Remote certification and verification method for data destruction

Abstract

The invention relates to the technical field of data destruction, in particular to a remote proving and verifying method for data destruction, which comprises the following steps: constructing a holographic blood relationship map, registering an initial physical storage address of external input data as a root node, analyzing a data flow direction according to an intercepted instruction, and verifying the data destruction. When it is monitored that the source data is written into a new target physical address, generating mapping child nodes; responding to a preset destruction triggering condition, triggering a global fusing mechanism, generating a reverse destruction queue and implementing interlocking control: continuously querying a physical address space state, and only after it is confirmed that all derivative child nodes complete overwriting and verification, unlocking a father node and executing physical erasing on the father node; and calculating a local hash value of the current node which completes physical erasing and aggregating the local hash value into a root fingerprint, and performing digital signature on the root fingerprint to generate a destruction voucher. According to the application, the implicit physical copy can be locked by constructing the holographic consanguinity map, and the global physical thorough destruction of the data is realized by utilizing a reverse interlocking mechanism.

Description

Technical Field

[0001] This application relates to the technical field of data destruction, and in particular to a remote proof and verification method for data destruction. Background Technology

[0002] With the widespread application of big data analytics, federated learning, and cross-domain privacy computing technologies, the flow and sharing of data elements among different entities has become commonplace. Data owners typically transfer data to the computing environment of data consumers for processing, clearly defining the data's usage period or destruction conditions. Ensuring the complete and irreversible deletion of data upon the expiration of the authorization period or the completion of the task is a crucial aspect of data lifecycle management, in order to meet the compliance requirements of the General Data Protection Regulation (GDPR) and various data security laws and regulations. However, in modern computer architectures, traditional file deletion operations often merely remove file system inodes or mark storage space as available, without touching the physical data on the storage medium. This logical-level deletion is inadequate when facing highly sensitive data protection needs, failing to guarantee the complete disappearance of data at the physical level. Therefore, how to achieve complete physical-level destruction of data in uncontrollable third-party computing environments and provide verifiable proof of destruction has become a fundamental problem urgently needing to be solved in the field of data security.

[0003] In the prior art, Chinese Patent Publication No. CN114579477B discloses a processor structure for dynamic information flow tracing based on hardware security tags. This technical solution achieves dynamic information flow tracing during instruction execution and data access by adding security tag bits to the registers and storage modules within the processor core, and in conjunction with tag transmission logic circuitry. This technology utilizes hardware tags to classify the security level of a program and isolates different security domains by monitoring the tag transmission rules. It effectively prevents illegal information flow and cache-based side-channel attacks during program execution, offering significant advantages in access control and runtime isolation during data usage. It can effectively prevent low-security-level processes from illegally reading highly sensitive data, ensuring data confidentiality during computation.

[0004] However, the aforementioned existing technologies suffer from a technical flaw when handling data destruction tasks at the end of the data lifecycle: a misalignment between the scope of logical instructions and the physical data dispersal domain. Specifically, while these technologies utilize hardware tags to achieve runtime information flow tracking and isolation, their core logic focuses on preventing unauthorized access and lacks a closed-loop cleanup mechanism for physical data copies. In real-world high-load computing scenarios, the operating system kernel, in order to optimize performance, automatically triggers physical data dispersal based on memory management mechanisms. This includes swapping out sensitive data pages that have not been accessed for a long time to the disk's swap partition, or generating uncontrolled temporary cache copies and I / O buffer data in multi-level storage architectures. This system-level physical data movement process is often transparent to upper-layer applications and the simple hardware tag logic. When data expires and needs to be destroyed, externally issued destruction commands typically only point to the logical handle of the data in the file system or its main memory address. However, current technology lacks a mechanism to reverse-index and lock all implicit physical copies automatically generated by the operating system through logical entry points. This means that while the destruction operation clears the main data entity, it cannot reach and erase those detached physical copies that are no longer managed by the file system index. These residual data become security vulnerabilities that cannot be detected by conventional verification methods. Therefore, the core technical problem that urgently needs to be solved is: how to address the issue that existing logical destruction commands cannot cover the physical data dispersion boundaries caused by the underlying resource scheduling of the operating system, thus failing to completely erase all physical copies. Summary of the Invention

[0005] In order to lock implicit physical copies by constructing a holographic lineage map and to achieve complete physical destruction of data across the entire domain by using a reverse interlocking mechanism, this application provides a remote proof and verification method for data destruction.

