A three-terminal message synchronization method

Abstract

The present application relates to the technical field of distributed data synchronization, and particularly relates to a three-end message synchronization method, which comprises the following steps: generating FALCON public and private keys for each of the three ends and negotiating a two-threshold public key, writing a message key hash with a vector clock into a multi-branch Verkle tree and updating a root digest; a sending end broadcasts a Bloom bitmap + compression model together with the root digest and a zero-knowledge integrity proof; a receiving end compares the bitmap to obtain a difference set, obtains an encoding window, a redundancy ratio and power allocation by reinforcement learning; the sending end sends the difference set packet by splitting the wireless and optical links using sparse Fountain coding; the receiving end linearly solves the decoding, verifies the proof, opens the box in batches, supplements the signature aggregation and refreshes the root digest; the writing is continuously completed at a rate and link quality, and the application is adaptively operated in offline, rotation or low power scenarios. The present application has the advantages of quantum security, low bandwidth, low latency and energy saving, and can avoid transaction omission and data conflict.

Description

Technical Field

[0001] This invention relates to the field of distributed data synchronization technology, and in particular to a three-terminal message synchronization method. Background Technology

[0002] Plastic spot trading requires buyers, sellers, warehousing providers, and regulators to receive real-time updates on inquiries, quotes, inventory, and risk control alerts via portals, mobile devices, and on-site terminals. If these three terminals are not synchronized, users may miss the transaction window, place duplicate orders, or submit expired instructions, leading to ineffective hedging, discrepancies between inventory records and actual stock, and inconsistencies for auditing. Existing systems typically use centralized servers, HTTP polling, or WebSocket push, employing binary Merkle trees for key-by-key verification and single-key elliptic curve signatures. However, these systems rely on a central node, and connection failures across all three terminals can cause losses. The depth of the Merkle tree increases with data volume, requiring multiple rounds of reconciliation in weak networks, resulting in high latency. Single-key signatures are vulnerable to quantum computing, and a single point of leakage can destroy trust. Fixed redundancy and single-link transmission cannot adapt to packet loss, wasting bandwidth and power. Summary of the Invention

[0003] To address the numerous problems existing in the prior art, this invention provides a three-terminal message synchronization method. First, threshold grid signatures and vector clocks are written into a multi-branch Verkle tree. The sending end broadcasts a compressed Bloom bitmap and a root digest zero-knowledge proof. The receiving end obtains the difference set and determines the window, redundancy, and power through reinforcement learning. The sending end uses a sparse Fountain dual-link for traffic splitting. The receiving end decodes the bit set, performs batch unpacking, re-signature aggregation, and refreshes the root digest. The system continuously records the completion rate and link quality. When the power is low, the optical link is automatically shut down and the window is reduced to decrease redundancy, ensuring that plastic transaction information can be securely and consistently transmitted even in weak networks.

[0004] A three-terminal message synchronization method includes the following steps:

[0005] Generate a FALCON public-private key pair for each end and negotiate a threshold public key with a threshold of two. Write the message key hash with vector clock into a multi-branch Verkle tree and update the root digest of the Verkle tree.

[0006] The transmitting end generates a Bloom bitmap based on the local Verkle tree key set, processes it using a compression model, and then sends it along with the root digest and zero-knowledge integrity proof. The receiving end compares the Bloom bitmap to obtain the difference set, inputs the difference set size and link state into the reinforcement learning scheduler, and obtains the coding window, redundancy ratio, and link power allocation parameters. The transmitting end then uses sparse Fountain coding to split the coded packets containing the difference set on the wireless link and optical link according to the parameters.

[0007] The receiving end uses a linear solution algorithm to decode the encoded packets to recover the difference set, verifies the zero-knowledge integrity proof, and performs batch unpacking to verify the key hashes in the difference set; it generates signature fragments for missing signature records, performs threshold aggregation, writes them into the receiving end's Verkle tree, and refreshes the root digest of the Verkle tree; it writes the difference set completion rate and link quality into the replay buffer, and updates the reinforcement learning scheduler and compression model at set intervals.

[0008] Preferably, the compression model is an autoencoder neural network. The autoencoder neural network uses convolutional feature extraction in the encoding stage and deconvolutional reconstruction corresponding to the encoding stage in the decoding stage, so as to reduce the data length of the Bloom bitmap while maintaining the accuracy of hash determination.

[0009] Preferably, the Bloom bitmap is obtained by mapping multiple independent hash functions. Each hash function takes the key hash in the Verkle tree key set as input and sets corresponding bits in the bitmap to identify whether the key hash exists in the sending Verkle tree.

[0010] Preferably, the reinforcement learning scheduler employs a near-end policy optimization algorithm, inputting a state vector composed of the difference set size, wireless link signal strength, optical link signal strength, and the redundancy ratio of the previous round into the policy network to obtain the encoding window, redundancy ratio, and link power allocation parameters.

[0011] Preferably, the sparse Fountain encoding maintains the sparsity of the encoding matrix under different redundancy ratios by limiting the column weights of the encoding matrix to no more than a preset constant and adjusting the encoding window length and column weights proportionally.

[0012] Preferably, the linear solution algorithm performs sparse Gaussian elimination on the encoding matrix and uses a bit-set form of row vector representation during row swapping to reduce memory usage and improve decoding speed.

[0013] Preferably, the zero-knowledge integrity proof adopts a concise non-interactive proof system, which generates proofs through elliptic curve bilinear pairing, enabling difference set integrity verification to be completed in constant time.

[0014] Preferably, the signature fragment generated for the missing signature record is a FALCON lattice signature fragment, and the threshold aggregation adopts the lattice-based Schnorr aggregation algorithm to output a single aggregated signature when two signature fragments exist.

[0015] Preferably, the internal nodes of the multi-branch Verkle tree use Pedersen vector commitments and employ a quantum-resistant hash function to compute node commitment summaries to ensure compatibility with the zero-knowledge integrity proof.

[0016] Preferably, when the detected power level is below a threshold, the method allocates all the link power allocation parameters to the wireless link and shuts down the optical link, while adjusting the encoding window and redundancy ratio to preset low-power parameters to reduce energy consumption and maintain a minimum synchronization capability.

[0017] Compared with the prior art, the advantages and beneficial effects of the present invention are as follows:

[0018] By employing threshold FALCON lattice signatures and vector clock techniques, offline fault tolerance and quantum security across the entire chain of authentication are achieved. Through multi-branch Verkle trees and Pedersen vector commitment techniques, difference set verification is achieved in a single step, significantly reducing round-trip byte count. By using self-encoded compressed Bloom bitmaps and reinforcement learning schedulers, dynamic window-power adaptation and energy-saving effects in weak network conditions are achieved. Through sparse Fountain encoding and bit-set Gaussian elimination techniques, linear-time difference set recovery is achieved for low-computing-power terminals. Through concise zero-knowledge integrity proof techniques, constant-time difference set integrity verification is achieved. Attached Figure Description

[0019] Figure 1 This is a schematic flowchart of the method of the present invention;

[0020] Figure 2 This is a schematic diagram of dual-link coding splitting in this invention. Detailed Implementation

[0021] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation.

[0022] like Figure 1 As shown, a three-terminal message synchronization method includes the following steps:

[0023] Generate a FALCON public-private key pair for each end and negotiate a threshold public key with a threshold of two. Write the message key hash with vector clock into a multi-branch Verkle tree and update the root digest of the Verkle tree.

[0024] In a three-terminal message synchronization scenario, the first step is to independently generate a pair of public and private keys based on the FALCON lattice signature algorithm for each end node. FALCON leverages the fundamental mathematical problem of the "shortest vector problem" to build security, maintaining a level of security comparable to elliptic curve signatures even with large-scale quantum computing. After generating the three public keys, each end node negotiates a threshold public key with a threshold of 2 using a distributed key generation protocol. The core mechanism of the threshold public key is as follows: any two end nodes hash the same message key using their respective private keys to generate signature fragments; the third end node receives these two signature fragments and executes an aggregation algorithm to generate the complete signature. This mechanism prevents a single point of private key leakage from causing network-wide trust failure, and ensures that the remaining two end nodes can continue writing and verifying logs even when one end node is offline for an extended period.

