Electronic file fragmentation encryption and recombination method and system based on distributed optical storage

Abstract

The invention discloses an electronic file fragmentation encryption and recombination method based on distributed optical storage. According to the method, original archives are fragmented and encrypted by using different secret keys, and for each encrypted fragment, an access control strategy based on archive attributes is compiled into an executable verification logic capable of independently running and packaged into a strategy voucher. And the encrypted fragments and the corresponding strategy vouchers are bound and signed through cryptography to form self-verification storage units, and then the self-verification storage units are stored in a plurality of physically isolated optical storage nodes in a scattered manner. And during recombination, obtaining and verifying the signature of the target unit, running verification logic packaged in the node in a local security environment of the node, and performing access control decision according to a requester voucher. And only decrypting the encrypted fragments passing the judgment, and recombining the encrypted fragments into an original file. According to the method and the device, the dynamic strategy is converted into the static executable logic, and the static executable logic and the data are integrally packaged, so that safe and dynamic access control in an off-line read-only optical storage environment is realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data storage and information security, in particular to an electronic archive fragmentation encryption reorganization method and system based on distributed optical storage. BACKGROUND

[0002] The long-term safe archiving of electronic archives is an important issue in the digital age. Optical storage media, such as Blu-ray discs, archival discs, etc., are widely considered as one of the ideal media for realizing decades of long-term preservation of electronic archives due to their long storage life, resistance to electromagnetic interference, good data stability, and the physical characteristics of "write once, unchangeable".

[0003] However, the "write once, unchangeable" feature of optical media also brings new challenges to the long-term dynamic security management of archives. Current mainstream electronic archive access control technologies, such as role-based or attribute-based access control models, usually rely on an online, real-time update policy central authorization service for effective operation. In a conventional online storage system, access requests need to query the service in real time to obtain authorization decisions. However, in a distributed optical storage archiving scenario, once the archive data is written to the optical disc, it is in an offline state and the content cannot be modified. This makes it difficult for traditional access control models that rely on online, updateable central services to adapt to the needs of policy maintenance and dynamic decision-making in offline environments and long-term preservation periods.

[0004] There are also some existing technologies that attempt to solve the problem of secure access to offline or distributed storage, such as using blockchain smart contracts to manage access permissions, or encrypting data and storing it in fragments. However, the execution of smart contracts still depends on the availability of the blockchain network; and simple data fragmentation encryption techniques usually lack mechanisms for deep, offline integration with complex, variable fine-grained access control policies. Therefore, how to provide a secure and flexible access control and data reorganization method for long-term archived electronic archives while strictly following the physical constraints of optical storage still needs further exploration. SUMMARY

[0005] The present application provides an electronic archive fragmentation encryption reorganization method and system based on distributed optical storage, at least to solve the problems existing in the prior art.

[0006] The first aspect of the embodiment of the present application provides an electronic archive fragmentation encryption reorganization method based on distributed optical storage, comprising the following steps: S1. Splitting the original electronic archive into multiple data fragments, and encrypting each data fragment using multiple different keys to obtain corresponding multiple encrypted fragments; S2. For each of the encrypted fragments, define an access control policy according to the attributes of the original electronic file, and use a policy compilation engine to compile the access control policy into independently executable verification logic, thereby generating a policy credential encapsulating the executable verification logic; S3. Cryptographically bind each of the encrypted fragments to the corresponding policy credential, generate a digital signature based on the result of the cryptographic binding, thereby forming a plurality of self-verifying storage units; S4. According to a preset scheduling algorithm, store the plurality of self-verifying storage units in a plurality of physically isolated optical storage nodes; S5. In response to a recombination request for the original electronic file, obtain the corresponding target self-verifying storage unit from each of the optical storage nodes, and perform digital signature verification on each of the target self-verifying storage units; S6. For each of the target self-verifying storage units that pass the digital signature verification, run the executable verification logic encapsulated in the policy credential within the target self-verifying storage unit in the secure execution environment associated with the optical storage node where the target self-verifying storage unit is stored, to make an access control decision based on the input requester credential; S7. According to the result of the access control decision, only perform decryption operations on the encrypted fragments in the target self-verifying storage units that pass the decision, and recombine all the decrypted data fragments into the original electronic file.

[0007] By pre-compiling dynamic access control policies into independently executable verification logic and integrating them with encrypted data fragments for decentralized storage, a decentralized data security management architecture is constructed. In the data recombination phase, each storage node can complete automated permission decisions and data decryption for access requests in a local secure environment based on the logic encapsulated within the unit. This method significantly reduces the dependence on real-time online authorization services, thereby better adapting to the long-term archiving scenario of offline and read-only optical storage media. It gives static data dynamic and fine-grained access control capabilities while maintaining the physical characteristics of the medium. At the same time, through the cryptographic binding and decentralized storage mechanism, the reliability and resistance of the entire storage system are enhanced while improving data security.

[0008] In some embodiments, in the S2, the policy compilation engine compiles the access control policy in text format into a bytecode program executable across different hardware and software platforms; the bytecode program is deterministic, and its execution result only depends on the input requester credential and the program itself logic.

[0009] The generation of portable bytecode through compilation reduces the coupling of verification logic with specific hardware or operating system platforms, enabling smooth operation in different architecture node security environments, which enhances the deployment flexibility and compatibility of the entire scheme in a heterogeneous and complex distributed storage system. At the same time, the determinacy of the verification logic is a key attribute that ensures that for the same access request input, the output of the permission decision is stable and predictable, and there is no ambiguity due to different execution environments or times. This determinacy provides a verifiable and auditable basis for access control behavior, which is beneficial for building a reliable security system.

[0010] In some embodiments, in the S3, the generation of the cryptographic binding and digital signature specifically includes: S31. Calculate the first cryptographic hash value of the encrypted shard and the second cryptographic hash value corresponding to the policy credential, respectively; S32. Combine the first cryptographic hash value and the second cryptographic hash value in a predetermined order to generate a combined hash value, to establish an inseparable association between the encrypted shard and the policy credential; S33. Use a signature private key to digitally sign the combined hash value, and use the digital signature as a component of the self-verifying storage unit for subsequent verification of the association and data integrity.

[0011] By calculating the hash values of the encrypted shard and the policy credential respectively and combining them, a one-to-one and inseparable strong association between the two is established at the cryptographic level. Any tampering with either component will result in a change in the final combined hash value. The digital signature generated on this basis not only serves as an authoritative endorsement of the combined hash value, but also makes each storage unit a self-contained verification carrier. This mechanism provides a direct and reliable technical basis for the signature verification step in the subsequent reorganization verification step, enabling the system to efficiently confirm the integrity and authenticity of the storage unit, thereby enhancing the trustworthiness of the entire scheme in the data integrity verification step.

[0012] In some embodiments, in the S4, the preset scheduling algorithm is a consistent hashing algorithm that maps the unique identifier of each self-verifying storage unit to an identifier of the optical storage node, so that the multiple self-verifying storage units corresponding to the original electronic file are stored in different physical optical storage nodes.

