Fused secure storage system, electronic equipment, data management method and computer readable storage medium

Abstract

The invention provides a fusion type secure storage system, electronic equipment, a data management method and a computer readable storage medium. The system comprises a hardware security layer, an encryption processing layer, a verification error correction layer, a data stream processing layer and an intelligent management layer which are in communication connection, the hardware security layer provides a physical trusted root for the system and executes a security policy; the encryption processing layer is used for carrying out encryption processing on data based on the security service provided by the physical trusted root; the verification and error correction layer is used for carrying out integrity verification and self-adaptive error correction coding on the encrypted data; the data stream processing layer is used for executing a near data calculation task on the data subjected to verification and error correction; and the intelligent management layer collects real-time state data from the hardware security layer, the encryption processing layer, the check error correction layer and the data stream processing layer, and performs dynamic strategy configuration and global optimization decision, thereby improving the active calculation, dynamic adaptation and intelligent optimization capabilities of the system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data storage, in particular to a fusion security storage system, an electronic device, a data management method and a computer readable storage medium. BACKGROUND

[0002] The existing storage system usually adopts a storage-computing separation architecture, which has obvious performance bottlenecks and security risks. Frequent migration of data between storage and processing units leads to high latency and high energy consumption, forming a "memory wall" problem. At the same time, the traditional storage system adopts a static reliability guarantee mechanism, which is difficult to cope with the complex error patterns of modern storage media that dynamically evolve with the life cycle, workload and environmental conditions. The system management complexity increases sharply with the increase of storage density, and tasks such as bad block management and metadata indexing make the traditional management algorithm unable to bear the heavy burden. In addition, the optimization strategy of the existing system depends on pre-set fixed rules, and lacks the ability of dynamic self-optimization according to the actual workload and device state. These limitations seriously restrict the performance of the storage system in emerging applications such as artificial intelligence and big data.

[0003] Therefore, there is an urgent need for a new type of storage system that can break through the traditional storage-computing barrier and has the ability of active computing, dynamic adaptation and intelligent optimization to solve the above problems. SUMMARY

[0004] The fusion security storage system, the electronic device, the data management method and the computer readable storage medium provided by the present application aim to build a new type of storage system with the ability of active computing, dynamic adaptation and intelligent optimization.

[0005] In a first aspect, a fusion security storage system is provided, which comprises a hardware security layer, an encryption processing layer, a check and error correction layer, a data stream processing layer and an intelligent management layer connected in communication.

[0006] The hardware security layer is configured to provide a physical trusted root for the system and execute security policies; the encryption processing layer is configured to encrypt data based on the security services provided by the physical trusted root; the check and error correction layer is configured to perform integrity checking and adaptive error correction coding on the encrypted data; the data stream processing layer is configured to perform near-data computing tasks on the data that has passed the checking and error correction; and the intelligent management layer collects real-time state data from the hardware security layer, the encryption processing layer, the check and error correction layer and the data stream processing layer, and is configured to monitor the running states of the layers and make dynamic strategy configuration and global optimization decisions.

[0007] The hardware security layer comprises a secure isolation execution and trusted root unit, which is configured to generate a true random number through a true random number generator, and provide a secure root of trust for the system. A cryptographically secure random number generator is used, and a physically unclonable function is employed to generate a unique device key as the root key. The root key is then used by a secure bootloader module to verify and load the hardware firmware, thus constructing a complete hardware trust chain. An adaptive dynamic key management unit connects the intelligent management layer and the encryption processing layer, used to dynamically adjust the key management strategy according to the system security status. A formally verifiable security logic synthesis unit is used to formally verify the security logic during the hardware design phase.

[0008] The adaptive dynamic key management unit includes a threat adaptive policy engine, which monitors at least one of access failure rate, power consumption fluctuation and external threat intelligence, and dynamically triggers key rotation or encryption algorithm switching.

[0009] The encryption processing layer includes: a streaming encryption unit based on number theory transformations, used to perform high-speed encryption based on number theory transformations. Encryption computation; a task-driven adaptive encryption scheduler, used to dynamically configure the working parameters of the streaming encryption unit according to the characteristics of the computing task; a biometric key fusion unit, used to realize a dynamic generation and immediate destruction temporary session key mechanism based on user biometric data and irreversible transformation algorithm, specifically for the anti-physical theft encryption protection of key system parameters.

[0010] The verification and error correction layer includes: a data integrity verification unit, used to perform end-to-end integrity verification and tamper detection of stored data based on a cryptographic hash algorithm; and a dynamic enhanced error correction engine, used to select a target scheme from multiple error correction coding schemes and perform error correction processing according to the instructions of the intelligent management layer and the real-time error mode.

[0011] The various error correction coding schemes include at least one of a coding scheme for correcting consecutive symbol transpose errors and a row-column distorted redundancy coding scheme.

[0012] The data stream processing layer includes: a programmable computing array for processing multiple independently executable tasks. The system includes a chip and its on-chip network interconnect architecture, enabling direct collaborative processing and parallel computing of data on the storage medium controller; a task-oriented dataflow programming model interface, used for an abstract programming paradigm based on task decomposition and dataflow dependency declaration, to achieve automated scheduling and efficient utilization of the parallel resources of the programmable computing array; and a task optimization compiler, used to map user-defined logical task graphs onto the programmable computing array for execution based on the Steiner shortest path tree optimization algorithm.

[0013] The intelligent management layer comprises: a parameter monitoring and data driven decision unit, configured to collect running state parameters of the hardware security layer, the encryption processing layer, the check and error correction layer and the data stream processing layer, and evaluate the running state parameters; a metadata management unit, configured to realize compressed storage of massive metadata and fast retrieval with near constant time complexity through adaptive block compression and a rank / selection query mechanism of hardware acceleration; a state verification and prediction optimization unit, configured to perform system stability prediction through a strong spatial mixing model based on the running state parameters, and perform global multi-objective optimization solving through sum of squares programming to generate the dynamic strategy.

[0014] The fusion security storage system further comprises a quantitative evaluation unit, configured to construct a unified performance quantization function based on indexes of performance, reliability, security, computing efficiency and life cycle cost, and the intelligent management layer performs optimization decision with the maximum of the performance quantization function as a target.

[0015] In a second aspect, an electronic device is provided, comprising the fusion security storage system according to any one of the first aspect.