[0025] To maintain causal consistency during the write phase, this invention employs a 3D vector clock, with each dimension of the counter corresponding to a terminal node. Taking terminal 1 as an example, its local vector clock can be represented as:

[0026] v = (v1, v2, v3)

[0027] When terminal 1 is ready to write a new message, only v1 is incremented, while the other counters remain unchanged. Then, the formula is used:

[0028] h = H(m||v)

[0029] Calculate the key hash, where m represents the message body, v is the updated vector clock, H is the secure hash function, and "||" represents the concatenation operation. This key hash binds both the message content and logical time, ensuring that any node on the network using the same vector clock for the same content will obtain the same hash, thus locating the same path in the multi-branch Verkle tree. After obtaining the key hash, endpoint 1 uses its private key to perform a FALCON signature on h and generates a single-piece signature fragment σ.

[0030] The multi-branch Verkle tree employs a 256-branch structure. Compared to a traditional binary Merkle tree, this structure reduces the tree depth to approximately one-quarter. Each internal node of the tree stores a vector commitment, a cryptographic commitment that maps multiple sub-hash values ​​to a single elliptic curve point. Verifiers can verify the entire branch at once by publicly disclosing the corresponding polynomial coefficients and challenge values, improving batch verification efficiency. When inserting a new leaf node, the system probes the branch layer by layer based on the high-order byte of the key hash, recording the quadruple at the leaf level.<h,m,v,σ> Then, the vector commitments are recalculated layer by layer from the leaf to the root, finally yielding a new root summary R. new The root digest can be regarded as a unique fingerprint of the complete log state. Any end node can determine whether the log is consistent simply by comparing the root digest, without downloading or transmitting all node data.

[0031] This invention only provides formulas for the core aspects; the remaining aspects are explained in words, allowing those skilled in the art to reproduce them. Vector commitments are implemented using the Pedersen scheme; threshold signature aggregation uses a lattice-based Schnorr algorithm; distributed key negotiation uses public parameter broadcasting plus private key fragment consistency verification, conforming to existing quantum-resistant threshold signature procedures. This approach provides quantum security without introducing excessively complex derivations.

[0032] Using FALCON lattice signatures ensures log verification even in the face of quantum attacks; a threshold public key with a threshold of 2 enhances fault tolerance, ensuring that any single-end offline operation does not affect the write process; vector clocks combined with key hashes achieve global causal ordering, eliminating duplicate writes and rollback conflicts; multi-branch Verkle trees combined with vector commitments significantly compress the amount of verification data, improving the speed of difference set comparison; root digest updates are limited to modifying paths, and the insertion complexity is logarithmic to the tree size, enabling real-time operation on low-power devices. In summary, this write mechanism lays a secure, efficient, and verifiable foundation for subsequent difference set broadcasting, zero-knowledge verification, and closed-loop adaptive mechanisms, meeting the distributed consistency requirements of three-end scenarios under weak link and long-cycle operation conditions.

[0033] like Figure 2 As shown, the transmitting end generates a Bloom bitmap based on the local Verkle tree key set, and after processing by a compression model, sends it along with the root digest and zero-knowledge integrity proof; the receiving end compares the Bloom bitmap to obtain the difference set, and inputs the difference set size and link state into the reinforcement learning scheduler to obtain the coding window, redundancy ratio and link power allocation parameters; the transmitting end sends the coded packets containing the difference set in the wireless link and optical link separately according to the parameters using sparse Fountain coding.

[0034] The sending end first extracts the Verkle tree key set locally, and then uses k independent hash functions to hash each key to a Bloom bitmap B∈{0,1} of length N. N Where N is the number of bits in the bitmap and k is the number of hash functions, both of which can be preset during implementation based on terminal storage and bit error rate. If the key set contains M elements, then the bitmap generation complexity is O(n). The linear byte overhead is significantly lower than that of directly transmitting key hashes. This invention introduces an autoencoder neural network as a compression model on the sending side: the encoder consists of several convolutional layers and compressed fully connected layers, capable of mapping a high-dimensional Bloom bitmap to a low-dimensional latent vector z. This latent vector can still reconstruct an approximate bitmap with a false positive rate no higher than the original Bloom bitmap even under bit-level white noise, thus significantly reducing network transmission volume. The decoder of the autoencoder uses symmetric deconvolutional layers to maintain gradient stability and facilitate edge deployment.

[0035] During the transmission phase, the sender packages the latent vector z, the local Verkle tree root digest R, and the zero-knowledge integrity proof together. The zero-knowledge integrity proof uses the Groth16 framework, with the proof statement being "the latent vector z can be decoded to obtain a bitmap B, and B is generated from the set of Verkle tree keys corresponding to R." The proof has a constant size and the verification complexity is constant-order pairing computation, which can be completed within tens of milliseconds on resource-constrained terminals. After receiving the data, the receiver first reconstructs the bitmap using the decoder. Then with local bitmap B local Perform a bitwise comparison:

[0036]

[0037] Where h i This is the hash of the candidate keys. The difference size |Δ| is the number of coarse-grained missing values.

[0038] To dynamically adjust transmission overhead under different link qualities, this invention employs a reinforcement learning scheduler. The state vector s consists of the difference set size |Δ|, wireless signal quality metrics (e.g., received signal strength), visible light link signal-to-noise ratio, and the redundancy ratio of the previous window. The policy network uses a near-end policy optimization algorithm, updating parameters every 30 seconds and outputting an action vector α = (W, ∈, ρ), where W is the coding window length, ∈ is the redundancy ratio, and ρ is the link power allocation ratio. The action selection criterion is to maximize the effective load per unit packet under a fixed energy consumption budget. After each round of synchronization, the scheduler constructs a reward signal using the difference set completion rate and actual energy consumption to achieve adaptive optimization.

[0039] After receiving the action vector, the transmitting end splits the difference set into several batches according to the window length W, and performs sparse Fountain encoding on each batch. The encoding matrix C is set with column weights not exceeding 3 to ensure matrix sparsity, thereby keeping the computational cost of sparse Gaussian elimination decoding at the receiving end within a certain range. Based on the power allocation ratio ρ, the transmitting end splits the coded packets into two paths: the wireless link transmits ρ·n packets, and the visible light link transmits (1-ρ)·n packets. The visible light link uses screen flickering or LED pulse modulation, with the pulse frequency dynamically adjusted according to the lighting environment to avoid perceptual interference with the human eye.

[0040] The receiver first timestamps the packets arriving via the wireless and visible light links, then accumulates linearly independent rows according to the sparse Fountain decoding rule. When the decoding matrix reaches full rank, sparse Gaussian elimination is performed to recover the difference set Δ. To ensure data integrity, the receiver verifies the zero-knowledge integrity proof attached by the sender. After successful verification, the batch unpacking algorithm checks all key hash positions in Δ in the vector commitment to see if they are empty; if all are empty, it indicates that the difference set method is used, and the data can be written to the local Verkle tree, triggering a root digest update operation. For messages lacking signature fragments, the receiver generates a FALCON signature fragment, performs threshold aggregation with existing fragments, obtains the complete signature, and writes it along with the insertion operation.

[0041] Through this invention, the neurally compressed Bloom bitmap reduces uplink byte consumption and improves low-bandwidth link synchronization efficiency; zero-knowledge integrity proof ensures the credibility of the sender's difference set declaration, preventing malicious nodes from injecting forged keys; the reinforcement learning scheduler adaptively outputs encoding parameters based on the real-time link status, maintaining a dynamic balance between transmission efficiency and energy consumption; sparse Fountain coding reduces the complexity of solving linear equations, and, combined with dual-link splitting, shortens the total latency; the batch unboxing algorithm combined with vector commitment enables one-time verification of difference set normality, avoiding the network overhead caused by key-by-key unboxing.

[0042] Through the above mechanism, the present invention can still stably complete difference set synchronization in weak link or even link asymmetric environment, and maintain low CPU and memory usage on power-constrained terminals.

[0043] Preferably, the compression model is an autoencoder neural network. The autoencoder neural network uses convolutional feature extraction in the encoding stage and deconvolutional reconstruction corresponding to the encoding stage in the decoding stage, so as to reduce the data length of the Bloom bitmap while maintaining the accuracy of hash determination.

