A method, device and system for file access in a distributed NAS storage system

Abstract

The present invention discloses a method, device, and system for file access in a distributed NAS storage system, specifically relating to the field of file access. By real-time monitoring of storage node topology changes, event codes are generated to drive key lifecycle management and distributed key operations, thereby dynamically adjusting data redundancy and distributing storage shards according to the topological state. At the same time, when a node is permanently offline, the reconstruction and destruction of related keys are triggered. A method, device, and system for file access in a distributed NAS storage system eliminate encryption blind spots caused by inconsistent timing by dynamically adapting key lifecycles to topology change events; by constructing an encryption parameter matrix of storage node physical topology and cryptographic parameters, the binding of keys to storage node coordinates is achieved, strengthening the correlation between dynamic keys and topological structures; and by adding a triple verification mechanism for multiple nodes, the risk of a man-in-the-middle attack by intercepting metadata shards and carrying out data reorganization attacks is prevented.

Description

Technical Field

[0001] The present invention relates to the field of file access technology, and more particularly, to a method, device and system for file access in a distributed NAS storage system. Background Art

[0002] With the widespread adoption of distributed storage technology, secure and efficient cross-node file access is becoming increasingly important. Traditional distributed NAS systems rely on centralized metadata management to achieve file location and permission control. Clients must obtain metadata through fixed communication channels and then connect directly to storage nodes to read and write data. However, when metadata servers are attacked by DDoS, system availability decreases, and the plaintext metadata exchange process carries the risk of data leakage due to man-in-the-middle attacks.

[0003] To address the above-mentioned shortcomings, the existing technology uses a consistent hashing algorithm to dynamically allocate metadata shards and introduces an end-to-end encryption mechanism in the data transmission layer. By building a decentralized metadata ring network, metadata query requests are dispersed to multiple virtual control nodes, effectively reducing the occurrence rate of single point failures and improving the security of basic communications through encrypted message transmission.

[0004] However, in actual use, it still has some shortcomings, such as insufficient adaptability of the dynamic key negotiation mechanism to the distributed metadata topology, which leads to a timing mismatch between the key update cycle and the dynamic joining and exiting events of nodes, resulting in encryption blind spots and exposing sensitive metadata; the lack of a zero-trust verification mechanism in multi-node collaborative encryption scenarios means that man-in-the-middle attacks disguised as legitimate virtual control nodes can still carry out data reconstruction attacks by intercepting scattered metadata shards. Summary of the Invention

[0005] In order to overcome the above-mentioned defects of the prior art, the present invention provides a method, device and system for file access in a distributed NAS storage system, which solves the problems raised in the above-mentioned background technology through the following solutions.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] A method for accessing files in a distributed NAS storage system, comprising:

[0008] S1: Monitor the topology status of each storage node in real time and generate a topology change event code based on changes in the topology status;

[0009] S2: Based on the topology change event code, dynamically manage the key lifecycle and perform distributed key management operations, including generating a first key for a new node when a storage node joins and triggering a reconstructed second key when a storage node exits;

[0010] S3: Based on the topology information of the storage node and the dynamically managed first key and second key, generate a dynamic encryption parameter bound to the topology information;

[0011] S4: Generate a dynamic device fingerprint based on the dynamic encryption parameter, and perform zero-trust verification and dynamic encryption processing on the file data shard corresponding to the first key and the file data shard corresponding to the second key;

[0012] S5: Based on the storage node topology state and the dynamic encryption parameters, dynamically adjust the data redundancy, and distribute the processed file data into the storage nodes.

[0013] S6: When it is detected that the storage node is permanently offline, the reconstruction and destruction operations of the first key and the second key are triggered.

[0014] Preferably, the S2, dynamically managing the key lifecycle, specifically includes:

[0015] If the topology state corresponding to the topology change event code is a storage node joining event, a key shard of a new node is generated among the surviving nodes based on the elliptic curve threshold signature algorithm;

[0016] If the topology state corresponding to the topology change event code is a storage node exit event, the key shards of the remaining nodes are reconstructed by the Lagrange interpolation method, and the key reconstruction completion time window is less than 100ms after the topology change event is triggered.

