A secure data processing system and method for a network platform

Abstract

The application relates to the technical field of network security protocol data processing, and discloses a security data processing system and method for a network platform, a dynamic key management module is used for generating an initial key seed based on quantum chaotic mapping, dynamically disturbing the key seed to generate a key, constructing a dynamic key topology network and setting a periodic key rotation threshold value; a trust evaluation module is used for generating a real-time trust score based on access request data of an access subject on the network platform; an access control module is used for dynamically adjusting an access permission level according to the real-time trust score, dynamically decrypting and authorizing encrypted data, and obtaining to-be-transmitted data; an encrypted transmission module is used for performing encrypted transmission on the to-be-transmitted data authorized to access based on a homomorphic encryption framework, and packing a hash digest of encrypted transmission logs to form a block, and storing the block in a blockchain; and the application improves the security of network platform data.

Description

Technical Field

[0001] This invention relates to the field of network security protocol data processing technology, and specifically to a secure data processing system and method for network platforms. Background Technology

[0002] With the rapid development of network technology and the increasing prominence of data value, network platforms are facing increasingly severe data security challenges. Security incidents such as data leakage, data tampering, unauthorized access, and privacy violations occur frequently, placing higher demands on the security protection capabilities of network platforms. In existing technologies, network security protocols typically employ encryption schemes with fixed keys or periodically rotating keys. However, traditional key rotation mechanisms have time window vulnerabilities. Once an attacker captures the key within the window, they can steal and tamper with data. At the same time, the public key update and revocation process often faces problems such as low distribution efficiency and complex certificate management. Summary of the Invention

[0003] The purpose of this invention is to solve the above-mentioned problems by designing a secure data processing system and method for network platforms.

[0004] The first aspect of the present invention provides a secure data processing system for a network platform, the system comprising: The dynamic key management module is used to generate an initial key seed based on quantum chaotic mapping, dynamically perturb the key seed to generate a key, construct a dynamic key topology network and set a periodic key rotation threshold, and trigger automatic key updates when the rotation period is reached. The trust assessment module is used to extract temporal behavioral features based on the access request data of the access subject on the network platform by constructing an LSTM-Attention model, and combine it with the DBSCAN clustering algorithm for anomaly detection to generate a real-time trust score. The access control module is used to dynamically adjust the access permission level based on real-time trust scores, and to dynamically decrypt and authorize encrypted data to obtain the data to be transmitted. The encrypted transmission module is used to encrypt the data to be transmitted by authorized access based on the homomorphic encryption framework, and to package the encrypted transmission log into blocks after generating a hash digest, and to store the evidence through the blockchain.

[0005] Optionally, in a first implementation of the first aspect of the present invention, the dynamic key management module includes: The generation submodule is used to generate an initial key seed based on quantum chaotic mapping. The initial key seed is XORed bit by bit. The XOR result is then concatenated with the current timestamp and a hash operation is performed. The result is used as the key. The construction submodule is used to use each communication node in the network platform as the vertex of the topology network, and to establish a logical link between each two nodes as the edge of the network according to communication needs, thus constructing a dynamic key topology network. The triggering submodule is used to trigger an automatic key update event when the time threshold and the encrypted data volume threshold are reached, generate a new key, and distribute it to the topology network.

[0006] Optionally, in a second implementation of the first aspect of the present invention, the generation submodule includes: Initialize two initial state values, iterate for a predetermined number of times, and generate a set of multidimensional state values ​​in each iteration; The multidimensional state values ​​are arranged in chronological order to form a state value sequence. Each state value in the sequence is bit-quantized, and multiple sets of random bits are extracted. The consecutive sets of random bits are concatenated into a binary string to obtain the initial key seed.

[0007] Optionally, in a third implementation of the first aspect of the present invention, the trust evaluation module includes: The acquisition submodule is used to acquire access request data of the access subject on the network platform and organize it into behavioral sequence data in chronological order; The update submodule is used to input behavioral sequence data into the LSTM-Attention model. Through the coordinated control of the input gate, forget gate and output gate of the LSTM network layer, it updates the current memory state and outputs the hidden state of the current time step, and outputs the hidden state vector corresponding to each time step. The weighted summation submodule is used to calculate the attention weight for each hidden state vector, and then perform a weighted summation of the hidden state vectors at each time step using the attention weight to obtain the aggregated feature vector. The nonlinear transformation submodule is used to input the aggregated feature vector into the fully connected layer for nonlinear transformation and output the probability of the current behavior sequence belonging to abnormal behavior. The anomaly detection submodule is used to detect anomalies based on anomaly probability and combined with the DBSCAN clustering algorithm, and generate a real-time trust score.

