206 results about "Man-in-the-middle attack" patented technology

The invention relates to the technical field of data access security, and discloses a container mirror image security management method and system, and the method comprises the steps: constructing a container mirror image, generating a differential encryption key through a strategy center, carrying out the encryption strategy of a kernel dependence layer, a runtime environment layer, an application code layer and a sensitive configuration layer, and forming a hierarchical protection basis. If an access request is triggered, firstly collecting equipment fingerprints and geofence information and evaluating an environmental risk score, verifying access authority and an access scene matching degree through attribute-based encryption, analyzing operation track characteristics in real time, identifying an abnormal mode, and if the three-layer verification is passed, generating a temporary access token; according to the method, access request authority is verified, a temporary access token is matched, key fragments are synthesized, a master key is only temporarily generated in a memory and encrypted and stored, and through combination of a double-layer encryption channel and inner-layer and outer-layer defense, the anti-attack ability of container mirror image transmission is improved, and man-in-the-middle attack and data tampering are effectively coped with.

The invention discloses a bidirectional authentication secure mobile communication method and system based on a public key digital fingerprint, and belongs to the technical field of communication security. The method specifically comprises the following steps: S1, digital certificate application and issuing: a mobile terminal and a service server respectively use an encryption algorithm to generate an asymmetric key pair which comprises a public key and a private key, an entity submits a CSR file which comprises a public key, entity identity information and an extension field to a CA, and the CA strictly audits the entity identity and issues a digital certificate; and performing digital signature on the public key and the entity information by using a CA private key after the auditing is passed. Two-way identity authentication is achieved, communication safety is improved, a traditional scheme only supports one-way authentication of a client to a server and is prone to phishing attack and identity false use, digital certificates are exchanged before communication between a mobile terminal and a service server, the legality of the certificates is verified through a public key of a CA root certificate, and the authenticity of the identities of the two parties is ensured. A bidirectional authentication mechanism effectively prevents man-in-the-middle attack and identity counterfeiting problems, and the security risk is greatly reduced.

The invention relates to the technical field of commercial password detection methods, and discloses a high-security method for negotiating a temporary session key based on a national secret algorithm, and the commercial password detection method comprises the following steps: initialization and identity authentication: two communication parties generate an SM2 public and private key pair, and the identity is verified through a digital certificate and an SM2 signature; temporary key negotiation: generating a shared key point based on an SM2 key exchange protocol; session key derivation: generating a temporary session key by using an SM3 hash algorithm; key confirmation and encrypted communication: verifying the key through an SM4 algorithm and encrypting communication data; according to the high-security method for negotiating the temporary session key based on the national secret algorithm, efficient key negotiation of both communication parties in an unsecure channel is realized through an SM2 key exchange protocol, an SM3 hash algorithm and an SM4 symmetric encryption algorithm. The method combines digital certificate authentication, dynamic random numbers and timestamps, has forward security, replay attack resistance and man-in-the-middle attack resistance, and is suitable for high-security scenes such as finance and government affairs.

Systems and methods for performing ZTNA secure traffic forwarding are provided. In one example, as part of setting up a TFAP tunnel, between a target service and an endpoint security agent of an endpoint device through which an application running on the endpoint device can interact with the target service, a secure connection is established between the endpoint security agent and a ZTNA AP. Based on an encryption status of traffic transmitted from the application to the target service: (i) protection against eavesdropping by an MITM attacker is provided by using the secure connection to encrypt one or more critical messages of the traffic between the endpoint security agent and the ZTNA AP; and (ii) the endpoint security agent abstains from switching to bypassing mode through the TFAP tunnel until after the one or more critical messages of the traffic have been exchanged.

The invention discloses a network information security defense detection method and system, and relates to the technical field of network information security, and the system comprises a website security check module, a downloading security check module, an access security check module and a display execution module. In daily Internet surfing, net friends often encounter network security problems, for example, users may receive phishing mails disguised as banks or download malicious software in untrusted websites, resulting in data stealing. Identity embezzlement and data leakage increase privacy and financial risks, and man-in-the-middle attack may intercept sensitive information through an unencrypted Wi-Fi network. According to the method, security detection including domain name check, certificate verification, content scanning, integrity verification and the like is carried out on websites, downloading programs and external access equipment, so that security risks are found and processed in time; and meanwhile, by adopting a virtual machine isolation technology and behavior monitoring, the protection on malicious programs is enhanced, the security risk of external equipment is evaluated, and the security of a network environment and data is ensured.

