Cross-domain financial clearing and settlement method and system based on satellite internet trusted access and permission blockchain, and storage medium

Abstract

The application provides a cross-domain financial clearing and settlement method and system based on satellite internet trusted access and permission blockchain and a storage medium, and relates to the technical field of financial data processing.The application collects link metadata through a satellite internet access layer, generates an on-satellite abstract package through an on-satellite light node module, anchors the on-satellite abstract package to a batch root, forwards a request through a ground gateway station module, executes compliance verification through a permission blockchain financial network, and submits a physical world proof through an asset state oracle module.Combining a hierarchical clearing and settlement state machine, the application realizes the orderly execution of regional pre-confirmation, on-satellite anchoring and final clearing, effectively solves the problems of link credibility, high dynamic topology adaptability, asset authenticity verification and chain recovery in a weak ground network environment, and has the advantages of realizing trusted access, link state trusted binding, asset state real-time verification and hierarchical clearing and settlement state machine guaranteeing transaction reliability in a weak ground network environment.

Description

Technical Field

[0001] This invention relates to the field of financial data processing technology, specifically to a cross-domain financial clearing and settlement method, system, and storage medium based on trusted access via satellite internet and permissioned blockchain. Background Technology

[0002] Traditional financial payments, clearing, credit granting, trade finance, and insurance claims rely heavily on terrestrial internet, dedicated communication lines, centralized clearing institutions, and manual review processes. However, in environments with weak terrestrial networks, such as maritime shipping, cross-border trade, mining operations, and disaster emergency response, financial entities need to complete clearing and settlement transactions such as payments, credit granting, warehouse receipt pledging, and insurance claims across geographical boundaries. These transactions typically require verifiable transaction documents, traceable fund transfers, and verifiable performance status, while also meeting compliance auditing and privacy protection requirements.

[0003] In response, existing technologies have been developed to transmit financial transaction messages in areas with weak network coverage via satellite links, utilize permissioned blockchain networks to achieve multi-party ledger synchronization and automatic contract execution, and leverage IoT oracles or remote sensing data to bring offline asset information onto the blockchain to trigger financing or compensation operations.

[0004] However, satellite communication is only used as a transparent transmission channel, and metadata such as satellite number, beam time slot, and link quality of its access link are not included in the transaction evidence chain, making it difficult to trace and prevent repudiation. Due to the limitations of on-board resources, satellites cannot deploy complete blockchain consensus nodes, making it difficult to guarantee the continuity and finality of transactions under link interruption or highly dynamic topology. In addition, there is still a lack of effective mechanisms for the reliable conversion of wide-area perception data such as remote sensing into on-chain asset proof and its integration with the clearing and settlement process. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a cross-domain financial clearing and settlement method, system, and storage medium based on trusted access to satellite internet and permissioned blockchain. This solves the problems of insufficient trusted access, trusted binding of link status, real-time verification of asset status, and layered clearing and settlement state machine to ensure transaction reliability in weak terrestrial network environments.

[0006] To achieve the above objectives, this invention provides a cross-domain financial clearing and settlement system based on trusted access to satellite internet and permissioned blockchain, comprising: The satellite internet access layer is used to receive financial transaction requests submitted by terminals via satellite links and to collect satellite link metadata. The on-board light node module, deployed on the satellite and not maintaining a complete financial ledger, is used to generate summaries of transaction requests, generate on-board summary packets carrying on-board signatures based on satellite link metadata and trusted timestamps, and anchor the summaries of candidate transactions to the on-board batch root. The ground gateway module is used to forward financial transaction requests and on-board digest packets to the permissioned blockchain financial network; The permissioned blockchain financial network maintains a complete ledger through multiple financial full nodes and deploys compliant smart contracts to verify transaction requests for at least one of identity, amount, and geofencing and output compliant results. The asset status oracle module is used to receive physical world perception data, generate signed asset status proofs, and submit them to the permissioned blockchain financial network. Specifically, by executing a hierarchical clearing and settlement state machine, the ground regional nodes perform regional pre-confirmation to form candidate states and freeze quotas, the on-board light node module performs on-board anchoring to anchor the candidate state summary to the on-board batch root, and the financial full node performs final clearing to confirm that the original transaction text is consistent with the on-board summary package and generate the final clearing state.

[0007] In one embodiment of the present invention, the satellite link metadata includes at least one of satellite number, beam number, orbit time slot, access time, and link quality; the onboard light node module signs the satellite link metadata together with the transaction original hash so that the communication link status is bound to the transaction evidence chain.

[0008] In one embodiment of the present invention, the permissioned blockchain financial network further includes a regulatory observer node, which receives anonymized transaction summaries, compliance result hashes, and risk labels without obtaining the complete plaintext of the transaction, in order to support auditable privacy protection.

[0009] In one embodiment of the present invention, the physical world perception data received by the asset state oracle module includes at least one of the following: remote sensing images, synthetic aperture radar data, Internet of Things sensor data, and positioning data, and generates a signed asset state certificate in a trusted execution environment.

[0010] In one embodiment of the present invention, the hierarchical clearing and settlement state machine is triggered in sequence: after regional pre-confirmation, satellite anchoring is triggered; after satellite anchoring, final clearing is triggered; and after final clearing is completed, the transaction status is marked as non-rollbackable.

[0011] In one embodiment of the present invention, a broken link cache recovery module is also included, which is used to encrypt and cache the on-board digest packet when the satellite link is interrupted; after the link is restored, the packet is submitted to the permissioned blockchain financial network after consistency verification based on the terminal identity, transaction sequence number and transaction hash.

[0012] In one embodiment of the present invention, the terminal is configured with a hardware security module for generating a transaction signature containing a transaction sequence number and a random challenge value. The signature covers the original transaction text, satellite link metadata, and the random challenge value.

[0013] This invention also provides a cross-domain financial clearing and settlement method based on trusted access to satellite internet and permissioned blockchain, comprising: The satellite internet access layer receives financial transaction requests submitted by terminals via satellite links and collects satellite link metadata. By deploying on-board light node modules on satellites without maintaining a complete financial ledger, a digest of transaction requests is generated, and an on-board digest package carrying an on-board signature is generated based on satellite link metadata and a trusted timestamp, and the digest of candidate transactions is anchored to the on-board batch root. Financial transaction requests and on-board digest packets are forwarded to the permissioned blockchain financial network via the ground gateway module; The complete ledger is maintained by multiple financial full nodes in a permissioned blockchain financial network, and compliant smart contracts are deployed to verify at least one of the following for transaction requests: identity, amount, and geofencing, and output compliant results. The asset state oracle module receives physical world perception data, generates a signed asset state certificate, and submits it to the permissioned blockchain financial network. By executing a hierarchical clearing and settlement state machine, regional pre-confirmation is performed on ground area nodes to form candidate states and freeze quotas. On-board anchoring is performed on the satellite light node modules to anchor the candidate state summary to the satellite batch root. Final clearing is performed on the financial full nodes to confirm that the transaction original is consistent with the satellite summary package and generate the final clearing state.