[0008] Optionally, in a fourth implementation of the first aspect of the present invention, the anomaly detection submodule includes: Iterate through each data point in the behavior sequence data of the accessing subject and count the number of other data points contained within the neighborhood radius of the current data point; If the number of points is greater than or equal to the minimum number of neighboring points, then mark the current data point as the core point and group all points that can be reached from the density of the current data point into the same cluster; Data points that are assigned to clusters are marked as normal behavior baseline points, and points that are not assigned to any cluster are marked as isolated points; The final real-time trust score is obtained by weighting and fusing the anomaly probability and outlier.

[0009] Optionally, in a fifth implementation of the first aspect of the present invention, the access control module includes: The determination submodule is used to determine the trust interval based on the real-time trust score and dynamically adjust the access permission level based on the trust interval. The trust interval includes at least a high trust interval, a medium trust interval, a low trust interval, and an untrusted interval. The calculation submodule is used to obtain the corresponding attribute private key based on the access subject's permission level. Starting from the leaf node of the access tree, the module calculates upwards layer by layer using the attribute private key to extract the data encryption key. After successful decryption, the data to be transmitted is based on the data encryption key.

[0010] Optionally, in a sixth implementation of the first aspect of the present invention, the encrypted transmission module includes: The matching submodule is used to identify the data processing task type of the data to be transmitted, match the corresponding homomorphic encryption scheme, generate the corresponding public and private key pair based on the matched homomorphic encryption scheme, and obtain the ciphertext data to be transmitted. The organizing submodule is used to transmit encrypted data using an end-to-end encrypted transmission protocol and organize each encrypted transmission information into a log record. The concatenation submodule is used to concatenate all fields in a log record into a string in a fixed order, and then perform a hash algorithm on the string to obtain a hash digest. The repetition processing submodule is used to take the hash digest of each log record as the child node of the Merkle tree, hash each pairwise to get the parent node, and repeat the processing to get the root hash value. The evidence storage submodule is used to construct the block header, concatenate the block header and log records to form a block, and store the evidence through the blockchain. The block header includes at least the hash value of the previous block, the creation timestamp of the current block, and the Merkle root hash value.

[0011] A second aspect of the present invention provides a secure data processing method for a network platform, the method comprising the following steps: The initial key seed is generated based on quantum chaotic mapping. The key seed is dynamically perturbed to generate the key. A dynamic key topology network is constructed and a periodic key rotation threshold is set. When the rotation period is reached, the key is automatically updated. Based on the access request data of the access subject on the network platform, the temporal behavior features are extracted by constructing an LSTM-Attention model, and anomaly detection is performed by combining the DBSCAN clustering algorithm to generate a real-time trust score. The access permission level is dynamically adjusted based on the real-time trust score, and the encrypted data is dynamically decrypted and authorized to obtain the data to be transmitted. Based on the homomorphic encryption framework, the data to be transmitted under authorized access is encrypted and transmitted. The encrypted transmission log is then packaged into blocks after being hashed and digested, and stored on the blockchain for evidence preservation.

[0012] A third aspect of the present invention provides a secure data processing apparatus for a network platform, the secure data processing apparatus for a network platform including a memory and at least one processor, the memory storing instructions; the at least one processor invokes the instructions in the memory to cause the secure data processing apparatus for a network platform to perform the steps of the secure data processing method for a network platform as described in any of the preceding claims.

[0013] A fourth aspect of the present invention provides a computer-readable storage medium storing instructions that, when executed by a processor, implement the steps of the secure data processing method for a network platform as described in any of the preceding claims.