The invention provides a secure communication method and system based on a QRNG and a Beidou positioning terminal. A sending end and a receiving end of communication preset a pre-shared initial key, and a space-time reference parameter group is obtained through Beidou positioning; a secret key packaging secret key is generated by using a national secret SM4 algorithm; monitoring time-space parameter deviation in a communication process in real time, and triggering a key updating protocol when the time-space parameter deviation exceeds a threshold value; and after the receiving end verifies the Hash verification value, decrypting to obtain the primary encryption key, and restoring the plaintext data. According to the system, the generated true random number sequence is used as an encryption key, so that the unpredictability and randomness of the key are fundamentally enhanced, and quantum computing attack and man-in-the-middle attack are effectively resisted. The use of the pre-shared key mechanism and the key packaging key improves the response speed and efficiency of the communication system. And meanwhile, the position parameter and the timestamp are deeply fused to the key generation process, so that the spatio-temporal information is more difficult to counterfeit, and the defense capability of the system is further improved.

The invention discloses a data security transmission method based on an ML-KEM algorithm and a PUF, and the method comprises the steps: in a registration stage, mobile equipment generates an anti-quantum key through employing a PUF technology, and a CA issues an anti-quantum digital certificate based on a Falcon algorithm and a cryptographic accumulator; in an identity authentication stage, a mobile device and an edge gateway complete bidirectional identity authentication by exchanging identity labels, anti-quantum certificates and authentication key parameters in combination with a Falcon algorithm and PUF challenge-response, and negotiate to generate a shared key by using an ML-KEM algorithm, thereby effectively defending threats such as man-in-the-middle attack, replay attack and identity counterfeiting; in a data transmission stage, two communication parties realize data encryption transmission by adopting a symmetric encryption algorithm, and data integrity and source credibility are guaranteed in combination with a Falcon digital signature; the whole scheme has the advantages of quantum security resistance, efficient authentication, dynamic key updating, lightweight encryption and the like.

The invention discloses an Internet of Things secure access method based on cloud edge collaboration, which comprises the following steps: firstly, an Internet of Things device and an edge server respectively register in a CSC (Content Service Controller), and obtain an intelligent card or related data to complete information updating and storage; the equipment is inserted into an intelligent card to log in, and data are sent to the edge server after identity password verification; the edge server verifies the timestamp and then forwards the data to the CSC; the CSC verifies the timestamp and the identity, generates a session key parameter and sends the session key parameter to the edge server; the edge server verifies the identity of the CSC and then generates session key encrypted data to be transmitted back, and after the verification of the device is passed, secure communication is established. According to the method, mutual verification and encryption protection are adopted in identity verification; a timestamp, a random value and strict verification are used for message transmission to prevent replay and man-in-the-middle attack; secret key management guarantees safety through dynamic change of secret values, attacks such as physical capture are resisted in combination with PUF, and communication safety is comprehensively guaranteed.

The invention discloses a computer data remote security management system based on block chain encryption, relates to the technical field of data security, and solves the problems that an existing verification mechanism is difficult to resist man-in-the-middle attack, and an attacker can bypass detection by tampering data and forging a verification code. According to the invention, through feature matching and dynamic interval feature calculation of the block chain storage node, dual binding of the transmission channel and the storage node is realized; in combination with randomization processing of virtual data positions, check codes have high uniqueness and reverse cracking resistance, man-in-the-middle attack and data forgery risks are effectively resisted, and a dual check code comparison mechanism before and after data transmission is realized; the verification code is generated before transmission, the identification code is generated after transmission, whether the data is tampered or lost can be accurately detected through consistency verification of the verification code and the identification code, and the integrity of the data in the remote transmission process is ensured.

The invention relates to the technical field of communication transmission, and particularly discloses an all-in-one machine encryption communication transmission method and system based on a dynamic strategy, and the method comprises the steps: collecting hardware state parameters, network environment parameters and communication content characteristics of an all-in-one machine and a target communication opposite end in real time; calculating a risk index of the current communication process based on the network environment parameters of the all-in-one machine and the target communication opposite terminal; matching an encryption algorithm sequence, a key updating frequency and a transmission protocol according to hardware state parameters, risk indexes and communication content characteristics of the all-in-one machine and a target communication opposite end, performing segmented encryption and multi-channel parallel transmission on communication data of the all-in-one machine, and performing security key distribution in combination with a distributed key management mechanism to obtain a security key; performing encrypted communication security verification based on the security key to obtain communication verification data; the security of the communication process of the all-in-one machine is improved, and the risks of data leakage and man-in-the-middle attack are prevented.