[0014] The present invention also provides an electronic device, including a processor and a memory, wherein the memory stores program instructions and the processor is used to run the program instructions to execute the cross-domain financial clearing and settlement method based on trusted access to satellite Internet and permissioned blockchain as described above.

[0015] The present invention also provides a computer-readable storage medium storing a computer program, wherein the computer program causes a computer to execute the cross-domain financial clearing and settlement method based on trusted access to satellite internet and permissioned blockchain as described above.

[0016] This invention provides a cross-domain financial clearing and settlement method and system based on trusted access via satellite internet and permissioned blockchain. Compared with existing technologies, it has the following advantages: It collects link metadata through the satellite internet access layer, generates on-board digest packets and anchors them to the batch root through the on-board light node module, forwards requests through the ground gateway module, performs compliance verification through the permissioned blockchain financial network, and submits physical world proofs through the asset status oracle module. Combined with a layered clearing and settlement state machine, it achieves the orderly execution of regional pre-confirmation, on-board anchoring, and final clearing. This effectively solves the problems of link trustworthiness, high dynamic topology adaptability, asset authenticity verification, and link failure recovery in financial transactions under weak terrestrial network environments. It has the advantages of achieving trusted access, trusted link status binding, real-time asset status verification, and transaction reliability guaranteed by the layered clearing and settlement state machine in weak terrestrial network environments. Attached Figure Description To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is an architecture diagram of a cross-domain financial clearing and settlement system based on trusted access to satellite internet and permissioned blockchain, provided in an embodiment of this application.

[0018] Figure 2 This is a schematic diagram of the satellite-to-ground node deployment topology provided in an embodiment of this application.

[0019] Figure 3 This is a schematic diagram of the cross-domain financial transaction processing flow provided in the embodiments of this application.

[0020] Figure 4 This is a schematic diagram illustrating the interaction between the compliant smart contract and the regulatory observation node provided in the embodiments of this application.

[0021] Figure 5 This is a schematic diagram illustrating the processing flow of the chain break caching and recovery mechanism provided in the embodiments of this application. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention are described clearly and completely. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] This embodiment provides a financial clearing and settlement system based on trusted satellite internet access and permissioned blockchain. Traditional financial payment, clearing, and credit services often suffer from service interruptions, hindered document circulation, and difficulties in clearing and settlement maintenance in scenarios with weak terrestrial networks, such as maritime shipping, mining and energy, agricultural production areas, border ports, and disaster emergency response, due to unstable communication links. Existing solutions combining blockchain and satellite communication typically fail to utilize the satellite access link itself as a trusted factor in financial transactions, lack a hierarchical clearing and settlement mechanism between onboard light nodes and ground-based full financial nodes, and struggle to effectively verify the true status of offline assets.

[0024] In response, this application proposes a cross-domain financial clearing and settlement system based on trusted access to satellite internet and permissioned blockchain, comprising: The satellite internet access layer is used to receive financial transaction requests submitted by terminals via satellite links and to collect satellite link metadata. The on-board light node module, deployed on the satellite and not maintaining a complete financial ledger, is used to generate a summary of transaction requests, generate an on-board summary package carrying an on-board signature based on the satellite link metadata and trusted timestamps, and anchor the summary of candidate transactions to the on-board batch root. The ground gateway module is used to forward the financial transaction request and the on-board digest packet to the permissioned blockchain financial network; The permissioned blockchain financial network maintains a complete ledger through multiple financial full nodes and deploys compliant smart contracts to verify transaction requests for at least one of identity, amount, and geofencing and output compliant results. The asset status oracle module is used to receive physical world perception data, generate signed asset status proofs, and submit them to the permissioned blockchain financial network. Specifically, by executing a hierarchical clearing and settlement state machine, the ground area node performs regional pre-confirmation to form candidate states and freeze quotas, the satellite light node module performs satellite anchoring to anchor the candidate state summary to the satellite batch root, and the financial full node performs final clearing to confirm that the original transaction text is consistent with the satellite summary package and generate the final clearing state.

[0025] This embodiment provides a cross-domain financial clearing and settlement system based on trusted access via satellite internet and permissioned blockchain. By integrating satellite communication and blockchain technology, this system aims to address issues such as business continuity, transaction credibility, and asset authenticity verification in traditional finance operating in environments with weak terrestrial networks.

[0026] Specifically, please refer to Figure 1This illustrates one embodiment of the system architecture, in which the terminal submits a financial transaction request through the satellite internet access layer, which collects satellite link metadata; the on-board light node module generates a signed on-board digest packet and performs digest anchoring; the ground gateway forwards the transaction request and the on-board digest packet to the permissioned blockchain financial network; compliant smart contracts are deployed within the permissioned blockchain financial network, and regional pre-confirmation is performed by ground regional nodes and final settlement is performed by financial full nodes; the asset state oracle module receives physical world perception data and generates a signed asset state certificate, which is then submitted to the permissioned blockchain financial network.

[0027] The satellite internet access layer consists of multiple low-Earth orbit or high-Earth orbit communication satellites, each carrying a light node module in addition to its communication payload. Terminals can be enterprise financial terminals, shipborne satellite terminals, or IoT sensor terminals, submitting financial transaction requests to the system via satellite links. During the process of receiving these requests, the satellites simultaneously collect satellite link metadata related to the access, including at least the satellite number, beam number, orbital time slot, access time, and link quality indicators.

[0028] The on-board light node module is deployed in the satellite computing environment, performing only lightweight processing without maintaining a complete financial transaction ledger. After obtaining the original financial transaction request text uploaded by the terminal, the module first generates a transaction digest using a hash algorithm; simultaneously, it obtains a trusted timestamp from the onboard time synchronization unit. Subsequently, the module combines the transaction digest, trusted timestamp, and the aforementioned satellite link metadata into a payload to be signed, and digitally signs it using a pre-installed onboard private key, forming an on-board digest packet. This on-board digest packet is crucial evidence for subsequent verification that the transaction occurred on a specific satellite within a specific time window. Furthermore, the on-board light node module also performs on-board anchoring functions, periodically aggregating multiple candidate transaction digests that have passed preliminary verification within a certain time window into a Merkle tree, calculating the on-board batch root, and signing the batch root using the on-board private key to form an anchor record.

