Blockchain-based communication processing method and apparatus, and blockchain system

Abstract

The application discloses a communication processing method and device based on a blockchain and a blockchain system, and comprises a first physically isolated network and a second physically isolated network, wherein the first physically isolated network and the second physically isolated network are not directly connected, the first physically isolated network comprises a first computing device and a first blockchain system, the first blockchain system is deployed with a first smart contract, the second physically isolated network comprises a second computing device and a second blockchain system, the second blockchain system is deployed with a second smart contract, the first physically isolated network and the second physically isolated network are physically transferred through a mobile storage medium, and the operation logic is automatically executed by predefining the smart contract code, so that the security risks caused by human intervention are avoided, and the overall security of cross-isolated network communication is greatly improved.

Description

Technical Field

[0001] This invention relates to the fields of blockchain and network security technology, specifically to a blockchain-based communication processing method, apparatus, and blockchain system. Background Technology

[0002] With the widespread application of blockchain technology in fields such as distributed ledgers and trusted computing, its potential as a secure communication infrastructure is attracting increasing attention. In existing technologies, some solutions attempt to hide communication content using blockchain transaction fields, for example, by constructing transaction pairs with specific signature relationships to achieve covert channel communication. However, such methods typically rely on on-chain public broadcasting, which carries the risk of address reuse leading to identity tracing, and cannot effectively prevent third-party eavesdropping and traffic analysis.

[0003] Furthermore, for data exchange needs across isolated networks (such as intranets and extranets), traditional approaches often employ centralized gateways or manual copying. The former is prone to creating single points of failure and expanding the attack surface, while the latter lacks integrity verification mechanisms and is difficult to prevent data tampering. Although some research has proposed secure transmission mechanisms based on QR codes or one-time passwords, the coordination issues between end-to-end encryption, non-repudiation, and operational auditability have not yet been resolved.

[0004] Therefore, there is an urgent need for a new communication processing mechanism that can leverage the trust foundation provided by blockchain, avoid the risks of direct network connections, support offline transfers, and have complete data verification capabilities, in order to meet the actual needs of high-security scenarios. Summary of the Invention

[0005] The purpose of this invention is to provide a blockchain-based communication processing method, apparatus, and blockchain system to solve the problems mentioned in the background art.

[0006] To achieve the aforementioned objective, the present invention provides the following technical solution: a blockchain-based communication processing system, comprising a first physically isolated network and a second physically isolated network, wherein there is no direct network connection between the first physically isolated network and the second physically isolated network, the first physically isolated network comprising a first computing device and a first blockchain system, wherein a first smart contract is deployed on the first blockchain system, the second physically isolated network comprising a second computing device and a second blockchain system, wherein a second smart contract is deployed on the second blockchain system, and the first physically isolated network and the second physically isolated network physically transfer encrypted ciphertext data and hash verification values ​​through a mobile storage medium.

[0007] Preferably, the first blockchain system and the second blockchain system adopt a consortium blockchain architecture, support different consensus algorithms, and the first smart contract and the second smart contract are deployed on different blockchain platforms.

[0008] A blockchain-based communication processing method includes the following steps:

[0009] S1: The first computing device encapsulates the request data into a first transaction and sends it to the first blockchain system. The first blockchain system calls the first smart contract deployed on it to encrypt the request data and generate request ciphertext. The first blockchain system calculates the first hash value corresponding to the request ciphertext, stores it on the blockchain, and returns the request ciphertext to the first computing device.

[0010] S2: The first computing device transmits the request ciphertext to the second computing device, the second computing device encapsulates the request ciphertext into a second transaction and sends it to the second blockchain system, the second blockchain system calls the second smart contract deployed on it to decrypt the request ciphertext and restore the request data;

[0011] S3: The second computing device encapsulates the response data into a third transaction and sends it to the second blockchain system. The second blockchain system calls the second smart contract to encrypt the response data and generate response ciphertext. The second blockchain system returns the response ciphertext to the second computing device.