[0006] This application provides a remote proof and verification method for data destruction, employing the following technical solution: A remote proof and verification method for data destruction, comprising: A holographic lineage map is constructed within the protected memory area. The initial physical storage address of the external input data is registered as the root node and its lifecycle attribute is initialized. A kernel probe is configured to intercept system call instructions and the data flow is analyzed based on the intercepted instructions. When it is detected that source data originating from a node in the holographic lineage map is written to a new target physical address, the target physical address is locked and a derived child node mapping the target physical address is generated in the holographic lineage map. In response to the preset destruction trigger condition, a global circuit breaker mechanism is triggered for the holographic lineage map, freezing the processes associated with the nodes in the holographic lineage map and generating a reverse destruction queue. Interlock control is implemented on the parent node in the reverse destruction queue: continuously query the physical address space status of all derived child nodes of the parent node, and only after confirming that all derived child nodes have completed overwriting and verification, the lock on the parent node is released and physical erasure is performed on it. Perform in-situ state verification on the current node that has completed physical erasure to calculate the local hash value, aggregate the local hash values ​​of all nodes in the holographic lineage graph into a root fingerprint, and digitally sign the root fingerprint to generate a destruction credential.

[0007] Optionally, the step of parsing the data flow based on the intercepted instructions involves performing dynamic taint determination based on address mapping: Maintain a dynamic taint address pool synchronized with the holographic lineage map, and mark the physical address range of nodes in the holographic lineage map as taint sources; When an instruction is intercepted, it is determined whether the source physical address read by the instruction falls into the dynamic tainted address pool; If the instruction is found, the target physical address is registered as the derived child node and added to the dynamic tainted address pool. At the same time, the lifetime attribute of the node corresponding to the source physical address is assigned to the derived child node.

[0008] Optionally, the step of performing dynamic taint determination based on address mapping includes capturing implicit physical copies: When a physical memory page in the dynamic tainted address pool is swapped out, its physical offset in the disk swap partition is locked and it is registered as the derived child node. When a buffer write via a file descriptor is detected, the corresponding kernel buffer physical address segment is locked and registered as the derived child node.

[0009] Optionally, the destruction triggering condition adopts an automatic determination logic based on timeliness negotiation: Monitor the lifecycle attribute of the root node, and initiate a renewal request when the remaining time is lower than a preset warning threshold; If authorization is not obtained within the preset response threshold, the destruction trigger condition will be forcibly responded to, triggering the global circuit breaker mechanism for the holographic lineage map and the construction of the reverse destruction queue.

[0010] Optionally, the step of triggering the global circuit breaker mechanism for the holographic lineage map involves performing a state freeze operation based on topology solidification: In response to the global circuit breaker mechanism, the process associated with the node in the holographic lineage map is suspended, and read and write operations on the node are blocked. Lock the physical memory page corresponding to the node, prohibit physical page swapping in and out and copy-on-write behavior, and switch the holographic lineage map from dynamic growth mode to static topology mode.

[0011] Optionally, the step of implementing interlock control on the parent nodes in the reverse destruction queue executes deadlock prevention logic based on state register bits: Initialize the pending destruction state bit for nodes in the static topology mode; When traversing the reverse destruction queue, write protection is applied to the current parent node, and the status bits of its associated derived child nodes are queried. Write protection is released and physical erasure is performed only when all the derived child nodes have been flipped to a verified zero state; otherwise, the parent node is kept locked to ensure the integrity of the index path.

[0012] Optionally, the step of performing physical erasure involves performing a media reset based on multiple rounds of overwrite: In response to the release of write protection, multiple rounds of data filling are performed on the physical address space of the parent node, and the last round is filled with all zero data until the number of overwrites reaches a preset security strength threshold. An in-situ readback verification is performed on the filled physical address space to compare the physical medium state with the all-zero sequence and confirm that the parent node has reached the physical zero state.

[0013] Optionally, the step of generating and destroying credentials involves performing isomorphic aggregation based on physical state: Collect the physical space data of the parent node that is in the physical zero state, and calculate the local hash value; A hash dependency chain is constructed based on the reverse destruction queue, and the local hash value of the associated derived child node is injected as a parameter into the hash calculation of the parent node; The root fingerprint is generated by recursively aggregating the data level by level, serving as the sole credential for anchoring the physical erasure status of all nodes in the holographic lineage map.

