Security event tracing method and device based on block chain, equipment, storage medium and computer program product

Abstract

The invention relates to a security event tracing method and device based on a block chain, equipment, a storage medium and a computer program product. The method comprises the following steps: encrypting log data and storing the encrypted log data in a decentralized block chain network; integrating log data of a plurality of devices and / or a plurality of systems in the block chain network to generate a data view; according to the data view and the log data, safety inspection is executed for a safety event, and whether a safety problem exists or not is judged; in response to the detected security issues, determining a causal relationship between the patrolled security issues, and determining an attack source corresponding to the security issues; and log data in different block chain networks are integrated through a cross-chain technology, and tracing and response are performed on security events of different block chain networks in combination with a preset security event early warning mechanism of a block chain and a preset security event knowledge base based on the block chain. By adopting the method, the safety event patrol and processing efficiency can be improved.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to a blockchain-based method, apparatus, device, storage medium, and computer program product for tracing security incidents. Background Technology

[0002] In the digital age, cybersecurity faces severe challenges. With the rapid development of information technology, enterprise and organizational systems are becoming increasingly complex, containing numerous devices and systems, such as servers, network equipment, and various applications.

[0003] Traditional methods require separate connections to logs from different sources such as servers, network devices, and various applications. After manually integrating the data, security inspections are conducted. Log privacy is protected through symmetric or asymmetric encryption technologies. Based on locally accumulated experience, the causal relationships of security issues are determined, and source tracing and response are carried out for security incidents in a single network environment.

[0004] However, traditional methods for tracing security incidents have many shortcomings: First, log data is stored in a scattered manner, making integration and management difficult and resulting in low efficiency of security patrols; second, traditional encryption algorithms are vulnerable to attacks, making it difficult to guarantee the authenticity and integrity of log data; and third, cross-network data interaction relies on traditional communication protocols, making it difficult to achieve collaborative tracing between different networks and limiting the scope of tracing. Summary of the Invention

[0005] Therefore, it is necessary to provide a blockchain-based security incident tracing method, device, equipment, storage medium, and computer program product that can improve the efficiency of security incident inspection and handling, addressing the aforementioned technical problems.

[0006] Firstly, this application provides a blockchain-based method for tracing security incidents. The method includes:

[0007] Log data is encrypted and stored in a decentralized blockchain network;

[0008] Integrate log data from multiple devices and / or multiple systems in the blockchain network to generate a data view;

[0009] Based on the data view and the log data, perform security inspections on security events to determine whether any security issues exist.

[0010] In response to the detection of security issues, the causal relationship between the detected security issues is determined, and the attack source corresponding to the security issues is identified.

[0011] By integrating log data from different blockchain networks through cross-chain technology, and combining a pre-set blockchain security incident early warning mechanism and a pre-set blockchain-based security incident knowledge base, security incidents on different blockchain networks can be traced and responded to.

[0012] In some embodiments of the method, the method further includes:

[0013] Encryption or decryption is performed through a pre-defined blockchain-based encryption key generation and management mechanism.

[0014] In some embodiments of the method, performing encryption or decryption through a preset blockchain-based encryption key generation and management mechanism includes:

[0015] The encryption key is divided into multiple key fragments and stored on multiple nodes;

[0016] During encryption and decryption, key fragments are obtained from multiple nodes and combined to form a complete key to perform the corresponding encryption or decryption operation.

[0017] In some embodiments of the method, the method further includes:

[0018] An initial quantum key pair shared among nodes is generated through a quantum key distribution protocol, and the quantum key is stored in a quantum-safe storage module, which is used to monitor the security of the key in real time.

[0019] The quantum encryption algorithm uses a quantum key to encrypt the shuffled key fragments, and then distributes the encrypted key fragments to multiple nodes in the blockchain network.

[0020] According to a preset cycle, a quantum entangled link is established between nodes based on the principle of quantum entanglement, a quantum verification signal is sent, and the verification result is compared to determine whether the key fragment has been tampered with; if tampering is detected, a quantum key pair is immediately regenerated, the key fragment of the tampered node is re-encrypted, stored and broadcast.

[0021] Encrypted key fragments are obtained from multiple nodes through a quantum communication encryption channel. The original key fragments are then restored using a shared quantum key and a corresponding quantum decryption algorithm. These fragments are combined to form a complete encryption key, which is then used to perform the decryption operation.

[0022] In some embodiments of the method, the step of integrating log data from multiple devices and / or multiple systems in the blockchain network to generate a data view includes:

[0023] Log data is automatically verified and integrated through blockchain smart contracts, and categorized and labeled according to preset rules for device type, system type, and security issue type to generate a data view.

[0024] In some embodiments of the method, the step of performing a security inspection based on the data view and the log data to determine whether a security problem exists includes:

[0025] Multiple inspection nodes are used to inspect log data simultaneously;

[0026] The system uses a blockchain consensus mechanism to determine whether the corresponding inspection results are consistent. If they are consistent, it is determined that there is no security problem; otherwise, it is determined that there is a security problem and multiple corresponding inspection nodes are triggered simultaneously.