[0012] S4: The second computing device writes the response ciphertext and the first hash value together into a mobile storage medium, and the mobile storage medium transfers the response ciphertext and the first hash value to the network where the first computing device is located through a physical transfer method;

[0013] S5: The first computing device reads the ciphertext and the first hash value from the mobile storage medium. The first computing device encapsulates the ciphertext and the first hash value into a fourth transaction and sends it to the first blockchain system. The first blockchain system calls the first smart contract, first uses the first hash value to perform integrity verification on the ciphertext, and after the verification is successful, decrypts the ciphertext, restores the response data, and returns it to the first computing device.

[0014] Preferably, in S1, the first smart contract uses a symmetric encryption algorithm to encrypt the request data. The symmetric encryption algorithm is either AES-256 or SM4 national cryptographic algorithm, and the first hash value is obtained by calculating the request ciphertext using SHA-256 or SM3 national cryptographic hash algorithm.

[0015] Preferably, in S1, the first smart contract associates the first hash value with the unique identifier of the requested data and stores it in the contract state variable.

[0016] Preferably, in step S4, when the second computing device writes the response ciphertext and the first hash value to the mobile storage medium, it adds a timestamp information, the timestamp having an accuracy of not less than milliseconds, and the mobile storage medium being any one of a USB flash drive, an SD card, or a solid-state portable hard drive.

[0017] Preferably, the integrity verification in S5 specifically involves: the first smart contract recalculating the hash value of the received response ciphertext, comparing the calculation result with the input first hash value, and if they match, the verification passes; if they do not match, the data is determined to have been tampered with, subsequent decryption operations are refused, and an exception log is recorded.

[0018] Preferably, the first blockchain system and the second blockchain system adopt different consensus mechanisms and different underlying platforms, there is no direct network connection between the first blockchain system and the second blockchain system, and the encryption keys of the first smart contract and the second smart contract are pre-distributed through offline secure channels or dynamically generated based on elliptic curve key negotiation protocol.

[0019] The blockchain-based communication processing device includes a transaction encapsulation module, a smart contract invocation module, a data transmission module, a media read / write module, and an integrity verification module.

[0020] The transaction encapsulation module is used to encapsulate request data or response data into a standard blockchain transaction format and attach a digital signature;

[0021] The smart contract calling module is used to submit transactions to the blockchain system and trigger the smart contract to perform encryption, decryption, and hash verification operations;

[0022] The data transmission module is used to transmit encrypted data between computing devices via a local area network or local interface;

[0023] The media read / write module is used to write or read encrypted data and hash values ​​to the mobile storage medium, and supports physical transfer.

[0024] The integrity verification module is used to perform integrity verification on the received ciphertext data using hash values ​​to determine whether the data has been tampered with.

[0025] Preferably, it also includes a key management module for storing and managing encryption keys, supporting regular key updates and dynamic negotiation, wherein the key storage area of ​​the key management module is encrypted and protected by a hardware security module.

[0026] Compared with the prior art, the beneficial effects of the present invention are:

[0027] 1. This invention employs a working method that deploys independent blockchain systems and corresponding smart contracts on two physically isolated networks. Encryption and decryption operations on both the request and response sides are automatically executed by the smart contracts on their respective chains, with keys held in escrow by the contracts. This eliminates the need for centralized gateways or trusted third-party institutions, completely eliminating the single point of failure and single point of attack risk associated with centralized devices. Attackers cannot control the entire data exchange channel by breaching a single node. Based on a decentralized trust model using blockchain, no single participant needs to be trusted; the operational logic is predefined and automatically executed by the smart contract code, avoiding security risks from human intervention and significantly improving the overall security of cross-isolated network communication.

[0028] 2. This invention employs a working method that involves storing the requested encrypted hash value on the blockchain, physically transferring the encrypted text and hash value via a mobile storage medium, and having the receiving smart contract verify the hash before decryption. This leverages the immutability of blockchain to ensure the trustworthiness of the hash base value and utilizes the one-way nature of the hash algorithm to verify the integrity of the transmitted data. Under the premise of complete physical isolation and no network connection, it achieves integrity verification of data transmission, effectively preventing the risk of malicious tampering, virus implantation, or data replacement of the mobile storage medium during physical transfer. Even if an attacker physically accesses the mobile storage medium, they cannot tamper with the encrypted content undetected, as any alteration will result in a hash value mismatch and be intercepted by the receiving smart contract, thus ensuring data trustworthiness in offline transmission scenarios. Attached Figure Description