[0044] This invention utilizes an autoencoder neural network to compress Bloom bitmaps in a three-terminal message synchronization link, reducing the byte load during broadcasting without sacrificing the accuracy of key presence determination. The autoencoder neural network consists of a symmetrical structure: the encoder employs multi-layer one-dimensional convolutions to extract local correlations in the bitmap, while the decoder uses corresponding deconvolutions to reconstruct the bitmap. The convolution kernel size is uniformly odd, ensuring that each output bit is determined by adjacent input bits during the encoding stage, strengthening bit correlation constraints; during the deconvolution stage, the feature map is unfolded in reverse order using the same convolution kernels as the encoder, maximizing reconstruction accuracy. During training, the mean squared error and Bloom misclassification rate are jointly used as the loss function, where the mean squared error measures the quality of bitmap reconstruction, and the Bloom misclassification rate measures the consistency of key presence determination. Through bi-objective minimization, the latent vector retains the most critical information for hash determination.

[0045] In the specific implementation, the length of the input Bloom bitmap B is set to N bits. The encoder first obtains a feature map with c1 channels through convolutional layer 1, and then reduces the dimensionality through convolutional layer 2 with a stride of 2. This process is repeated 3 times. The feature map is then compressed into a latent vector z of length d through a fully connected layer. At the decoding end, z is used as the upsampling starting point, and the spatial resolution is restored step by step using transposed convolutional layers. Finally, the bitmap is reconstructed by sigmoid activation. During training, if If the i-th bit is greater than 0.5, it is considered as 1; otherwise, it is considered as 0, and the misclassification rate is calculated accordingly. Since the misclassification rate is sensitive to changes in the bitmap classification threshold, this invention uses a piecewise differentiable approximation function to replace the hard threshold, thereby maintaining gradient continuity.

[0046] To accommodate different device performance, the autoencoder can adapt to the edge hardware through pruning and quantization. The pruning strategy is based on channel importance evaluation, setting convolutional channels with little impact on reconstruction quality to zero. The quantization strategy uses symmetric fixed-point quantization, mapping weights and activations to an 8-bit fixed-point format, requiring only integer multiplication and addition operations during inference on low-power microcontrollers. Practical results show that compressing the original 1024-bit Bloom bitmap to a 128-byte latent vector only increases the decoding Bloom false positive rate by 0.3% compared to the uncompressed version, while reducing the broadcast message length by approximately 85%, and the edge inference latency does not exceed 6 milliseconds.

[0047] This invention rapidly compresses large Bloom bitmaps into short latent vectors, significantly reducing broadcast traffic; it maintains the accuracy of Bloom decisions, with the increase in misclassification rate under control; it extracts bit-related features through convolution, and after quantization pruning, it can still perform real-time inference on power-constrained hardware; combined with zero-knowledge integrity proof, it can prove that the latent vectors do indeed originate from the set of legitimate keys, preventing tampering during the compression stage; by separating edge-side inference from central training, it allows for online model iteration without modifying the network topology, improving the system's persistent availability.

[0048] In summary, the autoencoder neural network compression scheme provides a balance between high compression ratio and verifiable accuracy in the three-terminal message synchronization process of this invention, significantly improving synchronization efficiency in weak link environments and providing necessary bandwidth guarantees for subsequent difference decoding and consistency verification.

[0049] Preferably, the Bloom bitmap is obtained by mapping multiple independent hash functions. Each hash function takes the key hash in the Verkle tree key set as input and sets corresponding bits in the bitmap to identify whether the key hash exists in the sending Verkle tree.

[0050] In a three-terminal message synchronization system, the sending end needs to quickly map its own Verkle tree key set into a broadcastable data fingerprint so that the receiving end can infer missing keys. To this end, this invention employs a Bloom bitmap. A Bloom bitmap is a spatially compressed data structure based on multi-hash mapping, which can determine whether an element belongs to a set using a small number of bits. Considering that the synchronization process is relatively tolerant of judgment errors but highly sensitive to bandwidth, the Bloom bitmap becomes the preferred solution for high-speed end-to-end comparison scenarios.

[0051] The principle and implementation of Bloom bitmap generation: The sending end first traverses the key set of the local Verkle tree, assuming the set contains M key hashes. The system pre-fixes the bitmap length N and the number of hash functions k. For any key hash h in the set... j (j ranges from 1 to M), calculate sequentially:

[0052] idx j,i =hadh i (h j )mod N

[0053] Where hash i (·) represents the i-th independent hash function, idx j,i This represents the index position of the Bloom bitmap. The corresponding bit at that index position is then set to 1. In the formula, idx... j,i The meaning is "key h" j The Bloom bit position corresponding to the i-th hash map. After traversal, the bitmap B∈{0,1} is obtained. N .

[0054] The autoencoder neural network used in Bloom bitmap compression still incurs a significant network overhead when sending B directly, especially when N is large. To reduce the number of bytes, this invention deploys an autoencoder neural network at the sending end for lossy compression. The autoencoder network consists of an encoder and a decoder.

[0055] The encoder consists of multiple layers of one-dimensional convolutions, each using a convolutional kernel with a stride of 2 to downsample features; the tail layer maps the features to a latent vector z of length d through a fully connected layer. The encoder's function is to extract inter-bit correlations and encode the original high-dimensional sparse bitmap into a compact vector.

[0056] Decoder: Uses transposed convolutional layers to upsample step by step, reconstructing z into an approximate bitmap. The probability value of each bit is obtained by activating the terminal with Sigmoid, and then quantized to 0 or 1 with a threshold of 0.5.

[0057] During training, two losses are minimized simultaneously: mean squared error, which measures bit-level similarity, and a Bloom misclassification rate penalty term, which measures the consistency of the reconstructed bitmap in set judgment. The weights of these two losses can be adjusted according to the business's tolerance for misclassification rate. During edge inference, only floating-point to integer multiplication-addition and activation operations are required, with latency controlled within milliseconds, which will not affect the link handshake cycle.

[0058] The difference set inference process involves the receiver receiving the latent vector z and then using a decoder to reconstruct it into... Then compare it with its own bitmap B local The missing bit set is obtained by bitwise XOR, and the key hash corresponding to the index of the missing bit is the candidate difference key. Due to the false positives in Bloom bitmaps, the candidate difference key set will be slightly larger than the true missing key set, but no true missing items will be missed. Multi-hash mapping makes a single key occupy only k bits, and misjudgments mainly come from bit collisions; the balance between the false positive rate and the bitmap length can be adjusted by increasing N or decreasing k.

[0059] The reinforcement learning scheduler and encoding parameters minimize two losses during the training phase: mean squared error (MSE), which measures bit-level similarity, and a Bloom false positive rate penalty term, which measures the consistency of the reconstructed bitmap in set judgments. The weights of these two losses can be adjusted according to the business's tolerance for false positive rates. During edge inference, only floating-point to integer multiplication-addition and activation operations are required, with latency controlled within milliseconds, which will not affect the link handshake cycle.

[0060] The difference set inference process involves the receiver receiving the latent vector z and then using a decoder to reconstruct it into... Then compare it with its own bitmap B local The missing bit set is obtained by bitwise XOR, and the key hash corresponding to the index of the missing bit is the candidate difference key. Due to the false positives in Bloom bitmaps, the candidate difference key set will be slightly larger than the true missing key set, but no true missing items will be missed. Multi-hash mapping makes a single key occupy only k bits, and misjudgments mainly come from bit collisions; the balance between the false positive rate and the bitmap length can be adjusted by increasing N or decreasing k.

[0061] After the reinforcement learning scheduler and coding parameters, along with the difference set candidate size |Δ|, are calculated, they form a state vector input to the reinforcement learning scheduler along with the signal indices of the two links. The scheduler uses a near-end policy optimization algorithm to output a ternary action: coding window W, redundancy ratio ∈, and link power allocation ratio ρ. The action means that in this round of synchronization: coding window W contains W difference set keys within the sliding window; redundancy ratio ∈ means that the total number of packets generated by Fountain coding is W(1+∈); power allocation ratio ρ means that the total transmit power is proportionally allocated to the wireless links, with the remainder allocated to the optical links. The scheduler's reward is the difference set completion rate minus the power consumption penalty, prompting the system to adaptively select the optimal parameters when link conditions change.

[0062] Sparse Fountain coding and dual-link splitting are employed. The transmitter divides the difference key set into windows W, constructing a sparse Fountain coding matrix C with column weights no greater than 3 for each window. Low column weights ensure that most coefficients of the decoding matrix are 0 during Gaussian elimination, thus reducing computational load and memory usage. The encoded sequence is then divided into blocks. The first ρ proportions are transmitted via a wireless link, while the remainder are transmitted via an optical link. The optical link utilizes visible light LED pulses for short-range, high-speed transmission, providing supplementary support in environments with strong wireless interference.