[0027] In some embodiments of the method, determining the causal relationship between detected security issues in response to detecting a security issue includes:

[0028] Causal reasoning techniques are used to determine the causal relationships between security issues detected during inspections. Combined with the timestamp characteristics of blockchain, the occurrence time and order of security issues are recorded, and the occurrence time is configured as the timestamp of blockchain transactions.

[0029] In some embodiments of the method, determining the attack source corresponding to the security problem includes:

[0030] The attack path and corresponding attack evidence are recorded by the blockchain and defined as a blockchain transaction. The source of the attack is determined based on the attack path.

[0031] In some embodiments of the method, the early warning mechanism is configured to utilize the distributed ledger and smart contract technology of blockchain to monitor changes in log data in real time, and to be triggered and generate a corresponding early warning signal in the event of a security problem.

[0032] In some embodiments of the method, the step of integrating log data from different blockchain networks using cross-chain technology, and combining a pre-defined blockchain security event early warning mechanism and a pre-defined blockchain-based security event knowledge base to perform source tracing and response to security events on different blockchain networks, includes:

[0033] In the various blockchain networks participating in cross-chain, a target node is selected as a cross-chain node. Quantum entanglement links are established between cross-chain nodes in different blockchain networks through quantum communication devices to form node pairs. Public and private key pairs are generated based on the properties of quantum entanglement states to complete identity authentication and key negotiation.

[0034] The cross-chain nodes of the source blockchain network preprocess the log data, encrypt the processed log data using a quantum key-based encryption algorithm, generate a unique quantum tag for each data block based on the hash value, timestamp, and characteristic parameters of the quantum entangled state, and synchronously transmit the encrypted data block and the quantum tag to the corresponding cross-chain node of the target blockchain network through a quantum entanglement link.

[0035] The cross-chain nodes of the target blockchain network decrypt and parse the encrypted data block and the quantum tag, and reconstruct the causal relationship model of the security problem by combining log data from multiple blockchain networks through cross-chain data analysis algorithms.

[0036] In some embodiments of the method, the log data includes at least one of system log information, network traffic log information, and device log information.

[0037] According to a second aspect of the present disclosure, a blockchain-based security event tracing device is provided. The device includes:

[0038] The encryption module is used to encrypt log data and store it on a decentralized blockchain network.

[0039] A view generation module is used to integrate log data from multiple devices and / or multiple systems in the blockchain network to generate a data view.

[0040] The security inspection module is used to perform security inspections on security events based on the data view and the log data to determine whether there are any security issues.

[0041] The security issue tracing module is used to respond to the detection of security issues, determine the causal relationship between the security issues detected, and identify the attack source corresponding to the security issues;

[0042] The cross-chain analysis module is used to integrate log data from different blockchain networks through cross-chain technology, and combine it with a preset blockchain security event early warning mechanism and a preset blockchain-based security event knowledge base to perform source tracing and response to security events on different blockchain networks.

[0043] According to a third aspect of the present disclosure, a computer device is provided. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the aforementioned blockchain-based security event tracing method.

[0044] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, implements the aforementioned blockchain-based security event tracing method.

[0045] According to a fifth aspect of the present disclosure, a computer program product is provided. The computer program product includes a computer program that, when executed by a processor, implements the aforementioned blockchain-based security event tracing method.

[0046] The blockchain-based security incident tracing solution provided in this application provides a solution that encrypts and stores log data in a decentralized blockchain network, integrates multi-source log data to generate a data view, conducts security inspections and determines the causal relationship and attack source of security issues, integrates log data from different blockchain networks using cross-chain technology, and uses early warning mechanisms and knowledge bases for tracing responses. This effectively solves the problems of difficulty in integrating scattered log data and difficulties in cross-network collaborative tracing in traditional methods, improves the efficiency of security incident inspection and processing, expands the tracing scope, and ensures the security and authenticity of log data.

[0047] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0048] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure, and are not intended to unduly limit this disclosure.

[0049] Figure 1 This is a flowchart illustrating a blockchain-based security incident tracing method according to an exemplary embodiment.

[0050] Figure 2 This is a schematic diagram illustrating the specific process of a blockchain-based security incident tracing method according to an exemplary embodiment;

[0051] Figure 3 This is a structural block diagram of a blockchain-based security event tracing device according to an exemplary embodiment;

[0052] Figure 4 This is a diagram illustrating the internal structure of a computer device according to an exemplary embodiment. Detailed Implementation

[0053] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0054] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure. The terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitations, the presence of other identical or equivalent elements in a process, method, product, or apparatus that includes said elements is not excluded. For example, the use of terms such as "first," "second," etc., to denote names does not indicate any specific order.

[0055] In some implementations provided in this disclosure, the execution of the blockchain-based security event tracing method can be controlled by a unified controller or by multiple controllers. These controllers may include controllers on local terminals or controllers on remote servers. In some implementations, the controllers on local terminals and the controllers on servers may jointly assist in completing the blockchain-based security event tracing control processing. The local terminal mentioned in this disclosure may include, but is not limited to, various robotic devices, in-vehicle devices, personal computers, laptops, smartphones, tablets, wearable devices, medical devices, VR (Virtual Reality) devices, etc. The server may also be a server, server cluster, distributed subsystem, cloud processing platform, server containing blockchain nodes, or a combination thereof. The controllers described in this disclosure may include various control units capable of implementing logic processing functions, including but not limited to CPU (Central Processing Unit), PLC (Programmable Logic Controller), ECU (Electronic Control Unit), MCU (Microcontroller Unit), FPGA (Field Programmable Gate Array), and CPLD (Complex Programmable Logic Device), as well as controllers composed of one or more logic function units, chips, etc.