[0029] Figure 1 A system flowchart of the present invention is shown. Detailed Implementation

[0030] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0031] according to Figure 1As shown, the present invention provides a technical solution: a blockchain-based communication processing blockchain system, comprising a first physically isolated network and a second physically isolated network, wherein there is no direct network connection between the first physically isolated network and the second physically isolated network. The first physically isolated network includes a first computing device and a first blockchain system, on which a first smart contract is deployed for performing data encryption, response ciphertext decryption, and hash integrity verification. The second physically isolated network includes a second computing device and a second blockchain system, on which a second smart contract is deployed for performing request ciphertext decryption and response data encryption. The first physically isolated network and the second physically isolated network physically transfer encrypted ciphertext data and hash verification values ​​through a mobile storage medium.

[0032] The first and second blockchain systems adopt consortium blockchain architecture and support different consensus algorithms. The first and second smart contracts are deployed on different blockchain platforms to enhance system heterogeneity and anti-collusion capabilities. The nodes of the two chains are operated and maintained by different management parties to avoid the trust concentration problem caused by a single management party controlling both chains at the same time.

[0033] The blockchain-based communication processing method includes the following steps:

[0034] S1: The first computing device encapsulates the request data into a first transaction and sends it to the first blockchain system. The first blockchain system calls the first smart contract deployed on it to encrypt the request data and generate request ciphertext. The first blockchain system calculates the first hash value corresponding to the request ciphertext, stores it on the blockchain, and returns the request ciphertext to the first computing device.

[0035] S2: The first computing device transmits the request ciphertext to the second computing device, the second computing device encapsulates the request ciphertext into a second transaction and sends it to the second blockchain system, the second blockchain system calls the second smart contract deployed on it to decrypt the request ciphertext and restore the request data;

[0036] S3: The second computing device encapsulates the response data into a third transaction and sends it to the second blockchain system. The second blockchain system calls the second smart contract to encrypt the response data and generate response ciphertext. The second blockchain system returns the response ciphertext to the second computing device.

[0037] S4: The second computing device writes the response ciphertext and the first hash value together into a mobile storage medium, and the mobile storage medium transfers the response ciphertext and the first hash value to the network where the first computing device is located through a physical transfer method;

[0038] S5: The first computing device reads the response ciphertext and the first hash value from the mobile storage medium. The first computing device encapsulates the response ciphertext and the first hash value into a fourth transaction and sends it to the first blockchain system. The first blockchain system calls the first smart contract, first uses the first hash value to perform integrity verification on the response ciphertext, and after the verification is passed, decrypts the response ciphertext, restores the response data, and returns it to the first computing device.

[0039] The first smart contract in S1 uses a symmetric encryption algorithm to encrypt the request data. The symmetric encryption algorithm is either AES-256 or SM4 national cryptographic algorithm. The first hash value is obtained by calculating the ciphertext of the request using either SHA-256 or SM3 national cryptographic hash algorithm to adapt to the compliance requirements of different industries.

[0040] In S1, the first smart contract associates the first hash value with the unique identifier of the requested data and stores it in the contract state variable. All on-chain operations are accompanied by digital signatures to ensure that the operations are traceable.

[0041] When the second computing device in S4 writes the response ciphertext and the first hash value to the mobile storage medium, it also adds a timestamp. The timestamp accuracy is no less than milliseconds, which is used to accurately locate the operation time during subsequent auditing. The mobile storage medium can be any one of a USB flash drive, SD card, or solid-state mobile hard drive to adapt to different deployment environments.

[0042] In S5, the integrity check is specifically performed as follows: The first smart contract recalculates the hash value of the received response ciphertext, compares the calculation result with the first input hash value, and if they match, the check passes; if they do not match, the data is determined to have been tampered with, subsequent decryption operations are refused, and an exception log is recorded.

[0043] The first and second blockchain systems employ different consensus mechanisms and underlying platforms, and there is no direct network connection between them. The encryption keys for the first and second smart contracts are pre-distributed through offline secure channels or dynamically generated based on an elliptic curve key negotiation protocol.

