Secret key distributed storage and safe calling method and device in optical fiber communication system

Abstract

The invention relates to the technical field of key management, and discloses a key distributed storage and safe calling method and device in an optical fiber communication system, and the method comprises the steps: segmenting a composite key into a plurality of fragments through a threshold secret sharing algorithm, encrypting the fragments through a hardware feature code, storing the index information of the fragments in a block chain alliance chain, and carrying out the encryption through a hardware feature code; storing the encrypted fragments in an IPFS network, and establishing an association relationship between an index and a content addressing identifier; and during calling, identity authentication and permission verification are performed through the smart contract, the encrypted fragments are retrieved from the IPFS network, threshold recombination is performed to restore the key, and integrity is verified through hash comparison. Through a double-layer distributed architecture and a double-protection system, the problems of high single-point fault risk and high key leakage risk of centralized key storage are solved.

Description

Technical Field

[0001] This invention relates to the field of key management technology, and more specifically, to a method and apparatus for distributed storage and secure retrieval of keys in an optical fiber communication system. Background Technology

[0002] With the development of 6G communication technology, fiber optic communication networks have become the core carrier for transmitting sensitive data in finance, government affairs, and national defense. As a core element of encrypted communication, the security of the key's storage and retrieval directly determines the attack resistance of the entire communication link.

[0003] The current mainstream key management scheme for fiber optic communication systems adopts a centralized storage architecture, where keys are uniformly stored on a central server, and terminal devices need to send a request to the central node to access the keys. This architecture has the following technical drawbacks: First, the central server is vulnerable to attacks, and once compromised, it will lead to the leakage of keys across the entire network; second, the centralized access mode generates a large amount of interactive traffic, increasing the transmission burden on fiber optic channels; and third, there is a risk of communication interruption caused by a single point of failure.

[0004] While existing distributed key storage schemes can alleviate the above problems to some extent, they suffer from issues such as chaotic key fragmentation management, difficulty in tracing key usage, and difficulty in ensuring data consistency between nodes. These technical shortcomings lead to insufficient reliability and security of the key management system, becoming a key technical bottleneck restricting the security of fiber optic communication systems. Summary of the Invention

[0005] This invention provides a method and apparatus for distributed key storage and secure access in an optical fiber communication system, which solves the technical problems of single point of failure risk, high risk of key leakage, difficulty in tracing access sources, and difficulty in ensuring data consistency between nodes in the centralized key storage architecture of related technologies.

[0006] This invention provides a method for distributed key storage and secure retrieval in an optical fiber communication system, comprising: Obtain the terminal identity identifier and random number, generate a composite key based on a symmetric encryption algorithm, perform a hash operation on the composite key to generate a key hash digest, and assign a key version number; The composite key is divided into N distinct key fragments using a threshold secret sharing algorithm. The terminal hardware feature code is obtained, and the hardware feature code is used as the encryption key to perform symmetric encryption operation on each key fragment to generate an encrypted fragment set. At the same time, fragment index information containing fragment number, key version number, key hash digest, terminal identity identifier and encryption timestamp is generated. The shard index information is packaged into transaction data and signed using the terminal's private key before being sent to the blockchain consortium chain node. After verification by the consortium chain node, the transaction data is written into a block and synchronized to all nodes of the consortium chain through a consensus algorithm, thus completing the decentralized notarization of the shard index information. The encrypted shard set is uploaded to the IPFS network for distributed storage. A unique content addressing identifier is generated by performing content hash calculation on each encrypted shard, and an association is established between the content addressing identifier and the corresponding shard index information stored in the blockchain. When a fiber optic communication terminal initiates an encrypted communication request, it generates a call request message containing the terminal's identity identifier, digital certificate, and target key version number, and sends it to the blockchain consortium chain node. The node calls a pre-deployed smart contract to authenticate the requesting terminal's identity and verify its permissions. After successful authentication, it retrieves the content addressing identifier list corresponding to the target key version from the blockchain's evidence storage data and returns it to the requesting terminal. Based on the content addressing identifier list, at least K encrypted fragments are retrieved from the IPFS network. The original key fragments are obtained by performing symmetric decryption operations on each encrypted fragment using the terminal hardware feature code. The composite key is restored by polynomial interpolation operations on the original key fragments based on the threshold recombination algorithm. The hash digest is obtained by performing a hash operation on the restored composite key. The hash digest of the original key is retrieved from the blockchain evidence storage data for comparison. If the comparison is consistent, the composite key is output to the physical layer encryption module of the optical fiber communication terminal.

[0007] Furthermore, the threshold secret sharing algorithm divides the composite key into N distinct key fragments, satisfying that any K or more fragments can be used to restore the complete key through polynomial interpolation, while any fewer than K fragments cannot obtain valid information about the original key. The threshold secret sharing algorithm takes the composite key as input and outputs N key fragments. The threshold secret sharing algorithm constructs a K-1 order random polynomial, uses the composite key as the constant term of the polynomial, randomly generates K-1 polynomial coefficients, and calculates the ordinate values ​​corresponding to N different horizontal coordinate points as key fragments. Each fragment is represented by a coordinate pair consisting of the horizontal and vertical coordinates.