[0013] Consistent hashing distributes storage units relatively evenly and stably across the storage node set. This characteristic helps balance the storage load across nodes, preventing excessive data concentration. More importantly, when distributed storage environments inevitably face node expansion, reduction, or partial failures, consistent hashing can reduce the amount of data that needs to be migrated, thereby reducing system maintenance overhead and improving adaptability to dynamic changes. This enhances the stability and scalability of the entire storage architecture in the face of node state changes. Simultaneously, forcibly distributing fragments of the same file across different physical nodes, combined with the aforementioned encryption and verification mechanisms, reduces the risk of the entire file becoming unrecoverable due to the complete failure of a single node, thus improving the overall reliability and robustness of long-term data preservation at the storage level.

[0014] In some embodiments, in step S6, the secure execution environment is a trusted execution environment provided by a hardware security module or a security chip; the executable verification logic is loaded within the trusted execution environment, its integrity is verified, and then it runs.

[0015] By placing the critical security operation of authorization adjudication within a hardware-hardened, isolated, and trusted execution environment, this design provides integrity protection for the loaded executable verification logic code, ensuring it is not tampered with or spied on by external malware during runtime. Simultaneously, sensitive credential information submitted by the requester is processed within this isolated environment, significantly reducing the risk of credential data leakage during the adjudication process. Through hardware-level security isolation and protection, this design establishes a highly reliable secure execution foundation for the entire authorization adjudication process. This not only enhances the credibility of the adjudication result itself but also improves the overall security level of the system against attacks targeting the authorization verification stage.

[0016] In some embodiments, before running the executable verification logic in step S6, the method further includes: the trusted execution environment performing integrity verification on the encrypted fragment data read from the optical storage node based on the hash value of the encrypted fragment encapsulated in the policy credential.

[0017] By adding a cryptographic verification layer to the original data block within the core security environment of authorization decisions, this step effectively identifies and prevents data corruption caused by physical degradation of storage media, read errors, or transmission processes. It extends integrity verification to before data is actually used, providing a more direct and reliable data source guarantee for decryption operations. Combined with storage unit-level digital signature verification, this mechanism constructs a multi-layered, progressive data trust verification system, enhancing the system's ability to guarantee data integrity and reducing the risk of subsequent processing failures or errors due to silent data corruption.

[0018] In some embodiments, in step S6, the executable verification logic is configured to perform an attribute-based access control decision, which determines whether at least one condition in the access control policy regarding data security level, department, and time validity is met by parsing the attribute declaration in the requester's credentials.

[0019] By employing an attribute-based access control model, this constraint enables static policies encapsulated within storage units to support fine-grained and context-aware permission adjudication. This model allows policies to be defined by combining attributes across multiple dimensions, such as data security level, user department, and time validity, thereby expressing complex access rules that closely align with actual management needs. This enhances the flexibility and adaptability of the method in dealing with diverse security policies, enabling it to achieve granular access management beyond simple authentication. Introducing this attribute-driven decision-making logic within the framework of offline adjudication maintains the core advantages of the solution while improving its compatibility and expressiveness with modern access control frameworks.

[0020] In some embodiments, in step S6, after the executable verification logic performs access control adjudication within the trusted execution environment, a local audit digest of the adjudication is also generated. The local audit digest at least includes the identifier of the executable verification logic and a cryptographic commitment value of the adjudication result. The method further includes: S8. Aggregate the local audit digests corresponding to all the target self-verifying storage units, and combine them with the reorganization request identifier and the timestamp of the reorganization operation to generate a structured reorganization audit record; S9. Submit the reorganized audit record itself or its cryptographic hash value to a blockchain network or distributed ledger for evidence storage, so as to form an immutable audit trail.

[0021] By introducing an audit evidence preservation mechanism, this limitation constructs a traceable and tamper-proof chain of evidence for the data reorganization process. Generating audit summaries locally preserves key evidence of the adjudication process, while submitting the aggregated global record to a distributed ledger such as a blockchain leverages its immutability to achieve long-term, reliable evidence preservation of audit information. This design ensures that key nodes in each file reorganization operation, including the independent adjudication results of each storage node, can be independently verified and inspected afterward. This mechanism significantly enhances the transparency and auditability of system behavior without affecting the core offline adjudication process, providing strong technical support for meeting the compliance requirements of data security regulations.

[0022] In some embodiments, the policy credential generated in S2 also encapsulates a policy version number and policy validity period information; in S6, before running the adjudication, the executable verification logic first checks whether the current time is within the policy validity period, so as to dynamically implement access control based on time conditions.

[0023] This approach introduces a dynamic dimension to the access control mechanism, enabling automated management based on time conditions. Time-based metadata is integrated into statically encapsulated policies, and real-time validity checks are performed through local verification logic. This allows permission policies to automatically take effect or expire based on a preset absolute time window. This design achieves lifecycle management of access permissions while fully respecting the immutable physical characteristics of the storage medium. It allows the entire approach to flexibly adapt to the actual needs of long-term archiving scenarios where access policies may require automatic adjustments based on a schedule, thus significantly enhancing the system's dynamic control capabilities in the time dimension and the level of automation in policy execution.

[0024] A second aspect of this application provides a fragmented, encrypted, and reconstructed electronic archive system based on distributed optical storage, the system comprising: The preprocessing module is used to divide the original electronic archive into multiple data fragments, encrypt each data fragment using multiple different keys to obtain encrypted fragments, generate policy credentials encapsulated with executable verification logic for each encrypted fragment, and cryptographically bind and digitally sign each encrypted fragment with the corresponding policy credentials to form a self-verifying storage unit. Multiple storage node modules, each storage node module including an optical storage device and a node security proxy module; the node security proxy module is used to write the received self-verifying storage unit into the optical storage device, and in response to a verification command, read the specified self-verifying storage unit from the optical storage device, verify its digital signature, and run the executable verification logic within it in a local security environment to generate a decision result. The reassembly control module is used to respond to the reassembly request for the original electronic file, obtain the corresponding target self-verifying storage unit from each of the optical storage nodes and perform digital signature verification, trigger the security proxy module of each node to run the verification logic to perform access control adjudication, and according to the adjudication result, only decrypt and reassemble the encrypted fragments that pass the adjudication into the original electronic file.