[0017] Preferably, the S3, dynamic encryption parameters include generating a chaotic sequence seed based on a hash value corresponding to the topology information of the storage node, generating an encryption parameter matrix that changes with the topology information through a logistic map, and binding the first key and the second key to the storage node coordinates;

[0018] The dimension parameters of the encryption parameter matrix are synchronized with the current number of surviving nodes, and the update frequency of the matrix elements and the generation frequency of the topology change event code maintain a positive proportional mapping relationship.

[0019] Preferably, the S4, zero-trust verification is a triple verification mechanism, specifically including:

[0020] generating a timestamp fingerprint including a node stability index based on the dynamic encryption parameter;

[0021] Use threshold signature to verify the legitimacy of the source node of the file data fragment;

[0022] Verify that the storage node holds a legitimate key shard through a verifiable random function;

[0023] If any of the verifications fails, S1 is triggered to re-collect the topology status of the storage node.

[0024] Preferably, the S4, zero trust verification also includes: threshold signature verification using (t,n) threshold BLS signature scheme; each node participating in the signature uses a private key Hash the message Generate signature share , specifically expressed as:

[0025] ,

[0026] in, Represented as the aggregated signature, Represented as mapping messages to elliptic curve groups Hash function.

[0027] Preferably, the S4, dynamic encryption processing includes:

[0028] The file data fragments are dynamically divided into sizes according to the chaotic sequence generated by the dynamic encryption parameters, and the file data fragments are encrypted using the SM4-CTR and ZUC algorithm alternating encryption modes, wherein the switching period is dynamically controlled by the Lyapunov exponent of the chaotic sequence, and a pseudo-random length padding field is inserted into the encrypted payload, and the padding length satisfies:

[0029] ,

[0030] in, The Fibonacci number item, Indicates the current timestamp The result of modulo 64 is, The Fibonacci number The result of taking the modulo 255, Represented as a parameter in dynamic encryption parameters, Expressed as Perform a bitwise AND operation with 0xFF.

[0031] Preferably, the S5, distributing and storing the processed file data in shards, includes adding an invisible watermark containing the zero-trust verification result to each shard.

[0032] Preferably, in S6, when a storage node is permanently offline, executing the key destruction operation includes:

[0033] Freeze all key versions associated with permanently offline storage nodes and mark them as obsolete;

[0034] Use chaos parameters to generate a one-time erase instruction driven by a physical unclonable function;

[0035] Complete multiple rounds of overwriting and erasure of residual data in key shards within a preset number of heartbeat cycles.

[0036] To achieve the above object, the present invention provides the following technical solution: a device for accessing files in a distributed NAS storage system, implementing the above method for accessing files in a distributed NAS storage system, comprising:

[0037] Storage node perception module: monitors the topology status of each storage node in real time and generates topology change event codes based on changes in the topology status;

[0038] Key management module: Based on the topology change event code, dynamically manage the key lifecycle and perform distributed key management operations, including generating a first key for a new node when a storage node joins and triggering a reconstructed second key when a storage node exits;

[0039] An encryption link binding module: generating a dynamic encryption parameter bound to the topology information based on the topology information of the storage node and the first key and the second key of the dynamic management;

[0040] Verification and encryption module: based on the dynamic encryption parameters, generates a dynamic device fingerprint, and performs zero-trust verification and dynamic encryption processing on the file data slice corresponding to the first key and the file data slice corresponding to the second key;

[0041] Dynamic reorganization module: dynamically adjusts data redundancy based on the storage node topology state and the dynamic encryption parameters, and distributes the processed file data into shards and stores them in the storage nodes;

[0042] Key destruction module: triggers the reconstruction and destruction operations of the first key and the second key when it is detected that the storage node is permanently offline.

[0043] To achieve the above object, the present invention further provides the following technical solution: a system for accessing files in a distributed NAS storage system, comprising:

[0044] Several storage nodes;

[0045] Several client interfaces;

[0046] The system central processing unit is capable of communicating and interacting with each storage node and each client interface to execute the method for accessing files in a distributed NAS storage system.