[0014] Optionally, the step of generating and destroying credentials involves performing hardware-anchored isolated signatures: Activate the preset hardware security components to construct a computing isolation domain, and ingest the root fingerprint into the computing isolation domain; The timestamp of the current operation is introduced as a time sequence factor and a session identifier associated with the holographic lineage map, and together with the root fingerprint, it is encapsulated into anti-replay metadata; The hardware-secured private key is used to encrypt the anti-replay metadata, generating the destruction credential.

[0015] Optionally, after generating the destruction credential, a remote verification support step is performed: The destruction certificate is output to an external verification terminal, which uses the public key to decrypt and parse the anti-replay metadata and the root fingerprint. When the time factor in the anti-replay metadata is within a preset time limit and the root fingerprint matches the preset zero-state hash value, it is confirmed that the physical medium associated with the holographic lineage map has been destroyed.

[0016] In summary, this application includes the following beneficial technical effects: 1. This method constructs a dynamically growing holographic lineage map and runs a taint determination mechanism based on address mapping. It can track and lock implicit physical copies that are transparent to upper-layer applications and generated by the underlying memory management behavior of the operating system in real time. These copies include memory pages swapped out to the disk swap partition and data copies in the kernel buffer. This completely solves the core technical problem of misalignment between the scope of logical destruction instructions and the physical diffusion domain of data in the prior art. It ensures that all physical storage locations of data are covered without omission, laying a solid foundation for the subsequent realization of complete destruction of the entire domain.

[0017] 2. This method designs a reverse interlocking destruction mechanism based on state register bit driving. After the destruction is triggered, a reverse destruction queue is generated according to the graph topology. It also forces that the parent node can only be unlocked and physical erased after all its derived child nodes have been overwritten and zeroed out. This bottom-up, child-first-parent-last interlocking control logic fundamentally eliminates the problem of zombie data remaining in child node replicas after the parent node is cleared due to improper destruction order, and ensures the integrity and thoroughness of data destruction under complex replica derivation relationships.

[0018] 3. This method proposes a credential generation method based on hash aggregation and hardware-isolated signatures of physical zero-state. By calculating the all-zero state of each storage medium after destruction as a local hash value, and recursively aggregating it into a unique root fingerprint along the reverse destruction order, a digital signature credential is generated in the hardware security isolation domain by combining a time-series factor. This allows external verifiers to independently verify the occurrence of the destruction event and that all associated physical media have been zeroed through cryptographic means, thereby establishing a verifiable destruction proof system across trust domains. This effectively breaks the technical trust barrier that data destruction results in remote environments cannot be self-verified and are difficult to be accepted by external parties. Attached Figure Description

[0019] Figure 1 It is a logical flowchart of the method; Figure 2 It is a schematic diagram of a holographic bloodline map; Figure 3 This is a schematic diagram of a fingerprint. Detailed Implementation

[0020] The following is in conjunction with the appendix Figure 1-3 This application will be described in further detail.

[0021] This application discloses a remote proof and verification method for data destruction. For example... Figure 1 As shown, a remote proof and verification method for data destruction is proposed, specifically addressing the core issues in existing technologies such as the inability of logical destruction instructions to cover the physical boundaries of data, the residual implicit physical copies, and the untrustworthiness of remote verification. This solution employs a closed-loop design of "holographic lineage map construction - reverse interlocking destruction - cryptographic credential verification" to manage all physical mapping addresses throughout the entire data lifecycle, ensuring complete physical destruction of the data across the entire domain. The following steps provide a detailed explanation: S1 Holographic Lineage Map Construction and Global Physical Address Locking like Figure 2 As shown, this step constructs a holographic lineage map synchronized with the physical diffusion of data by initializing the root node, dynamically tracking data flow, and capturing implicit copies. This enables precise locking of all data storage locations, solving the core problem that traditional technologies cannot cover the physical diffusion boundary of data, and providing comprehensive address support for subsequent destruction operations.

