Cross-border agricultural product digital lading system based on quantum encryption and block chain

Abstract

The invention relates to the technical field of information security and block chains, in particular to a quantum encryption and block chain-based cross-border agricultural product digital lading system, which comprises a quantum state sensing and key generation module for calculating a key life cycle according to a quantum channel bit error rate and a network transmission rate which are acquired in real time, a bit stream is extracted from a local quantum random number pool in the secret key life cycle to generate a one-time session secret key and a corresponding secret key identifier; and the dynamic encryption processing module is used for receiving the one-time session key and performing symmetric encryption operation on the agricultural product lading bill data by using the one-time session key so as to generate a lading bill ciphertext. According to the invention, through quantum state dynamic key making and ciphertext anchoring separation verification, a secure closed loop from a physical layer to an application layer is realized, so that the problem that a traditional system mostly adopts static encryption and cannot resist quantum computing power attack, so that long-term confidential faces backtracking cracking is solved.

Description

Technical Field

[0001] This invention relates to the fields of information security and blockchain technology, and in particular to a cross-border digital bill of lading system for agricultural products based on quantum encryption and blockchain. Background Technology

[0002] With the accelerating digitalization of global trade, electronic bills of lading have gradually replaced traditional paper bills of lading, becoming the core credentials for cross-border logistics and supply chain finance. Within the existing technological architecture, distributed ledger technology, with its decentralized, immutable, and traceable characteristics, has become the mainstream infrastructure for solving multi-party trust issues and is widely used in agricultural product traceability and trade rights confirmation. However, traditional systems mostly employ static encryption, which, due to its inability to withstand quantum computing attacks, poses a risk of long-term confidentiality being retrospectively compromised. Summary of the Invention

[0003] To overcome the above shortcomings, this invention provides a cross-border agricultural product digital bill of lading system based on quantum encryption and blockchain, aiming to improve the problem that traditional systems mostly use static encryption, which cannot resist quantum computing power attacks, thus causing long-term confidentiality to be vulnerable to retrospective cracking.

[0004] This invention provides the following technical solution: a cross-border agricultural product digital bill of lading system based on quantum encryption and blockchain, comprising the following modules:

[0005] The quantum state sensing and key generation module is used to calculate the key life cycle based on the real-time collected quantum channel bit error rate and network transmission rate, and extract the bit stream from the local quantum random number pool within the key life cycle to generate a one-time session key and the corresponding key identifier.

[0006] The dynamic encryption processing module is used to receive the one-time session key and use the one-time session key to perform symmetric encryption operation on the agricultural product bill of lading data to generate the bill of lading ciphertext;

[0007] The off-chain anchoring construction module is used to perform a one-way hash operation on the bill of lading ciphertext to obtain a hash digest, and associate and package the hash digest with the key identifier to construct an anchoring transaction that does not contain the bill of lading ciphertext and the one-time session key;

[0008] The distributed ledger consensus module is used to receive the anchored transactions and broadcast them to the blockchain network for consensus storage, generating on-chain rights confirmation records containing timestamps;

[0009] The separate verification and decryption module is used to receive the bill of lading ciphertext and calculate the local hash value. After the consistency verification with the on-chain rights confirmation record is passed, it generates a key acquisition request carrying a digital signature.

[0010] The identity authentication and trust management module is used to receive the key acquisition request, verify the source node authority of the digital signature, and, after the authority verification is passed, instruct the quantum state sensing and key generation module to send the one-time session key to the separate verification and decryption module through the quantum channel to complete the decryption.

[0011] By adopting the above technical solution, quantum dynamic key generation and ciphertext anchoring are separated and verified, thereby realizing a secure closed loop from the physical layer to the application layer. This improves the problem that traditional systems mostly use static encryption, which cannot resist quantum computing power attacks, resulting in long-term confidential information being vulnerable to backtracking cracking.

[0012] Preferably, in the quantum state sensing and key generation module, the calculation of the key lifetime based on the real-time acquired quantum channel bit error rate and network transmission rate includes:

[0013] The polarization state of the light pulse is measured using a photon detector connected to a quantum communication fiber. The number of erroneous photons per unit time is counted to obtain real-time quantum error rate data. The data throughput per second of the network interface is read simultaneously as the network transmission rate.

[0014] Read the agricultural product commodity metadata stored in the system database, parse the spoilage rate index and commodity value index, and quantify and map them into numerical commodity sensitivity parameters.

[0015] The embedded adaptive algorithm model is invoked, with the quantum error rate data as the independent variable of the exponential decay function and the cargo sensitivity parameter as the decay coefficient, to calculate the key life cycle value in seconds.

[0016] Based on a quantum key distribution protocol selected from BB84, E91 or COW, the original photon bit stream is subjected to basis vector comparison, error correction and privacy amplification to generate the final quantum random number pool. Within the time window of the key life cycle, a bit sequence of a specified length is extracted from the quantum random number pool as the one-time session key.

[0017] Preferably, in the quantum state sensing and key generation module, the step of extracting a bit stream from the local quantum random number pool to generate a one-time session key and a corresponding key identifier within the key lifetime includes:

[0018] Set a secure bit error rate threshold for the quantum channel, and sample and monitor the quantum bit error rate data at a millisecond frequency;

[0019] When the quantum error rate data for N consecutive sampling periods is higher than the security error rate threshold, the current key life cycle is reduced by a preset nonlinear step size to generate an updated life cycle value.

[0020] Start a countdown timer to track the activation duration of the current one-time session key in real time;

[0021] Once the activation duration equals the updated lifecycle value, a key expiration command is immediately sent to the dynamic encryption processing module, and the next round of key generation and identifier allocation process is triggered simultaneously, wherein the key identifier is generated by a combination of a universally unique identifier and a timestamp.

[0022] Preferably, in the dynamic encryption processing module, the step of performing symmetric encryption operations on the agricultural product bill of lading data using the one-time session key to generate the bill of lading ciphertext includes:

[0023] The one-time session key is received via the internal bus, and a random initialization vector is generated.

