Fused security storage system, electronic device, data management method, and computer-readable storage medium

Abstract

The application provides a fusion security storage system, an electronic device, a data management method and a computer readable storage medium. The system comprises a communication-connected hardware security layer, an encryption processing layer, a check error correction layer, a data flow processing layer and an intelligent management layer. The hardware security layer provides a physical trusted root for the system and executes a security policy. The encryption processing layer is configured to encrypt data based on a security service provided by the physical trusted root. The check error correction layer is configured to perform integrity checking and adaptive error correction coding on the encrypted data. The data flow processing layer is configured to execute near-data computing tasks on the data that has passed the checking and error correction. The intelligent management layer collects real-time state data from the hardware security layer, the encryption processing layer, the check error correction layer and the data flow processing layer, and performs dynamic policy configuration and global optimization decision, thereby improving the active computing, dynamic adaptation and intelligent optimization capabilities of the system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data storage, in particular to a fusion security storage system, an electronic device, a data management method and a computer readable storage medium. BACKGROUND

[0002] The existing storage system usually adopts a storage-computing separation architecture, which has obvious performance bottlenecks and security risks. Frequent migration of data between storage and processing units leads to high latency and high energy consumption, forming a "memory wall" problem. At the same time, the traditional storage system adopts a static reliability guarantee mechanism, which is difficult to cope with the complex error patterns of modern storage media that dynamically evolve with the life cycle, workload and environmental conditions. The system management complexity increases sharply with the increase of storage density, and tasks such as bad block management and metadata indexing make the traditional management algorithm unable to bear the heavy burden. In addition, the optimization strategy of the existing system depends on pre-set fixed rules, and lacks the ability of dynamic self-optimization according to the actual workload and device state. These limitations seriously restrict the performance of the storage system in emerging applications such as artificial intelligence and big data.

[0003] Therefore, there is an urgent need for a new type of storage system that can break through the traditional storage-computing barrier and has the ability of active computing, dynamic adaptation and intelligent optimization to solve the above problems. SUMMARY

[0004] The fusion security storage system, the electronic device, the data management method and the computer readable storage medium provided by the present application aim to build a new type of storage system with the ability of active computing, dynamic adaptation and intelligent optimization.

[0005] In a first aspect, a fusion security storage system is provided, which comprises a hardware security layer, an encryption processing layer, a check and error correction layer, a data stream processing layer and an intelligent management layer connected in communication.

[0006] The hardware security layer is configured to provide a physical trusted root for the system and execute security policies; the encryption processing layer is configured to encrypt data based on the security services provided by the physical trusted root; the check and error correction layer is configured to perform integrity checking and adaptive error correction coding on the encrypted data; the data stream processing layer is configured to perform near-data computing tasks on the data that has been checked and corrected; and the intelligent management layer collects real-time state data from the hardware security layer, the encryption processing layer, the check and error correction layer and the data stream processing layer, and is configured to monitor the running state of each layer and make dynamic strategy configuration and global optimization decisions.

[0007] The hardware security layer comprises a secure isolation execution and trusted root unit, which is configured to generate a true random number through a true random number generator

[0008] The cryptographic secure random number is combined with a physically unclonable function to generate a device unique key as a root key; then the root key is used by a secure boot loading module to verify and load hardware firmware, thereby constructing a complete hardware trust chain; an adaptive dynamic key management unit is connected to the intelligent management layer and the encryption processing layer, and is used to dynamically adjust a key management strategy according to a system security state; and a formalized verifiable security logic synthesis unit is used to perform formalized verification on security logic in a hardware design stage.

[0009] The adaptive dynamic key management unit comprises a threat adaptive strategy engine, which is used to monitor at least one of an access failure rate, power consumption fluctuation and external threat intelligence, and dynamically trigger key rotation or encryption algorithm switching.

[0010] The encryption processing layer comprises a stream encryption unit based on number theory transformation, which is used to perform high-speed

[0011] encryption operation based on number theory transformation; a task-driven adaptive encryption scheduler, which is used to dynamically configure working parameters of the stream encryption unit according to characteristics of a computing task; and a biometric key fusion unit, which is used to realize a dynamic generation, use and destroy temporary session key mechanism based on user biometric data and an irreversible transformation algorithm, and is specially used for anti-physical theft encryption protection of system key parameters.

[0012] The check and correction layer comprises a data integrity check unit, which is used to perform end-to-end integrity check and tamper detection on stored data based on a cryptographic hash algorithm; and a dynamic enhanced error correction engine, which is used to select a target scheme from a plurality of error correction coding schemes to perform error correction processing according to instructions of the intelligent management layer and real-time error patterns.

[0013] The plurality of error correction coding schemes comprise at least one of an encoding scheme for correcting continuous symbol transposition errors and a row-column twist redundancy encoding scheme.

[0014] The data stream processing layer comprises a programmable computing array, which is used to perform direct cooperative processing and parallel computing of data in a storage medium controller based on a plurality of processing units capable of independently executing tasks and a network-on-chip interconnection architecture thereof; a task-based data stream programming model interface, which is used to realize automatic scheduling and efficient utilization of parallel resources of the programmable computing array based on an abstract programming paradigm of task decomposition and data stream dependence declaration; and a task optimization compiler, which is used to map a user-defined logical task graph to the programmable computing array for execution based on a Steiner minimum path tree optimization algorithm.

[0015] The data stream processing layer comprises a programmable computing array, which is used to perform direct cooperative processing and parallel computing of data in a storage medium controller based on a plurality of processing units capable of independently executing tasks and a network-on-chip interconnection architecture thereof; a task-based data stream programming model interface, which is used to realize automatic scheduling and efficient utilization of parallel resources of the programmable computing array based on an abstract programming paradigm of task decomposition and data stream dependence declaration; and a task optimization compiler, which is used to map a user-defined logical task graph to the programmable computing array for execution based on a Steiner minimum path tree optimization algorithm.

[0016] The intelligent management layer comprises: a parameter monitoring and data driven decision unit, configured to collect running state parameters of the hardware security layer, the encryption processing layer, the check and error correction layer and the data stream processing layer, and evaluate the running state parameters; a metadata management unit, configured to realize compressed storage of massive metadata and fast retrieval with near constant time complexity through adaptive block compression and hardware accelerated rank query and selection query mechanism; a state verification and prediction optimization unit, configured to perform system stability prediction through a strong spatial mixing model based on the running state parameters, and perform global multi-objective optimization solution through sum of squares programming to generate the dynamic strategy.

[0017] The fusion security storage system further comprises a quantitative evaluation unit configured to construct a unified performance quantization function based on indicators of performance, reliability, security, computing efficiency and life cycle cost, and the intelligent management layer performs optimization decision with the maximum of the performance quantization function as the target.

