A distributed data storage security protection system

Abstract

This invention relates to the field of data storage protection technology and discloses a distributed data storage security protection system. The invention includes a data sharding and commitment unit, a high-fidelity deception shard generation unit, an obfuscated storage control unit, an immune verification and reading unit, and a distributed commitment and graph management unit. By dividing logical data objects into real data shards and constructing a Merkle tree to generate the Merkle tree root, high-fidelity deception shards are generated by extracting the structural features of the real shards. Real and deception shards are obfuscated and stored on multiple nodes. During reading, the shards and proof paths returned by multiple nodes are cross-validated based on the Merkle tree root to identify compromised nodes and trigger an immune response, including node marking, alarm broadcasting, and data self-healing. This invention can effectively respond to internal attacks and highly covert deception attacks, improving the security and reliability of the distributed storage system.

Description

Technical Field

[0001] This invention relates to the field of data storage protection technology, and in particular to a distributed data storage security protection system. Background Technology

[0002] With the rapid development of cloud computing and big data technologies, distributed data storage systems have become a core component of modern information infrastructure. While improving storage capacity, availability, and access efficiency through decentralized data storage, they also bring new security challenges. Traditional security measures such as encryption and access control primarily prevent unauthorized access and data leaks, but are insufficient in protecting against threats such as internal attacks, data tampering, node compromise, and malicious injection of false data. Existing data redundancy and hash verification technologies are also insufficient to comprehensively address these threats.

[0003] While existing technologies employ Merkle trees and other methods to verify data integrity, they still have significant limitations: they cannot effectively distinguish between fake data injected after a storage node has been compromised and real data; they struggle to deal with highly concealed deceptive data generated by attackers with similar structures; they lack proactive immunity, data self-healing, and attack tracing mechanisms after anomalies are detected; and they are difficult to balance between the complexity of security mechanisms and system performance, resulting in limited protection effectiveness in complex attack scenarios. Summary of the Invention

[0004] The technical problem to be solved by this invention is that existing technologies cannot effectively deal with internal attacks and malicious injections, highly covert deception attacks, and lack proactive immunity and tracing mechanisms. At the same time, it is difficult to balance security and performance. To this end, we propose a distributed data storage security protection system.

[0005] To achieve the above objectives, this application adopts the following technical solution: a distributed data storage security protection system, comprising: a data sharding and commitment unit, configured to: divide a logical data object into N real data shards, where N is a positive integer and N≥3; construct a Merkle tree based on the real data shards; and generate a unique representation of the Merkle tree root of the logical data object's authenticity. As a cryptographic commitment; the high-fidelity deception shard generation unit is configured to: extract a structured template from at least one real data shard, record non-content-related structural features, and generate at least one deception shard with a structural similarity ≥90% to the real data shard based on the structured template and a pseudo-random source; the obfuscation storage control unit is configured to: obfuscate and store N real data shards, M deception shards, and the Merkel proof paths corresponding to each real shard, M≥N, on multiple nodes of a distributed storage system according to a preset strategy, and the nodes cannot identify the shard type; the immune verification reading unit is configured to: when a data reading request is received, retrieve from a secure location ; Initiate read requests to k storage nodes, where k ≥ N + 2, to obtain the shards and proof paths; Based on Cross-validation challenge is performed; when the number of failed validation nodes is ≥ k-N+1, it is identified as a compromised node and an immune response is triggered. The distributed commitment and graph management unit is configured as follows: a secure storage mapping table records logical data objects and... The relationship between them, the location information of all storage nodes of all shards, and Protected by a threshold signature scheme.

[0006] Preferably, the high-fidelity deception fragment generation unit generates deception fragments using the following mathematical expression: ;in This represents the j-th deceptive fragment generated based on the i-th real fragment; The structure template extraction function is specifically implemented as follows: S11. Calculate the actual fragmentation. The total byte length L; S12. Using 512 bytes as a window, calculate the byte entropy value of each window. Generate an entropy distribution histogram. , S13. Determine the probability of byte b appearing within the window; S14. Extract the predefined file header fields from the first 128 bytes; S15. Identify the list of data block boundary offsets within the fragment; The template filling function is implemented as follows: S21. Generate an empty data structure with a total length of L; S22. Fill the template with... Consistent file header fields; S23. Adjust the byte distribution of pseudo-random fill content according to the entropy distribution histogram; S24. Insert data block separators according to the boundary offset list; For the preset hash function, This represents the i-th real data slice. This represents the j-th pseudo-random seed, 128 bits, generated by the system's random number generator, and || represents a byte-level concatenation operation.