[0024] The agricultural product bill of lading data is converted into a binary stream, and then combined with the one-time session key and the initialization vector, and a symmetric encryption algorithm in Galois / counter mode is used for computation.

[0025] The encrypted binary stream is output as the bill of lading ciphertext, and a message authentication code for verifying data integrity is output simultaneously.

[0026] The initialization vector and the message authentication code are appended to the header of the bill of lading ciphertext, and the corresponding key identifier is output to the off-chain anchoring construction module.

[0027] Preferably, in the off-chain anchoring construction module, constructing an anchoring transaction that does not include the bill of lading ciphertext and the one-time session key includes:

[0028] Receive the ciphertext of the bill of lading containing header information, and use a one-way hash algorithm selected from SHA-256, SHA-3 or the national cryptographic SM3 to operate on the ciphertext of the bill of lading to generate a fixed-length hash string as a hash digest.

[0029] Construct a JSON-formatted data object, and write the key identifier, the hash digest, and the current system's UTC timestamp into the data object;

[0030] The data object is serialized to generate standardized transaction payload data, which serves as the anchor transaction. This transaction payload data does not contain any bits of the bill of lading ciphertext or any bits of the one-time session key.

[0031] Preferably, in the distributed ledger consensus module, generating the on-chain ownership confirmation record containing a timestamp includes:

[0032] The received anchored transaction is parsed, the public key certificate of the sending node is extracted, and the digital signature of the transaction is verified to be within the list of authorized nodes of the consortium blockchain.

[0033] After the signature verification is successful, the anchored transaction is placed in the transaction pool to be packaged, and the entire network nodes reach consensus through a distributed consensus algorithm selected from Practical Byzantine Fault Tolerance, Raft, or Proof-of-Stake.

[0034] Write the anchored transaction that has passed consensus into the Merkel leaf node of the new block, and calculate the new block hash;

[0035] The record containing the block hash, block height, and anchored transaction content is broadcast and synchronized to all accounting nodes to form the on-chain ownership confirmation record.

[0036] Preferably, in the separate verification and decryption module, the consistency verification with the on-chain ownership record includes:

[0037] The bill of lading ciphertext is received via a public TCP / IP network, and the header data of the ciphertext is parsed to extract the key identifier in plaintext form.

[0038] Using the key identifier as an index key value, the query interface of the blockchain node is invoked to scan the local ledger data;

[0039] Locate the latest transaction record containing the key identifier and extract the original hash digest stored in that record;

[0040] The local hash value of the received bill of lading ciphertext is calculated using the same one-way hash algorithm as the off-chain anchoring construction module, and it is determined whether the local hash value is completely equal to the bit sequence of the original hash digest.

[0041] Preferably, in the separate verification and decryption module, the generation of the key acquisition request carrying the digital signature includes:

[0042] After determining that the bit sequences are completely equal, the private key of the receiving node is used to digitally sign the transaction hash value in the on-chain rights confirmation record.

[0043] Construct a key request message, and encapsulate the key identifier, the digital signature, and the distributed identity identifier of the receiving node in the message body;

[0044] Establish an encrypted communication tunnel with the identity authentication and trust management module, and send the key request message through the encrypted communication tunnel.

[0045] Preferably, in the identity authentication and trust management module, receiving the key acquisition request and verifying the source node permissions of the digital signature includes:

[0046] The key request message is received, and the validity of the digital signature is decrypted and verified using a preset receiving node public key.

[0047] Query the access control list in the smart contract to verify whether the distributed identity has the permission level to read the goods data corresponding to the key identifier;

[0048] When the signature is valid and the permission level meets the requirements, a key release instruction is generated, which contains the physical address information of the target quantum terminal;

[0049] The key release command is sent to the quantum state sensing and key generation module, which drives the module to transmit the stored one-time session key point-to-point to the target quantum terminal through the designated quantum channel port.

[0050] Preferably, in the identity authentication and trust management module, the step of instructing the quantum state sensing and key generation module to issue the one-time session key to the separate authentication and decryption module through a quantum channel to complete decryption after the permission verification is passed includes:

[0051] The distributed ledger consensus module is periodically polled through an internal interface to listen for identity change events triggered by specific nodes registering smart contracts.

[0052] Parse the data payload of the identity change event and extract the distributed identity identifier, public key certificate, and operation type field of the node to be changed. The operation type field includes at least one of registration, freezing, and cancellation.

[0053] Verify whether the transaction signature that triggered the identity change event originated from the preset regulatory root node, and check the validity period of the public key certificate and the status of the certificate revocation list;

[0054] After successful verification, the access control list stored locally is updated according to the operation type field. The distributed identity identifier of the node to be changed and its corresponding permission level are written to or removed from the trust list for verification of the key acquisition request.

[0055] The present invention has the following beneficial effects:

[0056] 1. In this invention, a secure closed loop from the physical layer to the application layer is achieved by separating and verifying quantum state dynamic key generation and ciphertext anchoring. This improves the problem that traditional systems, which mostly use static encryption, cannot resist quantum computing attacks, resulting in long-term confidential information being vulnerable to backtracking cracking.

[0057] 2. In this invention, the key lifecycle is dynamically calculated by using quantum error rate and cargo sensitivity parameters as variables, and then the key update frequency is adaptively adjusted. This improves the problem that traditional quantum key distribution mostly adopts a fixed-period update strategy, which cannot cope with cross-border channel environment disturbances, resulting in reduced security or wasted resources when the channel deteriorates.

[0058] 3. In this invention, by constructing an anchor transaction without original data by only using the ciphertext hash digest of the bill of lading and the key identifier, physical isolation between data privacy and evidence storage logic is achieved. This improves upon the problem that traditional blockchain evidence storage mostly uses full data storage, which, due to the tight coupling between the ciphertext and the index, makes the on-chain data susceptible to reverse analysis and privacy leaks.

