerprint, and Merkle root of the audit logs are calculated, and this metadata is uploaded to the blockchain. Upon receiving the metadata, on-chain nodes perform preliminary verification (such as checking the validity of the hash value). If the verification passes, the metadata is stored on the blockchain; otherwise, the upload request is rejected.

[0050] Data Access Phase: When a user initiates a data access request, they need to provide identity credentials and access permission information. The access control module verifies the request according to the access rules in the smart contract. The verification process includes checking the user's identity, role, and permission level, as well as confirming that the user meets specific access conditions. If the access request is approved, the system retrieves the corresponding raw data from off-chain storage and returns it to the user. Simultaneously, the user's access behavior (such as access time, accessed data identifier, etc.) is recorded and stored on-chain.

[0051] Compliance Verification Phase: The compliance verification module automatically performs compliance checks upon data upload or access. The process includes verifying whether the data complies with relevant laws, policies, or internal corporate compliance requirements (such as GDPR and CCPA provisions). The compliance verification module encodes compliance rules into smart contracts and deploys them on the blockchain. The smart contracts check the data item by item according to preset rules to ensure full compliance. If any abnormal or non-compliant data usage is detected, the module immediately triggers an alert and takes appropriate measures (such as blocking data access and recording violations). A compliance report is also generated, summarizing the data's compliance status.

[0052] Simultaneously, a layered / sharded blockchain network is designed to address the different consensus and permission models required for different data types and compliance requirements. Layer 1 (Consortium Chain): handles low-sensitivity compliance metadata requiring broad consensus (such as policy hashes and audit event digests); Layer 2 (Private Chain): handles high-sensitivity raw data and performs complex calculations, employing a more efficient PBFT consensus mechanism.

[0053] The data encryption module uses encryption algorithms such as AES (Advanced Encryption Standard) and RSA (Asymmetric Encryption Algorithm) to enhance data security.

[0054] The access control module supports fine-grained access control policies to meet the security needs of different scenarios.

[0055] The compliance verification module automatically performs compliance checks through smart contracts, improving verification efficiency.

[0056] To further enhance privacy protection in data processing, the system incorporates Zero-Knowledge Proof (ZKP) technology. Zero-Knowledge Proof allows the prover (data provider) to demonstrate the truthfulness of a statement to the verifier (such as a regulatory agency) without revealing any specific information. In this system, Zero-Knowledge Proof technology can be used to prove that data processing complies with specific compliance requirements without disclosing sensitive data content.

[0057] The implementation process is as follows: Proof Generation: The data provider uses a zero-knowledge proof algorithm to generate a proof that verifies whether the data processing meets specific compliance conditions without disclosing any original data. Proof Verification: Regulatory agencies or other verifiers use appropriate verification algorithms to verify the generated proof. If the verification passes, the data processing is confirmed as compliant; otherwise, it is considered non-compliant.

[0058] To address evolving compliance requirements, the system employs a dynamic adaptive engine that incorporates an upgradeable contract model and a rule-logic separation design. The smart contracts utilize an upgradeable architecture, allowing for secure code upgrades without disrupting system operation. This is achieved through technologies such as proxy contracts or data separation contracts, ensuring that newer versions of the contract seamlessly take over the functionality of older versions. Separating compliance rules from execution logic allows rule parameters to be modified independently of the contract code. This design enables system administrators to adjust compliance rules through simple configuration updates without redeploying the smart contracts.

[0059] Specifically, rule storage: Compliance rules are stored in a specific data structure (such as a map or array) on the blockchain for smart contracts to query during execution. Rule update interface: Secure interfaces are provided for administrators to update rule parameters; these interfaces typically require administrator privileges to access. Logic execution: When performing compliance checks, smart contracts read the latest rule parameters from the blockchain and perform verification based on these parameters.

[0060] Through the design of a dynamic adaptive engine, the system can flexibly respond to changes in compliance requirements, ensuring continuous compliance in data processing.