[0018] In a second aspect, an electronic device is provided, comprising the fusion security storage system according to any one of the first aspect.

[0019] In a third aspect, a data management method based on the fusion security storage system is provided, applied to the fusion security storage system according to any one of the first aspect, and the method comprises: establishing a system physical trusted root through the hardware security layer; performing encryption processing on data based on the physical trusted root through the encryption processing layer; performing integrity check and adaptive error correction coding on the encrypted data through the check and error correction layer; performing near-data computing tasks on the data that has passed the check and error correction through the data stream processing layer; monitoring the running state of each layer through the intelligent management layer, and performing dynamic strategy configuration and global optimization decision.

[0020] In a fourth aspect, a computer readable storage medium is provided, having a computer program stored thereon, and the program is executed by a processor to implement the method according to the third aspect.

[0021] The fusion security storage system provided by the present application can improve the active computing, dynamic adaptation and intelligent optimization capabilities of the system, which is different from the prior art. BRIEF DESCRIPTION OF DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor. Among them:

[0023] Figure 1is a structural schematic diagram of an embodiment of the fusion security storage system provided in the present application;

[0024] Figure 2 is a structural schematic diagram of an embodiment of the hardware security layer provided in the present application;

[0025] Figure 3 is a structural schematic diagram of an embodiment of the encryption processing layer provided in the present application;

[0026] Figure 4 is a structural schematic diagram of an embodiment of the verification and error correction layer provided in the present application;

[0027] Figure 5 is a structural schematic diagram of an embodiment of the data flow processing layer provided in the present application;

[0028] Figure 6 is a structural schematic diagram of an embodiment of the intelligent management layer provided in the present application;

[0029] Figure 7 is a flow schematic diagram of an embodiment of the data management method based on the fusion security storage system provided in the present application. DETAILED DESCRIPTION

[0030] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. It can be understood that the specific embodiments described herein are only used to explain the present application, but not to limit the present application. In addition, it should be noted that, for the convenience of description, only the parts related to the present application are shown in the drawings, but not all the structures. Based on the embodiments in the present application, all the other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0031] In this document, reference to“an embodiment” means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the application. The appearances of the phrase“in an embodiment” in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily mutually exclusive of one another. Those skilled in the art will understand that the embodiments described herein can be combined with other embodiments.

[0032] The existing storage system usually adopts a compute-storage separation architecture, which has obvious performance bottlenecks and security risks. Frequent migration of data between storage and processing units leads to high latency and high energy consumption, forming a "memory wall" problem. At the same time, the traditional storage system adopts a static reliability guarantee mechanism, which is difficult to cope with the complex error patterns of modern storage media that dynamically evolve with the life cycle, workload and environmental conditions. The system management complexity increases sharply with the improvement of storage density, and tasks such as bad block management and metadata indexing make the traditional management algorithm unable to bear the heavy burden. In addition, the optimization strategy of the existing system relies on pre-set fixed rules, and lacks the ability of dynamic self-optimization according to the actual workload and device state. These limitations seriously restrict the performance of the storage system in emerging applications such as artificial intelligence and big data.

[0033] Therefore, the present application aims to solve the above-mentioned core technical problems, that is, a new type of storage system that can break through the traditional compute-storage barrier and has the ability of active computing, dynamic adaptation and intelligent optimization. For specific reference, see the following embodiments.

[0034] Firstly, the present application provides a fusion security storage system.

[0035] Referring to Figure 1 , Figure 1 is a structural schematic diagram of an embodiment of the fusion security storage system provided by the present application.

[0036] In some embodiments, the fusion security storage system includes five core layers of a hardware security layer 10, an encryption processing layer 20, a check and error correction layer 30, a data stream processing layer 40 and an intelligent management layer 50 connected in communication, and in the present application, the hardware security layer 10 is the bottom layer of the system.

[0037] Among them, the hardware security layer 10 is used to provide a physical trusted root for the system and execute a security policy; the encryption processing layer

[0038] 20 is used to encrypt data based on the security services provided by the physical trusted root; the check and error correction layer 30 is used to perform integrity checking and adaptive error correction coding on the encrypted data; the data stream processing layer 40 is used to execute near-data computing tasks on the data that has been checked and corrected; and the intelligent management layer 50 collects real-time state data of the hardware security layer 10, the encryption processing layer 20, the check and error correction layer 30 and the data stream processing layer 40, which is used to monitor the running state of each layer and make dynamic strategy configuration and global optimization decision.

[0039] In some embodiments, referring to Figure 2 , Figure 2 is a structural schematic diagram of an embodiment of the hardware security layer provided by the present application.

[0040] The hardware security layer 10 comprises: a secure isolated execution and trusted root unit 11, an adaptive dynamic key management unit 12, and a formal verifiable secure logic synthesis unit 13.

[0041] The secure isolated execution and trusted root unit 11 is configured to generate a cryptographically secure random number by a true random number generator, and generate a device unique key as a root key by combining the random number and a physically unclonable function; and further verify and load hardware firmware by a secure boot loader using the root key to build a complete hardware trust chain.

[0042] Specifically, in some embodiments, the secure isolated execution and trusted root unit 11 builds a hardware level security cornerstone by integrating three physical components in the chip manufacturing stage: first, a physically unclonable function (PUF) module uses the inherent microscopic physical differences in the semiconductor manufacturing process to dynamically generate a unique device “fingerprint” key at each power-on, which is never statically stored and is used as a device identity authentication and a root key for encrypting a master key in real time; second, a true random number generator (TRNG) module continuously generates high-quality random numbers with cryptographic security by collecting physical entropy sources such as internal thermal noise and clock jitter, and provides unpredictable randomness for all session keys and encryption materials; and finally, a secure boot loader uses the root key generated by the PUF to perform integrity verification and decryption loading of the hardware security layer firmware at system startup, and builds a complete hardware trust chain through step-by-step verification to ensure that the system is in a trusted state from the bottom layer, thereby providing an unalterable security starting point for all upper layer cryptographic operations.

[0043] The adaptive dynamic key management unit 12 is connected to the intelligent management layer 50 and the encryption processing layer 20, and is configured to dynamically adjust a key management strategy according to a system security state.

[0044] In particular, the adaptive dynamic key management unit 12 further comprises a threat adaptive strategy engine configured to monitor at least one of an access failure rate, a power consumption fluctuation, and external threat intelligence, and dynamically trigger key rotation or encryption algorithm switching.