[0059] 4. In this invention, by forcing the receiving end to verify the consistency between the ciphertext and the record on the chain before initiating the signature request, a defense mechanism of verification before key issuance is constructed. This improves the problem that traditional key distribution, which mostly adopts the method of directly issuing keys after identity verification, lacks pre-verification of data integrity, resulting in the problem of key mis-issuance and hijacking due to man-in-the-middle tampering with data. Attached Figure Description

[0060] Figure 1 This is a module architecture diagram of the cross-border agricultural product digital bill of lading system based on quantum encryption and blockchain proposed in this invention;

[0061] Figure 2 This is a schematic diagram illustrating the key adaptive generation principle of the cross-border agricultural product digital bill of lading system based on quantum encryption and blockchain proposed in this invention.

[0062] Figure 3 This is a flowchart illustrating the encryption and off-chain anchoring construction process of the cross-border agricultural product digital bill of lading system based on quantum encryption and blockchain proposed in this invention.

[0063] Figure 4 This is a diagram illustrating the verification and decryption interaction of the cross-border agricultural product digital bill of lading system based on quantum encryption and blockchain proposed in this invention. Detailed Implementation

[0064] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0065] Example 1:

[0066] In a first embodiment of the present invention, the present invention provides a cross-border agricultural product digital bill of lading system based on quantum encryption and blockchain, such as... Figures 1-4 As shown, it includes the following modules:

[0067] The quantum state sensing and key generation module is used to calculate the key life cycle based on the real-time collected quantum channel bit error rate and network transmission rate, and extract the bit stream from the local quantum random number pool within the key life cycle to generate a one-time session key and the corresponding key identifier.

[0068] Furthermore, in the quantum state sensing and key generation module, the key lifecycle is calculated based on the real-time acquired quantum channel bit error rate and network transmission rate, including:

[0069] The polarization state of the light pulse is measured using a photon detector connected to a quantum communication fiber. The number of erroneous photons per unit time is counted to obtain real-time quantum error rate data. The data throughput per second of the network interface is read simultaneously as the network transmission rate.

[0070] Read the agricultural product commodity metadata stored in the system database, parse the spoilage rate index and commodity value index, and quantify and map them into numerical commodity sensitivity parameters.

[0071] The embedded adaptive algorithm model is invoked, with the quantum error rate data as the independent variable of the exponential decay function and the cargo sensitivity parameter as the decay coefficient, to calculate the key life cycle value in seconds.

[0072] Based on a quantum key distribution protocol selected from BB84, E91 or COW, the original photon bit stream is subjected to basis vector comparison, error correction and privacy amplification to generate the final quantum random number pool. Within the key lifespan time window, a bit sequence of a specified length is extracted from the quantum random number pool as a one-time session key.

[0073] In the quantum state sensing and key generation module, within the key lifetime, a bit stream is extracted from the local quantum random number pool to generate a one-time session key and its corresponding key identifier, including:

[0074] Set a secure bit error rate threshold for the quantum channel and sample and monitor the quantum bit error rate data at a millisecond frequency;

[0075] When the quantum error rate data for N consecutive sampling periods is higher than the security error rate threshold, the current key life cycle is reduced by a preset nonlinear step size to generate an updated life cycle value.

[0076] Start a countdown timer to track the activation duration of the current one-time session key in real time;

[0077] Once the activation duration equals the updated lifecycle value, a key expiration command is immediately sent to the dynamic encryption processing module, and the next round of key generation and identifier allocation process is triggered simultaneously. The key identifier is generated by combining a universally unique identifier and a timestamp.

[0078] Specifically, a photon detector is connected to a quantum communication fiber to measure the polarization state of light pulses in real time. The system counts the number of erroneous photons per unit time and calculates the real-time quantum bit error rate. Simultaneously, the module reads the real-time traffic logs of the network interface to obtain the data throughput per second as the network transmission rate. .

[0079] At the business data level, the module retrieves agricultural product and commodity metadata pre-stored in the system database. For high-perishable goods such as cold-chain fresh produce, it analyzes their spoilage rate indicators; for valuable agricultural products, it analyzes their value indicators. After weighted normalization, these indicators are mapped to numerical commodity sensitivity parameters. .

[0080] The module calls an embedded adaptive algorithm model to calculate the key lifespan. This model uses the quantum error rate as the independent variable of an exponential decay function and the cargo sensitivity parameter as the decay coefficient to determine the key replacement frequency.

[0081] Key lifecycle The calculation formula is as follows:

[0082] ;

[0083] in This represents the remaining available bit length in the current local quantum random number pool; This represents the current network transmission rate. This refers to real-time collected quantum bit error rate data; The preset security bit error rate threshold is used when the bit error rate is below this value, and the system is in a stable state. This is a channel noise sensitivity factor used to adjust the model's response gain to bit error rate fluctuations; its value is greater than 0. The cargo sensitivity parameter calculated above has a value range of 0 to 1; This is a business urgency adjustment constant used to balance security requirements and system resource consumption.

[0084] When the channel bit error rate Increase the approach threshold When the exponent term in the denominator increases, it leads to... The system is forced to change keys frequently to avoid the risk of interception; when the cargo is sensitive... At higher levels, the exponential decay term Reducing the key usage time also shortens the protection level of high-value goods.

[0085] The module performs low-level physical operations based on a selected quantum key distribution protocol, which can be chosen from BB84, E91, or COW protocols. The transmitted raw photon bit stream is sequentially subjected to basis vector alignment, error correction, and secret amplification, eliminating erroneous bits and compressing the information content to generate the final quantum random number pool.

[0086] In the calculation Within the time window, the module linearly extracts a bit sequence of a specified length from the quantum random number pool and marks it as the current one-time session key.

[0087] During key distribution, the module sets the security bit error rate threshold for the quantum channel and performs key distribution at millisecond-level frequencies. Perform sampling. If continuous... If the bit error rate data of a sampling period is higher than the security bit error rate threshold, the module triggers the defense logic, directly reducing the current key life cycle according to the preset non-linear step size, and generating an updated life cycle value.