[0007] The preferred core logic expression for cross-validation challenge is: ; The proof verification function for Merkel is implemented as follows: S31. Calculate the slices. hash value S32. Along the proof path Include arrive All intermediate hash values ​​are used to calculate the parent node hash layer by layer; S33. If the final calculation result is consistent with... If they match, return True; otherwise, return False; k is the number of nodes requested for reading. and These are the fragments returned by the m-th storage node and their corresponding Merkel proof paths. This represents a logical AND operation; if all nodes pass verification... It is True if true, otherwise False. When the value is False, an immune response is triggered.

[0008] Preferably, the non-content-related structural features of the structured template record include at least two of the following: the total byte length of the fragment, accurate to a single byte; a histogram of the statistical distribution of data byte entropy values, with a window size of 512 bytes and entropy values ​​retained to two decimal places; a fixed byte sequence in a predefined file header format, with a length of 16 to 128 bytes, containing a byte arrangement of file type identifier, version number, and checksum field; and a list of boundary offsets for internal data blocks, recording the start and end offsets of at least three data blocks, with precision in bytes.

[0009] Preferably, the immune response includes: marking the compromised storage node as untrusted, specifically: adding an "untrusted" tag to the compromised node in the distributed node status table; temporarily removing it from the list of valid shard holders of the logical data object when the attack level is "suspected"; and permanently removing it from the list of valid shard holders of the logical data object when the attack level is "confirmed" based on a verification failure count of ≥3; immediately broadcasting an alarm message to all nodes in the distributed storage cluster, the alarm message including: compromised node ID, shard hash of the failed verification, attack level, and alarm timestamp; the receiving node adds the compromised node to its local blacklist within 100ms, rejecting all its read / write requests and state synchronization requests; triggering a data self-healing process: selecting n real shards from the verified healthy nodes; regenerating the lost real shards and their Merkle proof paths using erasure coding decoding algorithms; storing the regenerated shards in a new trusted storage node; and updating the shard location mapping table in the distributed commitment and graph management unit.

[0010] Preferably, the distributed commitment and graph management unit is configured to: securely store the mapping table using a distributed hash table, where the key of the mapping table is a unique identifier for the logical data object, and the value is a triplet. ;in Mapping to the actual fragment location; To deceive the fragment location mapping; Merkel tree root pass The threshold signature scheme is used for protection, specifically: n=5 authorized nodes are selected, the authorized nodes are cluster management nodes, and the threshold value t=3; Storage and retrieval require at least three authorized nodes to verify signatures using the ECDSA algorithm; the signature private key is generated using a distributed key generation scheme, and each authorized node only holds a share of the private key and cannot decrypt it independently.

[0011] Preferably, the immune verification reading unit is configured to initiate read requests to k storage nodes, where the value of k follows the following rules: , where n is the minimum number of fragments required for erasure coding; the node selection strategy is: from and Nodes are randomly selected from the list and must meet the following conditions: at least two nodes from different physical racks are included; at least one node has a historical verification success rate of ≥99% is included; the network latency difference between any two nodes is ≤50ms; the immune response is triggered only when the number of nodes that have failed verification is ≥k-n+1, ​​to tolerate a maximum of two nodes failing verification due to non-aggressive faults such as network jitter or temporary offline.

[0012] Preferably, the high-fidelity deception fragment generation unit is further configured to: inject an invisible tracking watermark using a least significant bit watermarking algorithm when generating deception fragments. Specifically, the watermark content is a 128-bit binary sequence containing: fragment generation timestamp, generation node ID, and check bits; the embedding position is the redundant padding bits of the fragment data block, the last 4 bits of each 512-byte data block, which does not affect the structural characteristics of the fragment; the watermark extraction algorithm parses the 4-bit sequence of the redundant padding bits, concatenates them, and verifies the CRC32 value to achieve source tracing analysis and locate the generation node and time.