[0056] In some embodiments of this disclosure, a blockchain-based security event tracing method is provided, such as... Figure 1 As shown, it includes the following steps:

[0057] S20. The log data is encrypted and stored in a decentralized blockchain network.

[0058] Log data typically refers to various recorded information generated during system operation, which may include the system's own operating status, data transmission in the network, and operation and running information of various devices.

[0059] Blockchain networks typically refer to a decentralized distributed network architecture that uses distributed ledger technology to achieve distributed storage and synchronization of data. It features immutability, decentralization, and no single point of failure, providing reliable technical support for the encrypted storage, verification and integration of log data, and the recording of information related to security events, thus ensuring the authenticity and security of data during storage and transmission.

[0060] S22. Integrate log data from multiple devices and / or multiple systems in the blockchain network to generate a data view.

[0061] A data view typically refers to a data presentation format that provides a comprehensive, macro-level perspective and clearly displays the log data situation in a relevant network environment.

[0062] S24. Based on the data view and the log data, perform a security inspection on the security event to determine whether there is a security problem.

[0063] Security incidents generally refer to various events that occur in the network environment that may threaten network security, disrupt normal system operation, or lead to data leakage or damage. These can include network attacks, unauthorized access, and data tampering. Such incidents require specialized technical means for tracing, analysis, and response to minimize the damage they cause.

[0064] Security issues typically refer to specific security vulnerabilities or anomalies detected in log data through security patrols. They are specific manifestations of security incidents, such as unauthorized access records, abnormal data transmission, or tampering of key fragments in log data.

[0065] S26. In response to the detection of a security issue, determine the causal relationship between the security issues detected and identify the attack source corresponding to the security issue.

[0066] Causality usually refers to the interrelationship between different security issues, that is, the occurrence of one security issue may trigger another security issue. By clarifying this correlation and influence, we can help to understand the development of security incidents.

[0067] The source of an attack usually refers to the root cause of a cyberattack. By using blockchain to record the attack path and corresponding attack evidence in detail, and storing this information as blockchain transactions, the specific entity that launched the attack can be identified based on the complete attack path tracing and analysis. This entity may be a specific device, network address, or node.

[0068] S28. Integrate log data from different blockchain networks through cross-chain technology, and combine them with a pre-set blockchain security event early warning mechanism and a pre-set blockchain-based security event knowledge base to trace and respond to security events in different blockchain networks.

[0069] Cross-chain technology typically refers to a technology that enables data interaction, integration, and verification between different blockchain networks. It can break the limitations of a single blockchain network and achieve collaborative data processing and security incident tracing across multiple blockchain networks.

[0070] An early warning mechanism typically refers to the ability to monitor the dynamic changes in log data in real time. When a security problem or potential security risk is detected, it is automatically triggered and a corresponding early warning signal is generated, which promptly alerts relevant personnel to pay attention to the risk and take countermeasures.

[0071] A security incident knowledge base typically refers to a database built by collecting historical security incident data and their corresponding processing procedures, defining this information as historical blockchain transactions, and combining it with knowledge base technology.

[0072] In some embodiments of this disclosure, log data is encrypted and stored in a decentralized blockchain network, multi-source log data is integrated to generate a data view, security inspections are carried out to determine the causal relationship and attack source of security issues, and cross-chain technology is used to integrate log data from different blockchain networks. With the help of early warning mechanisms and knowledge bases, the problem of difficulty in integrating traditional log data and difficulty in cross-network collaborative tracing is effectively solved. This improves the efficiency of security incident inspection and handling, expands the scope of tracing, and ensures the security and authenticity of log data.

[0073] In some embodiments of this disclosure, the log data includes at least one of system log information, network traffic log information, and device log information.

[0074] In some implementations, log data can be encrypted and stored in a pre-defined decentralized blockchain network. Encrypted storage ensures the security and privacy of the log data, preventing unauthorized access or tampering during storage. Leveraging the decentralized nature of the blockchain network enhances data reliability, eliminates single points of failure, and the immutability of the data facilitates verification of its authenticity during subsequent tracing. The log data may include system logs, network traffic logs, and device logs.

[0075] In some embodiments of this disclosure, log data can cover multiple types of information, ensuring the comprehensiveness of log data and providing rich and sufficient data support for security inspection and tracing work. This avoids the situation where security problems are missed or the tracing is incomplete due to incomplete log data, and improves the comprehensiveness and accuracy of security incident tracing.

[0076] In some embodiments of this disclosure, the method further includes:

[0077] Encryption or decryption is performed through a pre-defined blockchain-based encryption key generation and management mechanism.

[0078] In some embodiments of this disclosure, the step of performing encryption or decryption through a preset blockchain-based encryption key generation and management mechanism includes:

[0079] The encryption key is divided into multiple key fragments and stored on multiple nodes;

[0080] During encryption and decryption, key fragments are obtained from multiple nodes and combined to form a complete key to perform the corresponding encryption or decryption operation.