[0008] Furthermore, the terminal hardware signature is generated by concatenating the terminal CPU serial number and MAC address into a string and then performing a hash operation on the concatenation result.

[0009] Furthermore, the consortium blockchain uses the Practical Byzantine Fault Tolerance consensus algorithm to synchronize index information among consortium blockchain nodes. The input of the Practical Byzantine Fault Tolerance consensus algorithm is the signed transaction data, and the output is the consensus result that is unanimously recognized by all nodes in the network. The practical Byzantine fault-tolerant consensus algorithm is executed in three phases: the pre-preparation phase, in which the master node receives the client request and broadcasts the pre-preparation message to all slave nodes; the preparation phase, after each slave node verifies the message, it broadcasts the preparation message to other nodes and waits to collect at least twice the maximum number of malicious nodes that the system can tolerate plus one of the valid preparation messages; and the commit phase, after each node broadcasts the commit message and waits to collect at least twice the maximum number of malicious nodes that the system can tolerate plus one of the valid commit messages, it writes the transaction data into the block. The maximum number of malicious nodes that the system can tolerate is the total number of nodes in the consortium chain minus one divided by three and rounded down.

[0010] Furthermore, a smart contract is automatically executed code deployed on a consortium blockchain, which includes authentication logic units, permission verification logic units, and index retrieval logic units; The authentication logic unit is used to verify the validity and legality of the terminal digital certificate; the permission verification logic unit is used to verify whether the terminal identity identifier has the right to call the target key; the index retrieval logic unit is used to extract the content addressing identifier list corresponding to the target key fragment from the blockchain evidence storage data.

[0011] Furthermore, the threshold recombination algorithm takes at least K key fragments as input and outputs a composite key. The threshold recombination algorithm calculates the value of the polynomial at the zero point using the Lagrange interpolation formula to restore the constant term of the original composite key. Specifically, it calculates the weighted sum of the ratios between the ordinate value of each key fragment and the abscissas of all other fragments to obtain the function value of the polynomial at the zero point as the composite key.

[0012] Furthermore, when retrieving at least K encrypted fragments in the IPFS network based on the content addressing identifier list, a parallel retrieval strategy is adopted to simultaneously initiate fragment retrieval requests to multiple IPFS nodes. Successfully obtaining any K valid fragments completes key reassembly.

[0013] Furthermore, the authentication logic executed by the smart contract includes: verifying the validity and legality of the terminal digital certificate, verifying whether the terminal identity has the authority to call the target key, and verifying whether the request timestamp is within the valid time window.

[0014] Furthermore, the fragment index information includes fragment number, key version number, key hash digest, terminal identity identifier, and encryption timestamp; the content addressing identifier is generated by the IPFS network through content hash calculation of the encrypted fragments, and different encrypted fragments correspond to unique content addressing identifiers.

[0015] This invention provides a distributed key storage and secure retrieval device for an optical fiber communication system, comprising: The key generation module is used to obtain the identity information of the fiber optic communication terminal and the random number generated by the random number generator, generate a composite key based on the symmetric encryption algorithm, perform a hash operation on the composite key to generate a key hash digest, and assign a unique key version number; The key sharding and encryption module is used to divide the composite key into N distinct key shards using a threshold secret sharing algorithm, obtain the terminal hardware feature code, perform symmetric encryption operations on each key shard to generate an encrypted shard set, and generate shard index information containing shard number, key version number, key hash digest, terminal identity identifier and encryption timestamp; The blockchain evidence storage module is used to receive shard index information, package the index information into transaction data and sign it using the terminal private key, and write the signed transaction data into the blockchain block to realize decentralized evidence storage of shard index information and establish the association between shard index information and content addressing identifier. The IPFS distributed storage module is used to receive a set of encrypted fragments, upload each encrypted fragment to the IPFS network for distributed storage, perform content hash calculation on each encrypted fragment to generate a unique content addressing identifier, and return the corresponding encrypted fragment in response to retrieval requests. The key call authentication and retrieval module is used to generate a call request message containing the terminal identity identifier, digital certificate and target key version number. It performs terminal identity authentication and permission verification through a pre-deployed smart contract. After successful authentication, it retrieves the content addressing identifier list corresponding to the target key version from the blockchain evidence storage data. Based on the content addressing identifier list, it retrieves at least K encrypted fragments from the IPFS distributed storage module. The key recombination and verification module is used to perform symmetric decryption operations on each encrypted fragment using the terminal hardware feature code to obtain the original key fragment. Based on the threshold recombination algorithm, polynomial interpolation operations are performed on the original key fragment to restore the composite key. The restored composite key is hashed to obtain a hash digest. The original key hash digest is retrieved from the blockchain evidence storage module for comparison and verification. If the comparison is consistent, the composite key is output to the fiber optic communication terminal. The cross-node synchronization module is used to synchronize index information between consortium blockchain nodes through a practical Byzantine fault-tolerant consensus algorithm, ensuring that the key shard index stored by all consortium blockchain nodes in the network is consistent with the IPFS content addressing identifier. The fiber optic communication terminal is used to receive the composite key output by the key recombination and verification module, load the composite key into the physical layer encryption unit, and realize the encrypted transmission of fiber optic communication data.