[0013] Preferably, the obfuscated storage control unit applies an anti-affinity scheduling strategy when distributing storage: by parsing the physical location metadata of storage nodes, including rack identifiers, availability zone identifiers, and network segment identifiers, the following steps are performed: the storage nodes in the cluster are divided into at least 3 groups according to physical racks; real fragments of the same logical data object are assigned to different groups; if the cluster spans multiple availability zones, ensure that at least 2 availability zones each store ≥2 real fragments; the network hop count between storage nodes of any two real fragments is ≥2, determined by BGP routing information.

[0014] This invention proposes another technical solution: a distributed data storage security protection method, comprising the following steps: S101. Dividing a logical data object into N real data fragments using an erasure coding algorithm, where N≥3; calculating the SHA-256 hash value for each fragment; constructing a Merkle tree using the hash value as the leaf node; and generating a unique Merkle tree root. Parent node hash = SHA-256(left child node hash || right child node hash); S102. Perform structure template extraction on at least one real data fragment, extracting length, entropy histogram, file header, and data block boundaries, based on the template and pseudo-random source, using the formula Generate M deception fragments, M≥N; S103. Mix and store the real fragments, deception fragments, and corresponding Merkel proof paths on multiple nodes in a real / deception fragment ratio of 1:1-2, and satisfy the anti-affinity scheduling strategy; S104. When responding to a data read request, obtain the logical data object corresponding to the distributed commitment and graph management unit. S105. Initiate read requests to k storage nodes to obtain fragments and proof paths, k=n+2, where n is the minimum number of fragments required for erasure coding; S106. Based on Perform cross-validation challenges using the formula Determine the authenticity; S107. If If the result is False and the number of failed nodes is greater than or equal to k-n+1, ​​the corresponding node is determined to be a compromised node, and an immune response including node marking, alarm broadcasting, and data self-healing is executed.

[0015] The technical effects and advantages of this invention are as follows: This invention divides logical data objects into real data fragments and constructs a Merkle tree to generate a unique Merkle tree root. Combined with extracting the structural features of the real fragments to generate high-fidelity deception fragments and storing them in an obfuscated manner, it achieves defense against internal attacks and highly covert deception attacks, making it difficult for attackers to distinguish between real and fake fragments. During reading, the fragments and proof paths returned by multiple nodes are cross-verified based on the Merkle tree root, accurately identifying compromised nodes and triggering an immune response including node marking, alarm broadcasting, and data self-healing, quickly isolating threats and restoring data integrity. Simultaneously, by distributing real fragments through anti-affinity scheduling and protecting the Merkle tree root through threshold signatures, it improves system security while balancing performance, effectively enhancing the anti-attack capability and reliability of the distributed storage system. Attached Figure Description

[0016] The disclosure of this invention is illustrated with reference to the accompanying drawings. It should be understood that the drawings are for illustrative purposes only and are not intended to limit the scope of protection of this invention. In the drawings, the same reference numerals are used to refer to the same parts:

[0017] Figure 1 This is a system topology diagram of the present invention. Detailed Implementation

[0018] It is readily understood that, based on the technical solution of this invention, those skilled in the art can propose various interchangeable structural methods and implementations without altering the essential spirit of the invention. Therefore, the following detailed embodiments and accompanying drawings are merely illustrative examples of the technical solution of this invention and should not be considered as the entirety of the invention or as limitations or restrictions on the technical solution of this invention.

[0019] Reference Figure 1As shown, the present invention provides a technical solution: a distributed data storage security protection system, including a processor and a memory connected to the processor. The memory stores instructions that can be executed by the processor. When the instructions are executed, the system performs the functions of the following units: a data fragmentation and commitment unit, a high-fidelity deception fragmentation generation unit, an obfuscated storage control unit, an immune verification reading unit, and an optional distributed commitment and graph management unit.

[0020] Data Sharding and Commitment Unit: This unit is responsible for preprocessing the original logical data object to achieve data redundancy and integrity commitment. Specifically, when a logical data object to be stored is received, this unit first uses erasure coding algorithm, such as RS(20,10) encoding, to encode the original data into 20 fragments, of which any 10 fragments can be used to recover the original data. The logical data object is then divided into N real data fragments, where N is a positive integer and N≥3 to ensure sufficient redundancy.

[0021] After generating real data shards, the unit calculates the SHA-256 hash value for each real data shard; these hash values ​​will serve as leaf nodes of the Merkle tree; subsequently, through hierarchical hashing, i.e., the hash of a parent node is equal to the concatenation of the SHA-256 hashes of its left and right child nodes, a complete Merkle tree is constructed; the final generated Merkle tree root... As a cryptographic commitment to the authenticity of logical data objects; It can uniquely and concisely represent the integrity of the original logical data object; any tampering with any real data fragment will result in... Changes in [something] are thus detected.