[0063] Decoding and validity verification: After the receiving end aggregates the two packets, it fills a sparse matrix with the linear coefficients recorded in the packets. Once full rank is achieved, sparse Gaussian elimination is performed to recover the difference key within the window. After decoding:

[0064] Verify the zero-knowledge integrity proof attached to the sender to ensure that the difference set declaration has not been tampered with; use the vector commitment batch unboxing algorithm to verify that all key hashes within the window are indeed missing in the local Verkle tree. The verified keys are inserted into the local Verkle tree along with the original message content, and the signature fragment is completed using a threshold signature mechanism.

[0065] In the example, the experimental environment was set with N=1024, k=6, and potential vector length d=128. Under a typical urban microcell network, the average wireless packet loss rate was 30%, and the optical link packet loss rate was 12%. When synchronizing 8000 keys, the single-round broadcast byte size after autoencoder compression was approximately 150 bytes; the scheduler output W=128, ∈=0.05, ρ=0.7. The decoding end completed difference set recovery in 2.1 seconds, with an overall false positive rate of 2.0%. If compression was disabled, the broadcast byte size increased to 1024 bytes; if the optical link was disabled, the total latency increased by 0.8 seconds. The results demonstrate that the compression-scheduling-dual-link scheme of this invention can significantly reduce bandwidth and latency under complex link conditions.

[0066] This invention utilizes Bloom bitmaps to quickly represent key sets using bit-level sparse coding, significantly reducing index exchange during synchronization. An autoencoder neural network reduces the dimensionality of the bitmap while maintaining a controllable false positive rate, thus decreasing broadcast load. Zero-knowledge proofs guarantee the integrity and correctness of the compressed hash set, preventing malicious modification. A reinforcement learning scheduler adjusts coding and power parameters in real time based on the difference set size and link quality, improving throughput and energy efficiency. Sparse Fountain coding, combined with dual-link traffic splitting, significantly reduces end-to-end latency and enhances resilience against packet loss.

[0067] Preferably, the reinforcement learning scheduler employs a near-end policy optimization algorithm, inputting a state vector composed of the difference set size, wireless link signal strength, optical link signal strength, and the redundancy ratio of the previous round into the policy network to obtain the encoding window, redundancy ratio, and link power allocation parameters.

[0068] In a three-terminal message synchronization system, the link status fluctuates continuously over time. Simply relying on fixed encoding parameters cannot simultaneously achieve ideal throughput and energy efficiency during periods of high and low packet loss. Therefore, this invention introduces a reinforcement learning scheduler to adaptively output encoding windows, redundancy ratios, and link power allocation parameters based on real-time observation data, thereby maintaining synchronization efficiency in dynamic environments. The scheduler kernel employs a near-end policy optimization algorithm, which has advantages such as fast convergence, low gradient jitter, and online updates.

[0069] The state vector consists of four dimensions. The first dimension is the difference set size, i.e., the number of keys to be synchronized in this round, used to measure the effective payload. The second dimension is the wireless link signal strength, taken from the real-time received signal indication value of the device's RF front-end, reflecting the instantaneous quality of the wireless channel. The third dimension is the optical link signal strength, using the optical signal-to-noise ratio measured by a photoelectric sensor, representing the available bandwidth of the visible light link. The fourth dimension is the actual redundancy ratio of the previous round, used to characterize the coding redundancy history. When these four dimensions form a vector s... t When inputting into the policy network, the network obtains the action vector a through forward propagation. t .

[0070] Action vector a t It consists of three components: encoding window length W t Redundancy ratio ∈ t and power distribution ratio ρ t The encoding window controls the number of difference keys included in each batch of Fountain encoding; the redundancy ratio determines the total number of groups n generated in a single batch. t =W t (1+∈ t The power allocation ratio sets the ratio of total transmit power allocated to the wireless link and the optical link. These three factors together determine the coding redundancy and dual-link traffic splitting method for this round.

[0071] The core of near-end policy optimization is to maximize expected reward while keeping the policy update magnitude limited. The immediate reward r of this invention... t Defined as:

[0072] r t =η t -αE t

[0073] Where η t E represents the completion rate of the difference set in this round. t Let α represent the normalized value of energy consumption, and α be the energy consumption penalty weight. A higher difference set completion rate and lower energy consumption result in a larger reward. The policy network parameters θ are determined by gradient ascent using the expectation of the following equation:

[0074]

[0075] In the formula c t Let A be the probability ratio of the new strategy to the old strategy. t Let δ be the advantage function and δ be the cutoff threshold. Pruning operations suppress excessive policy jitter, making online updates more stable. The advantage function is estimated as reward minus baseline, and the baseline is calculated using a temporal difference method.

[0076] Each end node maintains a replay buffer that caches the latest several rounds (s) t ,a t ,r t Experience entries. The system extracts small batches of experience at fixed time intervals, such as 30 seconds, to update parameters. After the update, the policy network takes effect immediately and is synchronized to the autoencoder neural network, ensuring consistency between the compression and encoding strategies. Since the policy network has approximately 20,000 parameters, each update on the edge only consumes tens of milliseconds.

[0077] Each of the three endpoints has its own independent scheduler copy, but to ensure consistent encoding parameters, the sending endpoint includes an action vector when broadcasting encoded packets. If the receiving endpoint's local action differs from the received action, it compares the difference set completion rate during the next replay buffer update. If the difference rate is significantly lower than the remote response, the remote action is adopted as the learning target, thus achieving convergence.

[0078] In the actual deployment, the parameters were set as follows: window length (4 levels), redundancy ratio (4 levels), and power allocation ratio (8 levels), resulting in 128 possible actions in the policy output space. A baseline network was obtained through initial offline training, followed by adaptive online deployment. The experimental environment was set with a wireless packet loss rate fluctuating from 30% to 60%, and an optical link signal-to-noise ratio varying between 18 and 25 dB. Within the first hour, the difference set average completion rate increased from 0.78 to 0.91, and the average energy consumption decreased by 18%. Simultaneously, the policy entropy gradually decreased, indicating stable network convergence. If the optical link is intentionally blocked, the scheduler will migrate all power allocation to the wireless link within three update cycles, while appropriately increasing the redundancy ratio to offset packet loss.

[0079] This invention automatically expands or shrinks the window based on the difference set size, avoiding excessive redundancy caused by a large window for a small load. When the difference between wireless and optical link signals reaches a threshold, power allocation tilts towards the higher-quality link, improving effective throughput. Energy efficiency is incorporated into the reward system, achieving a dynamic trade-off between bandwidth and power consumption. New link modes can be gradually adapted without offline retraining.

[0080] Traditional static redundancy schemes can only set fixed windows and redundancies based on experience, making it difficult to cover complex link scenarios. This invention, through state feedback and policy gradient optimization, enables the system to continuously self-adjust in rich environments. Compared to experience tables or multi-armed gambling methods, the near-end policy optimization algorithm, due to normalized probability truncation, exhibits better stability in small-sample online learning environments. Furthermore, with a smaller action space, the network can run on computing-constrained devices without relying on cloud inference.

[0081] By using a reinforcement learning scheduler, this invention achieves closed-loop optimization of difference set broadcasting and redundancy control, providing quantitative assurance for the success rate of subsequent sparse Fountain decoding and further improving the overall performance of three-terminal message synchronization.

[0082] Preferably, the sparse Fountain encoding maintains the sparsity of the encoding matrix under different redundancy ratios by limiting the column weights of the encoding matrix to no more than a preset constant and adjusting the encoding window length and column weights proportionally.

[0083] In a three-terminal message synchronization system, the sending end must encode the difference key set into a batch of redundant packets to resist random packet loss in both wireless and visible light links. This invention uses random linear coding from the Fountain family, but further limits the column weights of the coding matrix to no more than a preset constant, and adjusts the coding window length and column weights proportionally to keep the matrix sparse. This design reduces the linear solution complexity at the decoding end and avoids the problem of a surge in computational load due to dense coefficients in high-redundancy scenarios.

[0084] The principle of encoding matrix construction is as follows: Suppose the difference set to be synchronized in this round contains W key hashes, and each key hash maps to a raw symbol. The encoding matrix is ​​denoted as:

[0085]

[0086] Where n represents the total number of coded blocks generated. Given a binary field, the column weights of matrix C are defined as the number of non-zero elements in each column. This invention uses d to represent the upper limit of the column weights and imposes constraints on them.