[0016] The beneficial effects of this invention are as follows: This invention employs a two-layer distributed architecture combining blockchain notarization and IPFS distributed storage. It stores key index information on the blockchain consortium chain and stores encrypted keys in fragments on the IPFS network. This eliminates the risk of single point of failure in centralized storage architectures, solves the technical problems of central servers becoming easy targets for attacks leading to network-wide key leakage, and single point of failure causing communication interruptions. It achieves the technical effect that when some storage nodes fail, the remaining nodes can still provide complete key storage and retrieval services.

[0017] This invention employs a threshold secret sharing algorithm to fragment the key and encrypts each fragment using terminal hardware signature codes, forming a dual protection system of fragment-level information security protection and terminal-level physical binding. This solves the technical problem of high key leakage risk and achieves the technical effect that even if an attacker obtains fewer fragments than the threshold, they cannot deduce the original key information. Furthermore, the strong binding of fragments to terminal hardware prevents decryption and use on unauthorized terminals, thus improving the key's resistance to attacks.

[0018] This invention uses blockchain smart contracts for automated identity authentication and permission verification, replacing traditional third-party authentication centers. It solves the technical problems of trust dependence and difficulty in tracing key calls, achieving the technical effect of reducing authentication interaction steps and lowering key call latency. At the same time, the immutability of blockchain ensures the traceability of key sharding index information and call records, providing an audit basis for the entire lifecycle management of keys.

[0019] This invention achieves index information synchronization between consortium blockchain nodes through a practical Byzantine fault-tolerant consensus algorithm, solving the technical problem of difficulty in ensuring data consistency between nodes. It achieves the technical effect of ensuring data consistency across the entire network even in the presence of some malicious nodes, thereby improving the fault tolerance and reliability of the distributed system. Attached Figure Description

[0020] Figure 1 This is a flowchart of a method for distributed key storage and secure retrieval in an optical fiber communication system according to the present invention; Figure 2 This is an overall structural block diagram of the key distributed storage and secure retrieval device of the present invention; Figure 3 This is a schematic diagram illustrating the interaction principle of key sharding, blockchain notarization, and IPFS storage in this invention. Detailed Implementation

[0021] Reference will now be made to exemplary embodiments to discuss the subject matter described herein. It should be understood that the discussion of these embodiments is only for enabling those skilled in the art to better understand and thus implement the subject matter described herein, and that changes may be made to the functions and arrangements of the elements discussed without departing from the scope of protection of the content of this specification. Each example may omit, substitute or add various processes or components as needed. In addition, the features described in some examples may be combined in other examples.

[0022] In at least one embodiment of the present invention, a method for distributed storage and secure invocation of keys in an optical fiber communication system is disclosed. As Figure 1 shown, it includes the following steps: Step 100: Obtain the terminal identity identifier and a random number, and generate a composite key and its hash digest based on the SM4 symmetric encryption algorithm.

[0023] The key generation module obtains the identity identifier information of the optical fiber communication terminal and the random number generated by the random number generator, uses the terminal identity identifier and the random number as input parameters, performs key generation operations based on the SM4 symmetric encryption algorithm, and outputs a 256-bit composite key . At the same time, perform a hash operation on the composite key to generate a key hash digest , and assign a unique key version number .

[0024] It should be noted that the above hash operation uses the SHA-256 algorithm, that is , where is the binary sequence of the composite key, is the 256-bit hash digest value, which is used for subsequent key integrity verification.

[0025] Step 200: Perform fragmentation processing on the composite key based on the threshold secret sharing algorithm, and encrypt each fragment with the hardware signature to generate an encrypted fragment set and fragment index information.

[0026] The key fragmentation and encryption module obtains the composite key output in step 100 , and uses the threshold secret sharing algorithm to divide the composite key into non-identical key fragments . This algorithm satisfies the following properties: Any or more fragments can restore the complete key through polynomial interpolation, and any fewer than fragments cannot obtain any valid information about the original key.

[0027] The input of the aforementioned threshold secret sharing algorithm is the 256-bit composite key The output is Key fragmentation The algorithm constructs... stochastic polynomial of order: composite key As a constant term Randomly generated coefficients ,calculate Different x-coordinate points Corresponding ordinate value As key fragments, each fragment consists of coordinate pairs. composition.