[0045] Specifically, in some embodiments, the adaptive dynamic key management unit 12 realizes intelligent management of the key life cycle through an embedded threat adaptive strategy engine, which uses a multi-dimensional security state monitoring mechanism to collect multi-dimensional parameters in real time, including data access failure rate, encryption module power consumption fluctuation, number of illegal access attempts, and external threat intelligence; based on the threat-performance model stored in the parameterized security policy knowledge base, when the real-time parameters touch the risk threshold, the strategy adjustment is automatically triggered: for example, if the characteristics of brute force attack are detected (such as abnormal soaring of decryption failure rate), the dynamic key rotation frequency is accelerated and the key length is temporarily increased from the default 24 hours to 10 minutes; for example, if the engine identifies a side-channel attack pattern (such as periodic power consumption fluctuations) through the built-in power consumption analysis probe, it immediately switches to a cryptographic algorithm with resistance characteristics such as mask protection or injects random delays to disrupt attack synchronization, thereby realizing dynamic adaptive protection against threats.

[0046] The formal verifiable security logic synthesis unit 13 is used for formal verification of security logic in the hardware design stage.

[0047] Specifically, in some embodiments, the formal verifiable security logic synthesis unit 13 is a core component of the electronic design automation (EDA) tool chain, and uses a formal verification method based on mathematical proof to fundamentally eliminate security vulnerabilities in the hardware design stage. The specific implementation of this unit contains three key steps: first, the hardware security requirements are converted into mathematical problems through security attribute polynomial modeling, and the designer defines the key security invariants (such as "the value of the key register K must not be transmitted to the output bus O") using a formal language, and the system automatically models it as a polynomial constraint problem, and constructs a polynomial equation system that needs to be proved unsatisfiable (such as proving that 1-(K-O)^2=0 is always false in all hardware states). Second, use the Sum-of-Squares (SOS) programming framework for automated proof, convert the unsatisfiability problem of the polynomial system into a semi-definite programming problem, and find the square sum decomposition through a numerical solver: if "-1" can be expressed as the sum of squares of several polynomials, it is mathematically proven that there is no hardware state that may violate the security attribute. Finally, generate a machine-verifiable security certificate, which provides a mathematical guarantee of exhaustively all possibilities. Compared with traditional simulation verification based on test coverage, it can detect deep logical vulnerabilities such as information leakage and privilege bypass that are difficult to find by traditional methods, significantly improving the reliability and credibility of hardware security design.

[0048] Therefore, by the effective cooperation of the secure enclave execution and the trusted root unit 11, the adaptive dynamic key management unit 12 and the formalized verifiable secure logic synthesis unit 13, the hardware security layer 10 provides a physical trusted root for the system and implements the goal of executing a security policy, that is, the secure enclave execution and the trusted root unit 11, the adaptive dynamic key management unit 12 provide high-quality random numbers and device root keys for encapsulating master keys, and the trustworthiness of the entire hardware security layer firmware is ensured through secure boot loading; the adaptive dynamic key management unit 12 dynamically adjusts the key policy (such as update frequency and algorithm) based on threat intelligence received from the intelligent management layer 50, and safely executes the policy by using the services provided by the secure enclave execution and the trusted root unit 11; and the formalized verifiable secure logic synthesis unit 13 exhaustively verifies the key hardware logic of the secure enclave execution and the trusted root unit 11 and the adaptive dynamic key management unit 12 before the system is manufactured, thereby eliminating specific types of security vulnerabilities from the source and providing a mathematical guarantee for the reliability of the entire hardware security layer 10.

[0049] In some embodiments, referring to Figure 3 , Figure 3 is a structural schematic diagram of an encryption processing layer provided by the present application.

[0050] The encryption processing layer 20 includes a number theory transformation-based stream encryption unit 21, a task-driven adaptive encryption scheduler 22 and a biometric key fusion unit 23.

[0051] The number theory transformation-based stream encryption unit 21 is configured to perform high-speed encryption operation based on number theory transformation.

[0052] Specifically, the number theory transformation-based stream encryption unit 21 is implemented by using a special hardware logic circuit, and the encryption process is divided into three efficient stages by using a deep pipeline architecture. First, a number theory transformation (NTT) subunit converts input data blocks (as polynomial coefficient vectors) from time domain to frequency domain through finite field simulation of fast Fourier transform (FFT), so as to realize finite field simulation of fast Fourier transform. Second, a polynomial multiplication calculation subunit performs highly parallel point-by-point multiplication operation in the frequency domain, and performs multiplication operation on the data frequency domain representation and the encryption polynomial frequency domain representation generated by the private key, so that the frequency domain component calculation of the entire data block can be completed in a single clock cycle. Finally, an inverse number theory transformation (INTT) subunit converts the multiplication result from the frequency domain back to the time domain through inverse transformation, and outputs the final encrypted data block. The pipeline processing mode of "transformation-multiplication-inverse transformation" completely discards the iteration structure of the traditional block cipher, converts the complex encryption operation into a highly parallelized calculation process in algebra, fully utilizes the advantages of modern hardware parallel computing, and realizes high-efficiency data throughput.

[0053] The task-driven adaptive encryption scheduler 22 is configured to dynamically configure the working parameters of the stream encryption unit 21 according to the characteristics of the computing task.

[0054] Specifically, the core implementation of the task-driven adaptive encryption scheduler 22 is to build a dynamic response workload characteristic encryption strategy execution system through deep integration with the data stream processing layer 40. The scheduler internally maintains a multi-dimensional encryption strategy library that stores encryption variants and parameter configuration sets optimized for different application scenarios, and realizes adaptive scheduling through the following mechanisms: first, based on task characteristics, real-time decision is made to automatically select the maximum data block size encryption mode for batch data processing tasks to maximize throughput, and to enable small data block size and deep pipeline mode for real-time data streams to optimize the delay indicator; second, support for complex mathematical domain conversion operations, when advanced cryptography protocols such as homomorphic computing are detected, automatically trigger encryption kernel execution modulus promotion and modulus reduction operations to securely map and reconstruct data blocks in different finite field spaces, ensuring that arithmetic overflow does not occur during the calculation process; finally, integrate reproducibility processing capabilities by dynamically injecting randomization factors to make the encryption results of the same plaintext have random characteristics, effectively resisting statistical analysis attacks. The entire scheduling process is automatically completed based on the task graph context and is completely transparent to the application layer, allowing the encryption service to evolve from a fixed function unit to a dynamic optimization system that intelligently understands the computing intent.

[0055] The biometric key fusion unit 23 is configured to dynamically generate, use and destroy temporary session keys based on user biometric data and irreversible transformation algorithms, and is specifically used for anti-physical theft encryption protection of system key parameters.