[0014] The technical solution provided by this invention generates an initial key seed based on quantum chaotic mapping, dynamically perturbs the key seed to generate a key, constructs a dynamic key topology network and sets a periodic key rotation threshold, triggering automatic key updates when the rotation period is reached; based on access request data of the accessing subject on the network platform, it extracts temporal behavioral features by constructing an LSTM-Attention model and combines it with the DBSCAN clustering algorithm for anomaly detection to generate a real-time trust score; it dynamically adjusts the access permission level according to the real-time trust score, dynamically decrypts and authorizes encrypted data to obtain the data to be transmitted; and it uses a homomorphic encryption framework to manage authorized access. The data to be transmitted is encrypted, and the encrypted transmission log is generated by hash digest and packaged into blocks for storage via blockchain. This invention uses quantum chaotic mapping key generation to make the key unique and unpredictable, effectively cracking the time window vulnerability of traditional key rotation mechanisms. The LSTM-Attention model and DBSCAN clustering significantly improve the accuracy and real-time performance of abnormal behavior detection. The homomorphic encryption hybrid framework supports the computation of ciphertext data without revealing plaintext data, while solving the problems of data encryption and data availability. Complete and tamper-proof log recording is achieved through blockchain, greatly improving the security of network platform data. Attached Figure Description

[0015] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention.

[0016] Figure 1This is a schematic diagram of the structure of a secure data processing system for a network platform provided in an embodiment of the present invention; Figure 2 A flowchart of a secure data processing method for a network platform provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of a secure data processing device for a network platform provided in an embodiment of the present invention. Detailed Implementation

[0017] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a particular order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” or “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, apparatus, product, or device that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0018] For ease of understanding, the specific process of the embodiments of the present invention is described below. Please refer to [link / reference]. Figure 1 A schematic diagram of a secure data processing system for a network platform provided in this embodiment of the invention is shown. The system includes: The dynamic key management module is used to generate an initial key seed based on quantum chaotic mapping, dynamically perturb the key seed to generate a key, construct a dynamic key topology network and set a periodic key rotation threshold, and trigger automatic key updates when the rotation period is reached. The trust assessment module is used to extract temporal behavioral features based on the access request data of the access subject on the network platform by constructing an LSTM-Attention model, and combine it with the DBSCAN clustering algorithm for anomaly detection to generate a real-time trust score. The access control module is used to dynamically adjust the access permission level based on real-time trust scores, and to dynamically decrypt and authorize encrypted data to obtain the data to be transmitted. The encrypted transmission module is used to encrypt the data to be transmitted by authorized access based on the homomorphic encryption framework, and to package the encrypted transmission log into blocks after generating a hash digest, and to store the evidence through the blockchain.

[0019] In this embodiment, the dynamic key management module includes: The generation submodule is used to generate an initial key seed based on quantum chaotic mapping. The initial key seed is XORed bit by bit. The XOR result is then concatenated with the current timestamp and a hash operation is performed. The result is used as the key. The construction submodule is used to use each communication node in the network platform as the vertex of the topology network, and to establish a logical link between each two nodes as the edge of the network according to communication needs, thus constructing a dynamic key topology network. The triggering submodule is used to trigger an automatic key update event when the time threshold and the encrypted data volume threshold are reached, generate a new key, and distribute it to the topology network.

[0020] In this embodiment, the generation submodule includes: initializing two initial state values, iterating and running a predetermined number of times, generating a set of multidimensional state values ​​in each iteration; arranging the multidimensional state values ​​in chronological order to form a state value sequence; performing bit quantization processing on each state value in the sequence; extracting multiple sets of random bits; and concatenating the consecutive sets of random bits into a binary string to obtain the initial key seed.

[0021] In this embodiment, the trust assessment module includes: The acquisition submodule is used to acquire access request data of the access subject on the network platform and organize it into behavioral sequence data in chronological order; The update submodule is used to input behavioral sequence data into the LSTM-Attention model. Through the coordinated control of the input gate, forget gate and output gate of the LSTM network layer, it updates the current memory state and outputs the hidden state of the current time step, and outputs the hidden state vector corresponding to each time step. The weighted summation submodule is used to calculate the attention weight for each hidden state vector, and then perform a weighted summation of the hidden state vectors at each time step using the attention weight to obtain the aggregated feature vector. The nonlinear transformation submodule is used to input the aggregated feature vector into the fully connected layer for nonlinear transformation and output the probability of the current behavior sequence belonging to abnormal behavior. The anomaly detection submodule is used to detect anomalies based on anomaly probability and combined with the DBSCAN clustering algorithm, and generate a real-time trust score.