[0088] The module internally starts a countdown timer to track the activation duration of the current one-time session key in real time. Once the activation duration equals the updated lifespan value, the module immediately sends a key expiration command to the dynamic encryption processing module, terminating the use of the current key. Simultaneously, the module triggers the next round of key generation and assigns a key identifier to the newly generated key. This key identifier is generated by combining a universally unique identifier (UUID) with the current system timestamp and is used for subsequent on-chain anchoring indexing.

[0089] The dynamic encryption processing module is used to receive a one-time session key and use the one-time session key to perform symmetric encryption operations on agricultural bill of lading data to generate ciphertext of the bill of lading;

[0090] Furthermore, in the dynamic encryption processing module, the one-time session key is used to perform symmetric encryption operations on the agricultural product bill of lading data to generate the bill of lading ciphertext, including:

[0091] Receive a one-time session key via the internal bus and generate a random initialization vector;

[0092] The agricultural product bill of lading data is converted into a binary stream, and then processed using a Galois / counter mode symmetric encryption algorithm in combination with a one-time session key and an initialization vector.

[0093] The encrypted binary stream is output as the bill of lading ciphertext, and a message authentication code for verifying data integrity is output simultaneously.

[0094] The initialization vector and message authentication code are appended to the header of the bill of lading ciphertext, and the corresponding key identifier is output to the off-chain anchoring construction module.

[0095] Specifically, it connects to the preceding quantum state sensing and key generation module via an internal high-speed secure bus. Upon receiving a one-time session key of a specified bit length... Then, the module starts the random number generator to generate a unique initialization vector. The initialization vector is set to 96 bits in length to meet the structural requirements of the counter block in Galois / counter mode, ensuring the uniqueness of the encrypted streams for the same key in different sessions.

[0096] The module serializes the agricultural product bill of lading data to be processed into a binary plaintext stream. Subsequently, combined with a one-time session key With initialization vector The algorithm employs a Galois / counter mode with authentication capabilities to perform computations. This computation process comprises two parallel stages: data encryption and integrity tag generation.

[0097] The data encryption process uses a counter mode, where a keystream is generated by an encrypted counter block and XORed with the plaintext. The calculation formula is as follows: ;in For the output of the first One encrypted block; For the input of the first One plaintext block; To use a one-time session key The block encryption operation performed; For the first A counter block, initialized by the initialization vector. It is derived by combining the block number; Bitwise XOR operation;

[0098] The authentication tag generation process uses Galois field multiplication to calculate the message authentication code using ciphertext and additional data. The calculation formula is as follows: ;in The output message authentication code is used by the receiving end to verify whether the data has been tampered with; The hash subkey is obtained by block encryption of the zero vector; To provide additional verification data, the header metadata of the bill of lading is included here; The encrypted data stream obtained from the above calculations; For Galois domain A polynomial hash function; This is the preset initial block for the counter; To obtain the most significant bit Bit.

[0099] After the calculation is complete, the module performs data packet assembly. This involves initializing the vector... With message authentication code spliced ​​from the ciphertext of the bill of lading The header is used to form the final encrypted data packet. This encrypted data packet is then sent to the subsequent separate verification and decryption module via a public network interface.

[0100] Simultaneously, the module will use the currently used one-time session key. Corresponding key identifier The data is stripped and sent to the off-chain anchoring construction module via an independent internal data channel, where it constructs a logically anchored transaction without ciphertext. This diversion mechanism establishes the physical starting point for both the ciphertext transmission path and the logical evidence storage path.

[0101] The off-chain anchoring construction module is used to perform a one-way hash operation on the bill of lading ciphertext to obtain a hash digest, and associate the hash digest with the key identifier to package it into an anchoring transaction that does not contain the bill of lading ciphertext and the one-time session key;

[0102] Furthermore, in the off-chain anchoring construction module, constructing an anchored transaction that does not include the bill of lading ciphertext and one-time session key includes:

[0103] Receive the ciphertext of the bill of lading containing header information, and use a one-way hash algorithm selected from SHA-256, SHA-3 or the national cryptographic SM3 to generate a fixed-length hash string as a hash digest.

[0104] Construct a JSON-formatted data object and write the key identifier, hash digest, and the current system's UTC timestamp into the data object;

[0105] The data object is serialized to generate standardized transaction payload data, which serves as the anchor transaction. This transaction payload data does not contain any bits of the bill of lading ciphertext or any bits of the one-time session key.

[0106] Specifically, the internal data channel receives the encrypted bill of lading containing header information output by the dynamic encryption processing module. The module calls a cryptographically secure one-way hash function to process the input data. In this embodiment, the hash algorithm is selected from SHA-256, SHA-3, or the Chinese national cryptographic algorithm SM3 to ensure that the generated digest is collision-resistant.

[0107] The summary calculation process follows the functional relationship below: ;in The output is a fixed-length hash string, i.e., a hash digest, the length of which is determined by the selected algorithm; This refers to the one-way hash algorithm function currently configured for the system. The input is a encrypted data stream of the bill of lading, containing an initialization vector and a message authentication code. This step maps ciphertext of arbitrary length to a fixed-length feature fingerprint, ensuring that the subsequent on-chain data load remains constant and does not fluctuate with the size of the agricultural product bill of lading file.

[0108] The module receives the key identifier corresponding to the current ciphertext. The module then allocates a data area in memory and constructs a JSON-formatted data object. This object contains three core fields: a key identifier field, a hash digest field, and a timestamp field. The timestamp field reads the current system's UTC time and is used to mark the logical time sequence of data generation.

[0109] Logical structure representation of data objects:

[0110] ;

[0111] in The completed data object to be serialized; It serves as a unique index identifier associated with the physical layer quantum key; The hash digest obtained from the aforementioned calculation; To construct the Coordinated Universal Time (UTC) value for the moment in time for the data.

[0112] The module constructs data objects Perform serialization processing to convert it into a standard binary or hexadecimal string suitable for network transmission, generating the anchored transaction payload. .