[0061] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A blockchain-based network security compliance data security protection system, characterized in that, include: The blockchain node module is used to store data blocks in a distributed manner and verify the data blocks based on a consensus algorithm. The blockchain node module adopts a collaborative storage mechanism that combines on-chain storage and off-chain storage. The data encryption module is used to encrypt the original data using an encryption algorithm before the data is stored or transmitted by the blockchain node module, and to manage the encryption key. An access control module, integrated into the smart contract of the blockchain node module, is used to verify the user's data access requests according to predefined access rules. The compliance verification module is used to automatically check the compliance of uploaded or accessed data based on predefined compliance rules that have been encoded into smart contracts.

2. The blockchain-based network security compliance data security protection system according to claim 1, characterized in that, The blockchain node module stores metadata on-chain for storing data, and the metadata includes at least the key hash value, digital fingerprint, or Merkle root of the audit log. The off-chain storage is used to store the encrypted original data after it has been processed by the data encryption module.

3. The blockchain-based network security compliance data security protection system according to claim 2, characterized in that, The system is configured to perform data integrity verification by comparing the hash value recalculated from the original data retrieved from off-chain storage with the corresponding hash value stored on-chain when data integrity verification is required.

4. The blockchain-based network security compliance data security protection system according to claim 1, characterized in that, The blockchain node module adopts a layered architecture, including: The first layer of the blockchain network is a consortium blockchain, used to store compliance metadata and process verification operations that require broad consensus. The second-layer blockchain network is a private chain that connects to the first-layer blockchain network via cross-chain technology. It is used to store highly sensitive raw data and perform complex calculations. The second-layer blockchain network adopts the PBFT consensus mechanism.

5. The blockchain-based network security compliance data security protection system according to claim 1, characterized in that, The data encryption module specifically includes: The key management unit is used to generate, store, and distribute encryption keys, and utilizes the blockchain to store the hash value of the keys or key fragments. An encryption execution unit is used to encrypt data using symmetric or asymmetric encryption algorithms.

6. The blockchain-based network security compliance data security protection system according to claim 1, characterized in that, The operation process of the access control module includes: Access rules based on user identity, role, and permission level are defined through smart contracts; Receive data access requests initiated by users, which include their identity credentials; The smart contract is invoked to verify whether the identity credentials comply with the access rules. The data access request will be approved or rejected based on the verification results, and the access behavior will be recorded on the blockchain.

7. The blockchain-based network security compliance data security protection system according to claim 1, characterized in that, The operation process of the compliance verification module includes: Encode external compliance requirements into executable logic within smart contracts; When data upload or access is triggered, the logic in the smart contract is automatically executed to check whether the data meets compliance requirements; If the inspection fails, a compliance alert will be triggered and related operations will be blocked, while the violation will be logged.

8. The blockchain-based network security compliance data security protection system according to claim 7, characterized in that, The compliance verification module integrates a zero-knowledge proof mechanism, which is configured as follows: Data providers are allowed to generate a certificate that verifies their data processing procedures comply with specific compliance requirements without disclosing any sensitive data content. The verifier is allowed to verify the validity of the proof, thereby confirming the compliance of the data processing.

9. The blockchain-based network security compliance data security protection system according to claim 1, characterized in that, The system also includes a dynamic adaptive engine to enable the compliance verification module to adapt to changes in compliance requirements. This engine is implemented in the following ways: The upgradeable contract model, which adopts a proxy contract design, enables the smart contract code for compliance verification logic to be upgraded without interrupting service. The rule-logic separation design stores specific compliance rule parameters separately from the contract execution logic, allowing rule parameters to be updated independently through authorized operations.

10. The blockchain-based network security compliance data security protection system according to any one of claims 1 to 9, characterized in that, The consensus algorithm includes a proof-of-stake or proof-of-work algorithm, used to reach an agreement on the validity of data blocks among multiple nodes of the blockchain node module.

Images