[0022] In this embodiment, the anomaly detection submodule includes: traversing each data point in the behavioral sequence data of the accessing subject, counting the number of other data points contained within the neighborhood radius of the current data point; if it is greater than or equal to the minimum neighborhood number, then marking the current data point as a core point, and grouping all points that can be reached from the density of the current data point into the same cluster; marking the data points that are assigned to the cluster as normal behavior baseline points, and marking the points that are not assigned to any cluster as isolated points; and weighting and fusing the anomaly probability and isolated points to obtain the final real-time trust score.

[0023] In this embodiment, the access control module includes: The determination submodule is used to determine the trust interval based on the real-time trust score and dynamically adjust the access permission level based on the trust interval. The trust interval includes at least a high trust interval, a medium trust interval, a low trust interval, and an untrusted interval. The calculation submodule is used to obtain the corresponding attribute private key based on the access subject's permission level. Starting from the leaf node of the access tree, the module calculates upwards layer by layer using the attribute private key to extract the data encryption key. After successful decryption, the data to be transmitted is based on the data encryption key.

[0024] In this embodiment, the encrypted transmission module includes: The matching submodule is used to identify the data processing task type of the data to be transmitted, match the corresponding homomorphic encryption scheme, generate the corresponding public and private key pair based on the matched homomorphic encryption scheme, and obtain the ciphertext data to be transmitted. The organizing submodule is used to transmit encrypted data using an end-to-end encrypted transmission protocol and organize each encrypted transmission information into a log record. The concatenation submodule is used to concatenate all fields in a log record into a string in a fixed order, and then perform a hash algorithm on the string to obtain a hash digest. The repetition processing submodule is used to take the hash digest of each log record as the child node of the Merkle tree, hash each pairwise to get the parent node, and repeat the processing to get the root hash value. The evidence storage submodule is used to construct the block header, concatenate the block header and log records to form a block, and store the evidence through the blockchain. The block header includes at least the hash value of the previous block, the creation timestamp of the current block, and the Merkle root hash value.

[0025] Please see Figure 2 The flowchart of a secure data processing method for a network platform provided in this embodiment of the invention specifically includes the following steps: Step 201: Generate an initial key seed based on quantum chaotic mapping, dynamically perturb the key seed to generate a key, construct a dynamic key topology network and set a periodic key rotation threshold, and trigger automatic key update when the rotation period is reached. In this embodiment, a coupled mapping lattice system is used as the quantum chaotic mapping model. The coupling strength parameter and control parameter of the system are set to make the system enter a completely chaotic state. Two initial state values ​​are selected from the system, and the system is iterated a predetermined number of times. Each iteration generates a set of multidimensional state values. These state values ​​are arranged in chronological order to form a state value sequence. Each state value in the sequence is bit-quantized, and the lowest few bits are truncated as random bits. Multiple consecutive sets of random bits are concatenated into a fixed-length binary string, which serves as the initial key seed. Multidimensional environmental parameters at the current moment are collected, including timestamp, device hardware fingerprint, geofence location coordinates, and real-time environmental temperature and humidity data. All collected environmental parameters are concatenated into a parameter string in a fixed order. A hash operation is performed on the parameter string to obtain a fixed-length perturbation vector. The generated initial key seed and the perturbation vector are XORed bit by bit. The XOR result is then concatenated with the current timestamp and a hash operation is performed again. The result is used as the key for this operation. Each communication node in the network platform is considered a vertices of the topology network, and logical links are established between every two nodes as edges of the network based on communication needs. Each node maintains a local adjacency list, recording the identity and public key information of its directly communicating neighboring nodes. During topology network initialization, the key management center distributes an initial public key certificate to each node, and nodes establish trust relationships by exchanging certificates. When a new node joins or an existing node leaves, each node dynamically modifies its local adjacency list according to the update notification and recalculates network connectivity. Two preset rotation conditions are used: a time threshold and an encrypted data volume threshold. The time threshold is set to a fixed duration, and the data volume threshold is set to the maximum number of bytes of data encrypted using the current key. A timer and a counter are started to record the usage duration of the current key and the encrypted data volume, respectively. Whenever the timer reaches the time threshold or the counter reaches the data volume threshold, an automatic key update event is triggered. After the update event is triggered, the process of generating a new key is repeated and distributed to all relevant nodes in the topology network through a secure channel. The old key is marked as expired and removed from the active key pool.