[0016] In a third aspect, a data management method based on the fusion security storage system is provided, applied to the fusion security storage system according to any one of the first aspect, and the method comprises: establishing a system physical trusted root through the hardware security layer; performing encryption processing on data based on the physical trusted root through the encryption processing layer; performing integrity check and adaptive error correction coding on the encrypted data through the check and error correction layer; performing near-data computing tasks on the data that has passed the check and error correction through the data stream processing layer; monitoring the running state of each layer through the intelligent management layer, and performing dynamic strategy configuration and global optimization decision.

[0017] In a fourth aspect, a computer readable storage medium is provided, having a computer program stored thereon, and the program is executed by a processor to implement the method according to the third aspect.

[0018] The fusion security storage system provided by the present application can improve the active computing, dynamic adaptation and intelligent optimization capabilities of the system, which is different from the prior art. BRIEF DESCRIPTION OF DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor. Among them: Figure 1is a structural schematic diagram of an embodiment of the fusion security storage system provided in the present application; Figure 2 is a structural schematic diagram of an embodiment of the hardware security layer provided in the present application; Figure 3 is a structural schematic diagram of an embodiment of the encryption processing layer provided in the present application; Figure 4 is a structural schematic diagram of an embodiment of the check and correction layer provided in the present application; Figure 5 is a structural schematic diagram of an embodiment of the data flow processing layer provided in the present application; Figure 6 is a structural schematic diagram of an embodiment of the intelligent management layer provided in the present application; Figure 7 is a flow schematic diagram of an embodiment of the data management method based on the fusion security storage system provided in the present application. DETAILED DESCRIPTION

[0020] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. It can be understood that the specific embodiments described herein are only used to explain the present application, but not to limit the present application. In addition, it should be noted that, for the convenience of description, only the parts related to the present application are shown in the drawings, but not all the structures. Based on the embodiments in the present application, all the other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0021] In this document, reference to“an embodiment” means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the present application. The appearances of the phrase“in an embodiment” in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily mutually exclusive of one another. Those skilled in the art will understand that the embodiments described herein can be combined with other embodiments.

[0022] The existing storage system usually adopts a storage-computing separation architecture, which has obvious performance bottlenecks and security risks. Frequent migration of data between storage and processing units leads to high latency and high energy consumption, forming a "memory wall" problem. At the same time, the traditional storage system adopts a static reliability guarantee mechanism, which is difficult to cope with the complex error patterns of modern storage media that dynamically evolve with the life cycle, workload and environmental conditions. The system management complexity increases sharply with the improvement of storage density, and tasks such as bad block management and metadata indexing make the traditional management algorithm unable to bear the heavy burden. In addition, the optimization strategy of the existing system relies on pre-set fixed rules, and lacks the ability of dynamic self-optimization according to the actual workload and device state. These limitations seriously restrict the performance of the storage system in emerging applications such as artificial intelligence and big data.

[0023] Therefore, the present application aims to solve the above-mentioned core technical problems, that is, a new type of storage system that can break through the traditional storage-computing barrier and has the ability of active computing, dynamic adaptation and intelligent optimization. For specific reference, see the following embodiments.

[0024] Firstly, the present application provides a fusion security storage system.

[0025] Referring to Figure 1 , Figure 1 is a structural schematic diagram of an embodiment of the fusion security storage system provided by the present application.

[0026] In some embodiments, the fusion security storage system includes five core layers of a hardware security layer 10, an encryption processing layer 20, a check and error correction layer 30, a data stream processing layer 40 and an intelligent management layer 50 connected in communication, and in the present application, the hardware security layer 10 is the bottom layer of the system.

[0027] Among them, the hardware security layer 10 is used to provide a physical trusted root for the system and execute a security policy; the encryption processing layer 20 is used to encrypt data based on the security services provided by the physical trusted root; the check and error correction layer 30 is used to perform integrity checking and adaptive error correction coding on the encrypted data; the data stream processing layer 40 is used to execute near-data computing tasks on the data that has been checked and corrected; and the intelligent management layer 50 collects real-time state data of the hardware security layer 10, the encryption processing layer 20, the check and error correction layer 30 and the data stream processing layer 40, which is used to monitor the running state of each layer and make dynamic strategy configuration and global optimization decision.

[0028] In some embodiments, referring to Figure 2 , Figure 2 is a structural schematic diagram of an embodiment of the hardware security layer provided by the present application.

[0029] The hardware security layer 10 comprises: a secure isolated execution and trusted root unit 11, an adaptive dynamic key management unit 12, and a formal verifiable secure logic synthesis unit 13.

[0030] The secure isolated execution and trusted root unit 11 is configured to generate a cryptographically secure random number by a true random number generator, and generate a device unique key as a root key by combining the random number and a physically unclonable function; and further verify and load hardware firmware by a secure boot loader using the root key to build a complete hardware trust chain.

[0031] Specifically, in some embodiments, the secure isolated execution and trusted root unit 11 builds a hardware level security cornerstone by integrating three physical components in the chip manufacturing stage: first, a physically unclonable function (PUF) module uses the inherent microscopic physical differences in the semiconductor manufacturing process to dynamically generate a unique device “fingerprint” key at each power-on, which is never statically stored and is used as a device identity authentication and a root key for encrypting a master key in real time; second, a true random number generator (TRNG) module continuously generates high-quality random numbers with cryptographic security by collecting physical entropy sources such as internal thermal noise and clock jitter, and provides unpredictable randomness for all session keys and encryption materials; and finally, a secure boot loader uses the root key generated by the PUF to perform integrity verification and decryption loading of the hardware security layer firmware at system startup, and builds a complete hardware trust chain through step-by-step verification to ensure that the system is in a trusted state from the bottom up, thereby providing an unforgeable security starting point for all upper-layer cryptographic operations.

[0032] The adaptive dynamic key management unit 12 is connected to the intelligent management layer 50 and the encryption processing layer 20, and is configured to dynamically adjust a key management strategy according to a system security state.

[0033] In particular, the adaptive dynamic key management unit 12 further comprises a threat adaptive strategy engine configured to monitor at least one of an access failure rate, a power consumption fluctuation, and external threat intelligence, and dynamically trigger key rotation or encryption algorithm switching.

[0034] Specifically, in some embodiments, the adaptive dynamic key management unit 12 realizes intelligent management of the key life cycle through an embedded threat adaptive strategy engine, which uses a multi-dimensional security state monitoring mechanism to collect multi-dimensional parameters in real time, including data access failure rate, encryption module power consumption fluctuation, number of illegal access attempts, and external threat intelligence; based on the threat-performance model stored in the parameterized security policy knowledge base, when the real-time parameters touch the risk threshold, the strategy adjustment is automatically triggered: for example, if the characteristics of brute force attack are detected (such as abnormal soaring of decryption failure rate), the dynamic key rotation frequency is accelerated and the key length is temporarily increased from the default 24 hours to 10 minutes; for example, if the engine identifies a side-channel attack pattern (such as periodic power consumption fluctuation) through the built-in power consumption analysis probe, it immediately switches to a cryptographic algorithm with resistance characteristics such as mask protection or injects random delay to destroy attack synchronization, thereby realizing dynamic adaptive protection against threats.