[0047] Technical effects and advantages of the present invention:

[0048] 1. This invention solves the problem of mismatch between the key update cycle and the timing of node dynamic events by dynamically adapting the key lifecycle to topology change events, eliminating encryption blind spots caused by inconsistent timing and preventing the exposure of sensitive metadata.

[0049] 2. This invention achieves the binding of keys and storage node coordinates by constructing an encryption parameter matrix of storage node physical topology and cryptographic parameters, strengthens the correlation between dynamic keys and topological structures, dynamically defends against encryption blind spots, and improves the security of sensitive metadata.

[0050] 3. The present invention adds a triple verification mechanism in a multi-node collaborative encryption scenario to prevent the risk of a middleman disguised as a legitimate virtual control node from intercepting metadata fragments and carrying out a data reassembly attack. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 The present invention provides a flowchart of a method for accessing files in a distributed NAS storage system according to an embodiment of the present application.

[0052] Figure 2 This is a module flow chart of a device for file access in a distributed NAS storage system provided according to an embodiment of the present application.

[0053] Figure 3 A diagram showing the composition of a file access system in a distributed NAS storage system according to an embodiment of the present application. DETAILED DESCRIPTION

[0054] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0055] The terms used in the following examples of the present application are only for the purpose of describing specific embodiments and are not intended to limit the present application. As used in the specification of the present application, the singular expressions "a", "an", "said", "above", "the", and "this" are intended to include plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used in the present application refers to and includes any or all possible combinations of one or more of the listed items.

[0056] In the following, the terms "first" and "second" are used for descriptive purposes only and should not be understood to imply or suggest relative importance or implicitly indicate the number of the technical features indicated. Therefore, features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of this application, unless otherwise specified, "plurality" means two or more.

[0057] As attached Figure 1 A method for file access in a distributed NAS storage system is shown. This method generates event codes by real-time monitoring of storage node topology changes to drive key lifecycle management and distributed key operations. This method dynamically adjusts data redundancy and distributes storage shards based on the topology state. Furthermore, when a node is permanently offline, the method triggers the reconstruction and destruction of related keys. Specifically, the method includes the following steps:

[0058] S1: Monitor the topology status of each storage node in real time and generate a topology change event code based on changes in the topology status;

[0059] S2: Based on the topology change event code, dynamically manage the key lifecycle and perform distributed key management operations, including generating a first key for a new node when a storage node joins and triggering a reconstructed second key when a storage node exits;

[0060] S3: Based on the topology information of the storage node and the dynamically managed first key and second key, generate a dynamic encryption parameter bound to the topology information;

[0061] S4: Generate a dynamic device fingerprint based on the dynamic encryption parameter, and perform zero-trust verification and dynamic encryption processing on the file data shard corresponding to the first key and the file data shard corresponding to the second key;

[0062] S5: Based on the storage node topology state and the dynamic encryption parameters, dynamically adjust the data redundancy, and distribute the processed file data into the storage nodes.

[0063] S6: When it is detected that the storage node is permanently offline, the reconstruction and destruction operations of the first key and the second key are triggered.

[0064] Specifically, in S1, the topology information of each storage node is monitored in real time, and the stability index of each storage node is calculated through the dual dimensions of heartbeat packet strength and transmission delay. When a change in the topology state is detected, a topology change event code is generated. The topology state change includes but is not limited to storage node joining events, storage node exit events, etc., thereby triggering the initialization of distributed key management operations.

[0065] Furthermore, an improved μTP protocol is used to implement topological status monitoring of each storage node, and each storage node periodically sends an encrypted heartbeat packet. In this embodiment, the data structure of the heartbeat packet includes a 16-byte node ID generated based on SHA-256 hash, a 4-byte sequence number for preventing replay attacks, an 8-byte transmission timestamp synchronized to microseconds by NTP, and a 2-byte signal strength indication of a quantized value. The jitter value of the packet arrival interval of three adjacent heartbeat cycles is calculated to evaluate the stability index of the transmission of each storage node. The jitter value is the value of the quantized value. The calculation formula is specifically expressed as:

[0066] ,

[0067] in, and Respectively expressed as and The jitter of a heartbeat cycle, and Respectively expressed as and The arrival delay of a heartbeat packet, It represents a smoothing factor that balances the impact of sudden fluctuations on the jitter value. In this embodiment, the smoothing factor is 0.7. At the same time, based on fuzzy logic, the normalized jitter value is used as the link quality factor, the average CPU utilization of the preset sliding window is used as the resource load factor, and the verification pass rate within the preset time is used as the historical credibility, and the output is a stability index in the interval [0,100]. The preset sliding window is dynamically adjusted according to the number of nodes. In this embodiment, when the number of nodes is greater than the average, a window length of 60 seconds is taken; when the number of nodes is less than the average, a window length of 180 seconds is taken.