[0113] During this process, the module executes strict data filtering logic to ensure that the generated data is safe and secure. It does not contain the encrypted bill of lading. The data does not contain any original bits, nor any original bits of the one-time session key. The processing result is then output to the distributed ledger consensus module. Through this construction, even if the anchored transaction is publicly broadcast in the blockchain network, an attacker can only obtain the logical fingerprint and key index of the data, and cannot deduce the original data content or decryption key, thus establishing the zero-knowledge characteristic of the on-chain data.

[0114] The distributed ledger consensus module is used to receive anchored transactions and broadcast them to the blockchain network for consensus storage, generating on-chain ownership records containing timestamps;

[0115] Furthermore, in the distributed ledger consensus module, generating on-chain ownership confirmation records containing timestamps includes:

[0116] Parse the received anchored transaction, extract the public key certificate of the sending node, and verify whether the digital signature of the transaction belongs to the list of authorized nodes of the consortium blockchain;

[0117] After the signature verification is successful, the anchored transaction is placed into the transaction pool to be packaged, and the entire network nodes reach consensus through a distributed consensus algorithm selected from Practical Byzantine Fault Tolerance, Raft, or Proof-of-Stake.

[0118] Write the anchored transactions that have passed consensus into the Merkel leaf node of the new block and calculate the new block hash;

[0119] The record containing the block hash, block height, and anchored transaction content is broadcast and synchronized to all accounting nodes to form an on-chain ownership confirmation record.

[0120] Specifically, the module receives the serialized anchored transaction. The system first parses the transaction data packet and extracts the public key certificate of the sending node. and digital signatures The module reads the list of authorized nodes pre-configured in the consortium blockchain. The validity of the public key certificate is compared.

[0121] Subsequently, the module executes the elliptic curve digital signature verification algorithm, verification logic:

[0122] ;

[0123] in The result is a boolean value. A true value indicates that the signature is valid and the data has not been tampered with, while a false value indicates that the verification failed. This refers to the signature verification function used by the system, which corresponds to the signature algorithm used by the sending end. This is a summary value calculated from the transaction payload content; Digital signature data accompanying the transaction; This is the public key of the sending node extracted from the public key certificate. When the verification result... True and the sending node exists in the list of authorized nodes. In the meantime, the module places the anchored transaction into the transaction pool to be packaged, waiting for the consensus node to process it.

[0124] The module sorts and packages transactions in the transaction pool according to a selected distributed consensus algorithm, namely Practical Byzantine Fault Tolerance, Raft, or Proof-of-Stake. When generating a new block, the module writes the set of anchored transactions that have passed consensus into the leaf nodes of the Merkle tree.

[0125] The system calculates the Merkle root hash using recursive hashing operations. The calculation process is as follows:

[0126] ;

[0127] in The hash value of the parent node at the current level is used to iterate until a unique Merkle root is reached; The cryptographic hash function selected by the system; The hash value of the left child node; The hash value of the right child node; This is a concatenation operator for strings or binary data. This calculation process ensures that any bit-level change in the anchored transaction within any leaf node will result in a change in the final root hash, thus guaranteeing the integrity of the transaction.

[0128] After constructing the Merkle tree, the module generates block header data and calculates the block hash of the current new block. The block hash calculation is based on the chained dependency relationship between preceding and following blocks, and the formula is as follows:

[0129] ;

[0130] in The hash value of the newly generated block serves as its unique identifier. This is the block hash value of the previous block, used to link to the previous block; The Merkel root hash containing the anchored transactions, calculated above; A precise timestamp generated for the current block; The nonce value is a random number used to meet the consensus difficulty requirement. Under the non-proof-of-work mechanism, it can be a fixed padding value.

[0131] The module will include the block height and the calculated block hash. The complete data structure anchoring the transaction content is defined as an on-chain ownership confirmation record. This record is broadcast to all ledger nodes via a P2P network protocol, and each node completes ledger synchronization locally, thus completing the data storage and ownership confirmation.

[0132] The separate verification and decryption module is used to receive the bill of lading ciphertext and calculate the local hash value. After the consistency verification with the on-chain rights confirmation record is passed, a key acquisition request carrying a digital signature is generated.

[0133] Furthermore, in the separate verification and decryption module, the consistency verification with the on-chain ownership confirmation record includes:

[0134] Receive the ciphertext of the bill of lading over a public TCP / IP network, and parse the header data of the ciphertext to extract the key identifier in plaintext form;

[0135] Using the key identifier as the index key value, the query interface of the blockchain node is called to scan the local ledger data;

[0136] Locate the latest transaction record containing the key identifier and extract the original hash digest stored in that record;

[0137] The local hash value of the received bill of lading ciphertext is calculated using the same one-way hash algorithm as the off-chain anchoring construction module, and it is determined whether the local hash value is completely equal to the bit sequence of the original hash digest.

[0138] In the separate verification and decryption module, generating a key retrieval request carrying a digital signature includes:

[0139] After determining that the bit sequences are completely equal, the private key of the receiving node is used to digitally sign the transaction hash value in the on-chain rights confirmation record.

[0140] Construct a key request message, and encapsulate the key identifier, digital signature, and distributed identity identifier of the receiving node in the message body;

[0141] Establish an encrypted communication tunnel with the identity authentication and trust management module, and send key request messages through this encrypted communication tunnel.

[0142] Specifically, it listens on the data port through a public TCP / IP network interface to receive encrypted bill of lading data packets from the sender. The module calls the message parser to read the packet header information and extract the key identifier stored in plaintext. .

[0143] The module uses this key identifier As the key, a query request is initiated to the consensus node via a remote procedure call interface. The system traverses the local ledger database, locates the latest on-chain ownership confirmation record containing the key identifier, and extracts the original hash digest from the data payload of that record. and the on-chain transaction hash value corresponding to this record. .

[0144] The module calls a one-way hash algorithm consistent with the off-chain anchoring module configuration to process the received bill of lading encrypted data packets. Perform local hashing to obtain the local hash value. .