[0056] Specifically, when accessing key parameters is required, the biometric key fusion unit 23 first guides the authorized user to provide biometric input, generates binary mask data uniquely bound to the user's biometric features through irreversible transformations such as feature extraction, quantization and binarization; then generates an internal confusion value using a pseudo-random number generator, performs XOR operation with the mask data, and generates a temporary random key through parity check encoding processing, and verifies the legality of the biometric features by comparing the hash value of the key with the pre-stored template; after verification, the temporary key is confirmed as the biometric key of the current session and is temporarily stored in the volatile memory, and is destroyed immediately after the session ends; the system uses the dynamically generated key to encrypt and store core configuration such as error correction code parameters, and the decryption requires re-verification of the biometric features and generation of the same key to complete. This implementation uses a "dynamically generated-use and burn" key management mechanism to ensure that even if the storage medium is physically stolen, the attacker cannot obtain the decryption key, achieving a secure binding of biometric features and system parameters.

[0057] Therefore, through the effective cooperation of the above-mentioned stream encryption unit 21 based on number theory transformation, the task-driven adaptive encryption scheduler 22, and the biometric key fusion unit 23, the encryption processing layer 20 realizes the goal of encrypting data based on the security services provided by the physical trusted root. That is, the stream encryption unit 21 based on number theory transformation is a physical execution unit of encryption operations, and its working mode (such as data block size and operation type) is completely configured and controlled by the task-driven adaptive encryption scheduler 22. The task-driven adaptive encryption scheduler 22 analyzes the encryption requirements from the upper layer and converts them into specific operation instruction sequences for the stream encryption unit 21. When the task needs to use biometrics, it will request a key from the biometric key fusion unit 23. The biometric key fusion unit 23 provides the task-driven adaptive encryption scheduler 22 with a high-security-level key, which is specifically used to encrypt the key parameters specified by the intelligent management layer 50 and stored in the check and correction layer 30, forming a cross-layer security binding.

[0058] In some embodiments, referring to Figure 4 , Figure 4 is a structural schematic diagram of an embodiment of the check and correction layer provided by the present application.

[0059] The check and correction layer 30 includes a data integrity check unit 31 and a dynamic enhancement correction engine 32.

[0060] The data integrity check unit 31 is configured to perform end-to-end integrity check and tamper detection on stored data based on a cryptographic hash algorithm.

[0061] Specifically, the data integrity check unit 31 provides end-to-end integrity protection for data blocks through a cryptographic hash algorithm, and the specific implementation manner is as follows: in the data writing stage, a cryptographic secure hash algorithm such as SHA-256 is used to calculate the complete data block content ready to be written to the storage medium, to generate a fixed-length hash check digest; the digest is stored in association with the metadata such as the logical address and the physical address of the corresponding data block in a special storage area, to form a binding relationship between the data and the digest. In the data reading stage, the system recalculates the instant hash value of the data block read from the physical medium before returning the data, and strictly compares it with the original digest stored in the metadata area; when the digest is detected to be inconsistent, an integrity exception handling process is triggered immediately, a data tampering or damage error is reported to the upper layer, and a recovery mechanism (such as reading from a copy or triggering the correction engine to attempt repair) is started according to a preset strategy. This check mechanism based on a cryptographic hash can effectively detect any unauthorized data modification or bit-level changes caused by physical storage decay, and provide basic data integrity protection for the storage system.

[0062] The dynamic enhanced error correction engine 32 is configured to select a target error correction coding scheme from a plurality of error correction coding schemes according to an instruction of the intelligent management layer and a real-time error pattern, and perform error correction processing.

[0063] In particular, the plurality of error correction coding schemes include at least one of an encoding scheme for correcting continuous symbol transposition errors and a row-column twist redundancy encoding scheme.

[0064] In particular, the dynamic enhanced error correction engine 32 realizes intelligent error correction capability adaptive to a storage medium state and data importance by integrating a plurality of dynamically schedulable error correction coding schemes. Two innovative mechanisms are mainly included. First, a continuous symbol transposition error correction mechanism for high-density storage is provided. When adjacent symbol exchange errors in a flash memory medium are monitored, the engine automatically activates a dedicated encoder to additionally generate two sets of checksums (position weighted sum S_1 = Σ(w_i*x_i)modP_1 and position weighted square sum S_2 = Σ(w'_i*x_i)modP_2) in addition to the traditional ECC check bits. When decoding, the transposition error is accurately located and corrected by solving the mathematical equation set of the checksum difference ΔS_1, ΔS_2, the error position k and the symbol difference (x_{k+1}-x_k). Second, a row-column twist redundancy encoding mechanism for critical data is provided. A non-standard MDS code is constructed by using a generating matrix modified by a nonlinear twist factor. The algebraic structure is changed by taking the twist factor from an extension field of a base finite field, thereby obtaining error detection characteristics different from traditional RS codes while maintaining the maximum distance separable property. The intelligent management layer 50 dynamically allocates the encoding to protect system critical metadata according to data importance. The two mechanisms cooperate with real-time monitoring of the system according to the error pattern, so that the engine can dynamically select the optimal error correction strategy according to the physical medium state, error characteristics and data value, to achieve the maximum reliability improvement with the minimum redundancy overhead.

[0065] Therefore, through the effective cooperation of the data integrity verification unit 31 and the dynamic enhanced error correction engine 32, the verification and error correction layer 30 realizes the goal of integrity verification and adaptive error correction coding on the encrypted data. That is, the data integrity verification unit 31 serves as the first line of defense and performs verification first when the data is read out. If the verification fails, the data integrity verification unit 31 can be triggered to attempt repair, and the strength of the hash algorithm and the update strategy can be configured by the intelligent management layer 50. The dynamic enhanced error correction engine 32 is the main guarantee of data reliability, and its specific behavior (which error correction code to use and how much redundancy) is completely determined by the intelligent management layer 50 according to the real-time monitored physical error pattern.

[0066] In some embodiments, referring to Figure 5 , Figure 5 is a structural schematic diagram of an embodiment of the data flow processing layer provided by the present application.

[0067] The data stream processing layer 40 includes a programmable computing array 41, a task-based data stream programming model interface 42, and a task optimization compiler 43.

[0068] The programmable computing array 41 is configured to perform direct cooperative processing and parallel computing of data in a storage medium controller based on processing units of multiple independently executable tasks and an on-chip network interconnection architecture.

[0069] Specifically, the programmable computing array 41 is implemented as a physical execution basis for near-data computing using a dedicated hardware architecture on a storage controller chip, and its core is composed of three key components. First, multiple lightweight processing units (PEs) are distributed in an array form, each PE uses a RISC-V reduced instruction set architecture or a dedicated hardware accelerator (such as a matrix multiplication unit), and is equipped with a private SRAM memory for instruction and data caching. Second, all PEs are interconnected through a high-performance on-chip network (NoC), which integrates a first-in-first-out (FIFO) mechanism implemented in hardware, supports point-to-point data stream transmission, and realizes low-latency and high-bandwidth direct data exchange between processing units, completely bypassing the external main memory controller. Finally, a dedicated high-speed parallel interface is directly connected to the physical data path of the flash medium, so that data read out from the flash cell can be directly streamed into the computing array for processing, avoiding the data transfer overhead through the main memory in the traditional storage architecture. This architecture optimizes spatial parallelism and data stream transmission, realizes the close coupling of storage and computing, and provides high-performance processing capability for data-intensive applications.