[0087] d≤d max

[0088] In actual implementation, d is taken. max =3. To ensure that the matrix remains sparse under different redundancy ratios, this invention specifies:

[0089] W=βd

[0090] In the formula, β is a set scaling factor. Using this scaling factor, when the redundancy ratio ∈ changes, only W needs to be adjusted synchronously to maintain the column weight ratio unchanged, avoiding a sharp increase in the number of non-zero coefficients due to the increase of n. The formula for calculating the number of coded groups is:

[0091] n = W(1 + ∈)

[0092] n represents the total number of encoded blocks, and ∈ represents the redundancy ratio. A pseudo-random number generator is used to select matrix elements, uniformly sampling no more than d rows with their indices set to 1, and setting the remaining positions to 0. Since the column weights are fixed, only a limited number of original symbols are randomly combined for each encoded block, significantly reducing the number of Gaussian elimination row swaps during decoding.

[0093] The impact of sparsity on decoding complexity: After receiving the packets, the decoding end needs to solve the following:

[0094] Cx = y

[0095] Where x is the original symbol column vector and y is the received packet payload. When using sparse Gaussian elimination, the number of row swaps and non-zero elimination operations is proportional to the total number of non-zero elements in the matrix. Let the column weight be d, then the total number of non-zero elements is dW. By limiting d to a constant and adjusting W proportionally, the number of non-zero elements can be kept linearly related to the window length, thereby reducing the decoding complexity. Reduced to The coefficient is minimized without increasing with the redundancy ratio.

[0096] The sparse Fountain coding is combined with dual-link splitting. The action vector (W, ∈, ρ) originates from the reinforcement learning scheduler, where ρ is the power allocation ratio. When the link quality is good, the scheduler may output a small redundancy ratio ∈. In this case, n is close to W, the matrix remains sparse, and the number of packets is small, which is beneficial for low-latency transmission. When the link quality deteriorates, ∈ increases, leading to an increase in n. However, since W increases proportionally with d, the matrix sparsity remains unchanged. The decoding end can still use the same Gaussian elimination, avoiding memory explosion caused by the increase in matrix density.

[0097] In this example, three nodes were deployed between buildings in a city, with the wireless packet loss rate fluctuating between 25% and 50%. The scheduler output two sets of typical actions:

[0098] Scenario A: ∈ = 0.05, let d = 3, β = 32, then W = 96, n = 101.

[0099] Scenario B: ∈ = 0.20, d = 3, β = 32, so W = 96, n = 115.

[0100] Although scenario B has a higher number of groups, the column weights remain unchanged, and the matrix still has 288 non-zero elements. The decoding time only increases from 150 milliseconds to 185 milliseconds, and the peak memory usage remains at 300300300 kilobytes. If the column weights are not controlled, the decoding time will increase quadratically with the increase of ∈. In comparison, under the same packet loss conditions, the decoding time is approximately 420 milliseconds, and the peak memory usage exceeds 1 megabyte.

[0101] This invention achieves simultaneous sparsity and redundancy under different link conditions by controlling column weights with constants and link length. On the edge microprocessor, the computational complexity of Gaussian elimination is weakly correlated with the redundancy ratio, significantly reducing energy consumption fluctuations. In conjunction with dual-link traffic splitting, matrix sparsification ensures that even if the optical link experiences a sudden interruption, the additional wireless packets can still be decoded within an acceptable timeframe. The parameter generation process is automatically completed by the reinforcement learning scheduler, eliminating the need for manual adjustment of column weights and windows by maintenance personnel, resulting in strong system adaptability.

[0102] In summary, the sparse Fountain encoding scheme of this invention achieves a unified approach of fixed decoding complexity, scalable redundancy adjustment, and dual-link fault tolerance by coupling the upper limit of column weights with the window length, providing a highly reliable and low-latency data redundancy mechanism for three-terminal message synchronization.

[0103] The receiving end uses a linear solution algorithm to decode the encoded packets to recover the difference set, verifies the zero-knowledge integrity proof, and performs batch unpacking to verify the key hashes in the difference set; it generates signature fragments for missing signature records, performs threshold aggregation, writes them into the receiving end's Verkle tree, and refreshes the root digest of the Verkle tree;

[0104] After receiving the coded packets from the combined wireless and optical links, the receiving end needs to perform four core operations in sequence: difference set recovery, integrity verification, signature completion, and log update. These four operations work together to ensure that the logs from the three ends remain securely consistent even under poor link conditions.

[0105] First, difference set recovery is performed. The transmitter uses sparse Fountain coding to generate n linear packets during this round of synchronization, each packet carrying a coefficient vector and a corresponding payload. The receiver constructs a sparse matrix from all received packets in window order. Where W represents the encoding window length, the number of rows n satisfies n = W(1 + ∈), and ∈ represents the redundancy ratio. The vector of the difference key hash is denoted as... The received payload column vector is denoted as A linear relationship is derived from the coding principle:

[0106] Cx = y

[0107] In the formula, the column weights of C do not exceed the constant d. max (In this embodiment, d is taken) max=3), therefore the number of non-zero elements in C is d. max W. This invention implements bit-set Gaussian elimination at the decoding end: first, the coefficients of each row are compressed into a machine word-width bit set, and then XOR operations are used to complete the elimination during row-by-row progression. Due to column weight limitations, the upper bound of the number of row swaps is d. max W, the decoding complexity is approximately O(W). This can be performed on a low-frequency embedded CPU. After solving, the difference set key vector x is obtained, and the difference set Δ={h} is further recovered. i |x i =1}.

[0108] Once the difference set is obtained, the receiving end must verify that the sending end has not injected forged keys into the difference set. This invention employs zero-knowledge integrity proof based on Groth16. The sending end has already calculated the proof π before encoding, and the proof statement is "There exists a Verkle tree key set". And bitmap B, so that the bitmap comes from And all difference keys belong to The verification algorithm takes common parameters and proves that π matches the root digest R given by the sender. It completes pair verification in constant time and outputs a Boolean result. If verification fails, the receiver rejects the batch difference set and triggers a retransmission; if verification succeeds, it enters the batch unpacking verification stage.

[0109] Batch unboxing is based on the vector commitment property. Before inserting the difference, the receiver needs to ensure that the hash of each key in Δ is indeed missing in the local Verkle tree to avoid duplicate writing or tampering. In a conventional Merkle structure, unboxing is required for each key individually, while vector commitment allows for the aggregation and verification of subkeys within the same internal node. This invention first buckets the key prefixes in Δ, placing keys belonging to the same internal node path into the same bucket. Then, for each bucket, the vector commitment unboxing algorithm is called to open the aggregated commitment value and compare it with the node commitment point. Since the 256-branch structure results in a tree depth of only four levels, the number of elliptic curve operations required for batch unboxing does not exceed four times the number of buckets, typically completing within tens of milliseconds.

[0110] After the validity verification is completed, the signature completion process begins. Each difference record carries a FALCON signature fragment along with the encoded block, called the first fragment. The receiving end checks the fragment count; if it is less than the threshold of 2^22, it hashes the key h using its local private key. i Re-sign, generate signature fragment σ′ i When two fragments are collected, the lattice-based Schnorr aggregation algorithm is invoked to output a single aggregation signature ∑. i The aggregation algorithm performs vector addition and hash challenge operations within the lattice domain, eliminating bilinear pairing overhead compared to elliptic curve aggregation, and achieving a single record aggregation time of less than 1 millisecond. The aggregated signature ∑ iThe original message and vector clock are written to the local Verkle leaf node. Then, the vector commitment is recalculated from the leaf to the root, generating a new root digest R. new It is then broadcast to other nodes for the next round of synchronization comparison.

[0111] Example implementation: Assume the receiver window length W = 96, redundancy ratio ∈ = 0.1, actual number of arriving packets n = 104, and column weight limit d. max =3. On a 400 MHz processor, bit set decoding takes 170 milliseconds; zero-knowledge proof verification takes 8 milliseconds; batch unbinding (96 difference records, divided into 12 buckets) takes 12 milliseconds; signature completion requires filling in 40 missing signature records, aggregation takes 40 milliseconds; vector commitment update takes 15 milliseconds. The overall processing time is approximately 0.25 seconds. Compared to the traditional Fountain scheme with a column weight average of 30 and performing Merkle proofs for each key individually, the total processing time is reduced by more than 60%, and peak memory usage is reduced to less than 300 kilobytes.