The invention discloses a financial data security regulation and control management method and system, and relates to the technical field of commercial financial management, and the method comprises the following steps: 1, data encryption regulation and control: employing an encryption protocol to carry out encryption transmission, and carrying out encryption storage; step 2, access permission regulation and control: distributing corresponding access permissions; step 3, backup and recovery regulation and control: making a backup, and performing a data recovery test; 4, authenticating the identity of the regulator, wherein a multi-factor identity authentication and digital certificate authentication mode is adopted; 5, approval optimization regulation and control: refining the approval authority, and introducing an approval risk assessment mechanism and an abnormity early warning mechanism; and step 6, monitoring and auditing regulation and control: monitoring access and operation of data, and regularly performing internal and external auditing. According to the method, transmission encryption and storage encryption are utilized, man-in-the-middle attack is effectively prevented, permissions are allocated according to responsibilities, unauthorized operation is avoided, the internal abuse risk is reduced, and the security of financial data regulation and control management is improved.

The invention discloses a man-in-the-middle attack detection method and device, and the method comprises the steps: obtaining equipment information in a communication network, and the equipment information comprises hardware information, software information and network environment information; calculating a safety coefficient of the communication equipment according to the equipment information; calculating a data transmission deviation degree according to the bandwidth, the network delay and the packet loss rate; calculating feature vector similarity according to the feature information of the current communication data; calculating a risk assessment value according to the communication equipment safety coefficient, the data transmission deviation degree and the feature vector similarity; and performing man-in-the-middle attack detection according to the risk assessment value to obtain a detection result. According to the method, man-in-the-middle attack detection is realized, and the accuracy and adaptability are improved. The method can be widely applied to the technical field of safety communication.

The invention discloses a lightweight differential privacy federal learning method for cross-domain management and control of power data. The method comprises the following steps: S1, performing initialization setting; s2, performing local training and parameter processing on the client; s3, uploading and aggregating parameters; s4, privacy loss evaluation and parameter adjustment; s5, pruning and compressing the model; s6, privacy protection and full mask multiplexing based on secret sharing; and S7, preventing collusion attacks. According to the method, the calculation complexity is remarkably reduced, and the core contradiction that privacy protection and model practicability are difficult to consider in cross-domain cooperation of power data is solved; the problems of high communication overhead and insufficient computing power of edge equipment during massive power data processing of traditional federated learning are solved, and the real-time performance and expandability of cross-domain cooperation are remarkably improved; while data availability is guaranteed, complex threats such as multi-client collusion and man-in-the-middle attack are effectively handled, and a privacy protection framework with a higher security level is provided for multi-agent cooperation of a power system.

The invention relates to the technical field of data security communication, in particular to an electric energy metering data security communication method based on a coding and decoding technology. According to the technical scheme, the method comprises the following steps that electric energy metering data are collected, wherein the data comprise voltage, current, power and timestamps; a unique key is generated through a dynamic key generation mechanism, the key is based on a timestamp, an equipment unique identifier and a hash value of a data abstract, features are extracted through a Transform encoder, and then the randomness is enhanced in combination with a pseudo-random number generator; and inputting the electric energy metering data and the dynamic key into an encryption encoder model. Through dynamic key generation, a Transform codec model and an adversarial training mechanism, high-security encryption and efficient decryption of electric energy metering data are realized, data tampering, eavesdropping and man-in-the-middle attack are effectively resisted, large-scale distributed application is supported, and stable operation of a power system and privacy protection of user data are ensured.

The invention discloses a self-adaptive authentication method for a space-air-ground cooperative NOMA communication system, which introduces a self-adaptive access authentication mechanism based on an NTRU encryption algorithm, designs a dual-security mechanism for trusted and untrusted NOMA relays, ensures data security through authentication and key exchange in a trusted mode, and improves the security of the communication system. And in an untrusted mode, data tampering and stealing are prevented through a temporary session key and a message authentication code, and flexible application guarantee is provided. Meanwhile, in combination with a certification authority (CA) and a digital certificate technology, it is ensured that the public key is not tampered in the transmission process, man-in-the-middle attack is avoided, and the reliability of communication node identity authentication is further improved.