[0022] S11 Root Node Anchoring and Monitoring System Initialization When external input data enters the computing environment, the system first completes the initial configuration of the holographic lineage map in the protected memory area. The system assigns a unique session identifier to the data, registers the initial physical storage address range of the external input data as the root node of the holographic lineage map, and establishes the initial anchor point for data tracking. The system initializes the lifecycle attribute for the root node, which includes the lifecycle expiration time and the current state, and the current state is initialized to active.

[0023] The lifecycle expiration dates are determined based on standard data security management practices and practical application scenarios: 7-30 days for highly sensitive data, 30-90 days for moderately sensitive data, and 90-180 days for low-sensitivity data. This approach satisfies both the general data protection regulations' requirements for data of different sensitivity levels and adapts to the actual security needs of internal data flow within enterprises, ensuring the targeted and flexible nature of data lifecycle management.

[0024] After completing the root node configuration, the system deploys a kernel probe at the operating system kernel layer. This kernel probe specifically intercepts system call commands related to data reading, writing, copying, and migration, including key command types such as read, write, mmap, and memcpy. The kernel probe's interception path comprehensively covers all data interaction channels between the application layer and the kernel layer, enabling it to capture any operations that may lead to data flow or replica generation in real time, providing complete and accurate command source support for subsequent data flow analysis and replica tracking.

[0025] S12 Dynamic Impurity Detection and Derivative Child Node Generation The system synchronously maintains a dynamic taint address pool, which is linked in real time with the holographic lineage map to ensure that the coverage of taint sources is completely consistent with the physical address range of map nodes. The system marks the physical address range of all nodes in the holographic lineage map as taint sources one by one, establishing a one-to-one correspondence between taint sources and map nodes, providing a clear basis for judgment for data flow tracking.

[0026] When a kernel probe intercepts a system call instruction, the system immediately extracts the source physical address of the instruction and uses address matching logic to determine whether the source physical address falls within the address range of the dynamic tainted address pool. If the source physical address belongs to the dynamic tainted address pool, it means that the instruction operates on controlled data. The system then registers the target physical address of the instruction as a derived child node of the corresponding source node and adds the target physical address to the dynamic tainted address pool, thereby dynamically expanding the tainted range.

[0027] During this process, the system fully assigns the lifecycle attributes of the node corresponding to the source physical address to the derived child nodes, ensuring that the lifecycle of the derived child nodes is strictly consistent with that of the source node. This avoids the risk of data residue due to the lifecycle of the derived replicas being independent of the source node and thus leading to loss of control. This dynamic taint determination mechanism, which follows data flow, allows each active data copying and migration to trigger the dynamic growth of graph nodes, ensuring that all explicit copies of data generated at the application layer are promptly included in the control scope, breaking the limitation of traditional technologies that can only track the initial data address.

[0028] Precise capture and control of S13 implicit physical copies The system uses dedicated monitoring logic to fully capture implicit physical copies generated by the underlying resource scheduling of the operating system, filling the blind spots in the control of such implicit copies by traditional technologies.

[0029] When a physical memory page in the dynamic tainted address pool is swapped out to the disk swap partition due to high system load, insufficient memory, or other reasons, the system accurately captures this swapping operation by monitoring changes in the operating system's page table in real time. The system immediately locks the physical offset of the physical memory page in the disk swap partition, registers the storage area corresponding to that offset as a derived child node, and synchronously updates it to the dynamic tainted address pool and the holographic lineage map, ensuring that the storage location of the swapped-out data is under control. To reduce unnecessary memory page swapping, the system can call the `mlock()` system call to temporarily lock critical physical memory pages; if a physical memory page must be swapped out due to system resource limitations, the system forcibly records the swap area mapping relationship, ensuring that the swapped-out data can be accurately traced and subsequently managed.

[0030] When the system detects a buffer write operation via a file descriptor, it quickly locates the corresponding kernel buffer physical address segment by parsing the kernel data structure. The system registers this kernel buffer physical address segment as a derived child node and simultaneously incorporates it into the dynamic tainted address pool and holographic lineage graph, achieving effective control over implicit copies at the kernel level. Through this two-layer capture logic, both explicit copies actively generated by the application layer and implicit copies such as swap partition data and kernel buffer data generated by the operating system's underlying scheduling can be accurately captured by the holographic lineage graph, truly achieving full coverage of the data's physical diffusion domain and providing complete and comprehensive address information for subsequent thorough destruction.