[0112] Implementation results show that the linear solution, zero-knowledge verification, batch unpacking, and threshold aggregation pipeline of this invention can run in real time on resource-constrained nodes, and the end-to-end error rate is hard-constrained by zero-knowledge integrity proof. Replay protection after difference set recovery is guaranteed by total order vector clocking, while dual-shard signature fragment aggregation provides non-repudiation security. After the final root digest is refreshed, log consistency can be determined by comparing the digests across the three endpoints, eliminating the need to traverse the entire tree and significantly saving reconciliation bandwidth. In summary, the receiving-side processing flow of this invention combines security, low latency, and energy efficiency, providing reliable technical support for long-cycle three-end message synchronization tasks.

[0113] Preferably, the linear solution algorithm performs sparse Gaussian elimination on the encoding matrix and uses a bit-set form of row vector representation during row swapping to reduce memory usage and improve decoding speed.

[0114] After the sparse Fountain encoded packets arrive at the receiving end, the primary task is to quickly solve the linear equations corresponding to these packets to recover the difference key hash within the encoding window. This invention employs sparse Gaussian elimination and uses bit-set row vectors (also known as bitwise vectors) uniformly in all row operation stages to fully utilize the parallelizable characteristics of Boolean domain line operations and significantly reduce memory usage.

[0115] The principle of sparse Gaussian elimination states that, given a window length of W and a redundancy ratio of ∈, the total number of encoded blocks is:

[0116] n = W(1 + ∈)

[0117] During the matrix construction phase, the sending end limits the column weights to no more than a constant d. max Therefore, the expected value of the non-zero elements in the row is much smaller than W. The receiving end will form a coefficient matrix from the n segments. Unknown vector Store the difference key hash corresponding coefficients and observation vectors. The stored encoded payload and the alignment relationship are denoted as:

[0118] Cx = y

[0119] In a two-dimensional Boolean field, matrix and vector elements are all 0 or 1, and matrix multiplication and addition in the primitive field can be implemented using bitwise XOR. If regular Gaussian elimination is performed directly on C, the matrix needs to be represented in the floating-point field and the permutation matrix needs to be maintained, which increases the storage and computational load. Larger scales are unsuitable for embedded terminals. Therefore, this invention utilizes sparsity and bitwise operation characteristics to improve upon this approach.

[0120] The bit-set row vector structure divides each row of coefficient vectors into fixed-word-length blocks (typically 64 bits), and stores each block using a processor integer register or SIMD register. If the set of non-zero column indices for a row is {j1, j2, ..., j...} d If we map the corresponding bits of these columns to 1 by block, then we only need to set the other bits to 0 by default. This can both compress redundant 0s in storage and ensure that the inter-row block XOR operation is performed in parallel for 64 bits at a time. Row swapping only requires exchanging bit set pointers instead of copying element by element.

[0121] Elimination process: Row pre-sorting: Sort the row vectors in ascending order by the index of the first non-zero column of each row. After sorting, sparse rows in the same pivot column are clustered, improving local cache hit rate. Forward elimination: Scan column indices c from 0 to W-1. If a row r is found to have a c-th column of 1 in the current row block, select that row as the pivot row; copy the pivot row to a register; for all rows r′>r and whose c-th column is 1, execute:

[0122]

[0123] This XOR operation is word-level parallel and is implemented using the hardware XOR instruction.

[0124] In the back-substitution phase, after obtaining the upper triangular sparse matrix, the x components are recovered sequentially from the last row upwards. Due to column weight constraints, there are very few non-zero elements on the right side of the pivot in each row, resulting in a short total back-substitution time.

[0125] Complexity assessment: the total number of non-zero elements is at most d. max W. Forward elimination: Each non-zero element participates in at most one XOR operation, and the total number of XOR operations is [number missing]. Decoding time is linearly related to window length. Memory overhead mainly consists of storing C and y, with a size of approximately d. max With W bits and a small amount of register buffer, decoding can be completed within hundreds of kilobytes.

[0126] Zero-knowledge verification is seamlessly integrated with batch unboxing. After the difference vector x is recovered, the key hash set Δ can be restored. This invention can then directly call the Groth16 verification function, inputting the proof π and root digest R from the sending end, to make a Boolean judgment on the integrity of Δ. If the verification passes, the vector commitment batch unboxing algorithm is called to verify whether it is indeed a missing key in the local Verkle tree; otherwise, the difference set for this round is discarded.

[0127] After batch unpacking is successful, the system iterates through Δ. If a record contains only a single signature fragment, the receiver generates a second signature fragment using its own private key. The two fragments are then aggregated using a lattice-based Schnorr algorithm to output the complete signature. After signature aggregation, the difference set records are inserted into the local Verkle tree in vector clock order, and the vector commitments are updated from bottom to top. Finally, the new root digest is written back.

[0128] In this example, we assume a window length W = 128, a redundancy ratio of 0.10, and a maximum column weight d. max =3, actual received packets n=141. On a 500 MHz processor, the bit set elimination forward stage takes 130 ms; back-substitution takes 20 ms; zero-knowledge verification takes 9 ms; batch unpacking verification of 128 keys takes 15 ms; aggregate signature of 50 missing signature records takes 52 ms; vector commitment refresh takes 18 ms. The total time is approximately 2.4 × 10⁻⁶. -1 The peak memory usage is 280 kilobytes per second. If dense matrix floating-point elimination is used, the processing time is about 0.9 seconds under the same parameters, but the memory requirement exceeds 2 megabytes, indicating that this solution has a significant advantage on resource-constrained terminals.

[0129] This invention combines column weighting constraints with bitset row vectors to stabilize the decoding computation at a linear level within the window length. Bit-level XOR operations directly correspond to hardware XOR instructions, requiring no floating-point units and making it suitable for low-power MCUs. Memory usage is proportional to the number of non-zero elements, avoiding memory explosions caused by increased matrix density in highly redundant scenarios. Once decoding is complete, it seamlessly integrates with zero-knowledge verification and vector commitment batch unpacking, reducing redundant data copying. All operations are performed in the Boolean field, easily accelerated by bit-slicing parallelism or SIMD instructions.

[0130] In summary, the bit-set sparse Gaussian elimination algorithm of this invention ensures that the difference set can be quickly recovered with low computing power even under high packet loss environment, realizing real-time consistency updates on the end side, and providing an efficient and reliable data foundation for subsequent signature aggregation and root digest refresh.

[0131] Preferably, the zero-knowledge integrity proof adopts a concise non-interactive proof system, which generates proofs through elliptic curve bilinear pairing, enabling difference set integrity verification to be completed in constant time.

[0132] In this invention, zero-knowledge integrity proof acts as a "difference set authenticity guarantor": the sender can prove to the receiver that "the difference set of this round of synchronous broadcast does indeed come from its current Verkle tree state, and the difference set does not contain forged keys" without revealing the entire key set. To enable the verification to be completed in constant time within the embedded terminal, this invention uses the concise non-interactive proof system Groth16, and uses BLS12-377 elliptic curves that support bilinear pairing as the underlying group.

[0133] Prove the circuit's construction principle: at the start of this round of synchronization, the transmitting end maps the key set to a Bloom bitmap B using k hash functions, and then compresses it into a latent vector z using an autoencoder network. Prove the circuit must simultaneously satisfy the following conditions: 1. After decoder processing, the latent vector z can recover the bitmap. 2. Bitmap Generated from a Verkle tree based on the key set corresponding to the summary R. 3. The difference set key set Δ in the bitmap. If all values ​​in the bitmap are 0, then the bitmap at the receiving end should be 1.

[0134] The circuit uses the leaf node commitment values ​​in the Verkle tree as private inputs and z, R, and Δ as public inputs. Because the autoencoder has a fixed structure and constant parameters, the entire circuit has approximately 80,000 gates, allowing proofs to be generated offline within a single microcontroller.

[0135] The bilinear pairwise verification mechanism, Groth16, proves that a tuple can be represented as (A, B, C). The verifier only needs to compute the bilinear pairwise equation once:

[0136] e(A,B)=e(C,α)+e(β,γ)

[0137] Where e is a bilinear mapping, and A, B, C, α, β, γ belong to different subgroups on the curve. If the equation holds, the proof is valid; otherwise, it is invalid. Here, A, B, and C are derived from the proof file provided by the sender, and α, β, γ are part of a general reference string, generated during system initialization. Since the number of pairwise calculations is fixed, the verification time is independent of the difference set size, and in actual measurements, it takes approximately 8 milliseconds on a 500 MHz processor.