[0028] Obtain terminal hardware signature Using the hardware signature as the encryption key, symmetric encryption operations are performed on each key fragment to generate a set of encrypted fragments. Simultaneously, shard index information is generated, including shard number and key version number. Key hash digest Terminal identity identifier and encrypted timestamp.

[0029] It should be noted that the above hardware signature code It is a 160-bit feature value generated by concatenating the terminal CPU serial number and MAC address into strings and then using the SHA-1 hash algorithm. Right now ,in CPU serial number The physical address of the network card. This indicates a string concatenation operation.

[0030] In this embodiment of the application, in order to balance security and calling efficiency, the threshold parameter is set to , This option divides the composite key into 6 fragments, and any 4 or more fragments can be used to reconstruct the complete key. This parameter configuration can tolerate the loss or corruption of up to 2 fragments without affecting key reconstruction.

[0031] Step 300: Write the index information of the encrypted fragment into the blockchain for notarization, upload the encrypted fragment to the IPFS network for distributed storage, and establish the association between the index information and the content addressing identifier.

[0032] The blockchain evidence storage module obtains the output of step 200. The index information of each encrypted shard is packaged into transaction data. The transaction data is then asymmetrically encrypted and signed using the terminal's private key. The signed transaction data is sent to the consortium blockchain nodes. The consortium blockchain nodes verify the transaction data. Upon successful verification, the transaction data is written into a new block and synchronized to all nodes of the consortium blockchain via a consensus algorithm, completing the decentralized notarization of the index information. The IPFS distributed storage module obtains the encrypted shard set output in step 200. Each encrypted fragment is uploaded to the IPFS network separately.

[0033] The IPFS network performs content hash calculations on each encrypted fragment to generate a unique content addressing identifier. Address each content identifier It associates with the corresponding shard index information stored in the blockchain to complete the distributed storage of key shards.

[0034] It should be noted that the aforementioned consortium blockchain employs the Practical Byzantine Fault Tolerance (PBFT) consensus algorithm, composed of core nodes within a fiber optic communication network. The PBFT consensus algorithm takes signed transaction data as input and outputs a consensus result unanimously agreed upon by all nodes in the network. The algorithm executes in three phases: In the pre-preparation phase, the master node receives client requests and broadcasts pre-preparation messages to all slave nodes; in the preparation phase, each slave node verifies the message, broadcasts a preparation message to other nodes, and waits to collect at least [number missing] data. During the commit phase, each node broadcasts a commit message and waits to collect at least one valid preparation message. After each valid commit message, the transaction data is written to the block, where This represents the maximum number of malicious nodes the system can tolerate. This represents the total number of nodes in the consortium blockchain.

[0035] In this embodiment, to ensure the consistency of index information across all nodes in the network, the cross-node synchronization module uses the PBFT consensus algorithm to synchronize index information between consortium blockchain nodes. When any node receives a new index information write request, the request must go through the aforementioned three-stage consensus process to ensure that the key shard index stored by all nodes in the network is consistent with the IPFS content addressing identifier.

[0036] Step 400: Obtain the key access request, perform identity authentication and permission verification on the requesting terminal based on the blockchain smart contract, and retrieve the content addressing identifier of the target key fragment after successful authentication.

[0037] When a fiber optic communication terminal needs to conduct encrypted communication, the key retrieval and authentication module generates a retrieval request message. This request message includes the terminal's identity identifier, the digital certificate issued by the CA authority, and the target key version number.

[0038] The request message is sent to the blockchain consortium chain node, which then invokes a pre-deployed smart contract to process the request. The smart contract executes the following authentication logic: verifying the validity and legitimacy of the terminal's digital certificate, checking whether the terminal's identity has the authority to call the target key, and verifying whether the request timestamp is within a valid time window.

[0039] After successful authentication, the smart contract retrieves the shard index information corresponding to the target key version from the blockchain's stored data and extracts the IPFS content addressing identifier corresponding to each shard. The list is returned to the requesting terminal.

[0040] It should be noted that the aforementioned smart contract is automatically executed code deployed on a consortium blockchain, and its authentication logic and permission rules are pre-set during contract deployment. The execution process of the smart contract is automatically completed by the consortium blockchain nodes without the involvement of third-party intermediaries, thus reducing key access latency.

[0041] Step 500: Obtain encrypted fragments from the IPFS network based on the content addressing identifier, decrypt them using hardware signatures, perform threshold recombination operations to restore the composite key, verify the integrity of the key, and output the valid key.

[0042] The key reassembly and verification module obtains the content addressing identifier returned in step 400. List, based on each Retrieve the corresponding encrypted fragment from the IPFS network. Obtain at least... After each encrypted fragment, the terminal hardware signature is used. Symmetric decryption operations are performed on each encrypted fragment to obtain the original key fragment set.

[0043] The decrypted result Using the original key fragments as input, polynomial interpolation is performed based on the threshold recombination algorithm to reconstruct the composite key. .