Embodiments described herein provide for automatically authenticating operation requests and end-users who submit operation requests during contact events. A server obtains an operation request for an operation originated at an end-user device. The server generates a voice-based one-time password (OTP) using contextual information associated with the requested operation. The server generates and transmits an OTP prompt having text representing the OTP for display at a user interface of the user device. The server receives a response including an audio signal that contains the recording of the user speaking the OTP text aloud. The server uses the audio signal to authenticate the user and the operation request based on the speaker's voice, the accuracy of the user speaking the OTP, and liveness or fraud detection features extracted from the audio signal or metadata from the user device.

The invention relates to the technical field of charging facility network security, in particular to a charging pile and a charging pile control method. According to the charging pile, digital certificate dual verification and encryption communication are carried out between the cloud server and the gateway board, the risk of user information leakage caused by man-in-the-middle attack, data eavesdropping and the like is reduced, and the user experience is improved by carrying out second encryption verification on the gateway board and the control board. The risk that the data of the charging pile are tampered due to counterfeiting of the digital certificate is reduced, and compared with identity verification achieved only based on a cloud server in the prior art, the technical effect of improving the network security of the charging pile is achieved.

The invention discloses a data security transmission method and system based on homomorphic encryption and quantum key distribution, and relates to the technical field of data security transmission, the method comprises the following steps: carrying out homomorphic encryption processing on plaintext data at a sending end according to a predetermined encryption strategy to obtain ciphertext data; activating the quantum channel, extracting a key distribution strategy embedded in the quantum channel, distributing the quantum key according to the key distribution strategy, and transmitting the quantum key to a receiving end; and acquiring the ciphertext data sent by the sending end through a classic channel at a receiving end, and decrypting the ciphertext data by using a quantum key to obtain decrypted data. The technical problems that in the prior art, secret key transmission is low in safety, data encryption calculation is limited, transmission is prone to being attacked and eavesdropped by a man-in-the-middle, and data integrity and authenticity are difficult to guarantee are solved, and safe encryption transmission, reliable secret key distribution and accurate decryption of data in the transmission process are achieved. And the technical effects of data security and transmission integrity are ensured.

The invention discloses an energy transaction protection method and system based on block chain online transaction, and particularly relates to the technical field of data management. Energy data are collected regularly, an energy data sequence is formed, a credibility evaluation model is adopted, a transaction data link stability index and an energy consumption deviation value are integrated, low-credibility data are identified and abnormal marking is carried out, and abnormal data points are compared with adjacent energy transaction equipment data, so that the energy transaction efficiency is improved. According to the method and the system, whether the abnormity is caused by malicious tampering or not is judged, for the data which are confirmed to be tampered, if the credibility of all the data meets a set threshold value, transaction data are stored in an uplink mode, and settlement is automatically executed by an intelligent contract. The method and the system can effectively prevent man-in-the-middle attack, side channel attack and data forgery; the authenticity and credibility of the energy transaction data are improved, and the fairness and long-term stability of the block chain energy market are ensured.

Disclosed is a system and method for pre-emptive detection, attribution, and reversal of outbound data leaks and impersonation-based attacks occurring beyond traditional enterprise endpoint security boundaries. An outbound instrumentation gateway may insert telemetry identifiers into outbound electronic communications, enabling persistent tracking of message interactions within external or third-party domains. A RAPTORAI analytics engine may process metadata collected from these interactions using a multi-stage artificial-intelligence pipeline that combines predictive anomaly modeling and large-language-model (LLM) attribution. When anomalous or malicious behavior is detected, a Double DLP remediation engine may be activated, which is capable of pausing, auto-locking, or revoking message access after transmission but before compromise. A PRE-Crime telemetry layer provides visibility into early-stage reconnaissance activities by threat actors operating beyond the endpoint, thereby reducing mean time to detect (MTTD) and mean time to respond (MTTR) to effectively zero. Administrative dashboards present live analytics of third-party risks, reconnaissance indicators, and auto-remediation events.