[0022] High-fidelity deception fragment generation unit: This unit is key to the invention's defense against highly covert deception attacks. Its core function is to generate deception fragments that are structurally highly similar to real data fragments but with randomized content. The specific implementation process is as follows:

[0023] First, a structure template extraction operation is performed on at least one real data fragment. This operation aims to identify and record the non-content-related structural features of the real data fragment to form a structured template. The non-content-related structural features recorded in the structured template may include, but are not limited to: the total byte length of the fragment, accurate to a single byte; a statistical distribution histogram of data byte entropy values, for example, using 512 bytes as a window, calculating the byte entropy value of each window and statistically analyzing its distribution, with the entropy value precision retained to two decimal places; a fixed byte sequence in a predefined file header format, for example, a byte arrangement of 16-128 bytes in length, containing file type identifier, version number, and checksum fields; and a list of boundary offsets for internal data blocks, recording the start and end offsets of at least three data blocks with precision in bytes, identified based on a preset delimiter "0x0001FF" or a length prefix field.

[0024] Secondly, based on structured templates and pseudo-random sources, such as an AES pseudo-random number generator in CTR mode, at least one deception fragment is generated; the mathematical expression for generating the deception fragment is: ;in This represents the j-th deceptive fragment generated based on the i-th real fragment; The structural template extraction function, in its specific implementation process, includes: calculating the actual fragmentation. The total byte length L; using 512 bytes as a window, calculate the byte entropy value of each window. Generate an entropy distribution histogram. , The probability of byte b appearing within the window is calculated; predefined file header fields, such as MagicNumber, version number, and data type identifier, are extracted from the first 128 bytes; a list of data block boundary offsets within the slice is identified, based on the preset separator "0x0001FF" or a length prefix field; The template filling function, in its specific implementation, includes: generating an empty data structure of total length L; filling and... Consistent file header fields; adjusting the byte distribution of pseudo-random padding content according to the entropy distribution histogram, so that the entropy value of each 512-byte window is consistent with... The entropy deviation of the corresponding window is ≤5%; insert data block separators according to the boundary offset list; For the preset hash function, This represents the i-th real data slice. This represents the j-th pseudo-random seed, 128 bits, generated by the system random number generator, and || represents a byte-level concatenation operation;

[0025] The deceptive shards generated in this way have a preset similarity in structure to real data shards, such as a structural feature matching degree of ≥90%, making it difficult for attackers to distinguish between real shards and deceptive shards through simple structural analysis.

[0026] Furthermore, this unit can inject an invisible tracking watermark using the Least Significant Bit (LSB) watermarking algorithm when generating deceptive fragments. The watermark content can be a 128-bit binary sequence containing a fragment generation timestamp (32 bits), a generation node ID (64 bits), and a check bit (32 bits, which is the CRC32 value of the first 96 bits). The watermark is embedded in the redundant padding bits of the fragment data block, for example, the last 4 bits of each 512-byte data block. This does not affect the fragment's entropy, length, file header, or other structural features. The watermark extraction algorithm parses the 4-bit sequence of redundant padding bits, concatenates them, and verifies the CRC32 value to achieve traceability analysis, which can locate the generation node and time.

[0027] Obfuscated Storage Control Unit: This unit is responsible for sharding real data, deception shards, and the Merkel proof paths corresponding to the real data shards, including paths from leaf nodes to... All intermediate node hash values ​​are obfuscated and stored. Specifically, N real data shards, M deception shards, and the Merkel proof paths corresponding to each real data shard are stored on multiple storage nodes of a distributed data storage system according to a preset distribution strategy, where M is a positive integer and M≥N.

[0028] The distribution strategy ensures that the ratio of real shards to spoofed shards stored on each storage node is 1:(1~2) to achieve effective obfuscation. At the same time, the strategy ensures that no node can identify the type of shards it stores, that is, it cannot distinguish whether it stores real shards or spoofed shards. This can be achieved by uniformly encapsulating and processing metadata of shards during storage.