[0035] The formal verifiable security logic synthesis unit 13 is used for formal verification of security logic in the hardware design stage.

[0036] Specifically, in some embodiments, the formal verifiable security logic synthesis unit 13 is a core component of the electronic design automation (EDA) tool chain, and uses a formal verification method based on mathematical proof to fundamentally eliminate security vulnerabilities in the hardware design stage. The specific implementation of this unit contains three key steps: first, the hardware security requirements are converted into mathematical problems through security attribute polynomial modeling, and the designer defines the key security invariants (such as "the value of the key register K must not be transmitted to the output bus O") using a formal language, and the system automatically models it as a polynomial constraint problem, and constructs a polynomial equation system that needs to be proved unsatisfiable (such as proving that 1-(K-O)^2=0 is always false in all hardware states). Second, use the Sum-of-Squares (SOS) programming framework for automated proof, convert the unsatisfiability problem of the polynomial system into a semi-definite programming problem, and find the square sum decomposition through a numerical solver: if "-1" can be expressed as the sum of squares of several polynomials, it is mathematically proven that there is no hardware state that may violate the security attribute. Finally, generate a machine-verifiable security certificate, which provides a mathematical guarantee of exhaustively all possibilities. Compared with traditional simulation verification based on test coverage, it can detect deep logical vulnerabilities such as information leakage and privilege bypass that are difficult to find by traditional methods, significantly improving the reliability and credibility of hardware security design.

[0037] Therefore, by the effective cooperation of the secure enclave execution and the trusted root unit 11, the adaptive dynamic key management unit 12 and the formalized verifiable secure logic synthesis unit 13, the hardware security layer 10 provides a physical trusted root for the system and implements the goal of executing a security policy, that is, the secure enclave execution and the trusted root unit 11, the adaptive dynamic key management unit 12 provide high-quality random numbers and device root keys for encapsulating master keys, and the trustworthiness of the entire hardware security layer firmware is ensured through secure boot loading; the adaptive dynamic key management unit 12 dynamically adjusts the key policy (such as update frequency and algorithm) based on threat intelligence received from the intelligent management layer 50, and safely executes the policy by using the services provided by the secure enclave execution and the trusted root unit 11; and the formalized verifiable secure logic synthesis unit 13 exhaustively verifies the key hardware logic of the secure enclave execution and the trusted root unit 11 and the adaptive dynamic key management unit 12 before the system is manufactured, thereby eliminating specific types of security vulnerabilities from the source and providing a mathematical guarantee for the reliability of the entire hardware security layer 10.

[0038] In some embodiments, referring to Figure 3 , Figure 3 is a structural schematic diagram of an encryption processing layer provided by the present application.

[0039] The encryption processing layer 20 includes a number theory transformation-based stream encryption unit 21, a task-driven adaptive encryption scheduler 22 and a biometric key fusion unit 23.

[0040] The number theory transformation-based stream encryption unit 21 is configured to perform high-speed encryption operation based on number theory transformation.

[0041] Specifically, the number theory transformation-based stream encryption unit 21 is implemented by using a special hardware logic circuit, and the encryption process is divided into three efficient stages by a deep pipeline architecture. First, a number theory transformation (NTT) subunit converts input data blocks (as polynomial coefficient vectors) from time domain to frequency domain through finite field simulation of fast Fourier transform (FFT), so as to realize finite field simulation of fast Fourier transform. Second, a polynomial multiplication calculation subunit performs highly parallel point-by-point multiplication operation in the frequency domain, and performs multiplication operation on the data frequency domain representation and the encryption polynomial frequency domain representation generated by the private key, so that the frequency domain component calculation of the entire data block can be completed in a single clock cycle. Finally, an inverse number theory transformation (INTT) subunit converts the multiplication result from the frequency domain back to the time domain through inverse transformation, and outputs the final encrypted data block. The pipeline processing mode of "transformation-multiplication-inverse transformation" completely discards the iteration structure of the traditional block cipher, converts the complex encryption operation into a highly parallelized calculation process in algebra, fully utilizes the advantages of modern hardware parallel computing, and realizes high-efficiency data throughput.

[0042] The task-driven adaptive encryption scheduler 22 is configured to dynamically configure the working parameters of the stream encryption unit 21 according to the characteristics of the computing task.

[0043] Specifically, the core implementation of the task-driven adaptive encryption scheduler 22 is to build a dynamic response workload characteristic encryption strategy execution system through deep integration with the data stream processing layer 40. The scheduler internally maintains a multi-dimensional encryption strategy library that stores encryption variants and parameter configuration sets optimized for different application scenarios, and realizes adaptive scheduling through the following mechanisms: first, based on task characteristics, real-time decision is made to automatically select the maximum data block size encryption mode for batch data processing tasks to maximize throughput, and the small data block size and deep pipeline mode is enabled for real-time data streams to optimize the delay indicator; second, support for complex mathematical domain conversion operations, when advanced cryptography protocols such as homomorphic computing are detected, automatically trigger encryption kernel execution modulus promotion and modulus reduction operations to securely map and reconstruct data blocks in different finite field spaces, ensuring that arithmetic overflow does not occur during the calculation process; finally, integrate reproducibility processing capabilities by dynamically injecting randomization factors to make the encryption results of the same plaintext have random characteristics, effectively resisting statistical analysis attacks. The entire scheduling process is automatically completed based on the task graph context and is completely transparent to the application layer, allowing the encryption service to evolve from a fixed function unit to a dynamic optimization system that intelligently understands the computing intent.

[0044] The biometric key fusion unit 23 is configured to dynamically generate, use and destroy temporary session keys based on user biometric data and irreversible transformation algorithms, and is specifically used for anti-physical theft encryption protection of system key parameters.