[0070] The task-based data stream programming model interface 42 is configured to implement automatic scheduling and efficient use of parallel resources of the programmable computing array 41 based on the abstract programming paradigm of task decomposition and data stream dependency declaration.

[0071] Specifically, the task-based dataflow programming model interface 42 provides high-level abstraction for upper-layer applications through a dedicated software development kit (SDK), and its core implementation is based on four programming paradigms. First, a task decomposition mechanism is used to split complex computing logic (such as data decompression -> text sentiment analysis -> result aggregation) into independent schedulable units (decompression task, analysis task, and aggregation task), and each task is encapsulated as an independently schedulable computing unit. Second, an explicit data flow declaration is used to establish the dependency relationship between tasks, and the developer directly defines a named data flow (such as decompressed_stream) and explicitly specifies the source task (decompression task output) and target task (analysis task input), forming an intuitive data flow diagram. Third, a data layout type system is introduced to allow developers to declare the distribution strategy of data on the virtual computing grid through type modifiers (such as "sharding" or "replication"), for example, sharding an image tensor to an N x M grid by blocks, and the compiler automatically implements data distribution, boundary exchange, and result collection accordingly. Finally, a virtual-to-physical mapping abstraction is provided, and the developer only needs to logically define the virtual processing unit requirements (such as a P0 scale set), and the runtime system automatically completes the decoupled mapping with the underlying physical PE resources. This implementation approach uses a declarative programming paradigm to sink the parallel computing complexity to the compiler and runtime system, allowing the developer to only focus on the computing logic itself without manually managing data synchronization, resource allocation, and other underlying details, significantly improving the development efficiency of near-data computing applications.

[0072] The task optimization compiler 43 is configured to map the user-defined logical task graph to the programmable computing array 41 for execution based on a Steiner minimum spanning tree optimization algorithm.

[0073] Specifically, the task optimization compiler 43 first parses the logical task graph defined by the developer, constructs a directed acyclic virtual mapping graph, where the nodes represent task instances, and the edges represent data flow and expected delay weight; then abstracts the optimization problem as an SSPT model, sets the data source task as the root node, the key task that must output results as the terminal node, and the optional intermediate processing task as the non-terminal node, and takes the path delay as the weight index; the optimization goal is to find the shortest path sub-tree covering all terminal nodes through a heuristic algorithm, minimizing the number of non-terminal nodes (i.e. resource occupation) while ensuring the lowest end-to-end delay. Taking intelligent video analysis as an example: the compiler sets video decoding as the root node, alarm as the terminal node, and the resource-intensive pedestrian re-identification task as the optional non-terminal node, and accordingly generates two optimization paths (lightweight path: decoding -> detection -> judgment -> alarm; heavy path: decoding -> detection -> re-identification -> judgment -> alarm), and the runtime dynamically selects the path according to the target detection result. This implementation converts the task graph optimization into a Steiner tree solving problem under multi-objective constraints through mathematical modeling, ensuring both calculation correctness and on-demand scheduling of computing and communication resources.

[0074] Therefore, through the effective cooperation of the programmable computing array 41, the task-based data flow programming model interface 42, and the task optimization compiler 43, the data flow processing layer 40 achieves the goal of performing near-data computing tasks on data that has been verified and corrected. That is, the programmable computing array 41 is the physical platform for all computing tasks, and the allocation and scheduling of its resources (PE, bandwidth) are determined by the results of the task optimization compiler 43; the task-based data flow programming model interface 42 is the entrance to the system's computing power, and the logical task graph it generates is the original input to the task optimization compiler 43; the task optimization compiler 43 converts the high-level, logical computing intent generated by the task-based data flow programming model interface 42 into low-level instruction sequences that can be executed most efficiently on the programmable computing array 41 through optimization algorithms such as SSPT.

[0075] In some embodiments, referring to Figure 6 , Figure 6 is a structural schematic diagram of an embodiment of the intelligent management layer provided by the present application.

[0076] The intelligent management layer 50 includes a parameter monitoring and data-driven decision unit 51, a metadata management unit 52, and a state verification and prediction optimization unit 53.

[0077] The parameter monitoring and data-driven decision unit 51 is configured to collect the running state parameters of the hardware security layer, the encryption processing layer, the verification and correction layer, and the data flow processing layer, and evaluate the running state parameters.

[0078] Specifically, the parameter monitoring and data-driven decision unit 51 is composed of three core components: a global parameter monitoring subunit, a parameterized performance knowledge base, and a data-driven decision engine. The monitoring subunit collects four-dimensional parameters in real time through probes deployed in the storage controller hardware: performance parameters (IOPS, latency, bandwidth utilization), reliability parameters (raw bit error rate, correction failure count, bad block growth rate), load characteristic parameters (read-write ratio, request size distribution, access locality), and physical state parameters (chip temperature, operating voltage, erase count). The parameterized performance knowledge base dynamically stores performance reliability models for different system configurations under different workloads and continuously optimizes through online learning. The data-driven decision engine periodically inputs real-time parameter vectors into the knowledge base model for evaluation. For example, when detecting that the raw bit error rate of a certain storage area exceeds the threshold, the engine analyzes the error pattern characteristics (such as random bit flipping or symbol transposition errors), queries the knowledge base for the optimal error correction strategy (such as switching to high-redundancy ECC or activating transposition error correction code), and automatically executes the strategy switch within an acceptable performance loss range, achieving fine-grained adaptive management of physical layer reliability.

[0079] The metadata management unit 52 achieves compressed storage and fast retrieval of large amounts of metadata with near-constant time complexity through adaptive block compression and hardware-accelerated rank query and selection query mechanisms.