The invention discloses a multi-level encryption authentication and data integrity protection method in a vehicle cloud communication environment, and aims to guarantee communication security between an electric vehicle and a cloud platform. According to the method, a unique digital certificate is allocated to each electric vehicle, and identity verification of a vehicle end and a cloud platform is realized in combination with a two-way TLS handshake protocol. In the data transmission process, the transmission content is encrypted by adopting a symmetric encryption algorithm, so that the confidentiality of the data is ensured. Meanwhile, the integrity of information in the data transmission process is ensured by using a digital signature technology, and tampering is prevented. And if the data verification fails, an early warning mechanism is triggered, and abnormal information is fed back to a related supervision platform through the V2X communication system, so that instant response and fault positioning are realized. According to the method, potential safety hazards such as man-in-the-middle attack and data leakage in the communication process can be effectively prevented, and the safety and data integrity of an Internet of Vehicles system are improved. The method is widely applied to scenes such as intelligent transportation, motorcade management and electric vehicle remote monitoring.

The invention discloses an intelligent door lock safety management and control system based on the Internet of Things, and relates to the technical field of door lock management and control. A sliding window is adopted to process data, and improved adaptive median filtering is used for noise reduction; environment parameter dynamic features are extracted, and a three-dimensional environment feature vector is constructed; handle pressure distribution is collected, the angle change rate and complexity are calculated, and behavior feature vectors are constructed; generating a 128-bit dynamic key in combination with environment and behavior characteristics; and mixing the dynamic key and the master key, encrypting and transmitting to the cloud for password authentication and instruction updating. Multi-dimensional environment parameters are collected in real time, space-time association fusion is carried out on the multi-dimensional environment parameters and user operation behaviors, a dynamic secret key is generated, it is ensured that each authentication process is bound with the current environment and user operation characteristics, the secret key cannot be predicted or copied through historical data, and the defense capacity for man-in-the-middle attacks and data stealing is improved.

The invention discloses a cross-domain authentication key negotiation method based on an industrial internet of things, which is combined with the Chinese remainder theorem to realize reliable communication between cross-domain equipment of the industrial internet of things. Different from a traditional method which depends on a central authentication mechanism to distribute keys, the group key agreement is carried out among the edge nodes in each domain by utilizing the Chinese remainder theorem, so that the single-point fault risk caused by a centralized key distribution mode is avoided. Meanwhile, in order to reduce the resource consumption of certificate management, the ECQV implicit certificate technology is introduced, and the execution efficiency of the key negotiation process is further improved. Besides, an effective protection mechanism is provided for security threats faced by the industrial Internet of Things, and various security threats such as smart card theft attacks, device administrator camouflage attacks, replay attacks and man-in-the-middle attacks can be resisted. According to the method, the execution efficiency of cross-domain authentication of the industrial Internet of Things is remarkably improved, and the confidentiality, integrity and authentication of message transmission in cross-domain communication are enhanced, so that the security of data transmission in the industrial Internet of Things and the overall efficiency of the system are effectively improved.

The invention discloses a certificateless strong anonymous aggregation signcryption method in the Internet of Vehicles, and belongs to the technical field of information security. Based on a certificateless cryptosystem, the problems of certificate management and key escrow are effectively solved; a vehicle pseudonym autonomous dynamic updating mechanism based on pseudonym root parameters is designed, dependence of pseudonym updating on time is eliminated, a vehicle sends a registration application and a pseudonym activation application to different trusted mechanisms, the problem that the trusted mechanisms directly and independently restore the real identity of a vehicle user is solved, strong anonymity of the vehicle is guaranteed, and the reliability of the vehicle is improved. The public and private keys of the vehicle can be updated along with the update of the pseudonym, so that the forward security of the method is ensured; according to the aggregation signcryption method disclosed by the invention, a sender is allowed to perform encryption and signature operations on the message at the same time, and a verifier can verify a plurality of signatures at the same time, so that the calculation overhead in the signature generation and verification process is reduced while the message confidentiality is ensured; the method can effectively resist various attacks such as adaptive selection message attacks, adaptive selection ciphertext attacks, replay attacks and man-in-the-middle attacks, is low in calculation cost and low in communication overhead, and has a wide application prospect in the field of the Internet of Vehicles in which a large number of message signatures exist at the same time and message privacy needs to be protected.

The invention discloses a network security identity verification system based on a cryptographic technology and an implementation method thereof, which are implemented by constructing an elliptic curve group which continuously changes in a time dimension and combining equipment-level physical unclonable characteristics to realize the following steps: (1) automatically updating password parameters in each authentication period and eliminating the security risk of a fixed parameter system; (2) deep fusion of hardware-level key protection and software cryptography; and (3) the safe anti-quantum calculation characteristic can be proved. Tests show that compared with an AES-256 + ECDSA scheme, the system has the advantage that the security is improved by 5 orders of magnitude in the aspects of resisting man-in-the-middle attack, replay attack and the like.