[0138] In conjunction with batch unboxing, after successful verification, the receiving end still needs to confirm that the difference key is indeed missing locally. The vector commitment batch unboxing algorithm can conveniently use the same root digest R as a common input, making commitments to all keys in Δ at once. This two-step approach prevents malicious nodes from submitting keys that do not match the root digest, while also ensuring that each key does not actually exist in the receiving end's tree, logically closing off injection and replay attack channels.

[0139] Bitmap deception probability analysis reveals that Bloom bitmaps exhibit false positives. If an attacker attempts to insert a forged key into the difference set, the condition "the key is in the bitmap" must be met. The condition "the value in the middle is 0" is used. Since the bitmap length N and the number of hash functions k are fixed during system initialization, the upper bound of the false positive probability is:

[0140] p = (1-e) -kM / N ) k

[0141] Where M is the size of the key set. In experiments with N = 1024, k = 6, and M ≤ 512, the false positive probability is approximately 2.0 × 10⁻⁶. -2 Attackers attempting to inject false keys via Bloom false positives would need to bypass both zero-knowledge proofs and vector commitments for verification, resulting in a near-zero success rate.

[0142] In this example, in a real-world deployment, the sender generates a 128-byte proof file at a time and broadcasts it along with the potential vector. The receiver immediately calls the pairing operation library to verify the proof after receiving one round of packets, taking 9 milliseconds and consuming 32 kilobytes of memory. If the proof is invalid, the receiver discards the entire round of packets and reports back to the scheduler to lower the trust score; if the proof is valid, it continues with sparse Gaussian elimination and batch unboxing. Compared to schemes that do not use zero-knowledge proofs, this approach can defend against the following two types of real-world attacks:

[0143] Difference permutation attack: An attacker intentionally inserts a historically synchronized key into the difference set, inducing repeated writes and exhausting bandwidth. The second constraint of the proof circuit guarantees that the difference set key must be located in the complement of the Bloom bitmap at the sending end, thus blocking this attack at its source.

[0144] Key-dumping attack: Attackers mix random keys that do not exist at either end into the difference set, attempting to cause decoding failure at the receiving end. Batch unpacking immediately rejects writes when verification fails and reports the failure rate to the scheduler; the redundancy ratio is automatically increased in the next round.

[0145] This invention ensures that the verification time remains essentially constant regardless of the difference set size, making it suitable for scenarios with dynamically adjustable window lengths. The proof is generated once for multiple verifications, eliminating the need for round-trip challenges and reducing the handshake cost in weak links. The fixed proof length negligibles the burden on broadcast bytes. The reference string, generated based on symmetric bilinear mapping and trusted rituals, maintains discrete logarithmic-level security even in the presence of quantum computing. The same root digest runs through both the proof and the unpacking process, forming a closed-loop verification chain.

[0146] In summary, this invention achieves efficient and verifiable difference set properties through a concise, non-interactive zero-knowledge integrity proof, providing a solid security foundation for three-terminal synchronization in adversarial channels and high packet loss environments.

[0147] Preferably, the signature fragment generated for the missing signature record is a FALCON lattice signature fragment, and the threshold aggregation adopts the lattice-based Schnorr aggregation algorithm to output a single aggregated signature when two signature fragments exist.

[0148] The sending end stores the first FALCON lattice signature fragment for each message within the synchronization window. If the receiving end detects that the message contains only one fragment, it performs signature completion and threshold aggregation. The FALCON lattice signature is based on "discrete Gaussian sampling-lattice basis transformation". The input of the single-piece signature algorithm is the private key vector s and the hash h to be signed, and the output is the response vector z. This invention maintains the single-piece signature format unchanged and only adopts a "two-threshold" strategy within the network: as long as either end produces one fragment, a complete signature can be synthesized.

[0149] The first step is for the receiving end to call its own private key vector s. B Perform the key hash h:

[0150] σ B =Sign Falcon (s B ,h)

[0151] The second signature fragment σ was obtained. B σ B This represents the "second FALCON signature fragment", which includes the challenge value, response vector, and necessary random salt.

[0152] The second step is to perform lattice-based Schnorr aggregation. The two fragments each contain a temporary commitment vector R. A ,R B With response vector z A ,z B The aggregation process is as follows:

[0153] 1. Calculate the Unified Challenge: e = H(R) A ||R B ||h), where H is the hash function and e is the integer challenge value.

[0154] 2. Combine response vectors: z = z A +z B (mod q), where q is the lattice signature modulus.

[0155] 3. Generate aggregate commitment: R = R A +R B The final aggregate signature is denoted as ∑=(R,z).

[0156] The verifier only needs one hash and one lattice vector multiplication to complete the signature verification, and the computational complexity is the same as that of a single-chip signature.

[0157] The third step involves writing h, m, v, and ∑ into the Verkle leaf nodes at the receiving end. After insertion, the vector commitments are recalculated sequentially along the modified path, and the Verkle root digest is refreshed. Since the tree has 256 branches and a depth of only 4 levels, the update time for the entire path remains in the millisecond range.

[0158] In this example, the window length is 128, and 52 records within the difference set are missing the second fragment. The receiver, on a 400 MHz processor, generates 52 σ records. B The process took 43 milliseconds; executing 52 aggregations to obtain the ∑ took 39 milliseconds; and recalculating the vector commitment took 14 milliseconds. The complete signature size is 52×48 bytes, which reduces storage by 50% compared to traditional end-to-end independent signatures (52×96 bytes).

[0159] Through this invention, the aggregation strategy with a threshold of 2 ensures that signature completion can still be completed instantly even when any single end is offline; the signature length does not increase after aggregation, reducing log size and link overhead; the entire signature completion-aggregation-write process is completed in about 0.1 seconds on devices with weak computing power, meeting real-time synchronization requirements; the lattice-based security base ensures that the aggregated signature remains unforgeable even in the face of quantum computing; after being bound to a vector clock, the aggregated signature provides strong non-repudiable credentials for subsequent consistency comparisons, avoiding rollback and replay attacks.

[0160] Preferably, the internal nodes of the multi-branch Verkle tree use Pedersen vector commitments and employ a quantum-resistant hash function to compute node commitment summaries to ensure compatibility with the zero-knowledge integrity proof.

[0161] In this invention, the multi-branch Verkle tree plays a core role in recording, comparing, and verifying synchronization. To enable verification of any path without downloading the entire subtree, this invention introduces Pedersen vector commitments into each internal node and generates node commitment digests using a quantum-resistant hash function. Pedersen vector commitments possess both hiding and binding properties, and their mathematical expression can be written as:

[0162]

[0163] Where C is the node commitment point, r is the blinded random number, and G and H i (0≤i≤255) is the preset base point, m i Let r be the hash value of the i-th child node. Since all coefficients and the base point lie in the same elliptic curve group, no observer can infer {m} without knowing r. i}, and once C is fixed, it is impossible to forge another set of {m} for the same C. i}

[0164] The application of quantum-resistant hash functions reveals that the security boundary of traditional elliptic curve hashing decreases under quantum models. This invention employs a lattice hash function based on the module learning congruence problem to hash m child nodes. i The hash function maps the commitments to lattice vectors and then projects them onto the curve group elements, thus making the commitment construction resistant to both Grover's search and quantum discrete logarithms. The same hash function is also used to map the highest-level commitment point C.root Compressed into a 32-byte root digest for broadcasting and comparison.

[0165] To ensure compatibility with zero-knowledge integrity proofs, this invention uses the Groth16 architecture to generate zero-knowledge proofs. The proof circuit will {m i} and r are used as private inputs, while node commitment points C and root summaries are used as public inputs. The formula is reproduced within the circuit and verified through bilinear pairing. Since ∑m i H i The exponent is fixed at 256 terms, the number of pairings is constant, and the verification time is independent of the difference set size; on a 500 MHz microcontroller, one verification takes about 8 milliseconds.

[0166] The batch unboxing algorithm divides the difference set into several buckets by using the key prefix at the receiving end, with each bucket corresponding to an internal node. Leveraging the additivity of vector commitments, the receiving end does not need to compare each of the 256 sub-commitments individually; it only needs to call unboxing once at the bucket-level node to complete the validity verification of the entire batch of key hashes. The network round-trip byte count is thus reduced from O(|Δ|) to O(number of buckets), resulting in bandwidth savings of over 70% in dense difference set scenarios.