[0029] The ground gateway module, located in a ground station or edge computing device, is responsible for establishing a feed link with the passing satellite, performing protocol conversion, and verifying data integrity. This module forwards the received financial transaction request plaintext and on-board digest packet to the corresponding access node in the permissioned blockchain financial network via a dedicated ground line or trusted relay network.

[0030] Specifically, please refer to Figure 2 The diagram illustrates the deployment topology of the satellite-ground nodes in the system. Onboard light nodes are deployed on low-Earth orbit or high-Earth orbit communication satellites, with adjacent satellites connected via inter-satellite links. Ground gateway stations communicate with the satellites via feeder links, and then connect to ground-based financial full nodes and regulatory observation nodes via dedicated lines or relay networks. Onboard light nodes transmit summary anchoring data to the ground via satellite-ground links.

[0031] The permissioned blockchain financial network is a permissioned blockchain network jointly maintained by multiple banks, payment institutions, and clearing institutions. Each member runs a full financial node, and nodes maintain ledger consistency through consensus protocols such as Byzantine fault tolerance or Raft-like protocols. The full financial node deploys code for a compliance smart contract, which is automatically invoked before a transaction enters the clearing process to execute verification logic on the financial transaction request. For example, compliance smart contract 50 can extract the terminal identity identifier from the transaction request and interact with the identity registration contract on the permissioned chain to verify the validity of the digital certificate; read the transaction amount from the transaction request and compare it with the quota management status database to determine if it exceeds the limit; and verify the geofence constraints triggered by the transaction based on the geographical location reported by the terminal or the beam coverage area information in the satellite link metadata. After verification, the contract outputs a compliance result object containing a status code (pass, reject, freeze, or manual review) and the corresponding reason code, which is recorded in the blockchain's state tree.

[0032] The Asset State Oracle module consists of one or more service nodes running in a Trusted Execution Environment (TEE) to transform physical world perception data into on-chain verifiable proofs. Data sources received by this module include, but are not limited to, Synthetic Aperture Radar (SAR) remote sensing imagery, IoT sensor feedback values, and BeiDou or AIS positioning data. Internally, the module first performs spatiotemporal registration and noise filtering on the multi-source data, then uses a pre-built recognition model (e.g., a neural network-based stockpile change detection model) to generate asset state analysis results. Next, using the oracle node's private key within the TEE, the analysis results and their hash are signed to generate a signed asset state proof. This proof is directly written into the ledger of the permissioned blockchain financial network through the oracle contract's transaction interface, allowing other contracts to query and access it.

[0033] In this system, transaction confirmation adopts a hierarchical clearing and settlement state machine, and its process is executed sequentially by three units distributed on different nodes: 1) Regional Pre-confirmation: This is executed by ground-based regional nodes in the permissioned blockchain financial network. When a node receives a transaction request and on-board digest packet through the gateway module and obtains the approval result from the compliant smart contract, it creates a candidate state record for the transaction and temporarily freezes the associated account limit in its local state, forming a limit freeze record. At this point, the transaction has not yet been finally confirmed, but a response can be initiated at the business level.

[0034] 2) On-board anchoring: Performed by the on-board light node module. After completing regional pre-confirmation, the ground area node sends the candidate transaction summary (or candidate status identifier) ​​to the on-board light node module via the satellite uplink control channel. The on-board light node module adds the candidate transaction summary to the currently aggregated batch, updates the on-board batch root, timestamps and signs the new batch root, generating an anchoring certificate. This anchoring certificate is broadcast from the satellite or transmitted back to the ground via downlink, serving as proof that the transaction has been recorded on the satellite side within a specific time window and is tamper-proof.

[0035] 3) Final Settlement: Executed by full financial nodes in the permissioned blockchain financial network. Once a full financial node collects the original transaction text, on-premises digest, compliance result, and asset status proof (if required by the contract), it performs consensus verification: verifying whether the hash of the original transaction text matches the digest in the on-premises digest; verifying the validity of the signature in the on-premises digest and that the timestamp is within the allowed deviation; confirming that the compliance result is passed; and confirming that the hash of the asset status proof matches the proof already uploaded to the oracle. After all conditions are met, the full financial node submits the transaction block containing all the above verification evidence to consensus. Upon reaching consensus, the transaction status is updated to final settlement, generating a settlement receipt with the node's signature. This state cannot be rolled back, and the transaction is considered final. Simultaneously, the system synchronizes the anonymized transaction digest, compliance result hash, and other audit information to the regulatory observation nodes on the permissioned blockchain, achieving a balance between regulatory auditing and transaction privacy.

[0036] As can be clearly understood from the above embodiments, this system elevates satellite communication link information into an effective component of the financial transaction evidence chain. Through the coordination of onboard light node anchoring and the ground-based hierarchical clearing and settlement state machine, it adapts to the latency and disconnection characteristics of satellite networks, solving the problem of financial business interruption in low-network environments. The combination of the onboard light node module and the hierarchical clearing and settlement state machine uses satellite link metadata as a transaction credibility factor, enhancing the non-repudiation capability of the transaction evidence chain and adapting to the intermittent connectivity of satellite networks. The asset state oracle module transforms the physical world asset state into on-chain proof, improving the credibility of physical asset finance. Combined with compliant smart contracts of permissioned blockchain financial networks, it balances financial compliance with commercial privacy protection.

[0037] Specifically, please refer to Figure 3This demonstrates the complete processing flow from transaction initiation at the terminal to final settlement. After the terminal generates a transaction request, it collects link metadata via satellite access; the onboard light node generates a digest and timestamp signature; the ground gateway station completes protocol adaptation and integrity verification; the compliant smart contract executes compliance verification, and after successful verification, the asset status oracle generates an asset status certificate; subsequently, the regional node performs pre-confirmation and freezes the quota, the onboard light node anchors the candidate digest to the batch root, and finally, the financial full node completes the final settlement and outputs the settlement receipt and digital certificate.

[0038] To better understand the above technical solutions, the following will provide a detailed explanation of the technical solutions in conjunction with the accompanying drawings and specific implementation methods.

[0039] This application further proposes that the aforementioned satellite link metadata includes at least one of satellite number, beam number, orbit time slot, access time, and link quality; the onboard light node module will jointly sign the satellite link metadata with the transaction original hash to bind the communication link state to the transaction evidence chain.