The invention discloses a computer network equipment remote control system for the Internet of Things, and relates to the technical field of the Internet of Things, and the remote control system comprises an equipment end security agent module which is deployed on controlled network equipment and is used for collecting equipment operation state data and environment data and executing an instruction from a cloud control platform, and the cloud control platform is connected with the equipment end security agent module. And the equipment end security agent module is in communication connection with the equipment end security agent module through a network, and is used for receiving, storing and processing the equipment operation state data and the environment data. A high-reliability communication basis conforming to a network security protocol is constructed, the risk of illegal equipment access and man-in-the-middle attack is fundamentally eradicated, the integrity, confidentiality and authenticity of control instructions and state data in the transmission process are ensured, and the security level of the whole Internet of Things equipment control network is remarkably improved.

The invention discloses an industrial gateway data encryption transmission method based on a national cryptographic algorithm, which relates to the technical field of information security, and comprises the following steps: S001, an industrial gateway and a server respectively generate collaborative challenge seeds based on a physical random number source, and confirm consistency after exchange and synchronous comparison, so as to ensure that a session initial entropy source is synchronous and cannot be counterfeited; according to the method, through multiple mechanisms such as collaborative challenge seed, time consistency monitoring, intermediate parameter bidirectional comparison, symmetric cross validation, full-process mapping identification and link hash fingerprint, real-time identification and blocking can be ensured when each link of key negotiation encounters delay disturbance or man-in-the-middle attack, and session key inconsistency and pseudo-encryption link are prevented. Through data packet level mapping identification and Hash fingerprint bidirectional evidence storage, traceability and non-repudiation of a communication path are realized, and link security and anti-attack capability of industrial control and key infrastructure are guaranteed.

The embodiment of the invention relates to a security authentication method and device for eSIM network access, electronic equipment and a storage medium, and the method comprises the steps: obtaining first eSIM identification information, first equipment identification information and first user identification information in response to a received network access request; determining a verification hash value based on the first eSIM identification information, the first device identification information and the first user identification information; the verification hash value is sent to the cloud server and the equipment security chip for verification, the cloud server activates the network under the condition that the verification hash value passes verification, and the equipment security chip accesses the network under the condition that the verification hash value passes verification. According to the scheme, data of multiple dimensions of eSIM identification information, equipment identification information and user identification information are fused through Hash, deep association of different data is achieved, an irreversible multi-dimensional binding certificate is formed, multiple pieces of data need to be stolen at the same time for cracking, clone attacks can be effectively prevented, and the purpose of resisting man-in-the-middle attacks is achieved.

The invention relates to the technical field of quantum security computing communication, and discloses a cluster state-based third-party quantum summation method with a bidirectional identity authentication mechanism, which comprises the following steps of: firstly, realizing bidirectional identity authentication between a participant and a third party in a quantum channel by pre-sharing secret identity information and a hash function in combination with a decoy photon technology; and impersonation and man-in-the-middle attack are fundamentally eradicated. And after the authentication is passed, the participant randomly executes measurement or reflection operation on the particle to which the participant belongs, so that an encrypted private key can be generated under the assistance of a third party, and external eavesdropping and internal participant attack can be jointly detected according to an operation combination to form multi-level security protection. Finally, the third party can only calculate the bitwise modular binary sum of the private bit string of each party, and cannot obtain any single input value. According to the method, authentication and calculation are organically fused, unconditional security is guaranteed, and meanwhile, the quantum capability requirements of participants are remarkably reduced.

The invention relates to the technical field of data security and access control, in particular to an implementation method and system of a dual access control mechanism based on a block chain and an encryption machine, and the implementation method comprises the steps of authority management based on a smart contract, encryption machine dynamic key generation, dual access control, and exception handling and auditing. The method has the beneficial effects that the non-tampering property of authority distribution and operation records is ensured through a distributed account book technology of the block chain, and a double-layer security barrier of logic credibility and physical isolation is formed in combination with hardware-level key protection (such as a security chip HSM) of an encryption machine. And the anti-attack capability is improved, the block chain resists data tampering and insider disintegration, the encryption machine prevents key side channel attacks, and the double mechanisms can cope with complex attack modes such as man-in-the-middle attacks, replay attacks and advanced persistent threats (APT).