[0081] In some implementations, the encryption process can employ a pre-defined blockchain-based encryption key generation and management mechanism. Specifically, the encryption key is split into multiple fragments and stored in a distributed manner on multiple nodes of the blockchain network. During encryption and decryption, the key fragments are retrieved from these nodes and combined into a complete key for the corresponding operation.

[0082] In some embodiments of this disclosure, encryption and decryption operations are performed through a preset blockchain-based encryption key generation and management mechanism, providing secure and reliable key protection for the encrypted storage and subsequent decryption of log data. This avoids the security risks caused by improper key management in traditional encryption methods, further improving the security and privacy of log data during storage and use. The encryption key is divided into multiple key fragments and stored on multiple nodes. These fragments are then combined to form a complete key during encryption and decryption. This key fragment storage method reduces the risk of overall key leakage. Even if key fragments from individual nodes are obtained, a complete key cannot be formed, greatly improving key security and thus ensuring the encryption effect of log data.

[0083] In some embodiments of this disclosure, the method further includes:

[0084] An initial quantum key pair shared among nodes is generated through a quantum key distribution protocol, and the quantum key is stored in a quantum-safe storage module, which is used to monitor the security of the key in real time.

[0085] The quantum encryption algorithm uses a quantum key to encrypt the shuffled key fragments, and then distributes the encrypted key fragments to multiple nodes in the blockchain network.

[0086] According to a preset cycle, a quantum entangled link is established between nodes based on the principle of quantum entanglement, a quantum verification signal is sent, and the verification result is compared to determine whether the key fragment has been tampered with; if tampering is detected, a quantum key pair is immediately regenerated, the key fragment of the tampered node is re-encrypted, stored and broadcast.

[0087] Encrypted key fragments are obtained from multiple nodes through a quantum communication encryption channel. The original key fragments are then restored using a shared quantum key and a corresponding quantum decryption algorithm. These fragments are combined to form a complete encryption key, which is then used to perform the decryption operation.

[0088] In some implementations, quantum key distribution initialization can be performed. In some examples, quantum communication infrastructure can be deployed at the beginning of the blockchain network setup, enabling quantum communication capabilities between nodes. Using a quantum key distribution protocol (such as the BB84 protocol or an improved version), initial quantum key pairs are generated between nodes. These quantum key pairs have absolute security guaranteed by quantum mechanics principles; any measurement or eavesdropping will inevitably alter the quantum state, thus being detected by both communicating parties. Each node stores the received quantum key in a dedicated quantum-secure storage module. This module uses quantum physical properties (such as monitoring quantum entanglement) to detect key security in real time. Upon detecting an anomaly, an alarm is immediately triggered, and corresponding security measures are taken, such as re-distributing the quantum key. Then, key fragment encryption and distribution are performed. After the encryption key is generated and broken into key fragments, each key fragment is quantum encrypted using the corresponding inter-node shared quantum key. Specifically, a quantum encryption algorithm (such as an improved version of a one-time password algorithm based on qubits) is used to encode the key fragments into quantum state information, ensuring extremely high confidentiality during transmission and storage. The quantum-encrypted key fragments are distributed to multiple nodes on the blockchain for storage. During storage, the nodes use a quantum-secure storage module to store the quantum-encrypted key fragments. This module uses quantum state monitoring and error correction technology to ensure that the key fragments do not undergo quantum state changes due to environmental factors (such as temperature, electromagnetic interference, etc.) or external attacks during storage, thereby ensuring their integrity and confidentiality.

[0089] In other implementations, integrity verification and tamper detection can then be performed. Integrity verification of the quantum-encrypted key fragments stored on each node can be performed periodically (e.g., every certain block generation cycle). The verification process is based on the principle of quantum entanglement. By establishing quantum entanglement links between different nodes, sending specific quantum verification signals, and comparing the verification results, it can be determined whether the key fragment has been tampered with. If a potential tampering of the key fragment on a node is detected, a quantum key update mechanism is immediately initiated. A new quantum key pair is regenerated using quantum key distribution, and the key fragment on that node is re-encrypted and stored. Simultaneously, the event is broadcast to other nodes in the blockchain network so that they can take appropriate security measures, such as re-encrypting or marking the encrypted data associated with that node as suspicious data. Security can be ensured during decryption. When decryption is required, quantum-encrypted key fragments are retrieved from multiple nodes. During retrieval, a quantum communication encryption channel ensures secure transmission of the key fragments, preventing them from being stolen or tampered with during transmission. The obtained quantum-encrypted key fragment is decrypted using a corresponding quantum decryption algorithm and a shared quantum key to restore the original key fragment. The fragment is then combined into a complete encryption key for decryption. The entire process is carried out in a quantum-safe environment, effectively preventing interference and disruption to the decryption process by traditional network attack methods.