[0068] It should be noted that the calculation process of the stability index is completed with the participation of the fuzzy rule base in each storage node of the file access system in the distributed NAS storage system, specifically as follows: the jitter value, CPU utilization average and verification pass rate are normalized so that the numerical range is normalized to the [0,1] interval; the normalized jitter value, CPU utilization average and verification pass rate are fuzzified into corresponding fuzzy sets respectively; in this embodiment, the jitter value is fuzzified into "low jitter", "medium jitter" and "high jitter", the CPU utilization average is fuzzified into "low load", "medium load" and "high load", and the verification pass rate is fuzzified into "low credibility", "medium credibility" and "high credibility"; the fuzzy rule base in the storage node is used to perform combined reasoning on the fuzzified parameters; the fuzzy set of the stability index obtained by fuzzy rule reasoning is defuzzified using the center of gravity method, the center of gravity position of the fuzzy set is calculated, and mapped to the [0,100] interval as the final stability index.

[0069] Furthermore, when it is detected that the storage node has received three consecutive valid heartbeats and passed the elliptic curve digital signature verification, the storage node joining event is triggered; when five heartbeat packets are lost consecutively and the adjacent nodes confirm their offline status, the storage node exit event is triggered; the data structure of the topology change event code adopts the TLV encoding format. In this embodiment, the topology change event code includes a 1-byte event type, an 8-byte timestamp, a 32-byte topology hash value generated by performing a Merkle tree root hash calculation on the current surviving node ID set, and a variable-length list of affected nodes.

[0070] Specifically, in S2, after receiving the topology change event code, it is converted into a logical timestamp, and the currently valid key version is determined based on the logical timestamp to perform a distributed key management operation.

[0071] In one possible implementation, based on the topology change event code, dynamically managing the key lifecycle includes: if the topology state corresponding to the topology change event code is a storage node joining event, generating a key shard of a new node between surviving nodes based on the elliptic curve threshold signature algorithm, that is, a first key; if the topology state corresponding to the topology change event code is a storage node exit event, reconstructing the key shards of the remaining nodes through the Lagrange interpolation method, that is, a second key, and the key reconstruction completion time window is less than 100ms after the topology change event is triggered.

[0072] Furthermore, in the event of a storage node joining, a key shard of the new node is generated based on the elliptic curve threshold signature algorithm; specifically, the surviving node uses the elliptic curve threshold signature algorithm to sign the concatenated message of the new node number and the topology change event code to generate a key shard, i.e., a first key; after the new node collects at least a preset number of valid shards, this embodiment uses the Lagrange interpolation method to interpolate the valid shards to reconstruct the private key corresponding to the new node; in the event of a storage node exiting, the threshold value is recalculated based on the number of remaining nodes, and the key shards of the remaining nodes are reconstructed using the Lagrange interpolation method to generate a key shard, i.e., a second key.

[0073] It should be noted that the elliptic curve threshold signature algorithm is used to execute the generation and distribution of key shards to ensure that only nodes that meet the threshold value can collaboratively recover the complete private key; in this embodiment, the execution content based on the elliptic curve threshold signature algorithm includes but is not limited to threshold key shard generation, distributed key state synchronization, anti-interference key distribution, key destruction and residual clearing, etc.; the Lagrange interpolation method is used to recover the complete private key from multiple key shards, or to reconstruct the key shards of the remaining nodes when a node exits.

[0074] Specifically, in S3, dynamic defense against encryption blind spots is achieved by constructing a strong correlation matrix between the physical topology of the storage node and the cryptographic parameters. The implementation process includes extracting physical topology features, generating a chaotic sequence seed through comprehensive hash calculation, binding the first key and the second key to the storage node coordinates, and then generating dynamic encryption parameters consisting of an encryption parameter matrix.