[0025] This system architecture divides the complete data security processing flow into three specialized and collaborative hardware and logic units. The preprocessing module centrally performs data sharding, encryption, and secure encapsulation operations, helping to ensure consistency, improve efficiency, and simplify the management of initial security metadata. The distributed deployment of multiple storage node modules physically integrates and distributes optical storage media with trusted computing-enabled security agents. This provides the necessary physical foundation and parallel processing capabilities for geographically distributed data, mitigation of localized failures, and highly reliable localized permission adjudication in network-isolated environments. The reassembly control module, as the process coordination hub, is responsible for scheduling verification requests, coordinating verification tasks across nodes, summarizing adjudication results, and ultimately reassembling the data, thereby ensuring the synchronization of multi-node operations and the reliable progress of the entire process in a distributed environment. This modular, clearly defined architecture clarifies the boundaries of each core function, reduces internal complexity, and provides a solid engineering foundation for the large-scale deployment, flexible expansion, and independent maintenance of the entire technical solution. From a system implementation perspective, this architecture is the key support for transforming the core characteristics of offline controllability, secure adjudication, and reliable reconfiguration in the methodology into a stable and implementable physical system. Attached Figure Description

[0026] Figure 1 A flowchart illustrating a method for fragmented, encrypted, and reconstructed electronic archives based on distributed optical storage, provided in an embodiment of this application; Figure 2 A schematic diagram of an electronic archive fragmentation encryption and reassembly system based on distributed optical storage provided in an embodiment of this application; Figure 3 A schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0027] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0028] In practical applications of long-term secure archiving of electronic records, optical storage media are widely considered due to their excellent data preservation stability. However, the "write-once, unalterable" physical characteristics of this type of media contradict the dynamic access control requirements that archives may face over a preservation period of decades. Current mainstream access control technologies often require a continuously online, centralized authorization service with real-time policy updates for effective operation. In offline or network-constrained optical storage environments, this continuous reliance on a centralized service is difficult to guarantee, and it is challenging to implement dynamic and granular access control for fixed, read-only data, becoming a real technical bottleneck in this field.

[0029] To address the aforementioned issues, this application provides a method and system for the encrypted reassembly of fragmented electronic archives based on distributed optical storage. The aim is to offline and internalize dynamic access control logic. Before data is archived and written, access policies based on archive attributes are pre-converted into independently runnable and deterministic verification program modules. These modules are cryptographically bound and encapsulated with the corresponding encrypted data fragments, forming a complete and self-consistent static storage unit. When data access is required, each storage node can rely on its locally built security environment to directly execute the pre-built verification program within the storage unit, achieving autonomous permission adjudication for access requests without real-time intervention from an external central service. This method, by transforming policy decision-making capabilities into standardized components that can be deployed and executed distributedly with the data, provides a new technical path for achieving secure and flexible access control in offline, read-only optical storage environments.

[0030] Please refer to Figure 1 , Figure 1 This application provides a method for the encrypted reassembly of fragmented electronic archives based on distributed optical storage, comprising the following steps: S1. Divide the original electronic file into multiple data fragments, and encrypt each data fragment using multiple different keys to obtain multiple encrypted fragments; S2. For each encrypted fragment, define access control policies based on the attributes of the original electronic file, and use the policy compilation engine to compile the access control policies into executable verification logic that can run independently, thereby generating policy credentials that encapsulate executable verification logic. S3. Cryptographically bind each encrypted fragment to its corresponding policy credential, and generate a digital signature based on the result of the cryptographic binding, thereby forming multiple self-verifying storage units; S4. According to the preset scheduling algorithm, multiple self-verifying storage units are distributed and stored in multiple physically isolated optical storage nodes; S5. In response to the reassembly request for the original electronic archive, obtain the corresponding target self-verifying storage unit from each optical storage node, and perform digital signature verification on each target self-verifying storage unit; S6. For each target self-verifying storage unit that has passed digital signature verification, in the secure execution environment associated with the optical storage node where the target self-verifying storage unit is stored, run the executable verification logic encapsulated in the policy credential within the target self-verifying storage unit to make access control decisions based on the input requester credentials. S7. Based on the access control ruling, decryption is performed only on the encrypted fragments in the target self-verifying storage unit where the ruling passed, and all data fragments obtained after decryption are reassembled into the original electronic archive.

[0031] Understandingly, "data fragmentation" refers to the process of dividing a complete original electronic file into multiple data blocks or fragments using a specific algorithm. Fragmentation can be achieved through simple fixed-size or variable-length block divisions, or through coded fragments with redundant information generated using erasure coding or other encoding techniques. The purpose of fragmentation is to facilitate subsequent parallel encryption processing and distributed storage, and to improve the overall reliability and availability of the data by setting redundancy. "Encrypted fragmentation" refers to the ciphertext data blocks obtained by encrypting data fragments using cryptographic algorithms and independent keys. The encryption algorithm used can be a symmetric encryption algorithm (such as the Advanced Encryption Standard, AES) or an asymmetric encryption algorithm (such as the Rivest-Shamir-Adleman, RSA algorithm). By independently encrypting different fragments using different keys, fine-grained access control based on fragmentation can be achieved, meaning access permissions can be precisely controlled down to the fragment level, thus satisfying the principle of least privilege. "Policy credentials" are structured data credentials that encapsulate access control information and logic. Its content can be a combination of a plain text policy description and compiled executable code, or a composite data structure containing the policy's original hash, executable logic, and related metadata (such as version number and expiration date). It is the key carrier for transforming human-readable, declarative policies into machine-executable, deterministic adjudication logic. "Executable verification logic" refers to the code generated by the policy compilation engine for executing permission adjudication in a secure environment. It can take the form of platform-independent bytecode (such as WebAssembly, or WASM) or trusted code modules compiled for specific security hardware instruction sets (such as Intel SGX's Enclave Page Cache, EPC instruction set). Its design goal is to achieve determinism and portability of policy adjudication while providing sufficient security guarantees, ensuring consistent adjudication results on any compatible node using the same policy. "Cryptographic binding" refers to the operation of establishing an inseparable cryptographic association between an encrypted fragment and its policy credential. This can be implemented by calculating and combining the cryptographic hash values ​​of both (such as concatenation or concatenated hashing), or by signing both simultaneously using digital signature technology. The core purpose of binding is to ensure that neither party can be verified or used independently without the other, thereby enforcing the consistency and integrity of policies and data at the cryptographic level. A "self-verifying storage unit" is a basic storage unit consisting of encrypted fragments, their corresponding policy credentials, and a digital signature or Message Authentication Code (MAC) generated based on the cryptographic binding relationship between the two.The structural design of this unit makes it a self-contained trust anchor. Its integrity and authenticity can be verified solely through the data within the unit, without relying on external databases or online services, making it particularly suitable for offline, read-only storage environments. The "scheduling algorithm" refers to the rules that determine the location of the self-verifying storage unit in the distributed storage system. Its implementation can be a consistent hashing algorithm to minimize data migration when nodes change; or an optimized scheduling algorithm that combines factors such as node geographic location, load status, and media health. Its core objective is to achieve uniform data distribution, reliability, and efficient access, and it can be designed to support specific disaster recovery or compliance goals. An "optical storage node" refers to a physical entity with optical storage capabilities and local computing capabilities. The core equipment of an optical storage node can be an optical disc library, a Blu-ray burner, or other types of write-once optical storage devices. Nodes are typically deployed in physically isolated or geographically dispersed environments and equipped with necessary security proxy modules to achieve persistent data storage and localized secure computation. A "secure execution environment" refers to an isolated and protected computing environment provided for performing sensitive computations (such as verification logic and permission adjudication). Its specific form can be a Trusted Execution Environment (TEE) supported by a Central Processing Unit (CPU) architecture, or it can be a separate Hardware Security Module. The secure chip environment provided by HSM (Hardware Execution System) is characterized by integrity (ensuring code is not tampered with) and confidentiality (ensuring data processing is not spied on), providing a high level of security isolation for access control decisions. "Access control decision-making" refers to the process of automatically determining a requester's access rights by running executable verification logic within the secure execution environment. The basis for this decision (i.e., the requester's credentials) can be a digitally signed token containing attribute declarations (such as an attribute certificate based on the X.509 standard), or other forms of authentication information that can be parsed by verification logic. The decision result is the sole basis for determining whether to decrypt the corresponding encrypted fragment, reflecting the ultimate authority of policy enforcement. "Requester credentials" refer to the data object submitted by the accessing party during the reassembly phase to prove their identity and permissions. These can be in the form of a standard digital certificate or a custom security token containing attribute declarations and signed by a trusted authority. It is the key dynamic input relied upon by the executable verification logic for permission judgment, serving as a bridge connecting external entity identities with internal static policies.