[0045] Specifically, when accessing key parameters is required, the biometric key fusion unit 23 first guides the authorized user to provide biometric input, generates binary mask data uniquely bound to the user's biometric features through irreversible transformations such as feature extraction, quantization and binarization; then generates an internal confusion value using a pseudo-random number generator, performs XOR operation with the mask data, and generates a temporary random key through parity check encoding processing, and verifies the legality of the biometric features by comparing the hash value of the key with the pre-stored template; after verification, the temporary key is confirmed as the biometric key of the current session and is temporarily stored in the volatile memory, and is destroyed immediately after the session ends; the system uses the dynamically generated key to encrypt and store core configuration such as error correction code parameters, and the decryption requires re-verification of the biometric features and generation of the same key to complete. The implementation of the "dynamically generated-use and burn" key management mechanism ensures that even if the storage medium is physically stolen, the attacker cannot obtain the decryption key, and the security of the biometric features and system parameters is strongly bound.

[0046] Therefore, through the effective cooperation of the above-mentioned stream encryption unit 21 based on number theory transformation, the task-driven adaptive encryption scheduler 22, and the biometric key fusion unit 23, the encryption processing layer 20 realizes the goal of encrypting data based on the security services provided by the physical trusted root. That is, the stream encryption unit 21 based on number theory transformation is a physical execution unit for encryption operations, and its working mode (such as data block size and operation type) is completely configured and controlled by the task-driven adaptive encryption scheduler 22. The task-driven adaptive encryption scheduler 22 analyzes the encryption requirements from the upper layer and converts them into specific operation instruction sequences for the stream encryption unit 21. When the task needs to use biometrics, it will request a key from the biometric key fusion unit 23. The biometric key fusion unit 23 provides the task-driven adaptive encryption scheduler 22 with a high-security-level key, which is specifically used to encrypt the key parameters specified by the intelligent management layer 50 and stored in the check and correction layer 30, forming a cross-layer security binding.

[0047] In some embodiments, referring to Figure 4 , Figure 4 is a structural schematic diagram of an embodiment of the check and correction layer provided by the present application.

[0048] The check and correction layer 30 includes a data integrity check unit 31 and a dynamic enhancement correction engine 32.

[0049] The data integrity check unit 31 is configured to perform end-to-end integrity check and tamper detection on stored data based on a cryptographic hash algorithm.

[0050] Specifically, the data integrity check unit 31 provides end-to-end integrity protection for data blocks through a cryptographic hash algorithm, and the specific implementation manner is as follows: in the data writing stage, a cryptographic secure hash algorithm such as SHA-256 is used to calculate the complete data block content ready to be written to the storage medium, to generate a fixed-length hash check digest; the digest is stored in association with the metadata such as the logical address and the physical address of the corresponding data block in a special storage area, to form a binding relationship between the data and the digest. In the data reading stage, the system recalculates the instant hash value of the data block read from the physical medium before returning the data, and strictly compares it with the original digest stored in the metadata area; when the digest is detected to be inconsistent, an integrity exception handling process is triggered immediately, a data tampering or damage error is reported to the upper layer, and a recovery mechanism (such as reading from a copy or triggering the correction engine to attempt repair) is started according to a preset strategy. This check mechanism based on a cryptographic hash can effectively detect any unauthorized data modification or bit-level changes caused by physical storage decay, and provides basic data integrity protection for the storage system.

[0051] The dynamic enhanced error correction engine 32 is configured to select a target error correction coding scheme from a plurality of error correction coding schemes according to an instruction of the intelligent management layer and a real-time error pattern, and perform error correction processing.

[0052] In particular, the plurality of error correction coding schemes include at least one of an encoding scheme for correcting continuous symbol transposition errors and a row-column twist redundancy encoding scheme.

[0053] In particular, the dynamic enhanced error correction engine 32 realizes intelligent error correction capability adaptive to the storage medium state and data importance by integrating a plurality of dynamically schedulable error correction coding schemes. Two innovative mechanisms are mainly included: first, a continuous symbol transposition error correction mechanism for high-density storage, such as when adjacent symbol exchange errors occur in the flash memory medium, the engine automatically activates a dedicated encoder to append two sets of checksums (position weighted sum S_1 = Σ(w_i*x_i)modP_1 and position weighted square sum S_2 = Σ(w'_i*x_i)modP_2) in addition to the traditional ECC check bits. When decoding, the transposition error is accurately located and corrected by solving the mathematical equation set of the checksum difference ΔS_1, ΔS_2, the error position k and the symbol difference (x_{k+1}-x_k); second, a row-column twist redundancy encoding mechanism for critical data, a non-standard MDS code is constructed by using a generating matrix modified by a nonlinear twist factor. The algebraic structure is changed by taking the twist factor from the extension field of the base finite field, while maintaining the maximum distance separable property, obtaining an error detection characteristic different from the traditional RS code. The intelligent management layer 50 dynamically allocates the encoding to protect the system critical metadata according to the data importance. The two mechanisms cooperate with the real-time monitoring system to enable the engine to dynamically select the optimal error correction strategy according to the physical medium state, error characteristics and data value, to achieve the maximum reliability improvement with the minimum redundancy overhead.

[0054] Therefore, through the effective cooperation of the data integrity verification unit 31 and the dynamic enhanced error correction engine 32, the verification and error correction layer 30 realizes the goal of integrity verification and adaptive error correction coding on the encrypted data. That is, the data integrity verification unit 31 serves as the first line of defense and first performs verification when the data is read out; if the verification fails, the data integrity verification unit 31 can be triggered to attempt repair, and the strength of the hash algorithm and the update strategy can be configured by the intelligent management layer 50; the dynamic enhanced error correction engine 32 is the main guarantee of data reliability, and its specific behavior (which error correction code to use, how much redundancy) is completely determined by the intelligent management layer 50 according to the real-time monitored physical error pattern.

[0055] In some embodiments, referring to Figure 5 , Figure 5 is a structural schematic diagram of an embodiment of the data flow processing layer provided by the present application.

[0056] The data stream processing layer 40 includes a programmable computing array 41, a task-based data stream programming model interface 42, and a task optimization compiler 43.

[0057] The programmable computing array 41 is configured to perform direct cooperative processing and parallel computing of data in a storage medium controller based on processing units of multiple independently executable tasks and an on-chip network interconnection architecture.

[0058] Specifically, the programmable computing array 41 is implemented as a physical execution basis for near-data computing using a dedicated hardware architecture on a storage controller chip, and its core is composed of three key components. First, multiple lightweight processing units (PEs) are distributed in an array form, each PE uses a RISC-V reduced instruction set architecture or a dedicated hardware accelerator (such as a matrix multiplication unit), and is equipped with a private SRAM memory for instruction and data caching. Second, all PEs are interconnected through a high-performance on-chip network (NoC), which integrates a first-in-first-out (FIFO) mechanism implemented in hardware, supports point-to-point data stream transmission, and realizes low-latency and high-bandwidth direct data exchange between processing units, completely bypassing the external main memory controller. Finally, a dedicated high-speed parallel interface is directly connected to the physical data path of the flash medium, so that data read out from the flash cell can be directly streamed into the computing array for processing, avoiding the data transfer overhead through the main memory in the traditional storage architecture. This architecture optimizes spatial parallelism and data stream transmission, realizes the close coupling of storage and computing, and provides high-performance processing capability for data-intensive applications.