[0145] The system performs bit-level consistency comparisons, and the verification logic follows the functional relationship below:

[0146] ;

[0147] in The output verification result status code: 1 means verification passed and the data has not been tampered with; 0 means verification failed and the data integrity has been compromised. The system's default one-way hash function is selected from SHA-256, SHA-3, or SM3 in specific implementations. This is the encrypted text of the bill of lading to be verified received via a public network; This is the raw hash digest extracted from the blockchain ledger; This is the strict equality operator, which requires that the binary sequences of two hash values ​​be exactly the same in every bit.

[0148] when When the output is 0, the module directly discards the data packet and records an alarm log; if and only if When the output is 1, the module triggers the subsequent key request process.

[0149] After successful verification, the module reads the private key of the receiving node. To prevent replay attacks and verify the requester's identity, the module uses the transaction hash value recorded on the chain. Perform a digital signature operation. Signature calculation process: ;

[0150] in The generated digital signature data string; For asymmetric encryption signature algorithms, such as ECDSA or Ed25519; The private key stored in the receiving node's security module must not be disclosed. The unique transaction hash for on-chain ownership verification records serves as the original content of the signature, ensuring that the signature is bound to a specific transaction. The module then constructs a key request message. Write the key identifier sequentially into the message body. The generated digital signature and the distributed identity identifier of the receiving node .

[0151] The module invokes the transport layer security protocol stack to establish an encrypted communication tunnel with the identity authentication and trust management module. This tunnel is independent of the quantum channel and uses TLS 1.3 or an equivalent security level protocol for handshake and key negotiation.

[0152] The module will encapsulate the key request message The request is sent to the identity authentication and trust management module through this encrypted communication tunnel. This step completes the logical transition from data verification to permission request, and the request content is encrypted during transmission to prevent sniffing by third-party network nodes.

[0153] The identity authentication and trust management module is used to receive key acquisition requests, verify the source node permissions of digital signatures, and, after the permissions are verified, instruct the quantum state sensing and key generation module to issue a one-time session key to the separate verification and decryption module through the quantum channel to complete the decryption.

[0154] Furthermore, in the identity authentication and trust management module, receiving key acquisition requests and verifying the source node permissions of the digital signature includes:

[0155] Receive key request messages, decrypt them using the preset public key of the receiving node, and verify the validity of the digital signature;

[0156] Query the access control list in the smart contract to verify whether the distributed identity has the permission level to read the goods data corresponding to the key identifier;

[0157] When the signature is valid and the permission level meets the requirements, a key release instruction is generated, which contains the physical address information of the target quantum terminal;

[0158] The key release command is sent to the quantum state sensing and key generation module, which drives it to transmit the stored one-time session key point-to-point to the target quantum terminal through the specified quantum channel port.

[0159] In the identity authentication and trust management module, after successful authorization verification, the quantum state sensing and key generation module sends a one-time session key to the separate authentication and decryption module via a quantum channel to complete the decryption process, including:

[0160] The distributed ledger consensus module is periodically polled through an internal interface to listen for identity change events triggered by specific nodes registering smart contracts.

[0161] Parse the data payload of the identity change event and extract the distributed identity identifier, public key certificate, and operation type field of the node to be changed. The operation type field includes at least one of registration, freezing, and cancellation.

[0162] Verify whether the transaction signature that triggered the identity change event originated from the preset regulatory root node, and check the validity period of the public key certificate and the status of the certificate revocation list;

[0163] After successful verification, the access control list stored locally is updated based on the operation type field. The distributed identity of the node to be changed and its corresponding permission level are written to or removed from the trust list for verification of key acquisition requests.

[0164] Specifically, the key request message sent by the separate authentication and decryption module is received through the encrypted communication tunnel. The module first calls the message parser to extract the key identifier from the message body. Digital signature and the distributed identity identifier of the requesting node .

[0165] Module based on Retrieve the corresponding public key certificate from the locally stored identity database. Use this public key to create digital signatures. Asymmetric decryption and verification are performed, and the verification algorithm uses the elliptic curve digital signature algorithm.

[0166] Logic for determining signature validity: ;in This is a Boolean verification result; a true value indicates that the signature is valid, meaning the request did indeed originate from that source. The holder and the content has not been tampered with; A signature verification function conforming to the X.509 standard; This is the public key of the requesting node; The digital signature carried in the message; To pass The transaction hash value in the indexed on-chain ownership confirmation record is used as the verification benchmark.

[0167] exist If the verification is successful, the module reads the access control list from the smart contract state copy. The module then uses the key identifier... Query the sensitivity level of the corresponding agricultural products. and according to Query the permission level of the node requesting the query. .

[0168] The system executes access permission decision logic, and the decision function is expressed as follows:

[0169] ;

[0170] in For the access decision result, 1 indicates access is allowed, and 0 indicates access is denied; The security permission level of the requesting node in the current trust list; The minimum access permission threshold set for the cargo data itself;

[0171] when When the output is 1, the module generates a key release instruction. The data structure of this instruction contains the index of the target key. and the physical address of the quantum terminal corresponding to the requesting node. The module sends the instruction to the quantum state sensing and key generation module, triggering point-to-point key distribution at the physical layer.

[0172] The module is configured with an event listener that periodically polls the distributed ledger consensus module via an internal interface. The listener locks onto nodes registered with smart contracts at specific addresses and filters out triggered identity change events.

[0173] When an event is captured, the module parses the event data payload and extracts the distributed identity identifier of the node to be modified. Public key certificate and operation type field The possible values ​​for the operation type field are: register, freeze, and cancel.

[0174] The module verifies whether the transaction signature that triggered the event originated from a pre-configured regulatory root node public key. And check simultaneously The validity period field and online certificate status protocol response.

[0175] After successful verification, the module will proceed according to... Perform a local access control list update operation:

[0176] ;

[0177] in For the updated local access control list; This is the local access control list at the current moment; This is a set union operation, which involves writing new node identity and role information; This is a set difference operation, which removes access permissions for a specified node; This update process assigns permissions and roles to newly registered nodes. It ensures eventual consistency between the local permissions database and the on-chain regulatory state, preventing malicious nodes that have been deregistered from obtaining keys using historically cached identity information.