[0031] S2 global circuit breaker and reverse interlocking physical destruction This step relies on the holographic lineage map constructed by S1 and the locked global physical address. Through time-sensitive negotiation to trigger destruction, topology solidification and freezing of state, interlock control to ensure order, and multiple rounds of overwriting to achieve zeroing, it completes the orderly destruction from derived child nodes to the root node. This solves the pain points of disordered destruction and the difficulty in completely clearing implicit copies in traditional technologies, ensuring that all physical copies are effectively erased.

[0032] S21 Time-Limited Negotiated Destruction Trigger Judgment The system continuously monitors the lifecycle attributes of the root nodes registered in S1 and calculates the remaining lifecycle time of the root nodes in real time. The system presets an early warning threshold, which is set at 20%-30% of the total lifecycle of the root nodes. This ratio not only allows sufficient time for data users to complete business and negotiate renewals, but also avoids data exceeding the authorized usage period due to delays in the renewal process. For example, for highly sensitive data with a total lifecycle of 30 days, the early warning threshold is set at 6 days, which meets the actual scenario requirements of "early warning and efficient negotiation" in data security management.

[0033] When the remaining lifespan of a root node falls below a warning threshold, the system automatically initiates a renewal request to the data owner. The request includes core information such as the data identifier, current remaining lifespan, and session identifier, ensuring the data owner clearly understands the key information of the data to be renewed. The system simultaneously presets a response threshold of 24 hours, aligning with the typical time rhythm of internal enterprise business approvals and ensuring efficient progress in the renewal process. If the system fails to obtain renewal authorization from the data owner within the response threshold, or receives a clear instruction to refuse renewal, the system forcibly triggers the destruction condition, initiating a global circuit breaker mechanism for the holographic lineage graph.

[0034] S22 Topology-Fixed State Freezing Operation The system responds to the global circuit breaker mechanism by first suspending all processes associated with nodes in the holographic lineage map by sending a SIGSTOP signal, directly blocking any read or write operations on these nodes and preventing accidental data tampering or transfer during the destruction process from the process level. Subsequently, the system locks the physical memory pages corresponding to all locked nodes in S1, explicitly prohibiting page swapping in and out and copy-on-write behavior, thus preventing the creation of new copies of data during the destruction process from the underlying memory management level.

[0035] After completing the above operations, the system formally transitions the holographic lineage map in S1, which is in dynamic growth mode, to static topology mode. At this point, the number of nodes, the relationships between nodes, and the physical address mappings of the map remain fixed. This topology-fixed state freeze operation provides a stable and traceable topological foundation for the subsequent destruction process, effectively avoiding destruction omissions caused by dynamic data migration during the destruction process, and ensuring that the destruction operation can accurately apply to each locked physical address.

[0036] S23 status register bit driven interlock control logic The system initializes a pending-destruction status bit for all nodes transitioning to static topology mode in S22, with the initial value uniformly set to "not destroyed." This status bit serves as the core identifier of node destruction progress, providing a clear basis for subsequent interlock control. Based on the node relationships in static topology mode, the system performs a post-order traversal of the holographic lineage graph, generating a reverse destruction queue that prioritizes child nodes over parent nodes. This ensures that all types of derived copies (including explicit and implicit copies) captured in S1 are destroyed before the source node.

[0037] When traversing the reverse destruction queue, the system applies write protection to the currently pending parent node to prevent it from being prematurely erased at the permission level. Simultaneously, the system queries the status bits of all derived child nodes of the parent node in real time. Only when the status bits of all derived child nodes have flipped to the verified zero state is the write protection on the current parent node released, allowing subsequent physical erasure operations. If there are derived child nodes that have not been destroyed, the system maintains the parent node's locked state to ensure the integrity of the index path between nodes. This interlocking logic, centered on status bits and requiring the parent node to unlock only after the child node's destruction verification is passed, overcomes the limitations of traditional unordered batch deletion techniques, fundamentally eliminating the problem of zombie data remaining in child nodes after the parent node has been destroyed, ensuring the rationality and thoroughness of the destruction order.