[0029] In distributed storage, this unit also applies an anti-affinity scheduling strategy; by parsing the physical location metadata of storage nodes, including rack identifiers, availability zone identifiers, and network segment identifiers, the following steps are performed: storage nodes within the cluster are divided into at least 3 groups according to physical racks; real shards of the same logical data object are allocated to different groups, with each rack storing a maximum of Each real shard; if the cluster spans multiple availability zones, ensure that at least two availability zones each store ≥2 real shards; the network hop count between any two real shard storage nodes is ≥2, determined by BGP routing information; this anti-affinity strategy aims to distribute real shards to the greatest extent possible, reducing the impact of single-point failures or local attacks on data integrity.

[0030] Immune verification reading unit: When a read request for a logical data object is received, this unit performs the following operations: First, it retrieves the Merkle root corresponding to the logical data object from a preset secure storage location, such as a distributed key management node or a distributed commitment and graph management unit. Next, read requests are initiated to k storage nodes that hold the relevant shards of the logical data object, requesting the return of the data shards and the corresponding Merkel proof paths; here, k is a positive integer, and k≥N+2; the value of k can be determined by the rule that k=n+2, where n is the minimum number of shards required for erasure coding, for example, when n=10, k=12; the node selection strategy is: randomly selected from the RealMap and DecoyMap, and satisfying the following conditions: at least two nodes from different physical racks are included; at least one node has a historical verification success rate ≥99% is included; the network latency difference between any two nodes is ≤50ms; then, a cross-validation challenge based on Merkel commitments is executed; this challenge calls the Merkel proof verification function, respectively with Based on this, the authenticity of the shards and their proof paths returned by each node is verified; the core judgment logic of the cross-validation challenge is the following mathematical expression. ;

[0031] The proof verification function for Merkel is implemented by calculating the slice. hash value ; along the proof path Include arrive All intermediate hash values ​​are used to calculate the parent node hash layer by layer; if the final calculation result is consistent with... If they match, return True; otherwise, return False; k is the number of nodes requested for reading. and These are the fragments returned by the m-th storage node and their corresponding Merkel proof paths. This represents a logical AND operation; if all nodes pass verification... It is True if true, otherwise False. When the value is False, an immune response is triggered. Finally, when the number of nodes that fail verification is ≥ k-N+1, these nodes are identified as compromised nodes and a preset immune response is triggered. For example, when n=10 and k=12, the response is triggered when there are ≥ 3 failed nodes, to tolerate a maximum of 2 nodes failing verification due to non-aggressive faults such as network jitter or temporary offline.

[0032] Immune Response Mechanism: When the immune verification reading unit determines that a compromised node exists, a preset immune response will be triggered. This response includes: Node Marking and Isolation: The compromised storage node is marked as untrusted. Specifically, an "untrusted" tag is added to the distributed node status table, with a configurable validity period; when the attack level is "suspected" or "confirmed," based on a verification failure count of ≥3, the node is temporarily or permanently removed from the list of valid shard holders of the logical data object.

[0033] Alarm Broadcast: Immediately broadcasts alarm information to all nodes in the distributed storage cluster. The alarm information includes: compromised node ID, shard hash of the failed verification, attack level, and alarm timestamp; receiving nodes must add the compromised node to their local blacklist within 100ms, rejecting all read / write requests and state synchronization requests from it, thereby achieving rapid isolation.

[0034] Data self-healing process: Trigger the data self-healing process to restore data integrity; the specific steps are as follows: Select n real shards from the verified healthy nodes, where n is the minimum number of shards required by the erasure coding algorithm, for example, n=10 in RS(20,10); Regenerate the lost real shards and their Merkle proof paths using the erasure coding decoding algorithm, which is achieved through local reconstruction of the Merkle tree; Store the regenerated shards in a new trusted storage node, which must meet the following requirements: node reputation value ≥ 95 points, no abnormal behavior records within 30 days, and not on the same physical rack as the compromised node; Update the shard location mapping table in the distributed commitment and graph management unit to ensure that subsequent read requests can access the new, healthy real shards.

[0035] To enhance the robustness and security of the system, the present invention also includes a distributed commitment and graph management unit; this unit is configured to securely store the mapping table using a distributed hash table; the key of the mapping table is a unique identifier of the logical data object, and the value is a triplet. ;in This is a mapping of actual shard locations, where the key is the shard index and the value is a list of storage node IDs; To deceive the shard location mapping, the key is the shard index, and the value is a list of storage node IDs.