[0040] Specifically, satellite link metadata refers to auxiliary information describing the characteristics and status of a communication link, collected by the satellite internet access layer or onboard light node modules during the transmission of financial transaction requests via satellite links. This metadata includes: satellite numbers that uniquely identify the satellite performing the communication mission; beam numbers that identify specific beams within the satellite's coverage area; orbital time slots recording the satellite's orbital position and time window at the time of communication; precise records of the access time when the transaction request enters the system via the satellite link; and link quality reflecting communication link performance, such as signal strength, bit error rate, and latency. This metadata provides detailed contextual information about the communication environment at the time of the transaction, which is of significant value for subsequent compliance reviews, risk assessments, and troubleshooting.

[0041] Upon receiving a financial transaction request, the onboard light node module first calculates the hash value of the transaction plaintext and simultaneously obtains the corresponding satellite link metadata. It then combines the transaction plaintext hash with this satellite link metadata and uses its private key to digitally sign the combined data, generating an onboard digest packet carrying the onboard signature. This shared signature mechanism ensures that the transaction content and link metadata are logically and cryptographically integrated; any tampering by either party will result in signature verification failure, thus making the communication link state part of the transaction evidence chain.

[0042] In this way, by capturing and encrypting key satellite link metadata and transaction plaintext hashes, the environmental context information of financial transactions transmitted via satellite links is ensured to be completely and reliably recorded. This makes the real-time status of the communication link an inherent part of the transaction evidence chain, enhancing the integrity, traceability, and non-repudiation of transactions. In subsequent clearing and settlement, compliance review, or dispute resolution processes, the consistency between the transaction content and the specific satellite link status can be verified based on the signature information in the on-board digest packet, thereby avoiding risks and disputes caused by missing or uncertain link information and improving the credibility and auditing capabilities of the financial clearing and settlement system.

[0043] In one embodiment, the permissioned blockchain financial network also includes a regulatory watch node that receives anonymized transaction summaries, compliance result hashes, and risk labels without obtaining the full plaintext of the transactions, in order to support auditable privacy protection.

[0044] Specifically, regulatory watchdogs are designed to receive and process only information that has undergone specific anonymization to meet regulatory audit requirements while protecting the privacy of trading participants. They are typically operated and managed by regulatory agencies or their authorized third parties to ensure their independence and impartiality. Anonymized transaction summaries are data generated by extracting, hashing, or partially masking key information from the original financial transaction request. The summaries usually contain a unique identifier for the transaction, as well as anonymized transaction type, timestamps, and other non-sensitive or partially sensitive information, ensuring that regulators can identify and track specific transactions without exposing complete transaction details.

[0045] A compliance result hash refers to the value generated by hashing the compliance verification result output by a compliant smart contract in a permissioned blockchain financial network. When a compliant smart contract verifies a transaction request for identity, credit limit, or geofencing and concludes that it is compliant or non-compliant, its original text or structured data is input into a hash function to generate a hash value as a unique fingerprint of the compliance result. This hash value proves whether a transaction has passed the compliance verification, and the specific compliance verification details cannot be deduced from the hash value. Thus, while providing proof of compliance, it also protects the privacy of the smart contract's internal logic and specific verification parameters.

[0046] Risk labels are identifiers attached to transactions based on factors such as transaction characteristics, participants' historical behavior, transaction amount, transaction frequency, or specific business rules. These labels are applied after a risk assessment by a permissioned blockchain financial network or an external risk assessment system. These labels can be predefined categories such as high risk or low risk, or risk types such as anti-money laundering risk or fraud risk. Risk label generation can be based on machine learning models, rules, or manual review, providing regulatory observers with a risk overview of transactions. This helps regulators identify potentially unusual or suspicious transactions for further investigation without needing to examine the plaintext of the transactions.

[0047] Not obtaining the complete plaintext transaction means that when receiving and processing transaction information, regulatory observation nodes only receive the aforementioned anonymized transaction summary, compliance result hash, and risk label. This prevents regulatory observation nodes from directly accessing sensitive data such as the complete identity information of both parties to the transaction, the precise transaction amount, and specific descriptions of the goods or services traded. By forcibly isolating regulators' access to sensitive data through technical means, this fundamentally protects the privacy of transaction participants and avoids the risk of sensitive information leakage due to regulatory audits.

[0048] Supporting auditable privacy protection means that, through the aforementioned mechanisms, the auditing needs of regulatory agencies for financial transactions can still be met while ensuring the privacy of transaction participants is not compromised. Regulatory observation nodes can review the compliance, risk level, and basic characteristics of transactions by receiving anonymized transaction summaries, compliance result hashes, and risk labels. When suspicious transactions are detected, further investigation requests are initiated to the full financial node or relevant parties to obtain more detailed plaintext transaction data accessible only with specific authorization. This layered information disclosure mechanism ensures both the effectiveness of regulation and the protection of user privacy.

[0049] Specifically, please refer to Figure 4 This demonstrates the interaction between the compliance smart contract and the regulatory watchdog. When a financial transaction request enters the compliance smart contract, the contract sequentially performs checks such as KYC identity verification, AML risk assessment, credit limit verification, list verification, and geofencing. Based on the verification results, the transaction is directed to either proceed to candidate liquidation, undergo suspicious freeze review, or be directly rejected due to high risk. The compliance results are stored on the permissioned blockchain, and simultaneously, the contract synchronizes anonymized summaries and risk labels to the regulatory watchdog, allowing the watchdog to trace the audit data.

[0050] In one embodiment, the physical world perception data received by the asset state oracle module includes at least one of the following: remote sensing imagery, synthetic aperture radar data, IoT sensor data, and positioning data, and generates a signed asset state certificate in a trusted execution environment.

[0051] Specifically, remote sensing imagery refers to Earth surface image data acquired through platforms such as satellites and aircraft. It can be used to monitor macro-geographic information such as land use, crop growth, and natural disasters. By analyzing remote sensing imagery of specific areas, the yield of agricultural products or the reserves of natural resources can be assessed, serving as the underlying asset status basis for financial products (such as agricultural insurance and carbon trading). Synthetic Aperture Radar (SAR) data is an active microwave remote sensing technology capable of penetrating clouds and low outdoor visibility to acquire surface information around the clock. It has unique advantages in monitoring land deformation, water bodies, and infrastructure status. SAR data can be used to monitor minute deformations of infrastructure (such as bridges and pipelines), providing status proof for engineering insurance or asset collateral. Internet of Things (IoT) sensor data refers to data collected in real time by various IoT devices deployed in the physical world (such as temperature sensors, humidity sensors, pressure sensors, flow meters, and smart meters). This data can reflect the real-time status and operation of specific assets (such as stored goods, production equipment, and energy consumption). Temperature and humidity sensor data in smart warehousing can be used to prove that the storage conditions for a specific batch of goods meet requirements, thereby supporting supply chain finance. Location data refers to geographic location information obtained through the Global Positioning System (GPS), BeiDou Navigation Satellite System, or other positioning technologies. It can be used to track the location and trajectory of mobile assets (such as transport vehicles, ships, and containers) or to verify the location of specific events (such as cargo delivery or equipment installation). Location data for transport vehicles can be used to prove that goods have been transported along the agreed route and arrived at their destination. These specific data sources are characterized by high precision, real-time monitoring, or 24 / 7 monitoring, enabling them to provide financial clearing and settlement systems with richer, more accurate, and more reliable underlying asset status information.