[0080]

[0081] ​Specifically, with the continuous growth of storage capacity and complexity, the system needs to maintain a large amount of metadata (covering logical-physical address mapping table, bad block table, garbage collection information, snapshot index, etc.), the storage and query efficiency of which directly determines the performance of the entire system, and the metadata management unit 52 can realize high-speed query of massive metadata with minimal space overhead by using adaptive compression data structure; in specific implementation, the metadata management unit 52 manages all key metadata that can be represented as a bit vector by means of a hybrid coded bit vector data structure, on the one hand, adaptive block compression is used to optimize storage: the complete metadata bit vector (such as a bitmap marking whether a physical block is a bad block) is divided into fixed-size blocks, and when writing, the data characteristics in the block are quickly analyzed, if the data is highly repetitive (such as a large number of consecutive "0"s in the corresponding bitmap of a new storage area), run-length encoding is used to record only the repeated value and length, if the data is sparse (such as "1" being much less than "0" or vice versa), sparse encoding is used to record only the position index of a few minority bits, and if the data is randomly distributed without obvious rules, the original uncompressed bitmap form is retained, this adaptive selection mechanism can ensure that the storage space of metadata can be compressed to near the information entropy limit regardless of the distribution pattern; on the other hand, rank query and selection query are accelerated by hardware acceleration: the core of the hybrid bit vector structure design is to support high-speed execution of two key metadata query operations, namely the rank query that answers "how many '1's before position p" and the selection query that answers "where is the kth '1' located", the metadata management unit 52 establishes a hierarchical index structure for this purpose and directly implements it by hardware logic, so that the average time complexity of the query operation is close to a constant, for example, in the fast bad block positioning scenario, the file system needs to query the "position of the 100th available (non-bad block) physical block" when allocating a new block, this query will be converted into a select(0, 100) operation on the bad block bit vector, the unit can return the physical block address instantly through hardware-accelerated index, avoiding the slow traversal of traditional linked list or B-tree structure, and in garbage collection, the number of valid data pages in a certain area can also be quickly counted through rank query.

[0082] The state verification and prediction optimization unit 53 is configured to perform system stability prediction based on the running state parameters by using a strong spatial mixing model, and perform global multi-objective optimization solving by using a sum of squares programming, to generate the dynamic strategy.

[0083] Specifically, the state verification and prediction optimization unit 53 is the core decision engine of the intelligent reliability and management layer, and realizes the highest level of intelligence of the storage system through formal mathematical methods. The specific implementation of the unit is based on two major innovative mechanisms:

[0084] First, the stability prediction system based on the Strong Spatial Mixing (SSM) model abstracts the entire storage medium as a complex physical system. By establishing a phase transition model between the physical parameters such as the number of medium write times, operating temperature, voltage disturbance, and error rate evolution, and using mathematical methods to prove that the system satisfies the strong spatial mixing property, it is theoretically guaranteed that the influence of local faults will decay exponentially with distance. During operation, the aforementioned monitoring subunit continuously inputs real-time physical parameters into the model. When it detects that the parameter combination is approaching the phase transition critical point that may cause a sharp rise in error rate (even if the current macro error rate is still low), the state verification and prediction optimization unit 53 will immediately trigger an early warning and initiate preventive measures: including migrating data in high-risk areas to healthy areas, temporarily reducing the workload in this area, or dynamically increasing error correction redundancy, thereby actively avoiding the risk of "avalanche" global chain failure.

[0085] Second, the global multi-objective optimization engine based on Sum-of-Squares (SOS) programming uses a formal optimization framework to model the mutually restrictive multi-objective trade-off problem in storage system operation (such as maximizing performance, minimizing power consumption, maximizing service life, and ensuring data security) as a polynomial optimization problem. The specific implementation includes: expressing the performance function P(T, R, E), power consumption function C(T, R, E), and service life function L(T, R, E) as polynomials with respect to core adjustable parameters such as garbage collection threshold T, cache partition ratio R, and error correction redundancy E, and expressing the constraint conditions as polynomial inequalities (such as C_max - C(T, R, E) ≥ 0); then relaxing the original problem to a semi-definite programming (SDP) problem through Sum-of-Squares programming, and using the built-in lightweight SDP solver to calculate the parameter combination (T, R, E*) with theoretical optimality guarantee; the system dynamically adjusts the target function weights according to user macro instructions (such as "high performance mode" or "long life mode") and re-solves to ensure that the globally optimal configuration verified formally can be obtained in any working mode. Through the collaborative work of the SSM model and the SOS programming, this unit realizes the complete autonomous ability from macro stability prediction to multi-objective optimization decision-making, enabling the storage system to maintain the optimal operating state based on mathematical proof rather than empirical rules.

[0086] Therefore, through the effective coordination of the parameter monitoring and data-driven decision unit 51, the metadata management unit 52, and the state verification and prediction optimization unit 53, the intelligent management layer 50 achieves the goal of dynamically configuring the system and making global optimization decisions. That is:

[0087] The parameter monitoring and data-driven decision unit 51 provides real-time and accurate system state vectors required by the state verification and prediction optimization unit 53 for decision-making, and it also directly performs some local and tactical optimization adjustments; the metadata management unit 52 provides fast data positioning and statistical services for all units that need to access metadata; the state verification and prediction optimization unit 53 uses internal SSM and SOS models to conduct in-depth and forward-looking analysis and deduction based on the real data provided by the parameter monitoring and data-driven decision unit 51, and finally formulates strategic-level strategies to guide the operation of the entire system.

[0088] In some embodiments, the integrated security storage system further comprises a quantitative evaluation unit for constructing a unified performance quantification function based on indicators of performance, reliability, security, computing efficiency and life cycle cost, and the intelligent management layer makes optimization decisions with the goal of maximizing the performance quantification function.

[0089] The specific form of the performance quantification function is:

[0090] U(P|W,T)=∫_T[α(t)*F_P(t)+β(t)*F_C(t)-γ(t)*F_R(t)-δ(t)*F_S(t)-ε(t)*F_L(t)]dt

[0091] Wherein,

[0092] U represents a function of the system in a time period T and the work load set W handled by the system and the global policy configuration P adopted by the system;

[0093] P represents the current global policy configuration vector of the system, which is a high-dimensional vector containing adjustable parameters, such as: P={p_ecc,p_crypto,p_compute,p_gc,...}; Specifically, p_ecc represents the error correction strategy (such as error correction code type, redundancy); p_crypto represents the encryption strategy (such as algorithm, key length); p_compute represents the computing task scheduling strategy (such as PE allocation number, task fusion scheme); p_gc represents the garbage collection strategy, etc.

[0094] W represents the work load input into the system in the time period T, including the characteristics of data flow, computing task and access mode;

[0095] t represents time;

[0096] α(t), β(t), γ(t), δ(t), ε(t), these are function dynamic weight factors functions, dynamically set by the intelligent management layer 50 according to the current system's macro working mode (e.g. "high performance mode" or "longevity mode") and the priority of the working load, their sum is usually normalized to 1, for example, in high performance mode, the weights of α(t) and β(t) will be significantly increased.

[0097] In some embodiments, the interpretation and implementation of each sub-item of the performance quantification function is as follows:

[0098] 1. Performance and computation comprehensive performance item: α(t)*F_P(t)+β(t)*F_C(t), quantifies the positive benefits of the system as a data processing platform.