[0059] The task-based data stream programming model interface 42 is configured to implement automatic scheduling and efficient use of parallel resources of the programmable computing array 41 based on the abstract programming paradigm of task decomposition and data stream dependency declaration.

[0060] Specifically, the task-based dataflow programming model interface 42 provides high-level abstraction for upper-layer applications through a dedicated software development kit (SDK), and its core implementation is based on four programming paradigms. First, a task decomposition mechanism is used to split complex computing logic (such as data decompression -> text sentiment analysis -> result aggregation) into independent schedulable units (decompression task, analysis task, and aggregation task), and each task is encapsulated as an independently schedulable computing unit. Second, an explicit data flow declaration is used to establish the dependency relationship between tasks, and the developer directly defines a named data flow (such as decompressed_stream) and explicitly specifies the source task (decompression task output) and target task (analysis task input), forming an intuitive data flow diagram. Third, a data layout type system is introduced to allow developers to declare the distribution strategy of data on the virtual computing grid through type modifiers (such as "sharding" or "replication"), for example, sharding an image tensor to an N x M grid by blocks, and the compiler automatically implements data distribution, boundary exchange, and result collection accordingly. Finally, a virtual-to-physical mapping abstraction is provided, and the developer only needs to logically define the virtual processing unit requirements (such as a P0 scale set), and the runtime system automatically completes the decoupled mapping with the underlying physical PE resources. This implementation approach uses a declarative programming paradigm to sink the parallel computing complexity to the compiler and runtime system, allowing the developer to only focus on the computing logic itself without manually managing data synchronization, resource allocation, and other underlying details, significantly improving the development efficiency of near-data computing applications.

[0061] The task optimization compiler 43 is configured to map the user-defined logical task graph to the programmable computing array 41 for execution based on a Steiner minimum spanning tree optimization algorithm.

[0062] Specifically, the task optimization compiler 43 first parses the logical task graph defined by the developer, constructs a directed acyclic virtual mapping graph, where the nodes represent task instances, and the edges represent data flow and expected delay weight; then abstracts the optimization problem as an SSPT model, sets the data source task as the root node, the key task that must output results as the terminal node, and the optional intermediate processing task as the non-terminal node, and takes the path delay as the weight index; the optimization goal is to find the shortest path sub-tree covering all terminal nodes through a heuristic algorithm, minimizing the number of non-terminal nodes (i.e. resource occupation) while ensuring the lowest end-to-end delay. Taking intelligent video analysis as an example: the compiler sets video decoding as the root node, alarm as the terminal node, and the resource-intensive pedestrian re-identification task as the optional non-terminal node, and accordingly generates two optimization paths (lightweight path: decoding -> detection -> judgment -> alarm; heavy path: decoding -> detection -> re-identification -> judgment -> alarm), and the runtime dynamically selects the path according to the target detection result. This implementation converts the task graph optimization into a Steiner tree solving problem under multi-objective constraints through mathematical modeling, ensuring both calculation correctness and on-demand scheduling of computing and communication resources.

[0063] Therefore, through the effective cooperation of the programmable computing array 41, the task-based data flow programming model interface 42, and the task optimization compiler 43, the data flow processing layer 40 achieves the goal of performing near-data computing tasks on data that has been verified and corrected. That is, the programmable computing array 41 is the physical platform for all computing tasks, and the allocation and scheduling of its resources (PE, bandwidth) are determined by the results of the task optimization compiler 43; the task-based data flow programming model interface 42 is the entrance to the system's computing power, and the logical task graph it generates is the original input to the task optimization compiler 43; the task optimization compiler 43 converts the high-level, logical computing intent generated by the task-based data flow programming model interface 42 into low-level instruction sequences that can be executed most efficiently on the programmable computing array 41 through optimization algorithms such as SSPT.

[0064] In some embodiments, referring to Figure 6 , Figure 6 is a structural schematic diagram of an embodiment of the intelligent management layer provided by the present application.

[0065] The intelligent management layer 50 includes a parameter monitoring and data-driven decision unit 51, a metadata management unit 52, and a state verification and prediction optimization unit 53.

[0066] The parameter monitoring and data-driven decision unit 51 is configured to collect the running state parameters of the hardware security layer, the encryption processing layer, the verification and correction layer, and the data flow processing layer, and evaluate the running state parameters.

[0067] Specifically, the parameter monitoring and data-driven decision unit 51 is composed of three core components: a global parameter monitoring subunit, a parameterized performance knowledge base, and a data-driven decision engine. The monitoring subunit collects four-dimensional parameters in real time through probes deployed in the storage controller hardware: performance parameters (IOPS, latency, bandwidth utilization), reliability parameters (raw bit error rate, correction failure count, bad block growth rate), load characteristic parameters (read-write ratio, request size distribution, access locality), and physical state parameters (chip temperature, operating voltage, number of erase-write cycles). The parameterized performance knowledge base dynamically stores performance reliability models for different system configurations under different workloads and continuously optimizes through online learning. The data-driven decision engine periodically inputs real-time parameter vectors into the knowledge base model for evaluation. For example, when detecting that the raw bit error rate of a certain storage area exceeds the threshold, the engine analyzes the error pattern characteristics (such as random bit flipping or symbol transposition errors), queries the knowledge base for the optimal error correction strategy (such as switching to high-redundancy ECC or activating transposition error correction code), and automatically executes the strategy switch within an acceptable performance loss range, achieving fine-grained adaptive management of physical layer reliability.

[0068] Among them, the metadata management unit 52 realizes the compressed storage of massive metadata and the fast retrieval with near constant time complexity through adaptive block compression and hardware-accelerated rank / select query mechanism.