[0044] The input to the aforementioned threshold recombination algorithm is at least Each key fragment: The output is a composite key. The algorithm calculates the values ​​of the polynomial at the zeros using the Lagrange interpolation formula. Right now This yields the constant term of the original composite key.

[0045] The composite key for restoration Perform a SHA-256 hash operation to obtain the hash digest. Retrieve the original key hash digest from the blockchain evidence storage data. ,Will and Perform a comparison. If they match, the key is confirmed to be complete and valid, and the composite key is then... The physical layer encryption module output to the fiber optic communication terminal is used for encrypted transmission of subsequent communication data.

[0046] In this embodiment, to address the issue of some IPFS nodes being unreachable, the key retrieval process employs a parallel retrieval strategy, simultaneously initiating shard retrieval requests to multiple IPFS nodes. Due to the characteristics of the threshold secret sharing algorithm, only the successful acquisition of any... Key reassembly can be completed with just one valid fragment, which improves the fault tolerance of key retrieval.

[0047] This implementation uses a two-layer distributed architecture that combines blockchain and IPFS. It stores key index information on the blockchain consortium chain and stores encrypted keys in fragments on the IPFS network. This eliminates the risk of single point of failure in centralized storage architecture. When some storage nodes fail, the remaining nodes can still provide complete key storage and retrieval services.

[0048] This implementation method adopts The threshold secret sharing algorithm segments the key and encrypts each segment using a terminal hardware signature. Therefore, even if an attacker obtains less than [a certain amount of the key], the key remains secure. Even with individual fragments, it is impossible to deduce any valid information about the original key through calculation; at the same time, because the fragments are strongly bound to the terminal hardware, even if the fragments are leaked, they cannot be decrypted and used on unauthorized terminals, thereby improving the key's resistance to attacks.

[0049] This implementation uses blockchain smart contracts for automated identity authentication and permission verification, thus eliminating the need for third-party certification centers to authorize key access, reducing authentication interactions and lowering key access latency. Simultaneously, the immutability of the blockchain ensures the traceability of key sharding index information and access records, providing an audit basis for the entire key lifecycle management.

[0050] This embodiment provides a key distributed storage and secure retrieval device in an optical fiber communication system, used to execute the method described in Specific Embodiment 1.

[0051] The apparatus provided in this embodiment includes a key generation module, a key fragmentation and encryption module, a blockchain evidence storage module, an IPFS distributed storage module, a key retrieval and authentication module, a key reconstruction and verification module, a cross-node synchronization module, and a fiber optic communication terminal. The modules communicate with each other through data interfaces, forming a complete distributed key storage and secure retrieval system.

[0052] Module 1: Key Generation Module; The key generation module is connected to the key fragmentation and encryption module to obtain the identification information of the fiber optic communication terminal and the random number generated by the random number generator, and to generate a 256-bit composite key based on the SM4 symmetric encryption algorithm. Perform a SHA-256 hash operation on the composite key to generate a key hash digest. Assign a unique key version number and the composite key Hash digest and version number Output to the key fragmentation and encryption module.

[0053] Module 2: Key Fragmentation and Encryption Module; The key fragmentation and encryption module is connected to the key generation module, the blockchain evidence storage module, and the IPFS distributed storage module, respectively, and is used to receive the composite key output by the key generation module. ,use Threshold secret sharing algorithm divides composite key into Each key fragment is different , Obtain terminal hardware signature Perform symmetric encryption operations on each key fragment to generate an encrypted fragment set. Simultaneously, it generates fragment index information containing fragment number, key version number, key hash digest, terminal identity identifier, and encryption timestamp. This fragment index information is output to the blockchain evidence storage module, and the encrypted fragment set is output to the IPFS distributed storage module. It should be noted that the aforementioned hardware signature... It is a 160-bit feature value generated by concatenating the terminal CPU serial number and MAC address into strings and then using the SHA-1 hash algorithm. .

[0054] Module 3: Blockchain Evidence Preservation Module; The blockchain evidence storage module consists of a consortium blockchain network composed of core nodes in the fiber optic communication network. It connects to the key sharding and encryption module, the IPFS distributed storage module, the key retrieval and authentication module, and the cross-node synchronization module. The blockchain evidence storage module receives shard index information output from the key sharding and encryption module, packages the index information into transaction data, performs asymmetric encryption signing using the terminal's private key, and writes the signed transaction data into a blockchain block, achieving decentralized evidence storage and full lifecycle traceability of the shard index information. The blockchain evidence storage module also receives content addressing identifiers output from the IPFS distributed storage module. Establish the association between fragment index information and content addressing identifiers.