[0038] S24 Multi-round Overwrite and Physical Zeroing Verification In response to the release of write protection, the system performs a physical erase operation on the parent node's physical address space, employing a multi-round overwrite media reset method. The number of overwrites is determined based on the data sensitivity level and storage media type, referencing the NIST SP800-88r1 data destruction standard to set preset security strength thresholds: 7 overwrites for highly sensitive data, 3-5 overwrites for moderately sensitive data, and 1-3 overwrites for low-sensitivity data. This setting ensures that data cannot be recovered using conventional techniques while avoiding excessive overwrites that could lead to rapid wear and tear on the storage media, achieving a balance between data security and storage media lifespan. During the overwrite process, the system can use random number sequences for initial rounds of padding to disrupt residual magnetism in the media, but in the final overwrite round, the system must enforce all-zero data padding. After overwrite is complete, the system immediately performs in-situ readback verification on the physical address space, comparing the readback data byte-by-byte with the all-zero sequence. If the comparison results are completely consistent, the system determines that the node has reached the physical zeroing state and simultaneously updates the node's pending destruction status bit to verified zeroing; if there is a difference in the comparison, the system will re-execute the all-zero filling and verification operation until the verification passes, ensuring that the physical erasure of each node reaches the determined all-zero state, laying a reliable physical state foundation for the subsequent generation of destruction credentials that can be verified by the preset hash value.

[0039] S3 Destruction of Credentials Generation and Remote Trusted Verification like Figure 3 As shown, this step relies on the global physical zeroing result completed by S2, anchors the global state through hash aggregation, ensures signature security through hardware isolation, and confirms the destruction effect through remote verification, generating a destruction certificate with non-repudiation. This solves the trust barrier of destruction results caused by the remote invisibility of traditional technologies and realizes trusted verification of data destruction across subjects.

[0040] S31 Physical State Hash Aggregation and Root Fingerprint Generation The system collects physical space data of all nodes in S2 that have reached the physical zero state, and uses the SHA-256 hash algorithm to calculate the local hash value of each node. The SHA-256 algorithm is widely used in the field of data security, possessing high security and collision resistance characteristics. It can accurately map the physical state of nodes, ensuring that the local hash value is a unique identifier for the node's zero state, thus laying the foundation for subsequent aggregation verification.

[0041] The system strictly follows the reverse destruction queue order generated by S2 to construct a hash dependency chain. When calculating the local hash value of a parent node, the local hash values ​​of all its derived child nodes are injected as core parameters into the parent node's hash calculation process. Through hierarchical recursive aggregation, a root fingerprint is finally generated. This root fingerprint fully integrates the physical zeroing state information of all nodes in the holographic lineage graph, becoming the sole credential for anchoring the global physical erasure effect. This hash dependency chain design based on the destruction order strongly binds the root fingerprint to the destruction state of each node. Any node's failure to complete destruction will cause a identifiable change in the root fingerprint, breaking through the limitations of traditional technologies that can only verify a single node and cannot cover the entire domain, thus ensuring the authenticity and integrity of the root fingerprint.

[0042] S32 Hardware Isolated Domain Signature and Destruction Certificate Encapsulation The system initiates the preset hardware security components, which can be the TPM 2.0 module, Intel SGX Trusted Execution Environment, or ARM TrustZone Trusted Execution Environment, to build an independent computing isolation domain through hardware-level resource isolation. This computing isolation domain is completely isolated from the external system environment, effectively resisting malicious tampering and unauthorized access, and providing a secure execution environment for the root fingerprint signing process.

[0043] The system fully incorporates the root fingerprint generated by S31 into the computational isolation domain, while also introducing the timestamp of the current operation as a timing factor, and a session identifier associated with the S1 holographic lineage map. The root fingerprint, timing factor, and session identifier are encapsulated in a fixed format as anti-replay metadata, fundamentally preventing the destruction credential from being illegally reused. Subsequently, the system uses a private key embedded in the hardware security component to perform asymmetric encryption on the anti-replay metadata, generating the final destruction credential. The hardware-embedded private key is non-exportable, ensuring the encryption process cannot be forged, giving the generated destruction credential legally recognized non-repudiation, and providing a solid foundation of trust for cross-entity remote verification.

[0044] S33 External Verification Terminal Remote Verification Process The system outputs the generated destruction credential to an external verification terminal, which is pre-configured with a public key corresponding to the hardware-embedded private key. The verification terminal first uses the public key to decrypt the destruction credential, accurately parsing out the anti-replay metadata and root fingerprint. Subsequently, the verification terminal verifies the time-series factor in the anti-replay metadata, determining whether this factor is within a preset validity period threshold. The validity period threshold is set to 72 hours, a duration referencing the typical time window for data security verification. This provides sufficient execution time for the verification operation while avoiding potential security risks associated with prolonged credential validity.