[0026] Step 202: Based on the access request data of the access subject on the network platform, extract temporal behavioral features by constructing an LSTM-Attention model, and combine it with the DBSCAN clustering algorithm for anomaly detection to generate a real-time trust score. In this embodiment, all access records of the target user within the past specified number of days are extracted from the network platform's operation log database. These records include the login time, logout time, requested resource address, operation type, source IP address, device identifier, and response status code for each request. All operations within each complete login-to-logout sequence are arranged chronologically to form behavioral sequence data. This behavioral sequence data is preprocessed by performing one-hot encoding on categorical variables such as operation type and resource address, and normalizing numerical variables such as time interval and request frequency to obtain a fixed-dimensional feature vector sequence. This feature vector sequence is then sequentially input into an LSTM network layer. The LSTM network layer contains multiple memory units. Each unit receives the current input feature vector and the hidden state from the previous time step at each time step. Through the coordinated control of the input gate, forget gate, and output gate, the current memory state is updated, and the hidden state of the current time step is output. After traversing the entire behavioral sequence, the LSTM network layer outputs the hidden state vector corresponding to each time step. The hidden state vectors from all time steps are collected, and an attention weight is calculated for each hidden state vector. The method for calculating the attention weight is as follows: each hidden state vector is mapped to a scalar value through a fully connected layer, then processed by a non-linear activation function, and finally a normalized exponential function is used to convert the scalar values ​​of all time steps into weight coefficients in the form of a probability distribution. The sum of all weight coefficients equals one. The calculated weight coefficients are used to perform a weighted summation of the hidden state vectors of each time step to obtain an aggregated feature vector. This vector centrally reflects the key temporal features in the behavior sequence that contribute significantly to anomaly judgment. The obtained aggregated feature vector is input into a fully connected classification network, which contains one hidden layer and one output layer. The hidden layer performs a non-linear transformation on the aggregated feature vector, and the output layer uses an activation function to map the transformation result to a value between zero and one, which represents the probability that the current behavior sequence belongs to an anomalous behavior. A feature space is constructed using the multidimensional behavioral feature vectors of the visiting entity as data points. A density-based spatial clustering algorithm is executed within this feature space, setting parameters for neighborhood radius and minimum number of neighborhood points. Each data point is traversed, and the number of other data points within its neighborhood radius is counted. If this number is greater than or equal to the minimum number of neighborhood points, the point is marked as a core point, and all points density-reachable from that point are grouped into the same cluster. This process is repeated until all points are visited. Finally, all points assigned to clusters are considered normal behavior baseline points, while points not assigned to any cluster are marked as isolated points, i.e., abnormal behavior candidates. The output abnormal probability and the abnormal candidate labels output in step five are weighted and fused: if the current visiting entity is marked as an isolated point, the abnormal candidate value is set to one; otherwise, it is set to zero. The weight of the abnormal probability is set to a first value, and the weight of the abnormal candidate value is set to a second value; the weighted sum is calculated as the final abnormal score. The final abnormal score is subtracted from one to obtain the initial trust score. Then, based on the trend of the visiting entity's trust score changes over several consecutive periods, a moving average method is used for smoothing, and the current real-time trust score is output.