[0032] The technical solution constructed in this application is an organic whole with tightly coupled and logically progressive features. Data sharding is the starting point of the entire process, enabling subsequent parallel encryption and distributed storage. Independent encryption of each shard generates encrypted shards, laying the foundation for shard-level security control and achieving finer-grained security. Simultaneously, policies defined based on global or shard attributes are transformed into executable verification logic by the policy compilation engine and encapsulated into policy credentials. This completes the crucial transformation from "descriptive rules" to "executable code," realizing the staticization, coding, and portability of dynamic policies. Subsequently, through cryptographic binding operations, each encrypted shard is strongly associated with its unique policy credential at the cryptographic level, supplemented by a digital signature representing the system's root of trust, ultimately forming a self-verifying storage unit. This unit is the material carrier of the core idea of ​​this invention; it solidifies and binds "data" and "control data logic" into an inseparable whole, possessing the ability to self-prove integrity and authenticity, which is the cornerstone for achieving offline verification.

[0033] During the storage phase, the scheduling algorithm intelligently and in a controlled manner distributes these self-verifying units across multiple optical storage nodes. This achieves geographical redundancy and load balancing of data, improving the overall reliability and availability of the system. Furthermore, this distributed layout provides the physical prerequisite for subsequent "localized, parallel adjudication," a key deployment of the "decentralized" execution architecture. When file reassembly is required, each node utilizes the security isolation features of its local secure execution environment (such as a TEE or HSM) to load and execute the pre-built verification logic within the unit. This environment, combined with externally input, verified requester credentials, independently completes access control adjudication. This process is entirely completed locally and offline, without the real-time involvement of any central service.

[0034] The entire process forms a logical closed loop. From the initial fragmentation encryption, policy compilation, binding and encapsulation, to distributed storage, and finally to local verification and adjudication, each technical feature is interconnected and progressively builds upon the previous one. The preceding features create the technical conditions and security prerequisites for the subsequent steps, while the subsequent steps demonstrate and solidify the design value of the preceding features. Together, they constitute a complete technical solution that can achieve secure, dynamic, and granular access control and trusted data reassembly under strict offline, read-only physical constraints.

[0035] This application's embodiments construct a decentralized data security management architecture by pre-compiling dynamic access control policies into independently executable verification logic and integrating them with encrypted data shards for distributed storage. During the data reassembly phase, each storage node can automatically adjudicate access requests and decrypt data in a local secure environment based on the logic encapsulated within its unit. This method significantly reduces reliance on real-time online authorization services, thus better adapting to long-term, offline, read-only archiving scenarios using optical storage media. It endows static data with dynamic and granular access control capabilities while maintaining the physical characteristics of the media. Simultaneously, through cryptographic binding and distributed storage mechanisms, it enhances data security while also improving the reliability and resilience of the entire storage system.

[0036] In some embodiments disclosed in this application, in step S2, the policy compilation engine compiles the text-formatted access control policy into a bytecode program that can be executed across different software and hardware platforms; the bytecode program is deterministic, and its execution result depends only on the input requester credentials and the program's own logic.

[0037] It is understandable that a "text-formatted access control policy" can refer to data written in structured text (such as JSON, XML, or YAML) or a domain-specific language to describe access rules. It declares the conditions (such as user attributes, resource attributes, and environmental conditions) required to allow or deny access, and is a declarative, human-friendly form of policy expression. This serves as the input material for the policy compilation engine, and its format and syntax define the policy's expressive power. Limiting it to "text format" clarifies the policy's raw form before encapsulation, distinguishing it from directly embedded scripts or binary code, emphasizing the policy's readability, manageability, and the specific design requirement of a compilation step to transform it into executable logic. "Compiling into bytecode programs executable across different hardware and software platforms" means that multiple copies of native machine code do not need to be prepared for nodes with different architectures (such as security hardware using x86 or ARM chips). A single, universal bytecode can be executed by all nodes equipped with a compatible runtime, greatly simplifying the complexity and maintenance costs of distributed deployment. "Compilation" refers to the process of converting the aforementioned text policy into a low-level, abstract sequence of instructions (bytecode) using a policy compilation engine. This is a translation and code generation process from a high-level description to an executable intermediate representation. "A bytecode program that can be executed across platforms" refers to a compiled output that is intermediate code independent of a specific CPU instruction set or operating system. It is interpreted and executed or compiled just-in-time (JIT) by a general-purpose virtual machine or runtime environment running on the target platform. For example, it uses standardized bytecode formats like WebAssembly (WASM) designed for secure sandbox environments. "Bytecode programs are deterministic" is a key constraint on the execution behavior of bytecode programs. Determinism means that, given the same input (i.e., requester credentials), each execution of the program will produce the exact same output (i.e., the ruling result). Its execution path and result are not affected by external factors (such as system time, random numbers, I / O states), but are determined only by the input data and the program's own inherent logic. In access control scenarios, determinism is the cornerstone of ensuring consistent rulings and system credibility. It ensures that for the same access request, regardless of which node or when it is processed, the ruling is unique and predictable, completely eliminating the risk of ambiguity in permission judgment due to differences in execution environment. This is crucial for building a trustworthy offline adjudication system.

[0038] This application's embodiments reduce the coupling between the verification logic and specific hardware or operating system platforms by compiling portable bytecode, enabling it to run smoothly in secure environments with different architectures. This enhances the deployment flexibility and compatibility of the entire solution in heterogeneous and complex distributed storage systems. Simultaneously, the determinism of the verification logic is a key attribute, ensuring that for the same access request input, the output of its permission ruling is stable and predictable, without ambiguity arising from different execution environments or execution cycles. This determinism provides a verifiable and auditable basis for access control behavior, facilitating the construction of a reliable security system.

[0039] In some embodiments disclosed in this application, step S3, the generation of cryptographic binding and digital signature specifically includes: S31. Calculate the first cryptographic hash value of the encrypted fragment and the second cryptographic hash value of the corresponding policy credential, respectively; S32. Combine the first cryptographic hash value and the second cryptographic hash value in a predetermined order to generate a combined hash value, so as to establish an inseparable association between the cryptographic fragment and the policy credential; S33. Use the signing private key to digitally sign the combined hash value, and use the digital signature as part of the self-verifying storage unit for subsequent verification of the association and data integrity.