[0178] Example 2:

[0179] This is used for cross-border paperless customs clearance scenarios for high-value, time-sensitive agricultural products. In this scenario, exporters need to transmit digital bills of lading containing sensitive cargo values ​​and temperature control logs to importers through complex cross-border physical channels. This process has two stringent requirements: first, it must meet the millisecond-level customs clearance timeliness of fresh goods to avoid spoilage due to clearance delays; second, it must have long-term quantum attack resistance to confidentiality to prevent long-term eavesdropping on commercial pricing strategies.

[0180] However, existing technologies have three main drawbacks in the aforementioned scenarios: First, traditional encryption algorithms cannot withstand the threat of quantum computing power that can be intercepted now and cracked in the future, leading to the risk of retrospective leakage of long-term trade secrets; second, the key update strategy of existing quantum key distribution systems is fixed and cannot dynamically adjust the lifespan based on real-time channel error rate and the sensitivity of goods to spoilage, resulting in an inability to balance security and transmission efficiency during channel disturbances; third, the data verification and key distribution logic are strongly coupled, lacking a physical-logical dual-track verification mechanism, making the system prone to misissuing keys when data is tampered with or node identities are forged, thus failing to form a complete trust loop. To solve the above problems, this invention provides a cross-border agricultural product digital bill of lading system based on quantum encryption and blockchain, the structure of which is as follows: Figure 1 As shown. The specific implementation process of this system is as follows:

[0181] The quantum state sensing and key generation module directly couples the environmental parameters of the physical channel with the key management strategy. This module dynamically calculates the key lifetime based on the real-time quantum channel bit error rate and network speed, automatically adjusting the key update frequency when channel quality deteriorates or transmission rate fluctuates. This mechanism solves the problem of balancing security and key generation rate in traditional fixed-period key distribution modes under unstable cross-border channels. It prevents the risk of information leakage due to excessive key reuse time and avoids the excessive consumption of valuable quantum random number resources in low-risk environments.

[0182] The dynamic encryption processing module, in conjunction with the off-chain anchoring construction module, achieves a physical separation between data privacy and logical verification. The system uses only a one-time session key to locally encrypt the bill of lading data, while only the hash digest and key identifier are used to construct the anchored transaction and uploaded to the blockchain. This architecture ensures that the on-chain ownership confirmation records stored in the distributed ledger consensus module do not contain any encrypted information, fundamentally blocking attackers from performing backtracking cracks by analyzing historical data in the public ledger, thus guaranteeing the security of long-term business secrets.

[0183] The separate verification and decryption module establishes a defense logic of verification before request. The receiving end must first calculate the local ciphertext hash value and compare it with the immutable ownership record on the blockchain. Only after confirming that the data is complete and has not been tampered with will it generate a key acquisition request with a signature. This process effectively intercepts illegal key requests based on tampered data, prevents invalid requests from occupying quantum channel resources, and avoids the risk of data replacement caused by man-in-the-middle attacks.

[0184] The identity authentication and trust management module constructs a final trust loop from the application layer to the physical layer. Before distributing keys through the physical channel, this module forcibly verifies the digital signature and authorization level of the requesting node, ensuring that one-time session keys are transmitted only point-to-point to hardware terminals with legitimate identities and authorizations. This mechanism overcomes the shortcomings of traditional quantum key distribution systems that focus only on physical security while neglecting identity compliance, ensuring the exclusivity and non-repudiation of bill of lading data flow in cross-border trade scenarios.

[0185] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A cross-border agricultural product digital bill of lading system based on quantum encryption and blockchain, characterized in that, The system comprises the following modules: A quantum state sensing and key generation module for calculating a key lifetime based on real-time collected quantum channel error rate and network transmission rate, and extracting a bit stream from a local quantum random number pool to generate a one-time session key and a corresponding key identifier within the key lifetime; A dynamic encryption processing module for receiving the one-time session key and performing symmetric encryption operation on agricultural product bill of lading data using the one-time session key to generate bill of lading ciphertext; An off-chain anchor construction module for performing one-way hash operation on the bill of lading ciphertext to obtain a hash digest, and packing the hash digest and the key identifier to construct an anchor transaction not containing the bill of lading ciphertext and the one-time session key; A distributed ledger consensus module for receiving the anchor transaction and broadcasting it to a blockchain network for consensus storage to generate a timestamped on-chain authentication record; A separated verification and decryption module for receiving the bill of lading ciphertext and calculating a local hash value, and generating a key acquisition request carrying a digital signature after passing the consistency check with the on-chain authentication record; An identity authentication and trust management module for receiving the key acquisition request, verifying the source node authority of the digital signature, and instructing the quantum state sensing and key generation module to issue the one-time session key to the separated verification and decryption module through a quantum channel to complete decryption after passing the authority verification.

2. The quantum encryption and blockchain based cross-border agri-product digital bill of lading system according to claim 1, characterized in that, In the quantum state sensing and key generation module, the calculation of the key lifetime based on the real-time collected quantum channel error rate and network transmission rate comprises: Measuring the polarization state of the light pulse using a photon detector connected to the quantum communication optical fiber, counting the number of error photons per unit time to obtain real-time quantum error rate data, and synchronously reading the data throughput per second of the network interface as the network transmission rate; Reading the agricultural product cargo metadata pre-stored in the system database, parsing the decay rate index and the value index therein, and quantifying and mapping them into numerical cargo sensitivity parameters; Calling an embedded adaptive algorithm model, taking the quantum error rate data as the independent variable of the exponential decay function, and taking the cargo sensitivity parameters as the decay coefficient to calculate the key lifetime value in seconds; Based on a quantum key distribution protocol selected from the BB84 protocol, the E91 protocol or the COW protocol, performing basis vector comparison, error correction and private amplification processing on the original photon bit stream to generate a final quantum random number pool, and within the time window of the key lifetime, extracting a bit sequence of a specified bit length from the quantum random number pool as the one-time session key. 3.The quantum encryption and blockchain based cross-border agricultural products digital bill of lading system according to claim 1, characterized in that, In the quantum state sensing and key generation module, the extraction of the bit stream from the local quantum random number pool to generate the one-time session key and the corresponding key identifier within the key lifetime comprises: Setting a safe error rate threshold of the quantum channel, and sampling and monitoring the quantum error rate data at a millisecond level frequency; When the quantum error rate data of the continuous N sampling periods is higher than the security error rate threshold, the current key lifetime is reduced by a preset nonlinear step, and an updated lifetime value is generated; A countdown timer is started to track the activation duration of the current one-time session key in real time; Once the activation duration is equal to the updated lifetime value, a key invalidation instruction is sent to the dynamic encryption processing module, and the next round of key generation and identifier allocation process is triggered synchronously, wherein the key identifier is generated by combining a universally unique identifier and a timestamp.