[0090] In some embodiments of this disclosure, an initial quantum key pair is generated through a quantum key distribution protocol and stored in a quantum-safe storage module. Key fragments are encrypted and distributed using a quantum encryption algorithm. The integrity of the key fragments is verified periodically based on the principle of quantum entanglement. Tampering is detected and dealt with promptly. The decryption process obtains and restores the key fragments through a quantum communication encryption channel. This comprehensively ensures the security and integrity of the key fragments from generation, storage, transmission to use, resists attack risks that are difficult to deal with by traditional encryption technologies, and provides a higher level of security for the encryption of log data.

[0091] In some embodiments of this disclosure, S22 includes:

[0092] Log data is automatically verified and integrated through blockchain smart contracts, and categorized and labeled according to preset rules for device type, system type, and security issue type to generate a data view.

[0093] In some implementations, log data from different devices and systems can be integrated into a blockchain network to generate a data view. Smart contract technology in the blockchain can be used to perform automatic verification and integration of log data. Smart contracts corresponding to devices and systems are constructed; when updated log data is available, the smart contract performs automatic verification and integrates the log data into the blockchain network. The smart contract is also used to classify and label the log data based on preset classification and labeling rules, generating data view classification and labeling rules. In some examples, the data view classification and labeling rules may include at least one of device type classification and labeling, system type classification and labeling, and security issue type classification and labeling.

[0094] In some embodiments of this disclosure, by integrating log data from different sources, the resulting data view can provide a more comprehensive and macroscopic perspective to observe the data situation of the entire system or related network environment. This facilitates subsequent security inspections based on this unified view, avoids the tediousness of viewing logs from different devices and systems separately, and improves inspection efficiency.

[0095] In some embodiments of this disclosure, S24 includes:

[0096] Multiple inspection nodes are used to inspect log data simultaneously;

[0097] The system uses a blockchain consensus mechanism to determine whether the corresponding inspection results are consistent. If they are consistent, it is determined that there is no security problem; otherwise, it is determined that there is a security problem and multiple corresponding inspection nodes are triggered simultaneously.

[0098] In some implementations, with the previously integrated data foundation, security inspections can more efficiently locate potential security vulnerabilities. Displaying security issues on a data view can intuitively show the location and scope of the problem, facilitating subsequent analysis and processing. Security inspections are used to inspect log data for security issues and display them in a data view. The consensus mechanism of blockchain can be used to verify the inspection results. Multiple inspection nodes simultaneously inspect the log data, and the consensus mechanism is used to determine whether the corresponding inspection results are the same. If they are the same, it is determined that there is no security issue; otherwise, it is determined that there is a security issue, and the corresponding multiple inspection nodes are triggered simultaneously.

[0099] In some embodiments of this disclosure, multiple inspection nodes are used to inspect log data simultaneously, and the consistency of inspection results is determined by the blockchain consensus mechanism. This ensures the reliability and accuracy of the inspection results, avoids misjudgment or omission that may occur with a single inspection node, and triggers multiple inspection nodes in a timely manner once a security problem is detected, enabling a rapid response and subsequent processing, thereby improving the timeliness and accuracy of security problem detection.

[0100] In some embodiments of this disclosure, S26 includes:

[0101] Causal reasoning techniques are used to determine the causal relationships between security issues detected during inspections. Combined with the timestamp characteristics of blockchain, the occurrence time and order of security issues are recorded, and the occurrence time is configured as the timestamp of blockchain transactions.

[0102] In some implementations, causal reasoning techniques can be used to determine the causal relationships between detected security issues and identify the corresponding attack sources. Clarifying the causal connections between security issues helps to deeply understand the mechanisms and development of security incidents. Finding the attack source allows for a fundamental understanding of the cause of the security incident, providing crucial evidence for subsequent targeted prevention and response measures, and preventing similar security incidents from recurring. This can be achieved by combining the timestamp characteristics of blockchain to record the time and sequence of security issues, with the occurrence time of the security issue defined as the timestamp of the blockchain transaction.

[0103] In some embodiments of this disclosure, causal reasoning technology combined with the timestamp characteristics of blockchain is used to accurately determine the causal relationship between security issues, clearly record the occurrence time and sequence of security issues, provide a reliable basis for a deeper understanding of the occurrence mechanism and development context of security events, help to accurately trace the source of attacks and formulate effective defense measures, and improve the accuracy and depth of source tracing.

[0104] In some embodiments of this disclosure, S26 further includes:

[0105] The attack path and corresponding attack evidence are recorded by the blockchain and defined as a blockchain transaction. The source of the attack is determined based on the attack path.

[0106] In some implementations, the attack path and corresponding attack evidence can be recorded in detail using a blockchain, and this information can be defined as blockchain transactions. Based on the recorded attack path, the source of the attack corresponding to the security problem can be accurately identified, providing key evidence for subsequent processing.

[0107] In some embodiments of this disclosure, the attack path and corresponding attack evidence are recorded by blockchain and defined as blockchain transactions, ensuring the immutability and integrity of attack-related information. Based on this complete and reliable attack path information, the source of the attack can be accurately located, providing a strong basis for the handling of security incidents and the determination of responsibility, and improving the accuracy and credibility of the attack source location.

[0108] In some embodiments of this disclosure, the early warning mechanism is configured to utilize the distributed ledger and smart contract technology of blockchain to monitor changes in log data in real time, and to be triggered and generate a corresponding early warning signal in the event of a security problem.