[0027] Step 203: Dynamically adjust the access permission level based on the real-time trust score, dynamically decrypt and authorize the encrypted data to obtain the data to be transmitted; In this embodiment, multiple trust threshold ranges are set, such as high trust range, medium trust range, low trust range, and untrusted range. The output real-time trust score is compared with these ranges: if the score falls into the high trust range, all operation permissions are granted, including read, write, modify, and delete; if it falls into the medium trust range, read-only and limited write permissions are granted, and deletion and modification of critical data are prohibited; if it falls into the low trust range, only read-only permissions are granted, and sensitive data fields are anonymized; if it falls into the untrusted range, all access requests are rejected and a secondary authentication process is triggered. A global set of attributes is defined, including user attributes, environment attributes, and resource attributes. For each data resource to be protected, the data owner formulates an access policy, which describes the attribute combination conditions that allow access to the resource in the form of a Boolean expression. A lattice cryptography scheme based on the learning problem with errors on rings is adopted. First, system parameters are generated, including the dimension, modulus, and error distribution of the polynomial ring. During system initialization, a setup algorithm is run to sample from the error distribution to generate a master private key, and the corresponding master public key is calculated based on the master private key. The data owner generates a one-time data encryption key for the data to be encrypted, and uses a symmetric encryption algorithm to encrypt the data to obtain ciphertext. Then, this data encryption key is used for attribute-based encryption according to a defined access strategy: the strategy is represented as an access tree structure, and a polynomial is randomly generated for each node starting from the root node. The data encryption key is hidden in the secret value of the root node, and the attribute ciphertext is calculated by combining the master public key and the attribute set. Finally, the attribute base is encrypted using the public key from the lattice cryptography scheme. The master key is encrypted twice to obtain a lattice-encrypted version of the master key. When a user initiates a data access request, the system obtains the user's attribute set and its corresponding attribute private key. The attribute private key is generated by the key generation center based on the user's attributes using a lattice-encrypted cryptographic scheme and securely distributed to the user. During decryption, the system first attempts to decrypt the attribute ciphertext using the user's attribute private key: starting from the leaf node of the access tree, it calculates upwards layer by layer. If the user's attribute set meets the structural requirements of the access tree, the secret value in the root node can be recursively recovered, thereby extracting the data encryption key. If the attribute set does not meet the access policy, decryption fails and access is denied. After successful decryption, the user uses the data encryption key to decrypt the ciphertext and obtain the original data to be transmitted.

[0028] Step 204: Encrypt the data to be transmitted under authorized access based on the homomorphic encryption framework, and package the encrypted transmission log into a block after generating a hash digest, and store it through the blockchain.

[0029] In this embodiment, the type of data processing task to be executed is first determined: if the task only contains addition operations, such as summation or averaging, a partially homomorphic encryption scheme is selected; if the task contains mixed multiplication and addition operations, such as polynomial evaluation, a fully homomorphic encryption scheme is selected; based on the selected scheme, the system runs a key generation algorithm to generate a public-private key pair; the data owner uses the public key to encrypt the plaintext data, mapping the plaintext message to elements in the ciphertext space, and introducing random numbers during the encryption process to ensure semantic security; the encrypted data is stored or transmitted in ciphertext form; when data processing is required on the encrypted data, the system calculates... The computing nodes perform operations directly on the ciphertext without decrypting it. For partially homomorphic encryption schemes, ciphertext addition is defined as the multiplication of two ciphertexts or a combination according to specific rules, and the result after decryption is equal to the sum of the corresponding plaintexts. For fully homomorphic encryption schemes, ciphertext multiplication requires noise control techniques. Each multiplication operation amplifies the noise in the ciphertext. When the noise exceeds a threshold, the ciphertext cannot be decrypted correctly. Therefore, the system evaluates the current noise level before performing the multiplication operation. When the noise is close to the threshold, a bootstrapping process is initiated, i.e., homomorphic decryption of the ciphertext is performed to reduce the noise. After the calculation is completed, the system outputs a result ciphertext. The encrypted result or the encrypted data to be transmitted is used as the payload and sent using a secure end-to-end encrypted transmission protocol. Before transmission begins, the sender and receiver negotiate a key through a handshake, use this key to perform symmetric encryption on the data payload, and encapsulate the encrypted data into a transmission message. The message is sent to the receiver over the network, and the receiver uses the same key to decrypt and restore the encrypted data. Throughout the transmission process, intermediate nodes cannot obtain the plaintext content of the data payload. Information related to each encrypted transmission operation is automatically recorded, including the operation timestamp, initiator's identity, receiver's identity, the size of the transmitted data, the type of homomorphic encryption scheme used, the type description of the ciphertext calculation, and the hash value of the output ciphertext. All this information is arranged in chronological order to form a log record. Concatenate all fields of a log record into a string in a fixed order, and perform a secure hash algorithm on the string to obtain a fixed-length hash digest. For each subsequent log record, calculate its hash digest in the same way. Collect several log records and their hash digests generated within a certain period and construct a Merkle tree: use the hash digest of each log record as a leaf node, hash each pair of records to obtain its parent node, and repeat this process until a unique root hash value is obtained. Construct a block header, which contains the hash value of the previous block, the creation timestamp of the current block, the Merkle root hash value, and a random number determined by the consensus algorithm. Concatenate the block header with the log record set to form a complete log tree. The entire block is generated; the generated block is broadcast to all validating nodes in the private blockchain network; each node runs a practical Byzantine fault-tolerant consensus algorithm: a master node is elected to propose new blocks, and the remaining replica nodes vote to verify the validity of the block, including the correctness of the log hash, the matching of the hash of the previous block, and the consistency of the Merkle root; when more than two-thirds of the nodes have voted in favor, the block is officially accepted and appended to the end of each node's local blockchain; the blockchain adopts a chain structure, with the header of each block storing the hash value of the previous block, forming a link between the previous and subsequent blocks. Any subsequent tampering with the historical log will cause the hash verification of the subsequent block to fail, thus ensuring the immutability of the log.