[0040] Understandably, the calculation of the first and second cryptographic hash values ​​involves generating unique cryptographic digests for both the encrypted fragments and the policy credentials. A "cryptographic hash value" can refer to a fixed-length string calculated from the original data using a hash function (such as SHA-256 or SHA-3). This process is one-way and collision-resistant, meaning it's impossible to deduce the original data from the hash value, and the probability of different data generating the same hash value is extremely low. Calculating the two hash values ​​separately aims to generate "digital fingerprints" for two independent data objects that are sensitive to any changes to their content. This is not only the basis for subsequent binding operations but also avoids performing complex cryptographic operations directly on potentially large amounts of original data (especially encrypted fragments), improving processing efficiency and flexibility. The choice of hash function can be adjusted according to security strength requirements. The generation of the combined hash value defines how to merge two independent hash values ​​into a new hash value representing the association. The "combination" operation follows predefined deterministic rules, such as concatenating two hash values ​​in a specific order (e.g., H(fragment) first, H(credential) second), or using them as input for another hash operation (H(H(fragment) || H(credential))). This combination method establishes a strong cryptographic binding relationship, making the final combined hash value dependent on the original content of both the cryptographic fragment and the policy credential. Any slight alteration to the data on either side will cause a change in its own hash value, which will be propagated through the combination operation, rendering the final combined hash value invalid. This step is the core logical transformation for achieving "indivisible association." Digitally signing the combined hash value involves applying a digital signature algorithm (such as RSA or ECDSA) to the combined hash value using the signing private key to generate a digital signature. The digital signature provides source authentication, integrity protection, and non-repudiation proof for the combined hash value (and thus indirectly, the original data pair). It proves that the specific "cryptographic fragment-policy credential" association was confirmed and encapsulated by an authoritative entity (such as a system administrator) holding the corresponding private key before the signing time. During verification, any entity can use the public key to verify the signature, thus ensuring that the authenticity and integrity of the associated entity have not been compromised. The secure storage and management of the signing private key is crucial to the foundation of trust in this step.

[0041] This application's embodiments constitute a hierarchical, progressive chain of integrity protection and authentication. The first step, independent hash calculation, generates a basic integrity identifier for each core data object. The second step, combined hash generation, is a crucial leap; it fuses two independent identifiers using a defined algorithm, mathematically binding physically or logically separate "data" and "control logic" into a whole, creating cryptographic evidence of "association." The third step, digital signature, adds an authoritative "trust seal" to this association, elevating the technical binding to a legally or institutionally verifiable level. These three steps work in tandem and are indispensable: hashing is the foundation, binding is the core, and signature is the guarantee. Together, they endow the "self-verifying storage unit" with true self-verification capability—any verifier, without an external database, can independently verify the unit's integrity and association authenticity simply by repeating these three calculations and comparing the signature using the public algorithm and public key.

[0042] By separately calculating and combining the hash values ​​of the encrypted fragments and the policy credential, a strong, one-to-one, and indivisible relationship is forcibly established between them at the cryptographic level. Any tampering with any component will result in a change to the final combined hash value. The digital signature generated on this basis not only provides authoritative endorsement of the combined hash value but also makes each storage unit a self-contained verification carrier. This mechanism provides a direct and reliable technical basis for the signature verification step in the subsequent reassembly verification process, enabling the system to efficiently confirm the integrity and authenticity of the storage units, thereby enhancing the overall reliability of the data integrity verification process.

[0043] In some embodiments disclosed in this application, in step S4, the preset scheduling algorithm is a consistent hashing algorithm, which maps the unique identifier of each self-verifying storage unit to the identifier of an optical storage node, so that multiple self-verifying storage units corresponding to the original electronic archive are stored in different physical optical storage nodes.

[0044] It is understandable that a "pre-defined scheduling algorithm" refers to specific computational rules configured before the storage phase to determine the location of data storage. It is a predefined automated decision-making logic whose core objective is to achieve an ordered and optimized distribution of storage units within the target storage node set. The algorithm can be designed based on various factors, such as data identifiers, node states, network topology, or business strategies. Its output is the specific node identifier where each self-verifying storage unit should be stored. Defining the algorithm as "pre-defined" emphasizes that its rules are determined before the storage operation begins, thus ensuring the consistency and predictability of the storage distribution plan and avoiding arbitrariness or uncertainty during the storage process. A "consistent hashing algorithm" is a special type of hashing algorithm commonly used in distributed caching or storage systems to achieve efficient load balancing and minimize data migration. Its principle is to map nodes and data onto the same virtual ring, and use hash calculations to find the nearest node in the clockwise direction on the ring as its storage location for each data item (here, a self-verifying storage unit). When nodes in the system join or leave, the consistent hashing algorithm ensures that only a small amount of data in neighboring areas needs to be remapped, while most data remains on the original nodes. This significantly reduces the overhead of large-scale data migration caused by dynamic node changes, improving the system's scalability and stability. The "mapping between unique identifiers and node identifiers" describes the key matching operation in the scheduling process. The unique identifier is an identification code generated for each self-verifying storage unit that does not repeat with other units during its lifecycle, typically derived from its content hash or specific metadata. The node identifier uniquely distinguishes each physical optical storage node in the system. The mapping process uses the consistent hashing algorithm, taking the unit's unique identifier as input, to calculate its coordinates on the virtual ring and locate the target node identifier. This deterministic mapping ensures that each unit can be explicitly and reproducibly assigned to a specific node, forming the basis for automated, conflict-free scheduling. "Storing multiple units on different physical optical storage nodes" clarifies the direct physical effect the scheduling algorithm aims to achieve. Its core requirement is that all self-verifying storage units originating from the same original electronic archive must be stored on multiple different, physically isolated optical storage nodes. "Differentiation" and "physical isolation" emphasize the independence and risk isolation between nodes, aiming to avoid the single point of failure risk caused by concentrating related units on a single or a few nodes. This is not only a form of data redundancy, but also an architectural design that improves the overall disaster recovery capability and long-term data survival rate of the system.

[0045] In this embodiment, the "preset scheduling algorithm" provides automated and intelligent decision-making capabilities for data distribution, serving as the "command center" of the entire storage distribution process. The "consistent hashing algorithm," as an efficient and robust implementation of this scheduling center, elegantly solves the data management challenges caused by the dynamic nature of nodes in distributed systems, ensuring the long-term stability of the storage layout, thanks to its unique low-disturbance advantage. "Distributing units across multiple physically isolated nodes" is the final physical result and core objective of the scheduling algorithm, directly reflecting the system design's pursuit of reliability and resilience. This embodiment makes the storage phase not just a simple data transfer process, but a crucial step in building a solid infrastructure for the entire system: the consistent hashing algorithm ensures the flexibility and maintenance efficiency of the storage layout when nodes change; the mandatory distributed and physically isolated storage strategy minimizes single-point failures and correlation risks from a spatial and physical perspective, providing crucial redundancy guarantees for successful data reassembly even in offline environments where some nodes may be unavailable.

[0046] Consistent hashing distributes storage units relatively evenly and stably across the storage node set. This characteristic helps balance the storage load across nodes, preventing excessive data concentration. More importantly, when distributed storage environments inevitably face node expansion, reduction, or partial failures, consistent hashing can reduce the amount of data that needs to be migrated, thereby reducing system maintenance overhead and improving adaptability to dynamic changes. This enhances the stability and scalability of the entire storage architecture in the face of node state changes. Simultaneously, forcibly distributing fragments of the same file across different physical nodes, combined with the aforementioned encryption and verification mechanisms, reduces the risk of the entire file becoming unrecoverable due to the complete failure of a single node, thus improving the overall reliability and robustness of long-term data preservation at the storage level.