[0036] Merkel roots , Protection is provided through a (t,n) threshold signature scheme to prevent single points of failure or the compromise of a few nodes. Leakage or tampering. Specifically: Select n authorized nodes, for example, n=5 cluster management nodes, with a threshold value t, for example, t=3; Storage and retrieval require at least t authorized nodes to verify signatures using the ECDSA algorithm; the signature private key is generated using a distributed key generation scheme, with each authorized node holding only a share of the private key and unable to decrypt it independently, thus further enhancing security. Security.

[0037] This invention also provides a distributed data storage security protection method, which includes the following steps: Step 1: Divide a logical data object into N real data fragments using an erasure coding algorithm, where N≥3. Calculate the SHA-256 hash value for each fragment, and construct a Merkle tree using the hash values ​​as leaf nodes to generate a unique Merkle tree root. Parent node hash = SHA-256(left child node hash || right child node hash); Step 2: Perform structure template extraction on at least one real data fragment, extracting length, entropy histogram, file header, and data block boundaries. Based on the template and pseudo-random source, use the formula... Generate M deception fragments, M≥N; Step 3: Mix and store the real fragments, deception fragments, and corresponding Merkel proof paths on multiple nodes in a real / deception fragment ratio of 1:1-2, and satisfy the anti-affinity scheduling strategy; Step 4: When responding to a data read request, obtain the logical data object corresponding to the distributed commitment and graph management unit. Step 5: Initiate read requests to k storage nodes to obtain fragments and proof paths, where k = n + 2, and n is the minimum number of fragments required for erasure coding; Step 6: Based on Perform cross-validation challenges using the formula Determine authenticity; Step Seven: If If the result is False and the number of failed nodes is greater than or equal to k-N+1, the corresponding node is determined to be a compromised node, and an immune response including node marking, alarm broadcasting, and data self-healing is executed.

[0038] The technical scope of this invention is not limited to the content described above. Those skilled in the art can make various modifications and variations to the above embodiments without departing from the technical concept of this invention, and all such modifications and variations should fall within the protection scope of this invention.

Claims

1. A distributed data storage security protection system, characterized in that, Comprise: The data shard and commitment unit is configured to: split a logical data object into N real data shards, N being a positive integer, N≥3, build a Merkle tree based on the real data shards, and generate a Merkle tree root uniquely representing the authenticity of the logical data object As a cryptographic commitment; a high-fidelity fraud shard generation unit is configured to: extract a structured template from at least one real data shard, record non-content structural features, and generate at least one fraud shard with a structural similarity to the real data shard ≥90% based on the structured template and a pseudo-random source; The obfuscated storage control unit is configured to: store the N real data shards, M deception shards and the Merkle proof path corresponding to each real shard, M >= N, in a plurality of nodes of a distributed storage system according to a preset strategy, and the nodes cannot identify the shard type; The immune verification reading unit is configured to: when receiving a data reading request, obtaining the data from the secure location ; initiating a reading request to k storage nodes, where k≥N+2, obtaining the shard and proof path; based on Performing cross-validation challenge, when the number of failed verification nodes≥k-N+1, determining as a compromised node and triggering an immune response; the distributed commitment and graph management unit is configured to: securely storing a mapping table, recording the association relationship between the logical data object and The storage node location information of all shards, and Protected by a threshold signature scheme.

2. The distributed data storage security system of claim 1, wherein, The high-fidelity fake fragment generation unit generates a fake fragment by the following mathematical expression: ; wherein represents the jthfake fragment generated based on the ithreal fragment; is a structure template extraction function, which is specifically implemented as: S11. calculating the total byte length L of the real fragment ; S12. calculating the byte entropy value of each window with a window of 512 bytes , generating an entropy value distribution histogram, , is the occurrence probability of the byte b in the window; S13. extracting the predefined file header field in the first 128 bytes; S14. identifying the data block boundary offset list in the fragment; is a template filling function, which is specifically implemented as: S21. generating an empty data structure with a total length of L; S22. filling the file header field consistent with ; S23. adjusting the byte distribution of the pseudo-random filling content according to the entropy value distribution histogram; S24. inserting the data block separator according to the boundary offset list; to preset a hash function, represents the i-th real data shard, represents the j-th pseudo-random seed, 128 bits, generated by a system random number generator, and represents a byte-level concatenation operation.