[0109] In some implementations, the distributed ledger and smart contract technologies of blockchain can be used to monitor changes in log data in real time. When a security issue is detected, the early warning mechanism can be automatically triggered and a corresponding warning signal can be generated, allowing relevant personnel to detect the risk in a timely manner.

[0110] In some embodiments of this disclosure, the early warning mechanism utilizes the distributed ledger and smart contract technology of blockchain to monitor changes in log data in real time. When a security issue is detected, it promptly triggers and generates an early warning signal, solving the problem of untimely early warning of security incidents in traditional methods. This allows security personnel to detect potential security risks as early as possible, buying time for subsequent response and handling, and reducing the potential losses caused by security incidents.

[0111] In some embodiments of this disclosure, reference is made to Figure 2 S28 includes:

[0112] S282. In the various blockchain networks participating in cross-chain, select the target node as the cross-chain node, establish a quantum entangled link between the cross-chain nodes of different blockchain networks through quantum communication devices to form node pairs, generate public and private key pairs based on the quantum entangled state properties, and complete identity authentication and key negotiation.

[0113] S284. The cross-chain nodes of the source blockchain network preprocess the log data, encrypt the processed log data using a quantum key-based encryption algorithm, generate a unique quantum tag for each data block based on the hash value, timestamp, and characteristic parameters of the quantum entangled state, and synchronously transmit the encrypted data block and the quantum tag to the corresponding cross-chain node of the target blockchain network through a quantum entanglement link.

[0114] S286. The cross-chain nodes of the target blockchain network decrypt and parse the encrypted data block and the quantum tag, and reconstruct the causal relationship model of the security problem by combining the log data of multiple blockchain networks through cross-chain data analysis algorithms.

[0115] In some implementations, quantum entangled node pairs can be established first. Among the various blockchain networks participating in cross-chain data integration, nodes with strong computing power and stable network connections are selected as cross-chain nodes. Quantum entanglement links are established between these cross-chain nodes using quantum communication devices, forming quantum entangled node pairs. The two nodes in each pair are located in different blockchain networks, and their quantum entanglement state serves as the basis for subsequent data transmission and verification. Utilizing the properties of quantum entanglement, node pairs are used for identity authentication and key negotiation. Specifically, by measuring specific properties of the quantum entangled state, a public-private key pair based on quantum key distribution is generated for subsequent data encryption and signing, ensuring the security and non-repudiation of cross-chain communication.

[0116] The data is then encapsulated to generate quantum tags. When integrating log data from different blockchain networks, cross-chain nodes in the source blockchain network first preprocess the log data, including data cleaning and format standardization, to ensure data compatibility and availability. The preprocessed log data is then encrypted using a quantum-key-based encryption algorithm (such as quantum stream cryptography) to convert the data into a quantum encrypted state. Simultaneously, a unique quantum tag is generated for each data block. This tag is based on the data block's hash value, timestamp, and some characteristic parameters of the quantum entanglement state. This tag is synchronously transmitted to the corresponding node in the target blockchain network via a quantum entanglement link for data integrity verification and traceability.

[0117] Next, cross-chain data transmission and verification are performed. Utilizing the action-at-a-distance property of quantum entanglement, data transmission occurs between the source and target nodes. When the source node operates on quantum-encrypted data blocks and quantum tags, the target node can perceive the corresponding quantum state changes almost in real time and verify the integrity and authenticity of the data through the correlation of quantum entanglement. If the data is interfered with or tampered with during transmission, the quantum entanglement state will change, and the target node can immediately detect the anomaly and send a retransmission request to the source node through the quantum communication channel, ensuring the accuracy and reliability of the data. This quantum entanglement-based transmission and verification mechanism significantly improves data security and transmission efficiency compared to traditional cross-chain data transmission based on network protocols and encryption algorithms, while reducing the risk of data tampering and theft.

[0118] Simultaneously, data integration and analysis are performed. Upon receiving quantum-encrypted data blocks and verified quantum tags, cross-chain nodes of the target blockchain network decrypt and parse the data, integrating it into their local databases or data warehouses for subsequent analysis. Using specially designed cross-chain data analysis algorithms, combined with log data from multiple blockchain networks, a causal model of security issues is reconstructed. These algorithms can be based on artificial intelligence and machine learning technologies, such as using deep learning algorithms to extract features and recognize patterns from large-scale cross-chain log data, to accurately identify the root cause and source of security problems, thus providing strong support for tracing and responding to security incidents.

[0119] In other implementations, when a real-time security event occurs, a matching process based on the real-time security event is performed in a security event knowledge base to obtain and output the corresponding handling procedure. Security audits and assessments of the blockchain network can also be performed periodically, such as auditing and assessing log data, blockchain transactions, and smart contracts within the blockchain network.

[0120] In some embodiments of this disclosure, log data from different blockchain networks are integrated through cross-chain technology. Quantum entanglement links are established using quantum communication devices to complete identity authentication and key negotiation. The log data is encrypted and quantum tags are generated for transmission. After the target node decrypts and parses the data, a causal relationship model is reconstructed. This achieves secure and efficient data interaction between different blockchain networks, breaks the limitations of tracing from a single blockchain network, improves the accuracy and comprehensiveness of cross-network security incident tracing, and ensures the security and integrity of cross-chain data transmission.