[0099] Wherein:

[0100] F_P(t), represents the traditional I / O performance function (IOPerformanceFunction);

[0101] Definition: F_P(t)=w_i*IOPS(t)+w_b*BW(t)-w_l*Latency(t);

[0102] Quantitative implementation:

[0103] IOPS(t), represents the number of I / O operations per second at time point t;

[0104] BW(t), represents the effective data bandwidth at time point t;

[0105] Latency(t), represents the inverse of the average I / O delay at time point t or a function negatively correlated with it;

[0106] w_i, w_b, w_l, represent internal weights dynamically adjusted according to the characteristics of the working load W (whether biased towards small I / O or large bandwidth).

[0107] Wherein:

[0108] F_C(t), represents the in-situ computation utility function (In-SituComputationUtilityFunction)

[0109] This item quantifies the value brought by the aforementioned data stream processing layer;

[0110] Definition: F_C(t)=η_task*N_tasks(t)*R_optimized(t)*(1-O_dram(t))

[0111] Quantitative implementation:

[0112] N_tasks(t), representing the number of computing tasks being concurrently executed by the dataflow processing layer at time point t;

[0113] R_optimized(t), representing the task graph optimization rate function, which is calculated by the SSPT optimization compiler of the dataflow processing layer 40, R_optimized = 1-(N_active_nodes / N_original_nodes), where N_active_nodes is the number of non-terminal nodes actually executed after SSPT optimization, and N_original_nodes is the number of non-terminal nodes in the original logical task graph. This indicator directly quantifies the resource saving benefits brought by SSPT technology;

[0114] O_dram(t), representing the DRAM access offloading rate, which is (Bytes_on_chip / Bytes_total), where Bytes_on_chip is the amount of data exchanged directly through the on-chip data stream of the dataflow processing layer 40, and Bytes_total is the total amount of data that needs to be exchanged in theory. This indicator directly quantifies the data migration reduction benefits brought by the task-based dataflow model;

[0115] η_task, representing a dimension coefficient, used to convert the completion amount of computing tasks into a comparable order of magnitude with I / O performance.

[0116] 2. Risk and cost comprehensive penalty term: γ(t)*F_R(t)+δ(t)*F_S(t)+ε(t)*F_L(t), which quantifies the cost and risk paid by the system to achieve

[0117] performance and calculation, as a negative penalty term.

[0118] Where:

[0119] F_R(t), representing the Reliability Risk Function;

[0120] Definition: F_R(t)=w_u*UBER(t)+w_p*P_critical(t);

[0121] Quantification:

[0122] UBER(t), representing the Uncorrectable Bit Error Rate at time point t, which is reported by the dynamic enhanced error correction engine 32 of the check and correction layer 30 when decoding fails;

[0123] P_critical(t), represents the critical risk probability, which is calculated by the SSM model in the state verification and prediction optimization unit 53 of the intelligent management layer 50, and represents the probability of a "phase change" type large-scale error occurring in a future period of time under the current system state. This indicator directly quantifies the predictive risk assessment capability of the framework SSM technology.

[0124] wherein:

[0125] F_S(t), represents the security risk function (Security Risk Function);

[0126] Definition: F_S(t) = w_a * A_freq(t) + w_v * V_level(t) * K_usage(t);

[0127] Quantitative implementation:

[0128] A_freq(t), represents the abnormal access frequency at time point t, which is reported by the formalized verifiable security logic synthesis unit 13 of the hardware security layer 10 (for example, the number of key verification failures);

[0129] V_level(t), represents the external threat level, which can be dynamically obtained by the intelligent management layer 50 from an external threat intelligence library, and represents whether there is a known high-risk vulnerability against the encryption algorithm used by the system at present;

[0130] K_usage(t), represents the key usage intensity, for example, if the current strategy is to not rotate the key for a long time, the risk value will increase; the value is reported by the encryption processing layer 20 and evaluated by the adaptive dynamic key management unit 12 of the hardware security layer 10.

[0131] wherein:

[0132] F_L(t), represents the lifecycle cost function (Lifecycle Cost Function);

[0133] Definition: F_L(t) = w_e * Energy(t) + w_w * WAF(t) * Wear(t);

[0134] Quantitative implementation:

[0135] Energy(t), represents the instantaneous total power consumption at time point t, which is directly measured by a hardware power consumption probe;

[0136] WAF(t), represents the write amplification factor (Write Amplification Factor), which is calculated by the intelligent management layer 50 garbage collection and FTL;

[0137] Wear(t), representing the average medium wear degree, is calculated by the intelligent management layer 50 according to the average erase-write times of the flash memory block.

[0138] Therefore, the unified performance quantification function U constitutes the mathematical basis for the global optimization of the state verification and prediction optimization unit 53 of the intelligent management layer 50 of the system.

[0139] In some embodiments, the application process of the unified performance quantification function is as follows:

[0140] 1. Objective establishment: when the system receives a new macro instruction (such as switching to a "low power consumption mode"), the intelligent management layer 50 adjusts the dynamic weight factors a(t)...ε(t) in the function, for example, significantly increases the weight of ε(t);

[0141] 2. Model establishment: the system converts the maximization problem of U(P|W,T) into a polynomial optimization problem about the strategy vector P. Each sub-item IOPS(t), UBER(t), etc. in the function is modeled as a polynomial function or an approximate function about the strategy P, and these models are stored in the "parameterized performance knowledge base";

[0142] 3. Formalized solution: the polynomial optimization problem is sent to a sum of squares (SOS) programming solver;

[0143] 4. Strategy deployment: the solver calculates an optimal strategy vector P* that maximizes U under the current state and target, and this P* contains the optimal parameter combination of all sub-modules (error correction, encryption, computation scheduling, etc.).

[0144] 5. Closed-loop execution: the intelligent management layer 50 issues specific parameters in P* to the corresponding units of the hardware security layer 10, the encryption processing layer 20, the error correction and verification layer 30, and the data flow processing layer 40 for execution. The system enters a new, formally verified, and globally optimal running state.

[0145] Therefore, through the effective cooperation of the five core layers of the hardware security layer 10, the encryption processing layer 20, the error correction and verification layer 30, the data flow processing layer 40, and the intelligent management layer 50, the active computing, dynamic adaptation, and intelligent optimization capabilities of the system are improved.

[0146] Then, the present application also provides an electronic device comprising the fusion security storage system in any of the preceding embodiments.