[0069] ​Specifically, with the continuous growth of storage capacity and complexity, the system needs to maintain a large amount of metadata (covering logical-physical address mapping table, bad block table, garbage collection information, snapshot index, etc.), the storage and query efficiency of which directly determines the performance of the entire system, and the metadata management unit 52 can realize high-speed query of massive metadata with minimal space overhead by using adaptive compression data structure; in specific implementation, the metadata management unit 52 manages all key metadata that can be represented as a bit vector by means of a data structure of a hybrid coded bit vector, on the one hand, adaptive block compression is used to optimize storage: the complete metadata bit vector (such as a bitmap marking whether a physical block is a bad block) is divided into fixed-size blocks, and when writing, the data characteristics in the block are quickly analyzed, if the data is highly repetitive (such as a large number of consecutive "0"s in the corresponding bitmap of a new storage area), run-length encoding is used to record only the repeated value and length, if the data is sparse (such as "1" being much less than "0" or vice versa), sparse encoding is used to record only the position index of a few minority bits, and if the data is randomly distributed without obvious rules, the original uncompressed bitmap form is retained, this adaptive selection mechanism can ensure that the storage space of the metadata can be compressed to near the information entropy limit regardless of the distribution pattern; on the other hand, the efficiency is improved by using hardware-accelerated rank / select queries: the core of the hybrid bit vector structure design is to support high-speed execution of two types of key metadata query operations, namely the rank query that answers "how many '1's before position p" and the select query that answers "where is the kth '1' located", the metadata management unit 52 establishes a hierarchical index structure for this purpose and directly implements it by hardware logic, so that the average time complexity of the query operation is close to a constant, for example, in the fast bad block positioning scenario, the file system needs to query the "position of the 100th available (non-bad block) physical block" when allocating a new block, this query will be converted into a select(0, 100) operation on the bad block bit vector, the unit can return the physical block address instantly through hardware-accelerated index, avoiding the slow traversal of traditional linked list or B-tree structure, and in garbage collection, the number of valid data pages in a certain area can also be quickly counted through rank query.

[0070] The state verification and prediction optimization unit 53 is configured to perform system stability prediction based on the running state parameters by using a strong spatial mixing model, and perform global multi-objective optimization solving by using a sum-of-squares programming, to generate the dynamic strategy.

[0071] Specifically, the state verification and prediction optimization unit 53 is the core decision engine of the intelligent reliability and management layer, and realizes the highest level of intelligence of the storage system through formal mathematical methods. The specific implementation of the unit is based on two major innovative mechanisms: First, the stability prediction system based on the Strong Spatial Mixing (SSM) model abstracts the entire storage medium as a complex physical system. By establishing a phase transition model between the physical parameters such as the number of medium erasing times, working temperature, voltage disturbance, and error rate evolution, and using mathematical methods to prove that the system satisfies the strong spatial mixing property, it is theoretically guaranteed that the influence of local faults will decay exponentially with distance. During operation, the aforementioned monitoring subunit continuously inputs real-time physical parameters into the model. When it detects that the parameter combination is approaching the phase transition critical point that may cause a sharp rise in error rate (even if the current macro error rate is still low), the state verification and prediction optimization unit 53 will immediately trigger an early warning and start preventive measures: including migrating data in high-risk areas to healthy areas, temporarily reducing the workload in this area, or dynamically increasing error correction redundancy, etc., thereby actively avoiding the risk of "avalanche" global chain failure.

[0072] Second, the global multi-objective optimization engine based on Sum-of-Squares (SOS) programming uses a formal optimization framework to model the mutually restrictive multi-objective trade-off problem in the running of the storage system (such as maximizing performance, minimizing power consumption, maximizing service life, and ensuring data security) as a polynomial optimization problem. The specific implementation includes: expressing the performance function P(T, R, E), the power consumption function C(T, R, E), and the life function L(T, R, E) as polynomials with respect to the core adjustable parameters such as the garbage collection threshold T, the cache partition ratio R, and the error correction redundancy E, and expressing the constraint conditions as polynomial inequalities (such as C_max - C(T, R, E) ≥ 0); then, through Sum-of-Squares programming, the original problem is relaxed into a semi-definite programming (SDP) problem, and the built-in lightweight SDP solver is used to calculate the parameter combination (T, R, E*) with theoretical optimality guarantee; the system dynamically adjusts the target function weights according to user macro instructions (such as "high-performance mode" or "long-life mode") and re-solves to ensure that the globally optimal configuration verified formally can be obtained in any working mode. Through the collaborative work of the SSM model and the SOS programming, this unit realizes the complete autonomous ability from macro stability prediction to multi-objective optimization decision-making, enabling the storage system to maintain the optimal running state based on mathematical proof rather than empirical rules.

[0073] Therefore, through the effective coordination of the parameter monitoring and data-driven decision unit 51, the metadata management unit 52, and the state verification and prediction optimization unit 53, the intelligent management layer 50 achieves the goal of dynamically configuring the system and making global optimization decisions. That is: The parameter monitoring and data-driven decision unit 51 provides the real-time and accurate system state vector required for decision-making for the state verification and prediction optimization unit 53, and at the same time, it also directly performs some local and tactical optimization adjustments; the metadata management unit 52 provides fast data positioning and statistical services for all units that need to access metadata; the state verification and prediction optimization unit 53 uses internal SSM and SOS models to conduct in-depth and forward-looking analysis and deduction based on the real data provided by the parameter monitoring and data-driven decision unit 51, and finally formulates strategic level strategies to guide the operation of the entire system.

[0074] In some embodiments, the fusion security storage system further comprises a quantitative evaluation unit for constructing a unified performance quantization function based on indicators of performance, reliability, security, computing efficiency and life cycle cost, and the intelligent management layer optimizes decision-making with the goal of maximizing the performance quantization function.

[0075] The specific form of the performance quantization function is: U(P|W,T)=∫_T[α(t)*F_P(t)+β(t)*F_C(t)-γ(t)*F_R(t)-δ(t)*F_S(t)-ε(t)*F_L(t)]dt Wherein, U represents a function of the system within a period of time T and the global strategy configuration P adopted by the system to handle the workload set W; P represents the current global strategy configuration vector of the system, which is a high-dimensional vector containing adjustable parameters, such as: P={p_ecc,p_crypto,p_compute,p_gc,...}; Specifically, p_ecc represents the error correction strategy (such as error correction code type, redundancy); p_crypto represents the encryption strategy (such as algorithm, key length); p_compute represents the computing task scheduling strategy (such as PE allocation number, task fusion scheme); p_gc represents the garbage collection strategy, etc. W represents the workload input into the system within the time period T, including the characteristics of data flow, computing task and access mode; t represents time; α(t), β(t), γ(t), δ(t), ε(t) are function dynamic weight factor functions, which are dynamically set by the intelligent management layer 50 according to the current system macro working mode (for example, "high performance mode" or "long life mode") and the priority of the workload. Their sum is usually normalized to 1, for example, in high performance mode, the weights of α(t) and β(t) will be significantly increased.