[0044] The blockchain-based communication processing device includes a transaction encapsulation module, a smart contract invocation module, a data transmission module, a media read / write module, and an integrity verification module.

[0045] The transaction encapsulation module is used to encapsulate request or response data into a standard blockchain transaction format and attach a digital signature;

[0046] The smart contract invocation module is used to submit transactions to the blockchain system and trigger smart contracts to perform encryption, decryption, and hash verification operations.

[0047] The data transmission module is used to transmit encrypted data between computing devices via a local area network or local interface;

[0048] The media read / write module is used to write or read encrypted data and hash values ​​to or from the mobile storage medium, and supports physical transfer.

[0049] The integrity verification module is used to verify the integrity of received ciphertext data using hash values ​​to determine whether the data has been tampered with.

[0050] It also includes a key management module for storing and managing encryption keys, supporting regular key updates and dynamic negotiation. The key storage area of ​​the key management module is encrypted and protected by a hardware security module.

[0051] Working principle: Blockchain communication system:

[0052] like Figure 1 As shown, this embodiment provides a blockchain communication system, including a first physically isolated network and a second physically isolated network. There is no direct network connection between the two networks, and they are strictly physically isolated.

[0053] The first physical isolation network includes a first computing device and a first blockchain system, on which a first smart contract is deployed. The first smart contract performs three core functions: encrypting outbound request data, performing hash integrity verification on inbound response ciphertext, and decrypting the response ciphertext after the verification is successful.

[0054] The second physically isolated network includes a second computing device and a second blockchain system, on which a second smart contract is deployed. The second smart contract performs two core functions: decrypting the encrypted request data for inbound requests and encrypting the response data for outbound requests.

[0055] The first and second physically isolated networks are physically transferred via a mobile storage medium, transmitting only encrypted ciphertext data and hash verification values, without transmitting any plaintext data or keys.

[0056] Blockchain-based communication processing methods:

[0057] like Figure 1 As shown, this embodiment provides a blockchain-based communication processing method for secure data exchange between two physically isolated networks. The specific steps are as follows:

[0058] S1: Request Encryption and Hash On-Chain Stage

[0059] The first computing device generates plaintext request data containing the business request, encapsulates it into a first transaction, digitally signs the transaction using its own private key, and sends it to the first blockchain system. After verifying the transaction signature and legality, the first blockchain system calls the first smart contract deployed on it to execute the encryption logic: using a pre-set or negotiated encryption key to symmetrically encrypt the request data, generate request ciphertext, calculate the first hash value corresponding to the request ciphertext, associate the first hash value with the unique identifier of the request and store it on the blockchain in the state variable of the first smart contract for evidence storage, and finally return the request ciphertext as the transaction execution result to the first computing device.

[0060] S2: Request for ciphertext transmission across the network and decryption phase

[0061] After receiving the ciphertext request, the first computing device transmits it to a second computing device located in a second physically isolated network via an internal LAN or a dedicated data export interface. The second computing device encapsulates the ciphertext request into a second transaction, attaches a digital signature, and sends it to the second blockchain system. After verifying the legality of the transaction, the second blockchain system calls the second smart contract deployed on it, uses the decryption key paired with the encryption key to decrypt the ciphertext request, and restores the plaintext request data for processing by the business systems in the second network.

[0062] S3: Response Data Encryption Phase

[0063] After the business system of the second network processes the request, it generates response data. The second computing device encapsulates the response data into a third transaction and submits it to the second blockchain system. The second blockchain system calls the second smart contract to encrypt the response data, generate response ciphertext, and returns the response ciphertext to the second computing device.

[0064] This step uses a different key than the one used to encrypt the request data to separate the keys for the request and response channels, thereby further enhancing security.

[0065] S4: Physical Transfer Writing Stage

[0066] The second computing device obtains the response ciphertext from the second blockchain system and simultaneously obtains the first hash value from the local cache or synchronization channel; it writes the response ciphertext, the first hash value, and the current timestamp together into the mobile storage medium to form a complete ferry data packet; after writing is completed, it performs a secure offloading operation; then, it physically transfers the mobile storage medium from the second physical isolation network to the first physical isolation network area by manual or dedicated ferry equipment.