[0075] It should be noted that the physical topology characteristics of each storage node are extracted to generate a unique location identifier, which includes a 128-bit chip-level unique ID obtained through a physical unclonable function, an AS_PATH hash value calculated based on the BGP routing table, and GPS positioning data; then a comprehensive hash calculation is performed, which uses the SHA3-512 algorithm to concatenate and hash the PUF ID, AS_HASH, and the longitude and latitude rounded down and multiplied by 10 to the power of 6 to generate a 512-bit binary string as the initial seed of the chaotic system.

[0076] It should be noted that PUF ID represents a unique identifier generated by a physically unclonable function, which is used to ensure the uniqueness and security of hardware devices; AS_HASH represents the autonomous system path hash value calculated based on the BGP routing table.

[0077] In one possible implementation, the generation of dynamic encryption parameters includes generating a chaotic sequence seed based on a hash value corresponding to the topology information of the storage node, and generating an encryption parameter matrix that changes with the topology information through a logistic mapping to bind the first key and the second key to the storage node coordinates; wherein, the dimension parameters of the encryption parameter matrix are synchronized with the current number of surviving nodes, and the update frequency of the matrix elements maintains a positively proportional mapping relationship with the generation frequency of the topology change event code.

[0078] Furthermore, the hashing process of the storage node position is performed, the physical coordinate set of the current surviving node is input, and the physical coordinates are normalized by the SHA3-256 algorithm. The normalization process includes arranging the nodes in ascending order of coordinates to generate a standardized string and performing three rounds of sponge structure hash operations to output a hash value as the chaotic sequence seed; an improved Logistic map is used to generate a pseudo-random sequence, and a pre-processing operation is performed on the pseudo-random sequence. The pre-processing operation includes discarding the results of the previous preset number of iterations to eliminate transient effects, and continuously generating a preset multiple of the current number of surviving nodes. The chaotic value of the number is obtained, and the chaotic value is binary quantized. In this embodiment, if the chaotic value is greater than 0.65, the value is 1, otherwise the value is 0; an encryption parameter matrix is ​​constructed, the dimension parameters of the encryption parameter matrix are synchronized with the current number of surviving nodes, and each element in the encryption parameter matrix corresponds to the communication link parameters between each storage node; the binding of the key and the topological structure is implemented, and the key fragment of each storage node is XORed through the HMAC-SHA256 algorithm to calculate the corresponding topological binding value; the coordinates of each storage node are used as elliptic curve point generation parameters to perform elliptic curve threshold signature.

[0079] Furthermore, the generation rules of each element in the encryption parameter matrix include: the main diagonal elements use the chaotic sequence to generate the initial key version number, the off-diagonal elements define the link parameters between the storage nodes, and the diagonal elements are symmetrically processed, that is, each element is XORed with 0xAAAAAAAA and then bitwise ANDed with 0xFFFFFFFF.

[0080] Specifically, in S4, a dynamic device fingerprint is generated based on the encryption parameter matrix, where the dynamic device fingerprint includes CPU microarchitecture timing characteristics extracted based on a physical unclonable function, TCP retransmission rate and RTT variance within a sliding window, and chaotic values ​​in the encryption parameter matrix.

[0081] In one possible implementation, zero-trust verification adopts a triple verification mechanism, which includes generating a timestamp fingerprint containing a node stability index based on the dynamic encryption parameters; using a threshold signature to verify the legitimacy of the source node of the file data shard; and verifying that the storage node holds a legitimate key shard through a verifiable random function; and any failure of any of the verifications triggers S1 to re-collect the topological status of the storage node.

[0082] It should be noted that a timestamp fingerprint including a node stability index is generated based on the dynamic encryption parameters. The dynamically generated timestamp fingerprint is embedded in the header of each file data shard. The timestamp fingerprint includes a logical timestamp and a fingerprint digest. The verification end compares the expected fingerprint digest calculated locally. If the deviation exceeds the preset timestamp unit, it is determined to be an illegal shard.