[0121] This disclosure provides several blockchain-based security incident tracing methods. By encrypting and storing log data on a decentralized blockchain network, integrating multi-source log data to generate a data view, conducting security inspections, determining the causal relationships and attack sources of security issues, and combining cross-chain technology to integrate log data from different blockchain networks, along with early warning mechanisms and knowledge bases for tracing responses, this method effectively solves the problems of difficult integration of traditional scattered log data and difficulties in cross-network collaborative tracing. It improves the efficiency of security incident inspection and handling, expands the scope of tracing, and ensures the security and authenticity of log data.

[0122] It is understood that the various embodiments of the methods described in this specification are presented in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. Related details can be found in the descriptions of other method embodiments.

[0123] It should be understood that although the steps in the flowcharts shown in the accompanying drawings are displayed sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the accompanying drawings may include multiple steps or stages, which are not necessarily completed at the same time, but may be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but may be performed alternately or in turn with other steps or at least a portion of the steps or stages of other steps.

[0124] Based on the description of the above-described embodiments of the blockchain-based security event tracing method, this disclosure also provides a blockchain-based security event tracing device for implementing the aforementioned blockchain-based security event tracing method. The device may include a system (including a distributed system), software (application), module, component, controller, server, terminal, etc., using the method described in the embodiments of this specification, combined with necessary hardware implementation. Based on the same innovative concept, the devices in one or more embodiments provided in this disclosure are as described in the following embodiments. Since the implementation schemes and methods for solving the problem by the devices are similar, the implementation of specific devices in the embodiments of this specification can refer to the implementation of the aforementioned method, and repeated details will not be repeated. As used below, the terms "unit" or "module" can refer to a combination of software and / or hardware that performs a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0125] Figure 3 This is a schematic block diagram illustrating a blockchain-based security event tracing device according to an exemplary embodiment. The device can be the aforementioned terminal, a server, or a module, component, device, control unit, etc., integrated into the terminal. For details, please refer to... Figure 3 The device 100 may include: an encryption module 120, a view generation module 140, a security inspection module 160, a security issue tracing module 180, and a cross-chain analysis module 190. Specifically, the encryption module 120 encrypts log data and stores it in a decentralized blockchain network; the view generation module 140 integrates log data from multiple devices and / or systems in the blockchain network to generate a data view; the security inspection module 160 performs security inspections based on the data view and the log data to determine if security issues exist; the security issue tracing module 180, in response to a detected security issue, determines the causal relationship between the inspected security issues and identifies the attack source corresponding to the security issue; and the cross-chain analysis module 190 integrates log data from different blockchain networks using cross-chain technology, and, combined with a preset blockchain security event early warning mechanism and a preset blockchain-based security event knowledge base, performs tracing and response to security events in different blockchain networks.

[0126] The modules in the aforementioned blockchain-based security incident tracing device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0127] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 4 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements a blockchain-based security event tracing method.

[0128] Those skilled in the art will understand that Figure 4 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0129] Based on the foregoing description of the relevant methods and apparatus embodiments, this disclosure also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, it implements the blockchain-based security event tracing method described in any embodiment of this specification.

[0130] Based on the foregoing description of the relevant methods and apparatus embodiments, this disclosure also provides a computer-readable storage medium that, when the instructions in the computer-readable storage medium are executed by the processor of a computer device, enables the computer device to implement the blockchain-based security event tracing method as described in any embodiment of this disclosure.

[0131] Based on the foregoing description of the relevant methods and apparatus embodiments, this disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the blockchain-based security event tracing method described in any embodiment of this specification.

[0132] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on its differences from other embodiments. In particular, hardware + program embodiments are relatively simple in description because they are fundamentally similar to method embodiments; relevant parts can be referred to the descriptions in the method embodiments.

[0133] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0134] It should be noted that the apparatus, computer equipment, storage medium, and computer program products described above may also include other implementation methods according to the description of the method embodiments. Specific implementation methods can be found in the description of the relevant method embodiments. Furthermore, new embodiments formed by combinations of features from various methods, apparatuses, devices, and server embodiments still fall within the scope of this disclosure and will not be elaborated upon here.

[0135] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, when implementing one or more of these specifications, the functions of each module can be implemented in the same or different software and / or hardware, or a module that performs the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are merely illustrative. For example, the division of modules or units is only a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling and communication connections between the devices or units shown or described can be implemented through direct and / or indirect coupling / connection, through standard or custom interfaces or protocols, and can be implemented electrically, mechanically, or in other forms.

[0136] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the following claims.

[0137] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope.

Claims

1. A blockchain-based method for tracing security incidents, characterized in that, The method includes: Log data is encrypted and stored in a decentralized blockchain network; Integrate log data from multiple devices and / or multiple systems in the blockchain network to generate a data view; Based on the data view and the log data, perform security inspections on security events to determine whether any security issues exist. In response to the detection of security issues, the causal relationship between the detected security issues is determined, and the attack source corresponding to the security issues is identified. By integrating log data from different blockchain networks through cross-chain technology, and combining a pre-set blockchain security incident early warning mechanism and a pre-set blockchain-based security incident knowledge base, security incidents on different blockchain networks can be traced and responded to.