[0147] Next, the present application also provides a data management method based on the fusion security storage system, which is applied to the fusion security storage system of any of the preceding embodiments, and is described in detail with reference to Figure 7 , and the specific method is as follows:

[0148] S1, establishing a system physical trusted root through a hardware security layer;

[0149] S2, performing encryption processing on data based on the physical trusted root through an encryption processing layer;

[0150] S3, performing integrity checking and adaptive error correction coding on the encrypted data through a checking and error correction layer;

[0151] S4, executing near-data computing tasks on the data that has passed the checking and error correction through a data flow processing layer;

[0152] S5, monitoring the running states of each layer through an intelligent management layer, and performing dynamic strategy configuration and global optimization decision.

[0153] Finally, the application also provides a computer readable storage medium having a computer program stored thereon, the program being executed by a processor to implement the method shown in Figure 7 .

[0154] To sum up, the above-mentioned technology brings unexpected technical effects to the application: first, it realizes the qualitative change of the storage system from "passive defense" to "active intelligence", builds a complete "perception-analysis-decision-execution" intelligent closed loop through a stability prediction model, data-driven decision making and formal global optimization, so that the system has the cognitive ability of foreseeing risks, adapting to changes and autonomous optimization; second, it realizes the deep collaboration of storage computing and data management, realizes the seamless coupling of computing resource demand prediction and millisecond-level resource allocation at the micro level through the close cooperation of the task graph optimization unit and the efficient metadata management unit; third, it builds a cross-dimensional adaptive reliability system, forms a three-dimensional defense mechanism from physical layer dynamic error correction code, middle layer system stability prediction to top layer global parameter optimization, and the overall robustness far exceeds the effect of simply stacking each technology; fourth, it successfully reconciles the contradiction between performance, reliability and development efficiency, simplifies the development complexity through a high-level task-based data flow programming model, and at the same time, ensures the system to run autonomously at the approximate optimal performance point under the premise of high reliability through internal automatic optimization, and converts the traditional bottom-up optimization work relying on expert intervention into an endogenous ability of the system.

[0155] The above only describes the embodiments of the application, and does not limit the patent scope of the application, and any equivalent structure or equivalent flow transformation using the content of the application specification and drawings, or direct or indirect application in other related technical fields, are also included in the patent protection scope of the application.

Claims

1. A fusion security storage system, characterized by, The hardware security layer, the encryption processing layer, the check error correction layer, the data stream processing layer and the intelligent management layer are connected by communication connection: The hardware security layer is configured to provide a physical trusted root for the system and execute a security policy; The encryption processing layer is configured to perform encryption processing on data based on a security service provided by the physical trusted root; The check error correction layer is configured to perform integrity check and adaptive error correction coding on the encrypted data; The data stream processing layer is configured to execute near-data computing tasks on the data that has passed the check and error correction; The intelligent management layer collects real-time state data from the hardware security layer, the encryption processing layer, the check error correction layer and the data stream processing layer, and is configured to monitor the running states of the layers and perform dynamic policy configuration and global optimization decision; The hardware security layer comprises: A secure isolation execution and trusted root unit is configured to generate a cryptographically secure random number by a true random number generator, and generate a device unique key as a root key by combining the random number with a physically unclonable function; and a secure boot loading module is configured to verify and load hardware firmware by using the root key, so as to construct a complete hardware trust chain; An adaptive dynamic key management unit is connected to the intelligent management layer and the encryption processing layer, and is configured to dynamically adjust a key management policy according to a system security state; A formalized and verifiable security logic synthesis unit is configured to perform formalized verification on security logic in a hardware design stage; The data stream processing layer comprises: A programmable computing array is configured to perform direct cooperative processing and parallel computing of data in a storage medium controller based on a plurality of processing units with independently executable tasks and an on-chip network interconnection architecture; A task-based data stream programming model interface is configured to realize automatic scheduling and efficient utilization of parallel resources of the programmable computing array based on an abstract programming paradigm of task decomposition and data stream dependence declaration; A task optimization compiler is configured to map a user-defined logical task graph to the programmable computing array for execution based on a Steiner minimum path tree optimization algorithm; The intelligent management layer comprises: A parameter monitoring and data driven decision unit is configured to collect running state parameters of the hardware security layer, the encryption processing layer, the check error correction layer and the data stream processing layer, and evaluate the running state parameters; A metadata management unit is configured to realize compressed storage of massive metadata and fast retrieval with near constant time complexity by adaptive block compression and hardware accelerated rank query and selection query mechanism; A state verification and prediction optimization unit is configured to perform system stability prediction by a strong spatial mixing model based on the running state parameters, and perform global multi-objective optimization solution by sum of squares programming, to generate the dynamic policy.

2. The fusion security storage system of claim 1, wherein, The adaptive dynamic key management unit comprises a threat adaptive policy engine configured to monitor at least one of an access failure rate, a power consumption fluctuation and external threat intelligence, and dynamically trigger key rotation or encryption algorithm switching.

3. The fusion security storage system of claim 1, wherein, The encryption processing layer comprises: A stream encryption unit based on number theory transformation is configured to perform high-speed encryption operation based on number theory transformation; The task-driven adaptive encryption scheduler is used for dynamically configuring working parameters of the stream encryption unit according to characteristics of a computing task. The biometric key fusion unit is used for dynamically generating and destroying a temporary session key based on user biometric data and an irreversible transformation algorithm, and is specially used for anti-physical theft encryption protection of system key parameters.

4. The fusion security storage system of claim 1, wherein, The check and error correction layer comprises: The data integrity check unit is used for performing end-to-end integrity check and tamper detection on stored data based on a cryptographic hash algorithm. The dynamic enhanced error correction engine is used for selecting a target scheme from a plurality of error correction coding schemes to perform error correction processing according to instructions of the intelligent management layer and real-time error patterns. The plurality of error correction coding schemes comprises at least one of an encoding scheme for correcting continuous symbol transposition errors and a row-column twist redundancy encoding scheme.

5. The fusion security storage system of claim 1, wherein, The fusion security storage system further comprises The quantification evaluation unit is used for constructing a unified performance quantification function based on indicators of five dimensions of performance, reliability, security, computing efficiency and life cycle cost, and the intelligent management layer makes optimization decisions with the goal of maximizing the performance quantification function.

6. An electronic device, comprising: The fusion security storage system as claimed in any one of claims 1 to 5. The method is applied to the fusion security storage system as claimed in any one of claims 1 to 5, and comprises:

7. A data management method based on a fusion security storage system, characterized by, Establishing a system physical trusted root through the hardware security layer; Performing encryption processing on data based on the physical trusted root through the encryption processing layer; Performing integrity check and adaptive error correction coding on the encrypted data through the check and error correction layer; Performing near-data computing tasks on the data that has passed the check and error correction through the data stream processing layer; Monitoring running states of each layer through the intelligent management layer, and making dynamic strategy configuration and global optimization decisions. The program is executed by the processor to implement the method as claimed in claim 7.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, ​

Images