[0083] Furthermore, a threshold signature is used to verify the legitimacy of the source node of the file data slice, wherein the threshold signature verification adopts a (t,n) threshold BLS signature scheme; the legitimacy verification process of the source node of the file data slice includes: each node participating in the signature uses a private key Hash the message Generate signature share , specifically expressed as:

[0084] ,

[0085] in, Represented as the aggregated signature, Represented as mapping messages to elliptic curve groups The hash function of ; the verification phase uses a bilinear pairing function, specifically expressed as:

[0086] ,

[0087] in, Represented as the public key of all participating storage nodes The pairing result of ; if the equality is established, it proves that the file fragment data consists of at least The signature of each legitimate storage node must be signed by all the valid storage nodes. If the verification fails, it means that there are invalid or forged signature shares, which triggers the degradation of S1's node credibility.

[0088] In one possible implementation, the dynamic encryption process includes: dynamically dividing the size of the file data fragments according to the chaotic sequence generated by the dynamic encryption parameters, and encrypting the file data fragments using the SM4-CTR and ZUC algorithm alternating encryption modes, wherein the switching period is dynamically controlled by the Lyapunov exponent of the chaotic sequence; in this embodiment, if the Lyapunov exponent is greater than 0.5, the stream cipher mode of the ZUC algorithm is used, otherwise the SM4-CTR mode is used; and inserting a pseudo-random length padding field in the encrypted payload, the padding length satisfy:

[0089] ,

[0090] in, The Fibonacci number item, Indicates the current timestamp The result of modulo 64 is, The Fibonacci number The result of taking the modulo 255, Represented as a parameter in dynamic encryption parameters, Expressed as Perform a bitwise AND operation with 0xFF.

[0091] Specifically, in S5, based on the storage node topology state and dynamic encryption parameters, the data redundancy is dynamically adjusted, and the processed file data shards are distributed and stored, including adding an invisible watermark containing the zero-trust verification result to each shard. This embodiment embeds the invisible watermark information into the file data shard by bitwise XORing the topology change event code with the invisible watermark factor, and then adopts the LSB replacement algorithm.

[0092] Furthermore, dynamically adjusting data redundancy includes dynamically adjusting erasure code redundancy according to the storage node stability index. In this embodiment, erasure code redundancy The calculation formula for dynamic adjustment is specifically expressed as follows:

[0093] ,

[0094] in, Expressed as The stability index of storage nodes, It is represented by a preset stability attenuation coefficient, which is set to 12.8 in this embodiment; the distributed storage of the processed file data shards includes disrupting the storage location mapping relationship of the file data shards using the chaotic sequence generated by the dynamic encryption parameters; in this embodiment, the current surviving node ID set is XORed with the current value of the chaotic sequence to generate a new obfuscation seed, the node list is shuffled by the Fisher-Yates algorithm to generate a new pseudo-random storage location sequence, and then the storage node is intercepted as the current shard storage target according to the redundancy of the erasure code.

[0095] Specifically, in S6, when the storage node is permanently offline, a key reconstruction operation is performed, including: checking whether the offline node belongs to the current surviving node, traversing the list of affected nodes to verify the legitimacy of the event; and the surviving node uses the Lagrange interpolation formula to reconstruct the key shards.

[0096] When a storage node is permanently offline, the key destruction operation is performed, including: freezing all key versions associated with the permanently offline storage node and marking them as obsolete; using chaos parameters to generate a one-time erase instruction driven by a physical unclonable function; and completing multiple rounds of overwriting and erasure of residual data on the key shard within a preset number of heartbeat cycles.

[0097] As attached Figure 2 The device for accessing files in a distributed NAS storage system includes:

[0098] Storage node perception module: monitors the topology status of each storage node in real time and generates topology change event codes based on changes in the topology status;

[0099] Key management module: Based on the topology change event code, dynamically manage the key lifecycle and perform distributed key management operations, including generating a first key for a new node when a storage node joins and triggering a reconstructed second key when a storage node exits;

[0100] An encryption link binding module: generating a dynamic encryption parameter bound to the topology information based on the topology information of the storage node and the first key and the second key of the dynamic management;

[0101] Verification and encryption module: based on the dynamic encryption parameters, generates a dynamic device fingerprint, and performs zero-trust verification and dynamic encryption processing on the file data slice corresponding to the first key and the file data slice corresponding to the second key;

[0102] Dynamic reorganization module: dynamically adjusts data redundancy based on the storage node topology state and the dynamic encryption parameters, and distributes the processed file data into shards and stores them in the storage nodes;

[0103] Key destruction module: triggers the reconstruction and destruction operations of the first key and the second key when it is detected that the storage node is permanently offline.