2. The method according to claim 1, characterized in that, The method further includes: Encryption or decryption is performed through a pre-defined blockchain-based encryption key generation and management mechanism.

3. The method according to claim 2, characterized in that, The encryption or decryption is performed through a preset blockchain-based encryption key generation and management mechanism, including: The encryption key is divided into multiple key fragments and stored on multiple nodes; During encryption and decryption, key fragments are obtained from multiple nodes and combined to form a complete key to perform the corresponding encryption or decryption operation.

4. The method according to claim 3, characterized in that, The method further includes: An initial quantum key pair shared among nodes is generated through a quantum key distribution protocol, and the quantum key is stored in a quantum-safe storage module, which is used to monitor the security of the key in real time. The quantum encryption algorithm uses a quantum key to encrypt the shuffled key fragments, and then distributes the encrypted key fragments to multiple nodes in the blockchain network. According to a preset cycle, a quantum entangled link is established between nodes based on the principle of quantum entanglement, a quantum verification signal is sent, and the verification result is compared to determine whether the key fragment has been tampered with; if tampering is detected, a quantum key pair is immediately regenerated, the key fragment of the tampered node is re-encrypted, stored and broadcast. Encrypted key fragments are obtained from multiple nodes through a quantum communication encryption channel. The original key fragments are then restored using a shared quantum key and a corresponding quantum decryption algorithm. These fragments are combined to form a complete encryption key, which is then used to perform the decryption operation.

5. The method according to claim 1, characterized in that, The process of integrating log data from multiple devices and / or systems within the blockchain network to generate a data view includes: Log data is automatically verified and integrated through blockchain smart contracts, and categorized and labeled according to preset rules for device type, system type, and security issue type to generate a data view.

6. The method according to claim 1, characterized in that, The step of performing security inspections based on the data view and the log data to determine whether security issues exist includes: Multiple inspection nodes are used to inspect log data simultaneously; The system uses a blockchain consensus mechanism to determine whether the corresponding inspection results are consistent. If they are consistent, it is determined that there is no security problem; otherwise, it is determined that there is a security problem and multiple corresponding inspection nodes are triggered simultaneously.

7. The method according to claim 1, characterized in that, The process of determining the causal relationship between detected security issues, in response to the detection of security issues, includes: Causal reasoning techniques are used to determine the causal relationships between security issues detected during inspections. Combined with the timestamp characteristics of blockchain, the occurrence time and order of security issues are recorded, and the occurrence time is configured as the timestamp of blockchain transactions.

8. The method according to claim 1, characterized in that, Determining the source of the attack corresponding to the security issue includes: The attack path and corresponding attack evidence are recorded by the blockchain and defined as a blockchain transaction. The source of the attack is determined based on the attack path.

9. The method according to claim 1, characterized in that, The early warning mechanism is configured to utilize blockchain's distributed ledger and smart contract technology to monitor changes in log data in real time, and to be triggered and generate a corresponding early warning signal in the event of a security issue.

10. The method according to claim 1, characterized in that, The process of integrating log data from different blockchain networks using cross-chain technology, and combining a pre-defined blockchain security incident early warning mechanism and a pre-defined blockchain-based security incident knowledge base to perform source tracing and response to security incidents on different blockchain networks, includes: In the various blockchain networks participating in cross-chain, a target node is selected as a cross-chain node. Quantum entanglement links are established between cross-chain nodes in different blockchain networks through quantum communication devices to form node pairs. Public and private key pairs are generated based on the properties of quantum entanglement states to complete identity authentication and key negotiation. The cross-chain nodes of the source blockchain network preprocess the log data, encrypt the processed log data using a quantum key-based encryption algorithm, generate a unique quantum tag for each data block based on the hash value, timestamp, and characteristic parameters of the quantum entangled state, and synchronously transmit the encrypted data block and the quantum tag to the corresponding cross-chain node of the target blockchain network through a quantum entanglement link. The cross-chain nodes of the target blockchain network decrypt and parse the encrypted data block and the quantum tag, and reconstruct the causal relationship model of the security problem by combining log data from multiple blockchain networks through cross-chain data analysis algorithms.

11. The method according to claim 1, characterized in that, The log data includes at least one of system log information, network traffic log information, and device log information.

12. A blockchain-based security event tracing device, characterized in that, The device includes: The encryption module is used to encrypt log data and store it on a decentralized blockchain network. A view generation module is used to integrate log data from multiple devices and / or multiple systems in the blockchain network to generate a data view. The security inspection module is used to perform security inspections on security events based on the data view and the log data to determine whether there are any security issues. The security issue tracing module is used to respond to the detection of security issues, determine the causal relationship between the security issues detected, and identify the attack source corresponding to the security issues; The cross-chain analysis module is used to integrate log data from different blockchain networks through cross-chain technology, and combine it with a preset blockchain security event early warning mechanism and a preset blockchain-based security event knowledge base to perform source tracing and response to security events on different blockchain networks.

13. A computer device, characterized in that, It includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of the method according to any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that, It stores a computer program thereon, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 11.

15. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the steps of the method according to any one of claims 1 to 11.

Images