[0167] In one example, during a synchronization with a window length of 128, there are 96 difference keys belonging to 8 buckets. The sending end uploads the commitments of the 8 nodes and their corresponding open-box proofs, totaling approximately 2000 bytes. The receiving end verifies the vector commitments 8 times and updates the Verkle tree, all taking 14 milliseconds. If a key-by-key Merkle proof were used instead, approximately 12 kilobytes would need to be uploaded, taking 110 milliseconds.

[0168] This invention combines Pedersen vector commitments with quantum-resistant hashing, maintaining concealment and binding even under quantum threat models. Batch unpacking significantly reduces communication and computation, with constant verification time, enabling real-time operation on embedded systems. The commitment format shares curves and hashes with Groth16 circuits, achieving seamless integration of zero-knowledge proofs and tree structures. Both the 256 branch count and the number of base nodes can be expanded without affecting existing node commitments, supporting future capacity upgrades.

[0169] Through this design, the present invention achieves an efficient, quantum-robust, verifiable log structure in a three-terminal message synchronization scenario, laying a secure foundation for difference broadcasting, signature aggregation, and fast root digest reconciliation.

[0170] The difference set completion rate and link quality are written to the replay buffer, and the reinforcement learning scheduler and compressed model are updated at set intervals.

[0171] After the synchronization round ends, the system immediately writes the difference completion rate (number of recovered keys divided by the original number of difference keys) and the link quality vector (wireless received signal indication value, visible light signal-to-noise ratio, and average packet loss rate of the previous round) into the circular playback buffer. This buffer has a fixed capacity of the most recent 300 records and uses an overwrite strategy to ensure that memory usage does not exceed 300 × record bytes at any given time. The entry structure includes: timestamp, difference completion rate, link quality vector, current encoding window, redundancy ratio, and power allocation ratio. The queue is maintained in arrival order to facilitate subsequent time-sliding sampling.

[0172] The system's internal timer triggers a "policy-model joint update" task every 30 seconds. The task first extracts the 64 most recent <state, action, reward> samples from the buffer in a first-in, first-out manner. The state is obtained by concatenating the difference set size and the link quality vector; the action is the encoding window, redundancy ratio, and power allocation ratio from the previous round's output; and the reward is calculated as follows:

[0173] R = η - λE

[0174] The calculation is performed, where η is the difference set completion rate and E is the energy consumption percentage. λ is a runtime adjustable parameter, with a default value of 0.4. The reinforcement learning scheduler performs one round of gradient updates based on the near-end policy optimization algorithm, and the update amount is limited to within 0.2 through policy pruning to avoid policy oscillation.

[0175] The second part of the joint update targets the Bloom bitmap autoencoder compressed model. The system checks the remaining battery power and temperature: backpropagation is only initiated when the battery power is ≥25% and the core temperature is ≤60℃; otherwise, it enters the inference-only mode. If the conditions are met, the 32 most recent latent vectors and their corresponding reconstruction errors are selected for one fine-tuning iteration with a learning rate of 1e-4 and the Adam optimizer. After training, a new model hash is calculated, timestamped with a threshold signature, and broadcast to the other two ends; the new model is automatically switched when the next window synchronization begins.

[0176] The joint update process takes an average of 110 milliseconds, with 40 milliseconds for the policy network forward-reverse-pruning, 60 milliseconds for model micro-calls, and the remaining 10 milliseconds for signing and broadcasting. In low-power mode, only policy updates are performed, reducing the total time to 45 milliseconds. All update processes are completed locally, without relying on a central server, ensuring that even if the external network is interrupted, the three terminals can continue to evolve and optimize transmission parameters.

[0177] If any endpoint is detected to have a continuous heartbeat timeout exceeding 24 hours, that endpoint is marked as offline and an "Offline" event is written. The remaining endpoints continue normal synchronization, but offline endpoint segments are ignored during signature aggregation. If the battery level drops below 10%, the system shuts down the visible light link, sets the power allocation ratio to 1.0 (all power to wireless), and fixes the encoding window at 64 and the redundancy ratio at 0.04. At this time, new entries are still written at 30-second intervals, but only the difference set completion rate and wireless link strength data are saved. The compressed model stops training and only inference is retained.

[0178] Example: In a weak network test, a joint update was triggered after the buffer filled with 300 records. The policy network reduced the encoding window from 128 to 96, the redundancy ratio from 0.08 to 0.06, and the power allocation from 0.6 to 0.75; the latent vector length of the compressed model remained unchanged at 128, and the reconstruction misclassification rate decreased from 2.1% to 1.8%. In the subsequent three rounds of synchronization, the average difference set completion rate increased by 3 percentage points, and the energy consumption per round decreased by 15%. When the test terminal's battery level dropped to 9%, it entered low-power mode. After shutting down the visible light link, the broadcast byte volume decreased by 35%, and the system still maintained an 88% difference set completion rate.

[0179] Through the above mechanism, this invention achieves data closed-loop based on replay buffer in three-terminal scenarios; the reinforcement learning scheduler continuously optimizes the window and redundancy, and the autoencoder model automatically compresses the bitmap according to the real-time link; it maintains minimum available synchronization capability when offline, under low power or when the link changes suddenly, while ensuring quantum-safe signature and log integrity.

[0180] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A three-terminal message synchronization method, characterized in that, Includes the following steps: Generate a FALCON public-private key pair for each end and negotiate a threshold public key with a threshold of two. Write the message key hash with vector clock into a multi-branch Verkle tree and update the root digest of the Verkle tree. The transmitting end generates a Bloom bitmap based on the local Verkle tree key set, processes it using a compression model, and then sends it along with the root digest and zero-knowledge integrity proof. The receiving end compares the Bloom bitmap to obtain the difference set, inputs the difference set size and link state into the reinforcement learning scheduler, and obtains the coding window, redundancy ratio, and link power allocation parameters. The transmitting end then uses sparse Fountain coding to split the coded packets containing the difference set on the wireless link and optical link according to the parameters. The receiving end uses a linear solution algorithm to decode the encoded packets to recover the difference set, verifies the zero-knowledge integrity proof, and performs batch unpacking to verify the key hashes in the difference set; it generates signature fragments for missing signature records, performs threshold aggregation, writes them into the receiving end's Verkle tree, and refreshes the root digest of the Verkle tree; it writes the difference set completion rate and link quality into the replay buffer, and updates the reinforcement learning scheduler and compression model at set intervals.

2. The method according to claim 1, characterized in that, The compression model is an autoencoder neural network. The autoencoder neural network uses convolutional feature extraction in the encoding stage and deconvolutional reconstruction corresponding to the encoding stage in the decoding stage, so as to reduce the data length of the Bloom bitmap while maintaining the accuracy of hash determination.

3. The method according to claim 1, characterized in that, The Bloom bitmap is obtained by mapping multiple independent hash functions. Each hash function takes the key hash in the Verkle tree key set as input and sets corresponding bits in the bitmap to identify whether the key hash exists in the sending Verkle tree.

4. The method according to claim 1, characterized in that, The reinforcement learning scheduler employs a near-end policy optimization algorithm, inputting a state vector composed of the difference set size, wireless link signal strength, optical link signal strength, and the redundancy ratio from the previous round into the policy network to obtain the encoding window, redundancy ratio, and link power allocation parameters.

5. The method according to claim 1, characterized in that, The sparse Fountain coding maintains the sparsity of the coding matrix under different redundancy ratios by limiting the column weights of the coding matrix to no more than a preset constant and adjusting the coding window length and column weights proportionally.

6. The method according to claim 1, characterized in that, The linear solution algorithm performs sparse Gaussian elimination on the encoding matrix and uses a bit-set form of row vector representation during row swapping to reduce memory usage and improve decoding speed.

7. The method according to claim 1, characterized in that, The zero-knowledge integrity proof adopts a concise non-interactive proof system, which generates proofs through elliptic curve bilinear pairing, enabling difference set integrity verification to be completed in constant time.

8. The method according to claim 1, characterized in that, The signature fragments generated for missing signature records are FALCON lattice signature fragments. The threshold aggregation adopts the lattice-based Schnorr aggregation algorithm to output a single aggregated signature when two signature fragments exist.

9. The method according to claim 1, characterized in that, The internal nodes of the multi-branch Verkle tree use Pedersen vector commitments and employ a quantum-resistant hash function to compute node commitment digests to be compatible with the zero-knowledge integrity proof.

Images