[0076] In some embodiments, the interpretation and implementation of each subterm of the performance quantification function is as follows: 1. Performance and computation comprehensive performance term: α(t) * F_P(t) + β(t) * F_C(t), quantifies the positive benefits of the system as a data processing platform.

[0077] Wherein: F_P(t), represents the traditional I / O performance function (IOPerformanceFunction); Definition: F_P(t) = w_i * IOPS(t) + w_b * BW(t) - w_l * Latency(t); Quantitative implementation: IOPS(t), represents the number of I / O operations per second at time point t; BW(t), represents the effective data bandwidth at time point t; Latency(t), represents the inverse of the average I / O delay at time point t or a function negatively correlated with it; w_i, w_b, w_l, represent internal weights dynamically adjusted according to the characteristics of the workload W (biasing small I / O or large bandwidth).

[0078] Wherein: F_C(t), represents the in-situ computation utility function (In-SituComputationUtilityFunction) This term quantifies the value brought by the aforementioned data flow processing layer; Definition: F_C(t) = η_task * N_tasks(t) * R_optimized(t) * (1 - O_dram(t)) Quantitative implementation: N_tasks(t), represents the number of computing tasks concurrently executed by the data flow processing layer at time point t; R_optimized(t), represents the task graph optimization rate function, which is calculated by the SSPT optimization compiler of the data flow processing layer 40, R_optimized = 1 - (N_active_nodes / N_original_nodes), where N_active_nodes is the number of non-terminal nodes actually executed after SSPT optimization, and N_original_nodes is the number of non-terminal nodes in the original logical task graph. This indicator directly quantifies the resource saving benefits brought by the SSPT technology; O_dram(t), representing the DRAM access offloading rate, the value of which is (Bytes_on_chip / Bytes_total), Bytes_on_chip is the amount of data directly exchanged by the on-chip data stream through the data stream processing layer 40, and Bytes_total is the total amount of data theoretically required to be exchanged by the entire task stream, which directly quantifies the data migration reduction benefit brought by the task-based data stream model; η_task, representing a dimension coefficient, used to convert the completion amount of the computing task into a magnitude comparable to the I / O performance.

[0079] 2. Risk and cost comprehensive penalty term: γ(t)*F_R(t)+δ(t)*F_S(t)+ε(t)*F_L(t), quantifying the cost and risk paid by the system to achieve performance and calculation, as a negative penalty term.

[0080] Wherein: F_R(t), representing the Reliability Risk Function; Definition: F_R(t)=w_u*UBER(t)+w_p*P_critical(t); Quantitative implementation: UBER(t), representing the Uncorrectable Bit Error Rate at time point t, which is reported by the dynamic enhanced error correction engine 32 of the check and correction layer 30 when decoding fails; P_critical(t), representing the critical risk probability, which is calculated by the SSM model in the state verification and prediction optimization unit 53 of the intelligent management layer 50, representing the probability of a large-scale error of "phase change" in a future period of time under the current system state, which directly quantifies the predictive risk assessment capability of the framework SSM technology.

[0081] Wherein: F_S(t), representing the Security Risk Function; Definition: F_S(t)=w_a*A_freq(t)+w_v*V_level(t)*K_usage(t); Quantitative implementation: A_freq(t), representing the abnormal access frequency at time point t, reported by the formal verifiable security logic synthesis unit 13 of the hardware security layer 10 (for example, the number of key verification failures); V_level(t), representing the external threat level, which can be dynamically obtained by the intelligent management layer 50 from the external threat intelligence library, representing whether there is a known high-risk vulnerability against the encryption algorithm used by the system at present; K_usage(t), representing the key usage intensity, for example, if the current strategy is long-term non-renewal of the key, the risk value will increase; the value is reported by the encryption processing layer 20 and evaluated by the adaptive dynamic key management unit 12 of the hardware security layer 10.

[0082] Wherein: F_L(t), representing the lifecycle cost function (Lifecycle Cost Function); Definition: F_L(t) = w_e * Energy(t) + w_w * WAF(t) * Wear(t); Quantitative implementation: Energy(t), representing the instantaneous total power consumption at time point t, directly measured by the hardware power consumption probe; WAF(t), representing the write amplification factor (Write Amplification Factor), calculated by the garbage collection and FTL of the intelligent management layer 50; Wear(t), representing the average medium wear degree, calculated by the intelligent management layer 50 according to the average erase-write times of the flash memory block.

[0083] Therefore, the unified performance quantification function U constitutes the mathematical basis for the global optimization of the state verification and prediction optimization unit 53 of the intelligent management layer 50 of the system.

[0084] In some embodiments, the application process of the unified performance quantification function is as follows: 1. Goal setting: when the system receives a new macro instruction (such as switching to "low power consumption mode"), the intelligent management layer 50 will adjust the dynamic weight factors a(t)...e(t) in the function, for example, significantly increasing the weight of e(t); 2. Model establishment: the system converts the maximization problem of U(P|W, T) into a polynomial optimization problem about the strategy vector P. Each sub-item IOPS(t), UBER(t) in the function will be modeled as a polynomial function or its approximation function about the strategy P, and these models are stored in the "parameterized performance knowledge base"; 3. Formal solution: the polynomial optimization problem is sent to the sum of squares (SOS) programming solver; 4. Strategy deployment: the solver calculates an optimal strategy vector P* that maximizes U under the current state and target, and this P* contains the optimal parameter combination of all sub-modules (error correction, encryption, calculation scheduling, etc.).

[0085] 5. Closed loop execution: the intelligent management layer 50 issues specific parameters in P* to the corresponding units of the hardware security layer 10, the encryption processing layer 20, the check and error correction layer 30, and the data stream processing layer 40 for execution. The system enters a new, formally verified, globally optimal running state.

[0086] Therefore, through the effective cooperation of the five core layers of the hardware security layer 10, the encryption processing layer 20, the check and error correction layer 30, the data stream processing layer 40, and the intelligent management layer 50, the active computing, dynamic adaptation, and intelligent optimization capabilities of the system are improved.

[0087] Then, the present application also provides an electronic device comprising the fusion security storage system in any of the above embodiments.

[0088] Next, the present application also provides a data management method based on the fusion security storage system, which is applied to the fusion security storage system of any of the above embodiments, and the specific method is described with reference to Figure 7 , and the specific method is as follows: S1. Establishing a system physical trusted root through the hardware security layer; S2. Performing encryption processing on data based on the physical trusted root through the encryption processing layer; S3. Performing integrity checking and adaptive error correction coding on the encrypted data through the check and error correction layer; S4. Executing near-data computing tasks on the data that has passed the checking and error correction through the data stream processing layer; S5. Monitoring the running state of each layer through the intelligent management layer, and performing dynamic strategy configuration and global optimization decision.