[0104] As attached Figure 3 As shown, in one embodiment, a system for file access in a distributed NAS storage system is provided, comprising:

[0105] Several storage nodes;

[0106] Several client interfaces;

[0107] The system central processing unit is capable of communicating and interacting with each storage node and each client interface to execute the method for accessing files in a distributed NAS storage system.

[0108] Among them, the storage node is used to store a large amount of data related to file access in a distributed NAS storage system, including but not limited to a large amount of historical operation data, the topological structure of historical storage nodes, a fuzzy rule base, and relevant parameters for calculating the stability index; the system central processing unit will frequently call this data from the storage node when performing various functions, thereby achieving precise control and efficient management of file access in a distributed NAS storage system; the fuzzy rule base in the storage node contains a variety of fuzzy rules defined by the experience of domain experts, and the fuzzy rules define the steps of combinatorial reasoning corresponding to the fuzzy set composed of relevant parameters for calculating the stability index.

[0109] Among them, the client interface connects to external devices such as display screens and cameras through standard wired interfaces or wireless interfaces to provide users with an interface for interacting with the system.

[0110] Among them, the system central processing unit includes one or more processing cores, which connect various parts within the entire system by utilizing various interfaces and lines; by running or executing instructions, programs, code sets or instruction sets stored in storage nodes, and being able to call the data stored therein, thereby performing various functions of a file access method in a distributed NAS storage system.

[0111] Secondly: The drawings of the embodiments disclosed in the present invention only involve structures related to the embodiments disclosed in the present invention. Other structures may refer to conventional designs. The same embodiment and different embodiments of the present invention may be combined with each other without conflict.

[0112] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for file access in a distributed NAS storage system, characterized in that: include: S1: Monitor the topology status of each storage node in real time and generate a topology change event code based on changes in the topology status; S2: Based on the topology change event code, dynamically manage the key lifecycle and perform distributed key management operations, including generating a first key for a new node when a storage node joins and triggering a reconstructed second key when a storage node exits; S3: Based on the topology information of the storage node and the dynamically managed first key and second key, generate a dynamic encryption parameter bound to the topology information; The dynamic encryption parameters include generating a chaotic sequence seed based on a hash value corresponding to the topology information of the storage node, generating an encryption parameter matrix that changes with the topology information through a logistic map, and binding the first key and the second key to the storage node coordinates; S4: Generate a dynamic device fingerprint based on the dynamic encryption parameter, and perform zero-trust verification and dynamic encryption processing on the file data shard corresponding to the first key and the file data shard corresponding to the second key; The dynamic device fingerprint includes CPU microarchitecture timing characteristics extracted based on physical unclonable functions, TCP retransmission rate and RTT variance within a sliding window, and chaotic values ​​in the encryption parameter matrix; The zero-trust verification is a three-factor verification mechanism, including: Generate a timestamp fingerprint containing a node stability index based on the dynamic encryption parameters; use a threshold signature to verify the legitimacy of the source node of the file data shard; verify that the storage node holds a legitimate key shard through a verifiable random function; if any of the verifications fails, trigger S1 to re-collect the topological status of the storage node; The dynamic encryption process dynamically divides the size of the file data slices according to the chaotic sequence seed, and encrypts the file data slices using an alternating encryption mode of SM4-CTR and ZUC algorithms; S5: Dynamically adjust data redundancy based on the storage node topology state and the dynamic encryption parameters, and distribute the processed file data into shards and store them in the storage nodes; The dynamically adjusting data redundancy is to dynamically adjust erasure code redundancy according to the node stability index; S6: When it is detected that the storage node is permanently offline, the reconstruction and destruction operations of the first key and the second key are triggered.