4. The quantum encryption and blockchain based cross-border agri-product digital bill of lading system according to claim 1, characterized in that, In the dynamic encryption processing module, the symmetric encryption operation performed on the agricultural product bill of lading data using the one-time session key to generate bill of lading ciphertext includes: Receiving the one-time session key through the internal bus and generating a random initialization vector; Converting the agricultural product bill of lading data into a binary stream, combining the one-time session key and the initialization vector, and performing symmetric encryption algorithm operation in Galois / counter mode; Output the encrypted binary stream as the bill of lading ciphertext, and synchronously output the message authentication code for verifying data integrity; The initialization vector and the message authentication code are attached to the head of the bill of lading ciphertext, and the corresponding key identifier is output to the off-chain anchor construction module. 5.The quantum encryption and blockchain based cross-border agricultural products digital bill of lading system according to claim 1, wherein, In the off-chain anchor construction module, constructing an anchor transaction that does not contain the bill of lading ciphertext and the one-time session key includes: Receiving the bill of lading ciphertext containing the header information, performing operation on the bill of lading ciphertext using a one-way hash algorithm selected from SHA-256, SHA-3 or national standard SM3, and generating a fixed-length hash string as a hash digest; Constructing a JSON format data object, and writing the key identifier, the hash digest and the current system UTC timestamp in the data object; Serializing the data object to generate standardized transaction load data as the anchor transaction, wherein the transaction load data does not contain any bit of the bill of lading ciphertext and any bit of the one-time session key.

6. The quantum encryption and blockchain based cross-border agri-product digital bill of lading system according to claim 1, wherein, In the distributed ledger consensus module, the generation of the on-chain authentication record containing the timestamp includes: Parsing the received anchor transaction, extracting the public key certificate of the sending node, and verifying whether the digital signature of the transaction belongs to the authorized node list of the alliance chain; After the signature verification is passed, the anchor transaction is put into the pending transaction pool, and a distributed consensus algorithm selected from practical Byzantine fault tolerance, Raft or proof of stake is used for global node consensus; The anchor transaction that passes the consensus is written into the Merkle tree leaf node of the new block, and the new block hash is calculated; The record containing the block hash, block height and anchor transaction content is broadcasted and synchronized to all accounting nodes to form the on-chain authentication record.

7. The quantum encryption and blockchain based cross-border agri-product digital bill of lading system according to claim 1, wherein, In the separated verification and decryption module, the consistency check with the on-chain authentication record includes: Receiving the bill of lading ciphertext through the public TCP / IP network, parsing the ciphertext header data to extract the key identifier in plaintext form; The key identifier is used as an index key value to call the query interface of the blockchain node to scan the local ledger data; The latest transaction record containing the key identifier is located, and the original hash digest stored in the record is extracted; The local hash value of the received bill ciphertext is calculated using the same one-way hash algorithm as the off-chain anchor construction module, and it is determined whether the local hash value and the bit sequence of the original hash digest are completely equal.

8. The quantum encryption and blockchain based cross-border agri-product digital bill of lading system according to claim 1, characterized in that, In the separated verification and decryption module, the generation of the key acquisition request carrying a digital signature includes: After determining that the bit sequence is completely equal, the identity private key of the receiving node is called to perform a digital signature operation on the transaction hash value in the on-chain authentication record; A key request message is constructed, and the key identifier, the digital signature, and the distributed identity of the receiving node are encapsulated in the message body; An encrypted communication tunnel is established between the identity authentication and trust management module, and the key request message is sent through the encrypted communication tunnel. 9.The quantum encryption and blockchain based cross-border agricultural products digital bill of lading system according to claim 1, wherein, In the identity authentication and trust management module, the key acquisition request is received, and the source node authority of the digital signature is verified, including: The key request message is received, and the validity of the digital signature is decrypted and verified using the pre-set public key of the receiving node; The access control list in the smart contract is queried to check whether the distributed identity has the permission level to read the cargo data corresponding to the key identifier; When the signature is valid and the permission level meets the requirements, a key release instruction is generated, which includes the physical address information of the target quantum terminal; The key release instruction is sent to the quantum state perception and key generation module to drive it to transmit the stored one-time session key to the target quantum terminal through the specified quantum channel port.

10. The quantum encryption and blockchain based cross-border agri-product digital bill of lading system according to claim 1, wherein, In the identity authentication and trust management module, the quantum state perception and key generation module is instructed to issue the one-time session key to the separated verification and decryption module through the quantum channel to complete decryption after the permission verification is passed, including: Periodically poll the distributed ledger consensus module through an internal interface to listen to identity change events triggered by the node registration smart contract; Parse the data payload of the identity change event, extract the distributed identity, public key certificate, and operation type field of the node to be changed, and the operation type field includes at least one of registration, freezing, and deregistration; Verify whether the transaction signature triggering the identity change event is from the pre-set supervision root node, and check the validity period and certificate revocation list status of the public key certificate; After verification, update the local stored access control list according to the operation type field, write or remove the distributed identity of the node to be changed and its corresponding permission level from the trust list for use in the verification of the key acquisition request.

Images