[0055] Module 4: IPFS Distributed Storage Module; The IPFS distributed storage module is connected to the key sharding and encryption module, the blockchain evidence storage module, and the key retrieval and authentication module, respectively, and is used to receive the encrypted shard set output by the key sharding and encryption module. , Each encrypted fragment is uploaded to the IPFS network for distributed storage, and a content hash calculation is performed on each encrypted fragment to generate a unique content addressing identifier. The content addressing identifier is output to the blockchain evidence storage module for associated storage, and the corresponding encrypted fragment is returned in response to the retrieval request of the key call authentication and retrieval module.

[0056] Module 5: Key Retrieval Authentication and Retrieval Module; The key retrieval and authentication module is deployed in the fiber optic communication terminal and is connected to the blockchain evidence storage module, IPFS distributed storage module, and key reassembly and verification module. When the fiber optic communication terminal initiates an encrypted communication request, the key retrieval and authentication module generates a retrieval request message containing the terminal's identity identifier, a digital certificate issued by a CA authority, and the target key version number. This request message is sent to the consortium blockchain node of the blockchain evidence storage module. A pre-deployed smart contract performs terminal identity authentication and permission verification. Upon successful authentication, the module retrieves the content addressing identifier corresponding to the target key version from the blockchain evidence storage data. List, based on The list was retrieved from the IPFS distributed storage module at least The system generates encrypted fragments and outputs the obtained encrypted fragments to the key reconstruction and verification module.

[0057] It should be noted that the aforementioned smart contract is automatically executed code deployed on a consortium blockchain, comprising an authentication logic unit, a permission verification logic unit, and an index retrieval logic unit. The authentication logic unit verifies the validity and legality of the terminal's digital certificate; the permission verification logic unit verifies whether the terminal's identity has the authority to access the target key; and the index retrieval logic unit extracts the content addressing identifier list corresponding to the target key fragment from the blockchain's evidence storage data.

[0058] Module Six: Key Reassembly and Verification Module; The key reassembly and verification module is connected to the key invocation authentication and retrieval module, the blockchain evidence storage module, and the fiber optic communication terminal, respectively, and is used to receive at least the output of the key invocation authentication and retrieval module. Each encrypted fragment uses a terminal hardware signature. Symmetric decryption operations are performed on each encrypted fragment to obtain the original key fragment. A threshold recombination algorithm is then used to... The original key is fragmented and polynomial interpolation is performed to reconstruct the composite key. The hash digest is obtained by performing a SHA-256 hash operation on the restored composite key. Retrieve the original key hash digest from the blockchain evidence storage module A comparison and verification process is performed. If the comparison matches, the key is confirmed to be complete and valid, and the composite key is then... Output to fiber optic communication terminal.

[0059] Module 7: Cross-Node Synchronization Module; The cross-node synchronization module is connected to the blockchain evidence storage module to synchronize index information among consortium blockchain nodes using the Practical Byzantine Fault Tolerance (PBFT) consensus algorithm. When any consortium blockchain node receives a new index information write request, the cross-node synchronization module triggers the PBFT consensus process, sequentially executing the pre-preparation phase, preparation phase, and commit phase consensus verification to ensure that the key shard index stored by all consortium blockchain nodes is consistent with the IPFS content addressing identifier, thus guaranteeing data consistency in the distributed system.

[0060] The aforementioned PBFT consensus algorithm takes signed transaction data as input and outputs a consensus result unanimously agreed upon by all nodes in the network. This algorithm ensures distributed consistency through a three-phase message passing system: in the pre-preparation phase, the master node broadcasts a pre-preparation message; in the preparation phase, each node collects at least... During the commit phase, each node collects at least one valid preparation message. Consensus is confirmed after each valid submission message, among which... This represents the maximum number of malicious nodes the system can tolerate. This represents the total number of nodes in the consortium blockchain.

[0061] Module 8: Fiber Optic Communication Terminal; The fiber optic communication terminal is connected to the key reassembly and verification module via data connection, and includes a physical layer encryption unit and a communication interface unit. The fiber optic communication terminal is used to receive the composite key output by the key reassembly and verification module. The composite key is loaded into the physical layer encryption unit, and the encrypted transmission of optical fiber communication data is realized through the communication interface unit.

[0062] The data flow process of this device is as follows: After generating a composite key, the key generation module outputs it to the key sharding and encryption module; the key sharding and encryption module outputs the sharding index information to the blockchain evidence storage module and outputs the encrypted shard set to the IPFS distributed storage module; the IPFS distributed storage module outputs the content addressing identifier to the blockchain evidence storage module for association; the cross-node synchronization module synchronizes the index data of each consortium chain node in the blockchain evidence storage module; the key call authentication and retrieval module obtains the authentication result and content addressing identifier from the blockchain evidence storage module and obtains the encrypted shards from the IPFS distributed storage module; the key reassembly and verification module obtains the original hash digest from the blockchain evidence storage module for verification and outputs the valid key to the fiber optic communication terminal.

[0063] The device provided in this embodiment decouples the distributed key storage and secure call functions through modular division. Each module has a clear responsibility and a clear interface, which facilitates the deployment, maintenance and functional expansion of the system.