[0045] Simultaneously, the verification end compares the parsed root fingerprint with the pre-set zero-state hash value bit by bit. The zero-state hash value is a baseline hash value calculated based on the same aggregation logic as S31, assuming all nodes have reached a physical zero-state. If the time-series factor is within the time-sensitive threshold and the root fingerprint and zero-state hash value match perfectly, the verification end confirms that the physical medium associated with the holographic lineage map has been completely destroyed. If any verification step fails, the verification end immediately determines that the destruction is incomplete and provides feedback on specific anomalies such as time-series failure or fingerprint mismatch. This remote verification process uses the physical zero-state as the core verification basis, rather than relying on easily tampered operation logs, ensuring the objectivity and credibility of the verification results and successfully solving the trust problem of self-reported cross-domain data destruction.

[0046] The implementation principle of a remote proof and verification method for data destruction in this application embodiment is as follows: By constructing a holographic lineage map that dynamically tracks the physical flow of data, the initial physical address of externally input data is registered as the root node. System calls are intercepted in real time using kernel probes. Based on a dynamic taint determination mechanism of address mapping, all explicit and implicit physical copies, including memory swapping to the swap partition and kernel buffer writing, are captured, and derivative child nodes are generated synchronously, thereby achieving global locking of the physical boundaries of the data. On this basis, in response to destruction triggering conditions based on time-sensitive negotiation, a global circuit breaker mechanism is triggered to freeze the lineage map state and... A reverse destruction queue is generated, relying on interlock control logic driven by state register bits to ensure that all derived child nodes are overwritten and verified to be zero before the parent node is unlocked and physical erasure is performed. This forms an orderly and thorough destruction path from child nodes to the root node. Finally, the local hash value is calculated based on the physical zeroing state of each node, and the root fingerprint is recursively aggregated along the reverse destruction queue. A time-series factor and session identifier are introduced into the isolation domain built by the hardware security component to perform digital signature, generating a replay-proof destruction credential. This credential is then decrypted by the external verification end using the public key and its timeliness is verified to be consistent with the root fingerprint, thereby completing remote trusted verification. This fusion mechanism first solves the problem that logical destruction instructions cannot cover implicit physical copies generated by the underlying scheduling of the operating system by dynamically constructing a holographic lineage map and tracking taints, ensuring that the physical diffusion domain of data is locked without omission. Second, by using reverse interlocking and state bit control to control the destruction order, it overcomes the disorder and residual risks of traditional destruction methods, achieving complete physical erasure of the entire domain from the derived copy to the source data. Finally, by using hash aggregation based on the physical zero state and hardware isolated signature, it generates cryptographic credentials with tamper-proof and replay-proof characteristics, enabling external verifiers to reliably confirm the completion of destruction across domains, breaking the technical dilemma of difficulty in self-verification of remote destruction results and high trust barriers.

[0047] The above are all preferred embodiments of this application, and are not intended to limit the scope of protection of this application. Therefore, all equivalent changes made in accordance with the structure, shape and principle of this application should be covered within the scope of protection of this application.

Claims

1. A remote proof and verification method for data destruction, characterized in that, include: A holographic lineage map is constructed within the protected memory area. The initial physical storage address of the external input data is registered as the root node and its lifecycle attribute is initialized. A kernel probe is configured to intercept system call instructions and the data flow is analyzed based on the intercepted instructions. When it is detected that source data originating from a node in the holographic lineage map is written to a new target physical address, the target physical address is locked and a derived child node mapping the target physical address is generated in the holographic lineage map. In response to the preset destruction trigger condition, a global circuit breaker mechanism is triggered for the holographic lineage map, freezing the processes associated with the nodes in the holographic lineage map and generating a reverse destruction queue. Interlock control is implemented on the parent node in the reverse destruction queue: continuously query the physical address space status of all derived child nodes of the parent node, and only after confirming that all derived child nodes have completed overwriting and verification, the lock on the parent node is released and physical erasure is performed on it. Perform in-situ state verification on the current node that has completed physical erasure to calculate the local hash value, aggregate the local hash values ​​of all nodes in the holographic lineage graph into a root fingerprint, and digitally sign the root fingerprint to generate a destruction credential.