[0089] Finally, the present application also provides a computer readable storage medium having a computer program stored thereon, and the program is executed by a processor to implement the method as shown in Figure 7 .

[0090] To sum up, the above-mentioned technologies bring unexpected technical effects to the present application: first, the storage system realizes the qualitative change from "passive defense" to "active intelligence", and through the stability prediction model, data-driven decision and formal global optimization, a complete "perception-analysis-decision-execution" intelligent closed loop is constructed, so that the system has the cognitive ability of foreseeing risks, adapting to changes and autonomous optimization; second, the deep collaboration of in-memory computing and data management is realized, and through the close cooperation of the task graph optimization unit and the efficient metadata management unit, seamless coupling of computing resource demand prediction and millisecond-level resource allocation is realized at the micro level; third, a cross-dimensional adaptive reliability system is constructed, forming a three-dimensional defense mechanism from physical layer dynamic error correction code, middle layer system stability prediction to top layer global parameter optimization, and the overall robustness far exceeds the effect of simple superposition of each technology; fourth, the contradiction between performance, reliability and development efficiency is successfully reconciled, the development complexity is simplified through the high-level task-based data flow programming model, and at the same time, the system is ensured to run autonomously at the approximate optimal performance point under the premise of high reliability through internal automatic optimization, and the traditional bottom-layer optimization work relying on expert intervention is transformed into an endogenous ability of the system.

[0091] The above-mentioned is only the embodiment of the present application, and does not limit the patent scope of the present application, and any equivalent structure or equivalent process transformation using the content of the present application specification and drawings, or direct or indirect application in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A converged secure storage system, characterized in that, This includes a hardware security layer for communication connections, an encryption layer, a verification and error correction layer, a data stream processing layer, and an intelligent management layer. The hardware security layer is used to provide a physical root of trust for the system and to execute security policies. The encryption processing layer is used to encrypt data based on the security services provided by the physical root of trust. The verification and error correction layer is used to perform integrity verification and adaptive error correction coding on the encrypted data; The data stream processing layer is used to perform near-data computation tasks on the verified and corrected data; The intelligent management layer collects real-time status data from the hardware security layer, encryption processing layer, verification and error correction layer, and data stream processing layer to monitor the operating status of each layer and to make dynamic policy configuration and global optimization decisions. The hardware security layer includes: Securely isolated execution and trusted root unit, used to generate cryptographically secure random numbers through a true random number generator, and employing physical... The non-clonable function is combined with the random number to generate the device's unique key as the root key; then, the secure bootloader module uses the root key to verify and load the hardware firmware, thereby constructing a complete hardware trust chain; An adaptive dynamic key management unit, connecting the intelligent management layer and the encryption processing layer, is used to dynamically adjust the key management strategy according to the system security status. Formal verifiable security logic synthesis unit is used to formally verify security logic during the hardware design phase.

2. The converged secure storage system according to claim 1, characterized in that, The adaptive dynamic key management unit includes a threat adaptive policy engine, which monitors at least one of access failure rate, power consumption fluctuation and external threat intelligence, and dynamically triggers key rotation or encryption algorithm switching.

3. The converged secure storage system according to claim 1, characterized in that, The encryption processing layer includes: A streaming encryption unit based on number theory transformations is used to perform high-speed encryption operations based on number theory transformations. A task-driven adaptive encryption scheduler is used to dynamically configure the streaming encryption units based on the characteristics of the computational tasks. As parameters; The biometric key fusion unit is used to realize a dynamic generation and immediate destruction of temporary session keys based on user biometric data and irreversible transformation algorithms. It is specifically used for encryption protection against physical theft of key system parameters.

4. The converged secure storage system according to claim 1, characterized in that, The verification and error correction layer includes: The data integrity verification unit is used to perform end-to-end integrity verification and tamper detection of stored data based on cryptographic hash algorithms. A dynamic enhancement error correction engine is used to select a target scheme from multiple error correction coding schemes and perform error correction processing based on the instructions of the intelligent management layer and the real-time error pattern. The various error correction coding schemes include at least one of a coding scheme for correcting consecutive symbol transpose errors and a row-column distorted redundancy coding scheme.

5. The converged secure storage system according to claim 1, characterized in that, The data stream processing layer includes: Programmable computing arrays are used to perform direct collaborative processing and parallel computing of data on a storage medium controller, based on multiple independently executable processing units and their on-chip network interconnect architecture. The task-oriented dataflow programming model interface is used to achieve automated scheduling and efficient utilization of the parallel resources of the programmable computing array based on an abstract programming paradigm of task decomposition and dataflow dependency declaration. A task optimization compiler is used to map user-defined logical task graphs onto the programmable computing array for execution based on the Steiner shortest path tree optimization algorithm.

6. The converged secure storage system according to claim 1, characterized in that, The intelligent management layer includes: The parameter monitoring and data-driven decision-making unit is used to collect the operating status parameters of the hardware security layer, encryption processing layer, verification and error correction layer and data stream processing layer, and to evaluate the operating status parameters. The metadata management unit achieves compressed storage of massive amounts of metadata and fast retrieval with near constant time complexity through adaptive block compression and hardware-accelerated rank / selection query mechanism; The state verification and prediction optimization unit is used to predict the system stability based on the operating state parameters using a strong spatial hybrid model, and to perform global multi-objective optimization by using sum-of-squares programming to generate the dynamic strategy.

7. The converged secure storage system according to claim 1, characterized in that, The converged secure storage system also It includes a quantitative evaluation unit for constructing a unified efficiency quantification function based on five dimensions: performance, reliability, security, computing efficiency, and lifecycle cost. The intelligent management layer makes optimization decisions with the goal of maximizing the efficiency quantification function.

8. An electronic device, characterized in that, Including the converged secure storage system as described in any one of claims 1 to 7 System.

9. A data management method based on a converged secure storage system, characterized in that, Applied to a converged secure storage system as described in any one of claims 1 to 7, the method comprises: Establish a physical root of trust for the system through a hardware security layer; The data is encrypted using an encryption layer based on the physical root of trust. The encrypted data is subjected to integrity verification and adaptive error correction coding through a verification and error correction layer. The data stream processing layer performs near-data computation tasks on the validated and corrected data. The intelligent management layer monitors the operational status of each layer and makes dynamic strategy configurations and global optimization decisions.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in claim 9.

Images