[0030] Figure 3 This is a schematic diagram of a secure data processing device for a network platform according to an embodiment of the present invention. The secure data processing device 300 for a network platform can vary significantly due to different configurations or performance characteristics. It may include one or more central processing units (CPUs) 310 (e.g., one or more processors) and a memory 320, and one or more storage media 330 (e.g., one or more mass storage devices) for storing application programs 333 or data 332. The memory 320 and storage media 330 can be temporary or persistent storage. The program stored in the storage media 330 may include one or more modules (not shown in the diagram), each module including a series of instruction operations on the secure data processing device 300 for the network platform. Furthermore, the processor 310 may be configured to communicate with the storage media 330 and execute the series of instruction operations in the storage media 330 on the secure data processing device 300 for the network platform to implement the method provided in the above embodiment.

[0031] The secure data processing device 300 for a network platform may also include one or more power supplies 340, one or more wired or wireless network interfaces 350, one or more input / output interfaces 360, and / or one or more operating systems 331, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc. Those skilled in the art will understand that... Figure 3 The security data processing device structure shown for a network platform does not constitute a limitation on the computer device provided by the present invention. It may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0032] The present invention also provides a computer-readable storage medium, which can be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium, wherein the computer-readable storage medium stores instructions that, when executed on a computer, cause the computer to perform the various steps of the secure data processing method for a network platform provided in the above embodiments.

[0033] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the above-described equipment or apparatus / unit can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0034] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0035] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely preferred examples and are not intended to limit the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A secure data processing system for a network platform, characterized in that, The system includes: The dynamic key management module is used to generate an initial key seed based on quantum chaotic mapping, dynamically perturb the key seed to generate a key, construct a dynamic key topology network and set a periodic key rotation threshold, and trigger automatic key updates when the rotation period is reached. The trust assessment module is used to extract temporal behavioral features based on the access request data of the access subject on the network platform by constructing an LSTM-Attention model, and combine it with the DBSCAN clustering algorithm for anomaly detection to generate a real-time trust score. The access control module is used to dynamically adjust the access permission level based on real-time trust scores, and to dynamically decrypt and authorize encrypted data to obtain the data to be transmitted. The encrypted transmission module is used to encrypt the data to be transmitted by authorized access based on the homomorphic encryption framework, and to package the encrypted transmission log into blocks after generating a hash digest, and to store the evidence through the blockchain.

2. The secure data processing system for a network platform as described in claim 1, characterized in that, The dynamic key management module includes: The generation submodule is used to generate an initial key seed based on quantum chaotic mapping. The initial key seed is XORed bit by bit. The XOR result is then concatenated with the current timestamp and a hash operation is performed. The result is used as the key. The construction submodule is used to use each communication node in the network platform as the vertex of the topology network, and to establish a logical link between each two nodes as the edge of the network according to communication needs, thus constructing a dynamic key topology network. The triggering submodule is used to trigger an automatic key update event when the time threshold and the encrypted data volume threshold are reached, generate a new key, and distribute it to the topology network.

3. A secure data processing system for a network platform as described in claim 2, characterized in that, The generation submodule includes: Initialize two initial state values, iterate for a predetermined number of times, and generate a set of multidimensional state values ​​in each iteration; The multidimensional state values ​​are arranged in chronological order to form a state value sequence. Each state value in the sequence is bit-quantized, and multiple sets of random bits are extracted. The consecutive sets of random bits are concatenated into a binary string to obtain the initial key seed.