[0067] S5: Response Reading, Verification, and Decryption Phase

[0068] The first computing device connects to the mobile storage medium, reads the ciphertext of the response and the first hash value, encapsulates them into a fourth transaction, attaches a digital signature, and sends it to the first blockchain system. The first blockchain system calls the first smart contract to execute the verification and decryption logic: first, it recalculates the hash value of the received ciphertext of the response, compares the calculation result with the input first hash value, if they are inconsistent, it is determined that the data has been tampered with during the transfer process, immediately terminates the subsequent operation and records the abnormal log on the chain; if the hash comparison is consistent, the verification is passed, and the response decryption key is used to decrypt the ciphertext of the response, restore the plaintext response data, and return the result to the first computing device.

[0069] In this embodiment, the first blockchain system and the second blockchain system adopt different consortium blockchain underlying platforms and different consensus algorithms. For example, the first chain adopts Practical Byzantine Fault Tolerance consensus, and the second chain adopts Proof-of-Stake consensus. There is no direct network connection between the two to ensure strict physical isolation. In terms of key management, encryption keys and decryption keys can be pre-distributed through offline secure channels or dynamically generated based on elliptic curve key negotiation protocol. The elliptic curve uses the national cryptographic standard curve SM2 or secp256r1.

[0070] The entire communication process requires no real-time network interconnection; it relies solely on periodic physical transfers to complete the closed-loop interaction of request and response, making it particularly suitable for high-security control environments such as classified units, military systems, and power dispatch centers.

[0071] Blockchain-based communication processing devices:

[0072] A blockchain-based communication processing device is provided, deployed in a computing device, for executing a blockchain-based communication processing method. The device includes the following functional modules:

[0073] The transaction encapsulation module is used to encapsulate request or response data according to the standard blockchain transaction format, automatically adding timestamps, random numbers, and digital signatures to ensure the uniqueness and non-repudiation of transactions.

[0074] The smart contract invocation module is used to submit a packaged transaction to the corresponding blockchain system, trigger the smart contract to perform corresponding encryption, decryption, and hash verification operations, and receive the execution result returned by the contract.

[0075] The data transmission module is used to transmit encrypted data between different computing devices via a local area network, a dedicated data interface, or a local bus. The transmission process is protected by an encrypted channel to prevent the risk of eavesdropping during intranet transmission.

[0076] The media read / write module is used to write encrypted data and hash values ​​to or read relevant data from the mobile storage medium. It supports hot-plug detection, automatic mounting, and virus scanning. Integrity checks are performed before and after each read / write operation to prevent the medium itself from being contaminated.

[0077] The integrity verification module is used to verify the integrity of received ciphertext data using hash values. It recalculates the hash and compares it with the baseline value to determine whether the data has been tampered with during transmission. If the verification fails, an alarm is triggered and the subsequent process is terminated.

[0078] The key management module is used to store and manage encryption keys, and supports regular key updates and dynamic negotiation. The key storage area is encrypted and protected by a hardware security module, and the plaintext of the key never leaves the security chip to prevent key leakage.

[0079] The device in this embodiment is used to execute a blockchain-based communication processing method, and its implementation principle and technical effect are the same as those of the blockchain-based communication processing method.

[0080] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0081] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A blockchain-based communication processing system, comprising a first physically isolated network and a second physically isolated network, characterized in that: There is no direct network connection between the first physical isolation network and the second physical isolation network. The first physical isolation network includes a first computing device and a first blockchain system, on which a first smart contract is deployed. The second physical isolation network includes a second computing device and a second blockchain system, on which a second smart contract is deployed. The first physical isolation network and the second physical isolation network physically transfer encrypted ciphertext data and hash verification values ​​through a mobile storage medium.

2. The blockchain-based communication processing system according to claim 1, characterized in that: The first blockchain system and the second blockchain system adopt consortium blockchain architecture and support different consensus algorithms. The first smart contract and the second smart contract are deployed on different blockchain platforms.