[0047] In some embodiments disclosed in this application, in step S6, the secure execution environment is a trusted execution environment provided by a hardware security module or a security chip; the executable verification logic is loaded within the trusted execution environment, its integrity is verified, and then it runs.

[0048] It is understandable that the "Trusted Execution Environment (TEE) provided by the hardware security module or security chip" defines the underlying security foundation for execution permission adjudication. Hardware security modules (HSMs) and security chips are integrated circuits with physical tamper-proof designs, dedicated cryptographic processors, and secure storage areas; they can be used as standalone hardware or integrated into the main processor. The TEE provided by them is a secure computing area isolated from the device's main operating system, implemented through hardware mechanisms such as memory isolation, encrypted buses, and protected memory areas. Its core function is to provide runtime confidentiality (preventing external processes from spying) and integrity (preventing unauthorized modification of code and data) for the internally running code and processed data. Implementation can be a general TEE architecture conforming to international standards (such as the Global Platform TEE specification) or a vendor-specific secure execution technology. "Executable verification logic is loaded within the TEE" describes the controlled process of securely introducing external verification logic into the TEE. Loading refers to the operation of transferring and placing executable verification logic (bytecode programs) stored externally (e.g., read from optical storage media) into a protected, isolated memory area within the TEE through specific secure channels and interfaces. This process is typically managed by the TEE's driver or security monitoring program to ensure code confidentiality during transmission and prevent interception or injection of malicious code before it enters the security boundary. Loading is a necessary prerequisite for the verification logic to be executed within the TEE, enabling a secure switch from "external static storage" to "internal secure runtime state." "Executable verification logic is verified within a trusted execution environment" specifies mandatory security checks and execution constraints that must be completed before executing verification logic within the TEE. Verifying its integrity refers to using cryptographic methods (e.g., verifying the code's digital signature using a pre-set public key, or calculating its cryptographic hash value and comparing it with a trusted value) within the TEE to confirm the integrity and authenticity of the code to be executed, ensuring it is completely consistent with its original state at the time of authorization and release, and has not been tampered with. Execution refers to the process where, after successful integrity verification, the processor within the TEE executes the instruction sequence of the verified code to adjudicate the requester's credentials. The "execute after verification" mechanism is the core of ensuring the trustworthiness of the execution logic within the TEE, eliminating the possibility of compromised or malicious code being activated in a secure environment.

[0049] This application's embodiments constitute a hierarchical, closed-loop secure execution chain, jointly ensuring the credibility of the authorization process. The TEE (Transmission Equipment) provided by the hardware security module or security chip serves as the cornerstone of the entire chain, constructing an absolutely secure space with physical and logical isolation attributes. Loading within the TEE is the access control link of the secure chain, ensuring that external code can enter this space in a controlled and secure manner, preparing for subsequent processing. Running after its integrity is verified within the TEE is the core control link of the chain, performing final trusted authentication of the code within the secure space and allowing only authenticated code to exercise authorization. These three links are closely linked and indispensable: the hardware environment provides an isolated execution site, the loading operation implements secure access control, and running after verification ensures the secure granting of execution rights. Working together, they ensure that the adjudication of access requests can be autonomously completed on offline, distributed storage nodes in a highly trusted environment that can resist various software and even some hardware attacks, thus providing crucial and reliable secure computing support for the entire technical solution.

[0050] By placing the critical security operation of authorization adjudication within a hardware-hardened, isolated, and trusted execution environment, this design provides integrity protection for the loaded executable verification logic code, ensuring it is not tampered with or spied on by external malware during runtime. Simultaneously, sensitive credential information submitted by the requester is processed within this isolated environment, significantly reducing the risk of credential data leakage during the adjudication process. Through hardware-level security isolation and protection, this design establishes a highly reliable secure execution foundation for the entire authorization adjudication process. This not only enhances the credibility of the adjudication result itself but also improves the overall security level of the system against attacks targeting the authorization verification stage.

[0051] In some embodiments disclosed in this application, before running the executable verification logic in step S6, the method further includes: the trusted execution environment performing integrity verification on the encrypted fragment data read from the optical storage node based on the hash value of the encrypted fragment encapsulated in the policy credential.

[0052] Understandably, the "encrypted fragment hash value encapsulated in the policy credential" defines the source and storage location of the reference benchmark used for integrity verification. The encrypted fragment hash value refers to the fixed-length digest value calculated using a cryptographic hash function for the final encrypted fragment data to be written to the medium during the preprocessing stage. This value is generated before the data is written to the optical storage medium and is encapsulated within the corresponding policy credential as part of the metadata. Encapsulation means that the hash value, along with the policy credential, is protected by a digital signature and together constitutes part of the self-verifying storage unit. Therefore, when reading the policy credential from the storage unit, the original, authoritatively signed hash value can be extracted as the gold standard for subsequent data integrity verification. "Encrypted fragment data read from the optical storage node" clearly identifies the data object to be verified and its source. Encrypted fragment data refers to the raw byte stream read from the physical optical storage medium (such as an optical disc) through a drive during the reassembly stage, which should theoretically be consistent with the encrypted fragment content written during the preprocessing stage. The reading process may occur in the regular memory area of ​​the node security agent, which carries the potential risk of data corruption or tampering due to media aging, read head errors, transmission interference, or malicious attacks. This feature emphasizes that the object being verified is the original ciphertext data that has just been retrieved from the physical medium and has not yet entered the Trusted Execution Environment (TEE) to participate in core computation, highlighting the necessity of "security checks" before the data stream enters the security core. Performing integrity verification by the TEE limits the subject, environment, and purpose of the verification operation. Integrity verification is a cryptographic comparison process. Its core operation is: within the TEE, recalculating the current hash value of the encrypted fragment data just read from the outside, and then comparing the calculation result with the original hash value extracted from the policy credential. Execution by the TEE means that the entire computation and comparison process is completed under the hardware isolation protection of the TEE. This design has dual security implications: first, it prevents the verification process itself from being interfered with or the results from forged by external malicious code; second, it ensures that the original hash value used for comparison (extracted from the policy credential) is also protected during the transmission to the comparison logic. This application embodiment constructs a precise and protected integrity checkpoint for the original data source, added before the core adjudication process. The encrypted fragment hash value encapsulated in the policy credential provides a trusted verification benchmark, which is tamper-resistant due to signature protection. The encrypted fragment data read from the optical storage node is the real object that needs to be verified, exposed to physical storage risks. Most importantly, the design of performing integrity verification by a trusted execution environment elevates the entire verification process to the highest level of security. It does not perform a simple hash comparison in a normal operating system environment, but moves the two key steps of "calculating the hash of the current data" and "comparing it with the gold standard" to a hardware-isolated TEE.