[0052] Furthermore, the signed asset state proof is generated within a Trusted Execution Environment (TEE). A TEE is a hardware- or software-isolated secure zone that ensures that code and data running within it are not tampered with or stolen from the outside. After receiving physical world perception data, the asset state oracle module loads this data, along with the logic code used to generate the proof, into the TEE. Inside the TEE, pre-defined algorithms and rules are executed to process and analyze the perception data and generate the asset state proof. This asset state proof is then signed using the oracle module's private key within the TEE, generating a signed asset state proof. The TEE ensures the integrity and confidentiality of the data processing and signing process, preventing external attackers from tampering with the data or the signing process.

[0053] In one embodiment, the hierarchical clearing and settlement state machine is triggered sequentially, namely, after regional pre-confirmation, satellite anchoring is triggered, after satellite anchoring, final clearing is triggered, and after the final clearing is completed, the transaction status is marked as non-rollbackable.

[0054] Specifically, the on-board anchoring operation of the on-board light node module can only be initiated after the ground-based nodes have completed regional pre-confirmation, formed a candidate status, and frozen the quota. This ensures that only transactions that have undergone preliminary verification and resource reservation can enter the satellite's processing flow, thereby filtering out invalid or non-compliant transactions, reducing the processing burden on the on-board light node module, and improving the efficiency and resource utilization of the entire clearing and settlement process.

[0055] Furthermore, the prerequisite for a full-node financial transaction in a permissioned blockchain financial network to perform final settlement operations is that the on-board light node module has successfully completed on-board anchoring and anchored the candidate state digest to the on-board batch root. This ensures that final settlement is conducted based on transaction data that has been encrypted, signed, and anchored in a trusted satellite environment, and has a trusted on-board evidence chain, thereby enhancing the integrity and immutability of transaction data and providing a foundation for subsequent final settlement.

[0056] Furthermore, once the financial full node confirms the consistency between the original transaction text and the on-board summary package and generates the final settlement status, the transaction status is permanently fixed and cannot be revoked or modified in any form. This non-rollback marker is the core embodiment of the finality of financial transactions. It provides all participants with a certainty guarantee of the transaction result and effectively prevents risks such as double-spending and malicious rollback.

[0057] Thus, through a sequential triggering mechanism, a three-tiered progressive state machine is constructed: "Regional Pre-confirmation → Satellite Anchoring → Final Settlement." The regional pre-confirmation stage, through access verification and quota locking, prevents invalid transactions from impacting satellite resources at the source. The satellite anchoring stage leverages the hardware trust root of the satellite environment to generate unforgeable, reliable timestamps and link evidence for transaction data, compensating for evidence gaps in the transmission path of purely terrestrial networks. The final settlement stage, based on on-chain consensus, marks the transaction status as non-reversible, locking the result. This upgrades the traditional blockchain's "post-event verification" to a "pre-event filtering—in-event anchoring—post-event locking" chain, eliminating the possibility of double-spending and malicious rollback, enabling the satellite internet-based clearing and settlement system to meet financial-grade requirements in terms of finality and security.

[0058] In one embodiment, the system further includes a link failure cache recovery module. This module is a functional unit specifically designed to address the instability of satellite links. Its main function is to temporarily store and protect critical transaction data when a satellite link is interrupted, and to ensure that this data can be safely and completely resubmitted to subsequent processing stages after the link is restored. This module can be a standalone hardware unit or a software component deployed on a ground gateway module or terminal equipment.

[0059] Specifically, in the event of a satellite link interruption, the link failure cache recovery module is used to encrypt and cache the on-board digest packets. The on-board digest packets generated by the on-board light node module, serving as crucial evidence of transactions, are securely stored. To prevent data tampering or leakage during caching, the on-board digest packets are encrypted before storage. Encryption methods can employ symmetric or asymmetric encryption algorithms, such as AES or RSA, ensuring that even if the cached data is illegally accessed, its content cannot be easily deciphered. The cache location can be local storage on the ground gateway module or a secure storage area on the terminal device, depending on the system architecture and security requirements.

[0060] Furthermore, after the link is restored, the broken-link cache recovery module performs a consistency check based on the terminal identity, transaction sequence number, and transaction hash before resubmitting it to the permissioned blockchain financial network. Once the satellite link is restored, the broken-link cache recovery module will initiate the data recovery process. It will perform a consistency check on the cached on-board digest packet based on the terminal identity, transaction sequence number, and transaction hash. The terminal identity is used to identify the legitimate user initiating the transaction, the transaction sequence number is used to ensure the order and uniqueness of the transaction, and the transaction hash is used to verify the integrity and tamper-proof nature of the transaction content. The on-board digest packet that passes the consistency check will be decrypted and resubmitted to the permissioned blockchain financial network, thus completing the transaction process before the interruption.

[0061] Specifically, please refer to Figure 5 This illustrates the caching and recovery process when the satellite link is interrupted. When the link is interrupted, the onboard light node or the ground gateway station encrypts and caches the onboard digest packet. After the link is restored, the system performs a sequence consistency check based on the terminal identity, transaction sequence number, and transaction hash. If the check passes, the transaction is submitted to the permissioned chain and the ledger status is updated. If a duplicate or conflicting transaction is identified, it is frozen and submitted for manual review.

[0062] In one embodiment, the terminal is configured with a hardware security module for generating a transaction signature containing a transaction sequence number and a random challenge value. The signature covers the original transaction text, satellite link metadata, and the random challenge value.

[0063] Specifically, a hardware security module is a physically independent computing device with tamper-proof capabilities. Its core function is to securely store encryption keys and perform encryption operations. This hardware security module can be a standalone chip, an embedded security unit (such as a Trusted Execution Environment (TEE)), or a security element, designed to provide a highly secure execution environment that resists attacks from the software layer and tampering attempts from the physical layer, thereby ensuring the security of key generation, storage, and use.