3. A blockchain-based communication processing method, applied to the blockchain-based communication processing system according to any one of claims 1-2, characterized in that: Includes the following steps: S1: The first computing device encapsulates the request data into a first transaction and sends it to the first blockchain system. The first blockchain system calls the first smart contract deployed on it to encrypt the request data and generate request ciphertext. The first blockchain system calculates the first hash value corresponding to the request ciphertext, stores it on the blockchain, and returns the request ciphertext to the first computing device. S2: The first computing device transmits the request ciphertext to the second computing device, the second computing device encapsulates the request ciphertext into a second transaction and sends it to the second blockchain system, the second blockchain system calls the second smart contract deployed on it to decrypt the request ciphertext and restore the request data; S3: The second computing device encapsulates the response data into a third transaction and sends it to the second blockchain system. The second blockchain system calls the second smart contract to encrypt the response data and generate response ciphertext. The second blockchain system returns the response ciphertext to the second computing device. S4: The second computing device writes the response ciphertext and the first hash value together into a mobile storage medium, and the mobile storage medium transfers the response ciphertext and the first hash value to the network where the first computing device is located through a physical transfer method; S5: The first computing device reads the response ciphertext and the first hash value from the mobile storage medium. The first computing device encapsulates the response ciphertext and the first hash value into a fourth transaction and sends it to the first blockchain system. The first blockchain system calls the first smart contract, first uses the first hash value to perform integrity verification on the response ciphertext, and after the verification is passed, decrypts the response ciphertext, restores the response data, and returns it to the first computing device.

4. The blockchain-based communication processing method according to claim 3, characterized in that: In S1, the first smart contract uses a symmetric encryption algorithm to encrypt the request data. The symmetric encryption algorithm is either AES-256 or SM4 national cryptographic algorithm. The first hash value is obtained by calculating the request ciphertext using either the SHA-256 algorithm or the SM3 national cryptographic hash algorithm.

5. The blockchain-based communication processing method according to claim 3, characterized in that: In S1, the first smart contract associates the first hash value with the unique identifier of the requested data and stores it in the contract state variable.

6. The blockchain-based communication processing method according to claim 3, characterized in that: When the second computing device in S4 writes the response ciphertext and the first hash value to the mobile storage medium, it also adds a timestamp information. The timestamp accuracy is not less than milliseconds. The mobile storage medium is any one of a USB flash drive, an SD card, or a solid-state portable hard drive.

7. The blockchain-based communication processing method according to claim 3, characterized in that: The integrity verification in S5 specifically involves: the first smart contract recalculating the hash value of the received response ciphertext, comparing the calculation result with the first input hash value, and if they match, the verification passes; if they do not match, the data is determined to have been tampered with, subsequent decryption operations are refused, and an exception log is recorded.

8. The blockchain-based communication processing method according to claim 3, characterized in that: The first blockchain system and the second blockchain system adopt different consensus mechanisms and different underlying platforms. There is no direct network connection between the first blockchain system and the second blockchain system. The encryption keys of the first smart contract and the second smart contract are pre-distributed through offline secure channels or dynamically generated based on the elliptic curve key negotiation protocol.

9. A blockchain-based communication processing device, applied to the blockchain-based communication processing system and method according to any one of claims 1-8, comprising a transaction encapsulation module, a smart contract invocation module, a data transmission module, a media read / write module, and an integrity verification module, characterized in that: The transaction encapsulation module is used to encapsulate request data or response data into a standard blockchain transaction format and attach a digital signature; The smart contract calling module is used to submit transactions to the blockchain system and trigger the smart contract to perform encryption, decryption, and hash verification operations; The data transmission module is used to transmit encrypted data between computing devices via a local area network or local interface; The media read / write module is used to write or read encrypted data and hash values ​​to the mobile storage medium, and supports physical transfer. The integrity verification module is used to perform integrity verification on the received ciphertext data using hash values ​​to determine whether the data has been tampered with.

10. The blockchain-based communication processing device according to claim 9, characterized in that: It also includes a key management module for storing and managing encryption keys, supporting regular key updates and dynamic negotiation. The key storage area of ​​the key management module is encrypted and protected by a hardware security module.

Images