[0053] By adding a cryptographic verification layer to the original data block within the core security environment of authorization decisions, this step effectively identifies and prevents data corruption caused by physical degradation of storage media, read errors, or transmission processes. It extends integrity verification to before data is actually used, providing a more direct and reliable data source guarantee for decryption operations. Combined with storage unit-level digital signature verification, this mechanism constructs a multi-layered, progressive data trust verification system, enhancing the system's ability to guarantee data integrity and reducing the risk of subsequent processing failures or errors due to silent data corruption.

[0054] In some embodiments disclosed in this application, in step S6, the executable verification logic is configured to perform attribute-based access control decision, which determines whether at least one condition in the access control policy regarding data security level, department, and time validity is met by parsing the attribute declaration in the requester's credentials.

[0055] Understandably, "Attribute-Based Access Control (ABAC) adjudication" clarifies the security model followed by permission adjudication. Attribute-Based Access Control (ABAC) is a model that dynamically authorizes access by evaluating a series of attributes related to the subject, object, operation, and environment. In this context, "adjudication" refers to the process by which executable verification logic dynamically evaluates access requests and makes authorization decisions based on pre-compiled policy rules. This model supports more granular and context-aware permission management beyond simple identities or roles. "Parsing attribute declarations in requester credentials" describes the specific method by which the adjudication logic obtains the basis for dynamic evaluation. The digital credentials provided by the requester embed structured attribute declarations representing their identity and permissions (e.g., security level, department affiliation). During runtime, the verification logic needs to decode and verify the credentials, extracting the specific attribute values ​​necessary for policy judgment. This process transforms externally provided, variable identity information into structured input that the internal policy engine can process. "Determining whether at least one condition in the policy regarding data security level, department affiliation, and time validity is met" clarifies the core judgment logic executed internally by the adjudication logic. The conditions specified in the strategy refer to the specific access rules compiled and solidified into the verification logic during the preprocessing stage, such as "requester's security level ≥ data security level," "requester's department matches the specified department," and "current time is within the validity period." Determining whether at least one condition is met means that the strategy can flexibly include one or more sub-conditions connected by logical operators. The verification logic's decision is based on a comprehensive conclusion derived from evaluating all relevant sub-conditions. This reflects the flexibility of the strategy, enabling both simple single-condition checks and complex multi-condition combination judgments.

[0056] This application successfully integrates a dynamic ABAC model into a framework of static encapsulation and offline execution. The ABAC model provides the theoretical foundation for fine-grained dynamic control; parsing the attribute declarations in the credentials provides reliable real-time input for model operation; and the judgment of preset policy conditions is the specific code implementation of the model logic. These three elements are integrated through the "executable verification logic": the flexibility of the dynamic policy is achieved through the attributes input in each request, while offline feasibility is guaranteed by pre-compiling and encapsulating the policy containing complex judgment logic. This design not only enhances the expressive power of access control but also closely integrates with other technical aspects of the solution—its determinism is guaranteed by the compiled bytecode, and its execution security is protected by a trusted environment, thus jointly supporting secure, fine-grained, and dynamic permission management in an offline environment.

[0057] By employing an attribute-based access control model, this constraint enables static policies encapsulated within storage units to support fine-grained and context-aware permission adjudication. This model allows policies to be defined by combining attributes across multiple dimensions, such as data security level, user department, and time validity, thereby expressing complex access rules that closely align with actual management needs. This enhances the method's flexibility and adaptability in dealing with diverse security policies, enabling it to achieve granular access management beyond simple authentication. Introducing this attribute-driven decision-making logic within the offline adjudication framework maintains the core advantages of the solution while improving its compatibility and expressiveness with modern access control frameworks.

[0058] In some embodiments disclosed in this application, after running the executable verification logic to perform access control adjudication in the trusted execution environment in step S6, a local audit digest of the adjudication is also generated. The local audit digest at least includes the identifier of the executable verification logic and the cryptographic commitment value of the adjudication result. The method further includes: S8. Aggregate the local audit summaries corresponding to all target self-verifying storage units, and combine them with the reorganization request identifier and the timestamp of the reorganization operation to generate a structured reorganization audit record; S9. Submit the reconstructed audit record itself or its cryptographic hash value to a blockchain network or distributed ledger for evidence storage, so as to form an immutable audit trail.

[0059] Understandably, a "local audit digest" refers to a data set containing key evidence automatically generated after an access control decision is made within a trusted execution environment. This digest contains at least two core elements: an identifier for the executable verification logic (usually a cryptographic hash of its code), used to uniquely identify and trace the executed policy procedure; and a cryptographic commitment value for the decision result (e.g., a value obtained by hashing the decision result or using other commitment schemes), which provides cryptographic proof of the authenticity and non-repudiation of the result without directly exposing sensitive decision details. This digest is generated and signed in a hardware-protected environment, ensuring its credibility and tamper-proof nature as original operational evidence. "Aggregating local audit digests corresponding to all target self-verifying storage units" describes the process of gathering scattered node evidence. Aggregation refers to the reorganization control module issuing instructions to all relevant storage nodes and collecting their respective returned local audit digests for a specific file reorganization request. This operation aggregates the scattered decision evidence points triggered by a reorganization operation, distributed across multiple physical nodes, into a single evidence set globally relevant to this reorganization session, providing a data foundation for building a complete operational audit view. "Generating a structured reorganization audit log" defines how aggregated evidence is transformed into a standardized audit document. This process involves organizing and encapsulating all the aggregated local audit summaries, along with the global context information of the reorganization transaction—the reorganization request identifier (used to uniquely identify the request) and the timestamp of the reorganization operation—according to a predefined data pattern and logical relationship, thereby creating a uniformly formatted, complete, and machine-readable document. The structured record allows the entire picture of a complex distributed operation to be clearly and orderly recorded and presented. "Submitting to a blockchain network or distributed ledger for evidence preservation" clarifies the long-term persistence and tamper-proof mechanism of the audit log. Evidence preservation refers to sending the generated structured reorganization audit log itself, or the fixed-length digest value (hash value) obtained by calculating the record using a cryptographic hash function, as a transaction data to a blockchain network or distributed ledger system. These systems utilize consensus algorithms and chained data structures to ensure that once data is successfully recorded, it is extremely difficult to unilaterally modify or delete it, thus providing the audit log with timestamp-stamped, independent, and tamper-proof persistent storage, forming a long-term traceable and verifiable audit trail.

[0060] This application's embodiments construct a complete audit and evidence storage chain, from local to global, from generation to solidification. Local audit summaries, acting as trusted "atoms of evidence," are generated in a secure hardware environment, ensuring the authenticity of the evidence source. Aggregation operations collect these "atoms," preparing material for reconstructing the full picture of the event. Generating structured records integrates this material with the business context, forming a standardized report describing the "complete story." Finally, blockchain evidence storage provides this report with a publicly accessible or controlled, permanent, and tamper-proof "notarized archive." The close integration of each stage ensures that every offline, distributed data reorganization operation's key security decisions and processes can be independently, reliably, and permanently recorded and verified, significantly improving the overall system's auditability, transparency, and compliance support capabilities.