[0064] Building upon this, the hardware security module uses its internally stored private key to digitally sign the transaction data. When generating the signature, in addition to the core content of the transaction, it also includes a transaction sequence number and a random challenge value. The transaction sequence number is a number used to uniquely identify each transaction, preventing duplicate submissions or replay attacks. The random challenge value is a random number generated by the terminal or system to increase the randomness and unpredictability of the signature, further enhancing its security and effectively resisting the risks of pre-computation attacks or signature forgery.

[0065] Simultaneously, the signature comprehensively covers the original transaction text, satellite link metadata, and random challenge values. The original transaction text refers to the specific content of the financial transaction, such as the transfer amount and recipient information. Satellite link metadata can include information such as satellite number, beam number, orbital time slot, access time, and link quality. By incorporating all this crucial information into the signature calculation, it ensures that the signature can simultaneously prove the integrity of the transaction content, the authenticity of the specific communication link state used at the time of the transaction, and the randomness of the signature. Internally, this data is first combined or hashed, and then the hash value is signed using a private key, thus forming an immutable digital certificate. This provides reliable original evidence for the subsequent on-board anchoring of the on-board light node module and the final clearing of the full financial node, enhancing the end-to-end security and credibility of the entire satellite internet-based financial clearing and settlement system.

[0066] The following are several examples for more detailed explanation.

[0067] Example 1: Cross-regional procurement and settlement in overseas industrial parks Company A in an overseas industrial park initiates a purchase payment request to supplier B via a satellite terminal. The terminal generates a TxPacket and accesses the system via a low-Earth orbit satellite. Onboard light nodes timestamp and sign the transaction summary, and ground-based gateways forward the data to the permissioned blockchain financial network. A compliant smart contract confirms that both Company A and supplier B are on the park's financial whitelist, the transaction purpose matches the contract number, and the credit limit is sufficient. An asset status oracle generates a cargo arrival certificate based on port remote sensing images, logistics trajectories, and electronic seal data. Regional nodes complete pre-confirmation and freeze the credit limit, onboard nodes anchor the summary packet, bank nodes and clearing nodes complete final clearing, and regulatory observation nodes obtain anonymized summaries and risk labels.

[0068] Example 2: Mining Equipment Leasing and Production Sharing Settlement The mining area is equipped with satellite IoT terminals, weighing equipment, drone inspection systems, and SAR change detection services. Equipment leasing contracts stipulate phased deductions based on actual output and equipment runtime. An asset status oracle integrates SAR change data, vehicle trajectory data, and weighing data to generate proof of mineral stockpile changes and transportation completion. Once the proof meets a threshold, the contract automatically generates a settlement candidate status, and the financial full-node completes final settlement and releases funds to the equipment lessor.

[0069] Example 3: Fast Claims Settlement for Agricultural Insurance Flooding occurred in agricultural production areas, disrupting terrestrial communications. Farmers, cooperatives, or insurance surveyors submitted claims via satellite terminals. The system used SAR inundation identification, multispectral crop growth data, and meteorological data to generate proof of the affected area. After a compliant smart contract verified the policy number, land boundaries, and insured entity, the insurance node confirmed the candidate compensation amount. Once the link was restored, the final clearing node issued a compensation receipt.

[0070] Example 4: Ocean Shipping Bill of Lading and Payment Release During ocean shipping, ships submit arrival status, AIS track, and electronic seal data via satellite link. An oracle verifies the ship's track, port remote sensing data, and cargo status to generate an arrival certificate. A smart contract releases letter of credit payments or margin deposits based on the arrival certificate, electronic bill of lading, and compliance verification results.

[0071] Example 5: Procurement and Disbursement of Disaster Emergency Supplies When public internet access is interrupted at the disaster site, government emergency response units, material suppliers, and financial institutions access the permissioned chain via satellite internet. Material arrival is verified by BeiDou positioning, warehouse photography, drone inspections, and receipt data. After fulfilling the conditions for procurement contracts, limits, and authorization approvals, the system confirms emergency payment candidates and generates a final settlement status once all financial nodes regain connectivity.

[0072] This application also provides a financial clearing and settlement method based on trusted access to satellite internet and permissioned blockchain, including: The satellite internet access layer receives financial transaction requests submitted by terminals via satellite links and collects satellite link metadata.

[0073] By deploying on-board light node modules on the satellite without maintaining a complete financial ledger, a digest of transaction requests is generated. Based on the satellite link metadata and trusted timestamps, an on-board digest package carrying an on-board signature is generated, and the digest of candidate transactions is anchored to the on-board batch root.

[0074] The financial transaction request and on-board digest packet are forwarded to the permissioned blockchain financial network via the ground gateway module.

[0075] The complete ledger is maintained by multiple financial full nodes in a permissioned blockchain financial network, and compliant smart contracts are deployed to verify at least one of the following for transaction requests: identity, amount, and geofencing, and output compliant results.

[0076] The asset state oracle module receives physical world perception data, generates a signed asset state certificate, and submits it to the permissioned blockchain financial network.

[0077] By executing the hierarchical clearing and settlement state machine, regional pre-confirmation is performed on ground area nodes to form candidate states and freeze quotas. On-board anchoring is performed on the satellite light node module to anchor the candidate state summary to the satellite batch root. Final clearing is performed on the financial full node to confirm that the transaction original is consistent with the satellite summary package and generate the final clearing state.

[0078] Specifically, by combining satellite link metadata as a transaction credibility factor with a hierarchical clearing and settlement state machine in a collaborative manner, and by introducing an on-board light node module and an asset state oracle module, the problems of insufficient continuity of financial transactions in weak terrestrial network environments, satellite links not serving as a financial credibility factor, blockchain consensus not being compatible with satellite networks, on-chain ledgers not being able to prove the true state of offline assets, difficulty in balancing compliance and privacy protection in cross-domain financial transactions, and duplicate transactions or state conflicts in scenarios of chain interruption are solved. This achieves the effect of reliable, compliant, and privacy-protected financial clearing and settlement under the conditions of highly dynamic topology and intermittent connection of satellite networks.

[0079] Specifically, the satellite internet access layer collects satellite link metadata while receiving transaction requests, making the communication link status an integral part of the transaction evidence chain and enhancing transaction non-repudiation capabilities. The on-board light node module, deployed on the satellite, does not maintain a complete financial ledger; it only performs digest generation, trusted timestamp signing, and anchoring operations, effectively adapting to satellite payload resource constraints and reducing deployment costs. After the ground gateway module completes data forwarding, full financial nodes in the permissioned blockchain financial network implement identity, limit, and geofence verification through compliant smart contracts to ensure transaction compliance. The asset state oracle module converts physically perceived data into verifiable on-chain signed asset state proofs, enabling financial smart contracts to be triggered based on the actual asset state. The layered clearing and settlement state machine, through the orderly connection of regional pre-confirmation, on-board anchoring, and final clearing, ensures both business response speed and clearing reliability even in scenarios with intermittent satellite link connections.