3. The distributed data storage security system of claim 1, wherein, The core judgment logic expression of the cross-validation challenge is: ; The Merkle proof verification function is S31. The implementation logic is: calculate the hash value of the shard ; ; S32. Along the proof path contains to All intermediate hash values are calculated layer by layer to calculate the parent node hash; S33. If the final calculation result is consistent with , return True, otherwise return False; k is the number of nodes of the read request, and respectively, the shard returned by the mth storage node and the corresponding Merkle proof path, indicates logical and operation, all node verification is passed is True, otherwise False, when is False, trigger the immune response.

4. The distributed data storage security system of claim 2, wherein, The non-content structure features of the structured template record include at least two of the following: the total byte length of the shard, accurate to a single byte; a statistical distribution histogram of data byte entropy values, with a window size of 512 bytes and an entropy value accuracy of 2 decimal places; a fixed byte sequence of a predefined file header format, with a length of 16 to 128 bytes, containing byte arrangements of file type identification, version number, and checksum field; a boundary offset list of internal data blocks, recording the starting offset and ending offset of at least 3 data blocks, with an accuracy of bytes.

5. The distributed data storage security system of claim 1, wherein, The immune response includes: marking the compromised node as untrusted, specifically: adding an "untrusted" label to the compromised node in the distributed node state table, temporarily removing from the valid shard holder list of the logical data object when the attack level is "suspected", permanently removing from the valid shard holder list of the logical data object based on the number of verification failures >= 3 when the attack level is "confirmed"; immediately broadcast alarm information to all nodes in the distributed storage cluster, the alarm information includes: compromised node ID, verification failed shard hash, attack level, alarm timestamp, receiving node adds the compromised node to the local blacklist within 100ms, and refuses all read and write requests and state synchronization requests; trigger data self-healing process: select n real shards from the verified healthy nodes; regenerate the lost real shards and their Merkle proof paths using erasure code decoding algorithm; store the regenerated shards in new trusted storage nodes; update the shard location mapping table in the distributed commitment and graph management unit.

6. The distributed data storage security system of claim 1, wherein, The distributed commitment and graph management unit is configured to: securely store a mapping table using a distributed hash table, where the key of the mapping table is a unique identifier for the logical data object, and the value is a triplet. ;in Mapping to the actual fragment location; To deceive the fragment location mapping; the Merkle root pass The threshold signature scheme is used for protection, specifically: n=5 authorized nodes are selected, the authorized nodes are cluster management nodes, and the threshold value t=3; Storage and retrieval require at least three authorized nodes to verify signatures using the ECDSA algorithm; the signature private key is generated using a distributed key generation scheme, and each authorized node only holds a share of the private key and cannot decrypt it independently.

7. The distributed data storage security system of claim 1, wherein, The immune verification reading unit is configured to initiate a reading request to k storage nodes, wherein: the value of k is regulated as , n is the minimum number of shards required for erasure code; the node selection strategy is to randomly select from and , and meet: at least contain 2 different physical racks of nodes; at least contain 1 node with a historical verification success rate ≥ 99%; the network delay difference of any two nodes ≤ 50 ms; the immune response is triggered only when the number of verification failures ≥ k-n+1, to tolerate at most 2 nodes caused by network jitter, temporary offline non-attack failure.

8. The distributed data storage security system of claim 1, wherein, The high-fidelity deception shard generation unit is further configured to: when generating deception shards, inject invisible tracking watermarks through the least significant bit watermark algorithm, specifically: the watermark content is a 128-bit binary sequence, including: shard generation timestamp, generation node ID and check bit; the embedding position is the redundant padding bit of the shard data block, the last 4 bits of every 512-byte data block, without affecting the structure features of the shard; the watermark extraction algorithm extracts the 4-bit sequence from the redundant padding bit, concatenates and checks the CRC32 value to realize traceability analysis and locate the generation node and time.

9. The distributed data storage security system of claim 1, wherein, The obfuscated storage control unit applies an anti-affinity scheduling strategy when distributing storage: by analyzing the physical location metadata of the storage nodes, including rack identifier, availability zone identifier, network segment identifier, the following steps are performed: divide the storage nodes in the cluster into at least 3 groups according to physical racks; real shards of the same logical data object are allocated to different groups; if the cluster spans multiple availability zones, ensure that at least 2 availability zones each store >= 2 real shards; The network hop count between the storage nodes of any two real shards is >= 2, determined by BGP routing information.

Images