4. A secure data processing system for a network platform as described in claim 1, characterized in that, The trust assessment module includes: The acquisition submodule is used to acquire access request data of the access subject on the network platform and organize it into behavioral sequence data in chronological order; The update submodule is used to input behavioral sequence data into the LSTM-Attention model. Through the coordinated control of the input gate, forget gate and output gate of the LSTM network layer, it updates the current memory state and outputs the hidden state of the current time step, and outputs the hidden state vector corresponding to each time step. The weighted summation submodule is used to calculate the attention weight for each hidden state vector, and then perform a weighted summation of the hidden state vectors at each time step using the attention weight to obtain the aggregated feature vector. The nonlinear transformation submodule is used to input the aggregated feature vector into the fully connected layer for nonlinear transformation and output the probability of the current behavior sequence belonging to abnormal behavior. The anomaly detection submodule is used to detect anomalies based on anomaly probability and combined with the DBSCAN clustering algorithm, and generate a real-time trust score.

5. A secure data processing system for a network platform as described in claim 4, characterized in that, The anomaly detection submodule includes: Iterate through each data point in the behavior sequence data of the accessing subject and count the number of other data points contained within the neighborhood radius of the current data point; If the number of points is greater than or equal to the minimum number of neighboring points, then mark the current data point as the core point and group all points that can be reached from the density of the current data point into the same cluster; Data points that are assigned to clusters are marked as normal behavior baseline points, and points that are not assigned to any cluster are marked as isolated points; The final real-time trust score is obtained by weighting and fusing the anomaly probability and outlier.

6. A secure data processing system for a network platform as described in claim 1, characterized in that, The access control module includes: The determination submodule is used to determine the trust interval based on the real-time trust score and dynamically adjust the access permission level based on the trust interval. The trust interval includes at least a high trust interval, a medium trust interval, a low trust interval, and an untrusted interval. The calculation submodule is used to obtain the corresponding attribute private key based on the access subject's permission level. Starting from the leaf node of the access tree, the module calculates upwards layer by layer using the attribute private key to extract the data encryption key. After successful decryption, the data to be transmitted is based on the data encryption key.

7. A secure data processing system for a network platform as described in claim 1, characterized in that, The encrypted transmission module includes: The matching submodule is used to identify the data processing task type of the data to be transmitted, match the corresponding homomorphic encryption scheme, generate the corresponding public and private key pair based on the matched homomorphic encryption scheme, and obtain the ciphertext data to be transmitted. The organizing submodule is used to transmit encrypted data using an end-to-end encrypted transmission protocol and organize each encrypted transmission information into a log record. The concatenation submodule is used to concatenate all fields in a log record into a string in a fixed order, and then perform a hash algorithm on the string to obtain a hash digest. The repetition processing submodule is used to take the hash digest of each log record as the child node of the Merkle tree, hash each pairwise to get the parent node, and repeat the processing to get the root hash value. The evidence storage submodule is used to construct the block header, concatenate the block header and log records to form a block, and store the evidence through the blockchain. The block header includes at least the hash value of the previous block, the creation timestamp of the current block, and the Merkle root hash value.

8. A secure data processing method for a network platform, characterized in that, The method includes the following steps: The initial key seed is generated based on quantum chaotic mapping. The key seed is dynamically perturbed to generate the key. A dynamic key topology network is constructed and a periodic key rotation threshold is set. When the rotation period is reached, the key is automatically updated. Based on the access request data of the access subject on the network platform, the temporal behavior features are extracted by constructing an LSTM-Attention model, and anomaly detection is performed by combining the DBSCAN clustering algorithm to generate a real-time trust score. The access permission level is dynamically adjusted based on the real-time trust score, and the encrypted data is dynamically decrypted and authorized to obtain the data to be transmitted. Based on the homomorphic encryption framework, the data to be transmitted under authorized access is encrypted and transmitted. The encrypted transmission log is then packaged into blocks after being hashed and digested, and stored on the blockchain for evidence preservation.

9. A secure data processing device for a network platform, characterized in that, The secure data processing device for a network platform includes a memory and at least one processor, the memory storing instructions; the at least one processor invokes the instructions in the memory to cause the secure data processing device for a network platform to perform the steps of the secure data processing method for a network platform as described in any one of claims 8.

10. A computer-readable storage medium storing instructions thereon, characterized in that, When the instructions are executed by the processor, they implement the steps of the secure data processing method for a network platform as described in any one of claims 8.

Images