[0064] This implementation method utilizes the collaborative operation of the blockchain evidence storage module and the IPFS distributed storage module to store index information and encrypted fragments in a layered manner. Therefore, while ensuring the immutability of the index information, it leverages the content addressing characteristics of IPFS to achieve efficient retrieval of key fragments, thus avoiding the performance bottleneck caused by storing large amounts of data in the blockchain.

[0065] This implementation uses the PBFT consensus algorithm through a cross-node synchronization module to synchronize data between consortium blockchain nodes. Therefore, even in the presence of some malicious nodes, it can still ensure the consistency of data across the entire network, thereby improving the fault tolerance and reliability of the distributed system.

[0066] The embodiments of the present invention have been described above. However, the embodiments are not limited to the specific implementation methods described above. The specific implementation methods described above are merely illustrative and not restrictive. Those skilled in the art can make more equivalent embodiments under the guidance of the present embodiments, and all of them are within the protection scope of the present embodiments.

Claims

1. A method for distributed key storage and secure retrieval in an optical fiber communication system, characterized in that, Includes the following steps: Obtain the terminal identity identifier and random number, generate a composite key based on a symmetric encryption algorithm, perform a hash operation on the composite key to generate a key hash digest, and assign a key version number; The composite key is divided into N distinct key fragments using a threshold secret sharing algorithm. The terminal hardware feature code is obtained, and the hardware feature code is used as the encryption key to perform symmetric encryption operation on each key fragment to generate an encrypted fragment set. At the same time, fragment index information containing fragment number, key version number, key hash digest, terminal identity identifier and encryption timestamp is generated. The shard index information is packaged into transaction data and signed using the terminal's private key before being sent to the blockchain consortium chain node. After verification by the consortium chain node, the transaction data is written into a block and synchronized to all nodes of the consortium chain through a consensus algorithm, thus completing the decentralized notarization of the shard index information. The encrypted shard set is uploaded to the IPFS network for distributed storage. A unique content addressing identifier is generated by performing content hash calculation on each encrypted shard, and an association is established between the content addressing identifier and the corresponding shard index information stored in the blockchain. When a fiber optic communication terminal initiates an encrypted communication request, it generates a call request message containing the terminal's identity identifier, digital certificate, and target key version number, and sends it to the blockchain consortium chain node. The node calls a pre-deployed smart contract to authenticate the requesting terminal's identity and verify its permissions. After successful authentication, it retrieves the content addressing identifier list corresponding to the target key version from the blockchain's evidence storage data and returns it to the requesting terminal. Based on the content addressing identifier list, at least K encrypted fragments are retrieved from the IPFS network. The original key fragments are obtained by performing symmetric decryption operations on each encrypted fragment using the terminal hardware feature code. The composite key is restored by polynomial interpolation operations on the original key fragments based on the threshold recombination algorithm. The hash digest is obtained by performing a hash operation on the restored composite key. The hash digest of the original key is retrieved from the blockchain evidence storage data for comparison. If the comparison is consistent, the composite key is output to the physical layer encryption module of the optical fiber communication terminal.

2. The method for distributed key storage and secure retrieval in an optical fiber communication system according to claim 1, characterized in that, The threshold secret sharing algorithm divides the composite key into N distinct key fragments, satisfying that any K or more fragments can be used to restore the complete key through polynomial interpolation, while any fewer than K fragments cannot obtain valid information about the original key. The threshold secret sharing algorithm takes the composite key as input and outputs N key fragments. The threshold secret sharing algorithm constructs a K-1 order random polynomial, uses the composite key as the constant term of the polynomial, randomly generates K-1 polynomial coefficients, and calculates the ordinate values ​​corresponding to N different horizontal coordinate points as key fragments. Each fragment is represented by a coordinate pair consisting of the horizontal and vertical coordinates.

3. The method for distributed key storage and secure retrieval in an optical fiber communication system according to claim 1, characterized in that, The terminal hardware feature code is generated by concatenating the terminal CPU serial number and MAC address into a string and then performing a hash operation on the concatenation result.

4. The method for distributed key storage and secure retrieval in an optical fiber communication system according to claim 1, characterized in that, The consortium blockchain uses a practical Byzantine fault-tolerant consensus algorithm to synchronize index information among consortium blockchain nodes. The input of the practical Byzantine fault-tolerant consensus algorithm is the signed transaction data, and the output is a consensus result that is unanimously recognized by all nodes in the network. The practical Byzantine fault-tolerant consensus algorithm is executed in three phases: the pre-preparation phase, in which the master node receives the client request and broadcasts the pre-preparation message to all slave nodes; the preparation phase, after each slave node verifies the message, it broadcasts the preparation message to other nodes and waits to collect at least twice the maximum number of malicious nodes that the system can tolerate plus one of the valid preparation messages; and the commit phase, after each node broadcasts the commit message and waits to collect at least twice the maximum number of malicious nodes that the system can tolerate plus one of the valid commit messages, it writes the transaction data into the block. The maximum number of malicious nodes that the system can tolerate is the total number of nodes in the consortium chain minus one divided by three and rounded down.