2. The method for accessing files in a distributed NAS storage system according to claim 1, wherein: S2, dynamically managing the key lifecycle, specifically includes: If the topology state corresponding to the topology change event code is a storage node joining event, a key shard of a new node is generated among the surviving nodes based on the elliptic curve threshold signature algorithm; If the topology state corresponding to the topology change event code is a storage node exit event, the key shards of the remaining nodes are reconstructed by the Lagrange interpolation method, and the key reconstruction completion time window is less than 100ms after the topology change event is triggered.

3. The method for accessing files in a distributed NAS storage system according to claim 1, wherein: In the S3, the dimension parameters of the encryption parameter matrix are synchronized with the current number of surviving nodes, and the update frequency of the matrix elements and the generation frequency of the topology change event code maintain a positive proportional mapping relationship.

4. The method for accessing files in a distributed NAS storage system according to claim 1, wherein: S4, Zero Trust Verification, specifically includes: The threshold signature verification adopts the (t,n) threshold BLS signature scheme; each node participating in the signature uses the private key sk k Generate a signature share for the message hash H(m) Specifically expressed as: Where σ represents the aggregated signature and H(m) represents the hash function that maps the message to the elliptic curve group G1.

5. The method for accessing files in a distributed NAS storage system according to claim 1, wherein: The dynamic encryption process in S4 includes: The file data fragments are encrypted using the alternating encryption mode of SM4-CTR and ZUC algorithms, wherein the switching period is dynamically controlled by the Lyapunov exponent of the chaotic sequence, and a pseudo-random length padding field is inserted into the encrypted payload, and the padding length satisfies: Among them, Fib(tmod64) represents the tmod64th term of the Fibonacci sequence, tmod64 represents the result of taking the current timestamp t modulo 64, Fib(tmod64)mod255 represents the result of taking the tmod64th term of the Fibonacci sequence modulo 255, M i,j Represented as a parameter in the dynamic encryption parameter, M i,j &0xFF means to convert M i,j Perform a bitwise AND operation with 0xFF.

6. The method for accessing files in a distributed NAS storage system according to claim 1, wherein: The S5, distributing and storing the processed file data in shards, includes adding an invisible watermark containing the zero-trust verification result to each shard.

7. The method for accessing files in a distributed NAS storage system according to claim 1, wherein: In step S6, when the storage node is permanently offline, the key destruction operation is performed, including: Freeze all key versions associated with permanently offline storage nodes and mark them as obsolete; Use chaos parameters to generate a one-time erase instruction driven by a physical unclonable function; Complete multiple rounds of overwriting and erasure of residual data in key shards within a preset number of heartbeat cycles.

8. A device for accessing files in a distributed NAS storage system, applied to a method for accessing files in a distributed NAS storage system according to any one of claims 1 to 7, characterized in that: include: Storage node perception module: monitors the topology status of each storage node in real time and generates topology change event codes based on changes in the topology status; Key management module: Based on the topology change event code, dynamically manage the key lifecycle and perform distributed key management operations, including generating a first key for a new node when a storage node joins and triggering a reconstructed second key when a storage node exits; An encryption link binding module: generating a dynamic encryption parameter bound to the topology information based on the topology information of the storage node and the first key and the second key of the dynamic management; Verification and encryption module: based on the dynamic encryption parameters, generates a dynamic device fingerprint, and performs zero-trust verification and dynamic encryption processing on the file data slice corresponding to the first key and the file data slice corresponding to the second key; Dynamic reorganization module: dynamically adjusts data redundancy based on the storage node topology state and the dynamic encryption parameters, and distributes the processed file data into shards and stores them in the storage nodes; Key destruction module: triggers the reconstruction and destruction operations of the first key and the second key when it is detected that the storage node is permanently offline.

9. A system for accessing files in a distributed NAS storage system, applied to a method for accessing files in a distributed NAS storage system according to any one of claims 1 to 7, characterized in that: include: Several storage nodes; Several client interfaces; The system central processor is capable of communicating and interacting with each storage node and each client interface to execute the file access method in a distributed NAS storage system as described in any one of claims 1 to 7.

Images