2. The method according to claim 1, characterized in that, The step of parsing the data flow based on the intercepted instructions involves performing dynamic taint determination based on address mapping: Maintain a dynamic taint address pool synchronized with the holographic lineage map, and mark the physical address range of nodes in the holographic lineage map as taint sources; When an instruction is intercepted, it is determined whether the source physical address read by the instruction falls into the dynamic tainted address pool; If the instruction is found, the target physical address is registered as the derived child node and added to the dynamic tainted address pool. At the same time, the lifetime attribute of the node corresponding to the source physical address is assigned to the derived child node.

3. The method according to claim 2, characterized in that, The step of performing dynamic taint determination based on address mapping includes capturing implicit physical copies: When a physical memory page in the dynamic tainted address pool is swapped out, its physical offset in the disk swap partition is locked and it is registered as the derived child node. When a buffer write via a file descriptor is detected, the corresponding kernel buffer physical address segment is locked and registered as the derived child node.

4. The method according to claim 1, characterized in that, The destruction triggering condition adopts an automatic determination logic based on time-sensitivity negotiation: Monitor the lifecycle attribute of the root node, and initiate a renewal request when the remaining time is lower than a preset warning threshold; If authorization is not obtained within the preset response threshold, the destruction trigger condition will be forcibly responded to, triggering the global circuit breaker mechanism for the holographic lineage map and the construction of the reverse destruction queue.

5. The method according to claim 1, characterized in that, The step of triggering the global circuit breaker mechanism for the holographic lineage map involves performing a state freeze operation based on topology solidification: In response to the global circuit breaker mechanism, the process associated with the node in the holographic lineage map is suspended, and read and write operations on the node are blocked. Lock the physical memory page corresponding to the node, prohibit physical page swapping in and out and copy-on-write behavior, and switch the holographic lineage map from dynamic growth mode to static topology mode.

6. The method according to claim 5, characterized in that, The step of implementing interlock control on the parent nodes in the reverse destruction queue executes deadlock prevention logic based on state register bits: Initialize the pending destruction state bit for nodes in the static topology mode; When traversing the reverse destruction queue, write protection is applied to the current parent node, and the status bits of its associated derived child nodes are queried. Write protection is released and physical erasure is performed only when all the derived child nodes have been flipped to a verified zero state; otherwise, the parent node is kept locked to ensure the integrity of the index path.

7. The method according to claim 6, characterized in that, The step of performing physical erasure involves performing a media reset based on multiple rounds of overwrite: In response to the release of write protection, multiple rounds of data filling are performed on the physical address space of the parent node, and the last round is filled with all zero data until the number of overwrites reaches a preset security strength threshold. An in-situ readback verification is performed on the filled physical address space to compare the physical medium state with the all-zero sequence and confirm that the parent node has reached the physical zero state.

8. The method according to claim 7, characterized in that, The step of generating and destroying credentials involves performing isomorphic aggregation based on physical state: Collect the physical space data of the parent node that is in the physical zero state, and calculate the local hash value; A hash dependency chain is constructed based on the reverse destruction queue, and the local hash value of the associated derived child node is injected as a parameter into the hash calculation of the parent node; The root fingerprint is generated by recursively aggregating the data level by level, serving as the sole credential for anchoring the physical erasure status of all nodes in the holographic lineage map.

9. The method according to claim 8, characterized in that, The step of generating the destruction credential involves performing a hardware-anchored isolated signature: Activate the preset hardware security components to construct a computing isolation domain, and ingest the root fingerprint into the computing isolation domain; The timestamp of the current operation is introduced as a time sequence factor and a session identifier associated with the holographic lineage map, and together with the root fingerprint, it is encapsulated into anti-replay metadata; The hardware-secured private key is used to encrypt the anti-replay metadata, generating the destruction credential.

10. The method according to claim 9, characterized in that, After generating the destruction credential, the remote verification support steps are executed: The destruction certificate is output to an external verification terminal, which uses the public key to decrypt and parse the anti-replay metadata and the root fingerprint. When the time factor in the anti-replay metadata is within a preset time limit and the root fingerprint matches the preset zero-state hash value, it is confirmed that the physical medium associated with the holographic lineage map has been destroyed.

Images