5. The method for distributed key storage and secure retrieval in an optical fiber communication system according to claim 1, characterized in that, The smart contract is automatically executed code deployed on the consortium blockchain, which includes an identity verification logic unit, a permission verification logic unit, and an index retrieval logic unit. The authentication logic unit is used to verify the validity and legality of the terminal digital certificate; the permission verification logic unit is used to verify whether the terminal identity identifier has the right to call the target key. The index retrieval logic unit is used to extract the content addressing identifier list corresponding to the target key fragment from the blockchain evidence storage data.

6. The method for distributed key storage and secure retrieval in an optical fiber communication system according to claim 1, characterized in that, The threshold recombination algorithm takes at least K key fragments as input and outputs a composite key. The threshold recombination algorithm calculates the value of the polynomial at the zero point using the Lagrange interpolation formula to restore the constant term of the original composite key. Specifically, it calculates the weighted sum of the ratios between the ordinate value of each key fragment and the abscissas of all other fragments to obtain the function value of the polynomial at the zero point as the composite key.

7. The method for distributed key storage and secure retrieval in an optical fiber communication system according to claim 1, characterized in that, When retrieving at least K encrypted fragments in the IPFS network based on the content addressing identifier list, a parallel retrieval strategy is adopted to simultaneously initiate fragment retrieval requests to multiple IPFS nodes. Successfully obtaining any K valid fragments completes key reassembly.

8. The method for distributed key storage and secure retrieval in an optical fiber communication system according to claim 1, characterized in that, The authentication logic for smart contract execution includes: verifying the validity and legality of the terminal digital certificate, verifying whether the terminal identity has the authority to call the target key, and verifying whether the request timestamp is within the valid time window.

9. The method for distributed key storage and secure retrieval in an optical fiber communication system according to claim 1, characterized in that, The fragment index information includes fragment number, key version number, key hash digest, terminal identity identifier, and encryption timestamp; The content addressing identifier is generated by the IPFS network through content hash calculation of the encrypted fragments, and each encrypted fragment corresponds to a unique content addressing identifier.

10. A device for distributed key storage and secure retrieval in an optical fiber communication system, used to execute the method for distributed key storage and secure retrieval in an optical fiber communication system as described in any one of claims 1 to 9, characterized in that, include: The key generation module is used to obtain the identity information of the fiber optic communication terminal and the random number generated by the random number generator, generate a composite key based on the symmetric encryption algorithm, perform a hash operation on the composite key to generate a key hash digest, and assign a unique key version number; The key sharding and encryption module is used to divide the composite key into N distinct key shards using a threshold secret sharing algorithm, obtain the terminal hardware feature code, perform symmetric encryption operations on each key shard to generate an encrypted shard set, and generate shard index information containing shard number, key version number, key hash digest, terminal identity identifier and encryption timestamp; The blockchain evidence storage module is used to receive shard index information, package the index information into transaction data and sign it using the terminal private key, and write the signed transaction data into the blockchain block to realize decentralized evidence storage of shard index information and establish the association between shard index information and content addressing identifier. The IPFS distributed storage module is used to receive a set of encrypted fragments, upload each encrypted fragment to the IPFS network for distributed storage, perform content hash calculation on each encrypted fragment to generate a unique content addressing identifier, and return the corresponding encrypted fragment in response to retrieval requests. The key call authentication and retrieval module is used to generate a call request message containing the terminal identity identifier, digital certificate and target key version number. It performs terminal identity authentication and permission verification through a pre-deployed smart contract. After successful authentication, it retrieves the content addressing identifier list corresponding to the target key version from the blockchain evidence storage data. Based on the content addressing identifier list, it retrieves at least K encrypted fragments from the IPFS distributed storage module. The key recombination and verification module is used to perform symmetric decryption operations on each encrypted fragment using the terminal hardware feature code to obtain the original key fragment. Based on the threshold recombination algorithm, polynomial interpolation operations are performed on the original key fragment to restore the composite key. The restored composite key is hashed to obtain a hash digest. The original key hash digest is retrieved from the blockchain evidence storage module for comparison and verification. If the comparison is consistent, the composite key is output to the fiber optic communication terminal. The cross-node synchronization module is used to synchronize index information between consortium blockchain nodes through a practical Byzantine fault-tolerant consensus algorithm, ensuring that the key shard index stored by all consortium blockchain nodes in the network is consistent with the IPFS content addressing identifier. The fiber optic communication terminal is used to receive the composite key output by the key recombination and verification module, load the composite key into the physical layer encryption unit, and realize the encrypted transmission of fiber optic communication data.

Images