[0080] Thus, this method can still submit transaction requests via satellite links even when weak terrestrial networks are interrupted, significantly improving the continuity of financial services; the on-board lightweight node design avoids the deployment challenges of a complete ledger on satellites; the hierarchical clearing and settlement mechanism effectively addresses the challenges of high-dynamic topology on low-Earth orbit satellites; the asset state oracle module transforms remote sensing, IoT, and other data into verifiable proofs, enhancing the financial credibility of physical assets; at the same time, the permissioned blockchain financial network, combined with compliant smart contracts and privacy protection mechanisms, ensures commercial privacy while meeting financial regulatory requirements, comprehensively solving the bottleneck problems of financial services in special scenarios.

[0081] The following example will provide a more detailed explanation of the above technical solution: In a remote agricultural area, User A's farmland suffered a natural disaster, resulting in a disruption of the terrestrial communication network. User A needs to submit a claim for crop damage to the insurance company.

[0082] First, User A uses a terminal equipped with a hardware security module. This terminal generates a claim request containing a transaction sequence number and a random challenge value. The signature of this request covers the original transaction text, satellite link metadata, and the random challenge value, ensuring the integrity and non-repudiation of the transaction and effectively preventing risks such as transaction clipping, impersonation, and replay.

[0083] Subsequently, the terminal submitted the claim request to the satellite internet access layer via satellite link. Upon receiving this financial transaction request, the satellite internet access layer collected satellite link metadata in real time, including satellite ID, beam ID, orbital time slot, access time, and link quality. This metadata provided the foundation for the credibility of subsequent transactions.

[0084] The on-board light node module deployed on the satellite receives a claim request. Instead of maintaining a complete financial ledger, this module first generates a summary of the claim request. Next, based on the collected satellite link metadata and a trusted timestamp, the on-board light node module generates an on-board summary packet carrying an on-board signature. This process co-signs the communication link state with the transaction's original hash, making the satellite link metadata part of the transaction's evidence chain, thus solving the technical problem of traditional financial systems failing to incorporate satellite link state into the transaction's credibility factor. Simultaneously, the on-board light node module anchors the summary of this candidate transaction to the on-board batch root, providing on-board proof of the transaction's existence.

[0085] After receiving the financial transaction request and on-board summary packet relayed by the satellite, the ground gateway module forwards them to the permissioned blockchain financial network.

[0086] In a permissioned blockchain financial network, a tiered clearing and settlement state machine begins execution. First, local nodes perform regional pre-confirmation of claims requests. For example, they quickly assess the initial validity of claims requests based on preset rules, creating candidate states and freezing the corresponding payout amount. This step allows for preliminary processing even when the local network is interrupted, improving the continuity of financial transactions.

[0087] Once regional pre-confirmation is complete, on-board anchoring is triggered. The on-board light node module anchors the summary of the candidate state to the on-board batch root. This anchoring operation is completed on the satellite side, providing an immutable on-board proof of existence for transactions, avoiding the high cost and stability issues associated with running a full blockchain ledger in a low-Earth orbit, high-dynamic satellite network.

[0088] Meanwhile, the asset status oracle module begins operation. It receives physically-sense data, such as multispectral remote sensing imagery, synthetic aperture radar data, and meteorological data for user A's farmland area. This data is processed in a trusted execution environment to generate signed asset status proofs, such as proof of the affected area and extent of crop damage. This proof is then submitted to a permissioned blockchain financial network, resolving the issue that on-chain ledgers cannot directly verify the true status of offline assets.

[0089] The permissioned blockchain financial network maintains a complete ledger through multiple full financial nodes and deploys compliant smart contracts. These contracts perform identity verification (verifying user A's identity), limit verification (checking the policy's payout cap), and geofencing verification on claims requests (confirming that the affected farmland is within the policy's coverage area), and output compliance results.

[0090] Finally, the final settlement is performed by a financial full node. The financial full node confirms the consistency of the original transaction, the on-board summary package, the compliance results, and the asset status proof. For example, it confirms that user A's claim request matches the transaction recorded in the on-board summary package, that the compliance smart contract has passed verification, and that the asset status oracle has provided valid disaster proof. Once consistency is confirmed, a final settlement state is generated, and the transaction status is marked as non-reversible. This tiered clearing and settlement mechanism, through regional pre-confirmation, on-board anchoring, and ground-based final settlement, effectively adapts to potential latency and outage scenarios in satellite networks, improving the efficiency and reliability of clearing and settlement.

[0091] The permissioned blockchain financial network also includes a regulatory watch node. This node receives anonymized transaction summaries, compliance result hashes, and risk labels, without accessing the complete plaintext of the transactions. This supports auditable privacy protection, meeting regulatory auditing requirements while protecting business privacy.

[0092] If the satellite link or terrestrial network is interrupted again during the above process, the link failure cache recovery module will intervene and encrypt and cache the on-board digest packet. When the link is restored, the system performs consistency verification based on the terminal identity, transaction sequence number, and transaction hash to ensure that the transaction has not been processed repeatedly or tampered with, and then submits it to the permissioned blockchain financial network, thus solving the problem of duplicate transactions or state conflicts that are prone to occur in the event of a link failure.

[0093] Through the above process, even in disaster scenarios where the terrestrial network is interrupted, User A's claim request can be trusted to access via satellite internet. After being reliably anchored by the light nodes on the satellite, combined with the physical world asset status proof and the compliance verification and hierarchical clearing and settlement of the permissioned blockchain financial network, a reliable, auditable and privacy-protected financial clearing and settlement is finally completed, which significantly improves the continuity of financial business in weak terrestrial network environments.

[0094] In summary, compared with existing technologies, it has the following beneficial effects: 1. Enhance the continuity of financial services in cross-domain and weak terrestrial network environments. Even if the public terrestrial network is interrupted, candidate transactions and anchor summaries can still be submitted via satellite link.

[0095] 2. Enhance transaction credibility. Satellite number, beam number, orbit time slot, link quality, and reliable timestamps become part of the transaction evidence chain.

[0096] 3. Reduce on-board deployment costs. On-board light nodes do not store the complete financial ledger; they only perform summary anchoring, caching, and broadcasting, adapting to satellite payload resource constraints.

[0097] 4. Improve consensus efficiency. The division of labor between regional pre-confirmation, satellite anchoring, and ground final settlement is clear, balancing business response speed and final settlement reliability.

[0098] 5. Enhance the financial credibility of physical assets. Remote sensing, SAR, IoT, BeiDou / AIS, and drone data form asset status certificates, reducing false warehouse receipts, double pledging, and performance disputes.

[0099] 6. Balancing compliance and privacy. Permissioned blockchains, compliant smart contracts, regulatory watchdog nodes, and privacy-preserving computation work together to achieve auditability, regulatory oversight, and protection of business privacy.

[0100] 7. Enhance financial service capabilities for special scenarios such as disasters, oceans, border areas, mining areas, and overseas industrial parks.

[0101] An electronic device provided in this application includes a memory and a processor; the memory is used to store a computer program; the processor is used to implement the above-mentioned cross-domain financial clearing and settlement method based on trusted access to satellite internet and permissioned blockchain when executing the computer program.

[0102] This application provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the above-mentioned cross-domain financial clearing and settlement method based on trusted access to satellite internet and permissioned blockchain.

[0103] In this embodiment, the beneficial effects of the electronic device and the computer-readable storage medium are similar to those of the cross-domain financial clearing and settlement method based on trusted access to satellite internet and permissioned blockchain described above, and will not be repeated here.

[0104] The present invention describes electronic devices that can serve as servers or clients of this application, which are examples of hardware devices applicable to various aspects of this application. Electronic devices are intended to represent various forms of digital electronic computer devices. Electronic devices can also represent various forms of mobile devices and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or claimed herein.

[0105] Electronic devices include a computing unit that can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) or loaded from a storage unit into random access memory (RAM). The RAM can also store various programs and data required for device operation. The computing unit, ROM, and RAM are interconnected via a bus. Input / output (I / O) interfaces are also connected to the bus.

[0106] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. The storage medium can be a read-only memory (ROM) or random access memory (RAM), etc. In this application, the separately described modules may or may not be physically separate. Some or all of the modules can be selected to achieve the purpose of the embodiments of this application according to actual needs. Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0107] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A cross-domain financial clearing and settlement system based on trusted access to satellite internet and permissioned blockchain, characterized in that, include: The satellite internet access layer is used to receive financial transaction requests submitted by terminals via satellite links and to collect satellite link metadata. The on-board light node module, deployed on the satellite and not maintaining a complete financial ledger, is used to generate a summary of transaction requests, generate an on-board summary package carrying an on-board signature based on the satellite link metadata and trusted timestamps, and anchor the summary of candidate transactions to the on-board batch root. The ground gateway module is used to forward the financial transaction request and on-board digest packet to the permissioned blockchain financial network; The permissioned blockchain financial network maintains a complete ledger through multiple financial full nodes and deploys compliant smart contracts to verify transaction requests for at least one of identity, amount, and geofencing and output compliant results. The asset status oracle module is used to receive physical world perception data, generate signed asset status proofs, and submit them to the permissioned blockchain financial network. Specifically, by executing a hierarchical clearing and settlement state machine, the ground area node performs regional pre-confirmation to form candidate states and freeze quotas, the on-board light node module performs on-board anchoring to anchor the candidate state summary to the on-board batch root, and the financial full node performs final clearing to confirm that the original transaction text is consistent with the on-board summary package and generate the final clearing state.

2. The system according to claim 1, characterized in that, The satellite link metadata includes at least one of satellite number, beam number, orbit time slot, access time, and link quality; the on-board light node module signs the satellite link metadata together with the transaction original hash so that the communication link status is bound to the transaction evidence chain.

3. The system according to claim 1, characterized in that, The permissioned blockchain financial network also includes regulatory watch nodes that receive anonymized transaction summaries, compliance result hashes, and risk labels without obtaining the full plaintext of the transactions, in order to support auditable privacy protection.

4. The system according to claim 1, characterized in that, The asset state oracle module receives physical world perception data including at least one of remote sensing imagery, synthetic aperture radar data, IoT sensor data, and positioning data, and generates the signed asset state certificate in a trusted execution environment.

5. The system according to claim 1, characterized in that, The hierarchical clearing and settlement state machine is triggered in sequence: after regional pre-confirmation, satellite anchoring is triggered; after satellite anchoring, final clearing is triggered; after final clearing is completed, the transaction status is marked as non-rollbackable.

6. The system according to claim 1, characterized in that, It also includes a link break cache recovery module, which is used to encrypt and cache the on-board digest packet when the satellite link is interrupted; after the link is restored, it is resubmitted to the permissioned blockchain financial network after consistency verification based on the terminal identity, transaction sequence number and transaction hash.

7. The system according to claim 1, characterized in that, The terminal is equipped with a hardware security module for generating a transaction signature containing a transaction sequence number and a random challenge value. The signature covers the original transaction text, satellite link metadata, and the random challenge value.

8. A cross-domain financial clearing and settlement method based on trusted access to satellite internet and permissioned blockchain, characterized in that, include: The satellite internet access layer receives financial transaction requests submitted by terminals via satellite links and collects satellite link metadata. By deploying on-board light node modules on the satellite without maintaining a complete financial ledger, a digest of transaction requests is generated, and an on-board digest package carrying an on-board signature is generated based on the satellite link metadata and a trusted timestamp, and the digest of candidate transactions is anchored to the on-board batch root. The financial transaction request and on-board digest packet are forwarded to the permissioned blockchain financial network via the ground gateway module; The complete ledger is maintained by multiple financial full nodes in a permissioned blockchain financial network, and compliant smart contracts are deployed to verify at least one of the following for transaction requests: identity, amount, and geofencing, and output compliant results. The asset state oracle module receives physical world perception data, generates a signed asset state certificate, and submits it to the permissioned blockchain financial network. By executing the hierarchical clearing and settlement state machine, regional pre-confirmation is performed on ground area nodes to form candidate states and freeze quotas. On-board anchoring is performed on the on-board light node module to anchor the candidate state summary to the on-board batch root. The financial full node performs final clearing to confirm that the transaction original is consistent with the on-board summary package and generate the final clearing state.

9. An electronic device, characterized in that, It includes a processor and a memory; the memory stores program instructions; the processor is used to run the program instructions to execute the cross-domain financial clearing and settlement method based on trusted access to satellite internet and permissioned blockchain as described in claim 8.

10. A computer-readable storage medium, characterized in that, It stores a computer program that causes the computer to execute the cross-domain financial clearing and settlement method based on trusted access to satellite internet and permissioned blockchain as described in claim 8.

Images