[0061] By introducing an audit evidence preservation mechanism, this limitation constructs a traceable and tamper-proof chain of evidence for the data reorganization process. Generating audit summaries locally preserves key evidence of the adjudication process, while submitting the aggregated global record to a distributed ledger such as a blockchain leverages its immutability to achieve long-term, reliable evidence preservation of audit information. This design ensures that key nodes in each file reorganization operation, including the independent adjudication results of each storage node, can be independently verified and inspected afterward. This mechanism significantly enhances the transparency and auditability of system behavior without affecting the core offline adjudication process, providing strong technical support for meeting the compliance requirements of data security regulations.

[0062] In some embodiments disclosed in this application, the policy credential generated in step S2 also encapsulates the policy version number and policy validity period information; in step S6, the executable verification logic first verifies whether the current time is within the policy validity period before running the adjudication, so as to dynamically implement access control based on time conditions.

[0063] It's understandable that "the policy version number and policy validity information encapsulated in the policy credential" refers to the fact that, in addition to the access control policy itself, the policy credential data structure also contains specific metadata for policy management. The policy version number is an identifier used to uniquely distinguish iterative updates of the same policy at different times, facilitating system tracking of policy evolution history and compatibility management. The policy validity information defines the policy's effective window in the time dimension, typically expressed as a start time and end time. Encapsulating this information in the credential means that version and timeliness become inseparable components of the policy, and are protected by signature along with the policy, ensuring its authenticity and integrity. "The executable verification logic checks whether the current time is within the policy's validity period before running the decision" defines a necessary pre-judgment operation in the verification logic execution process. Verification refers to the internal logical step executed by the verification logic before it begins authorizing the requester's attributes. The current time is usually obtained by the Trusted Execution Environment (TEE) running the verification logic from its internal or bound trusted time source. "Within the policy validity period" means comparing the current time with the validity period information parsed from the policy certificate to determine whether the current moment is within the specified time window. The output of this step is a boolean value, which directly affects subsequent decisions.

[0064] This application introduces a time-based dynamic management capability into the access control mechanism. The policy validity period information encapsulated in the policy credential provides a static and authoritative basis for time control. The timeliness verification of the executable verification logic is the execution mechanism that applies this static basis to the dynamic adjudication process. The synergy of the two achieves the effect of "static encapsulation, dynamic effectiveness". The policy validity period is predefined and encapsulated, and cannot be changed after being written to the read-only medium, which conforms to the physical constraints of optical storage. However, by dynamically obtaining and verifying the current time in the TEE at each adjudication, the static policy can automatically switch its validity state according to the real time, without human intervention. For example, a policy can automatically take effect on a preset future date, or automatically expire after it expires. This application significantly enhances the dynamic control capability of the system, enabling long-term archived electronic files to achieve fine-grained permission management based on time plans (such as periodic decryption and automatic permission revocation), thereby improving the adaptability and automation level of the entire solution in dealing with complex and long-term archival security needs.

[0065] This approach introduces a dynamic dimension to the access control mechanism, enabling automated management based on time conditions. Time-based metadata is integrated into statically encapsulated policies, and real-time validity checks are performed through local verification logic. This allows permission policies to automatically take effect or expire based on a preset absolute time window. This design achieves lifecycle management of access permissions while fully respecting the immutable physical characteristics of the storage medium. It allows the entire approach to flexibly adapt to the actual needs of long-term archiving scenarios where access policies may require automatic adjustments based on a schedule, thus significantly enhancing the system's dynamic control capabilities in the time dimension and the level of automation in policy execution.

[0066] In some embodiments disclosed in this application, in step S4, the preset scheduling algorithm is a consistent hashing algorithm, and the nodes are assigned differentiated weights based on the brand, model, batch number and nominal lifespan of the medium used by each optical storage node; the scheduling algorithm optimizes the storage distribution based on the weights, so that multiple self-verifying storage units corresponding to the same original electronic file are distributed on optical storage media with different brand, model or batch number.

[0067] Understandably, the consistent hashing algorithm, by combining the physical attributes of the media to assign differentiated weights to nodes, significantly enhances the scheduling strategy. While maintaining the basic mapping framework of consistent hashing, it introduces the perception and evaluation of the physical media carried by the storage nodes. The physical attributes of the media specifically include brand, model, batch number, and nominal lifespan. These attributes are related to the manufacturer's technological differences, common risks from the same production source, and the media's expected durability. Assigning differentiated weights to nodes means that the scheduling algorithm, based on a comprehensive analysis of these attributes (e.g., assigning different priorities or selection probabilities to media of different brands or batches), assigns each node a quantified influence factor, thereby transforming the physical diversity and reliability expectations of the media into input parameters for scheduling decisions. Weight-based optimization of storage distribution defines the optimization objective and execution result of the scheduling decision. Weight-based optimization means that when executing the mapping, the scheduling algorithm not only considers the position on the hash ring but also actively uses the aforementioned weight factors to guide or adjust the final storage location of the storage units. Its core objective is to distribute multiple self-verifying storage units corresponding to the same original electronic file across optical storage media with different brands, models, or batch numbers.

[0068] This application's embodiments collectively construct a media-aware, risk-distributed scheduling strategy for long-term data preservation. The consistent hashing algorithm, combined with the physical attributes of the media, sets differentiated weights for nodes, serving as the strategy's decision engine. It combines a general, logical distribution algorithm with a specific, physical media reliability model. By analyzing attributes such as brand and batch and setting weights, the algorithm can identify and quantify the potential correlation risks inherent in different media nodes (e.g., media from the same batch may collectively fail prematurely due to common process defects). Weight-based optimization of storage distribution is the strategy's execution goal and final manifestation. It utilizes the weights output by the decision engine to consciously break the random or uniform distribution of data fragments on the physical media, instead pursuing a controlled heterogeneous distribution. Its direct effect is to maximize the "isolation" of data fragments from the same archive at the physical carrier level, preventing them from concentrating on media from a single brand or a single production batch.

[0069] By intentionally scheduling fragments of the same archive across optical storage media of different brands and batches, this solution effectively reduces the associated risk of multiple fragments failing simultaneously due to common defects or concentrated aging of media from a specific batch. This media-aware scheduling strategy enhances the overall robustness and risk resistance of long-term data preservation at the physical carrier level, representing a significant deepening and optimization of distributed storage reliability in the specific scenario of long-term archiving.

[0070] In some embodiments disclosed in this application, in step S2, the policy compilation engine supports compiling access control policies that include unlocking conditions for future times; the executable verification logic is compiled into a sequence of instructions that includes verification of the current time provided by a trusted time source from within or bound to the secure execution environment.

[0071] Understandably, the statement that "the policy compilation engine supports compiling access control policies containing future time unlock conditions" expands the capabilities of the policy compilation engine. A future time unlock condition is a special policy rule that binds access authorization to a future, specific point in time or time period. For example, a policy can be expressed as "access is allowed after date T" or "access is allowed within the time interval [T1, T2]". Supporting compilation means that the policy compilation engine's parser and code generator can understand such time-based logical expressions and translate them into corresponding conditional judgment instructions in the verification logic, rather than treating them as invalid policies or ordinary attributes. Compiling the time verification instruction sequence directly into the verification logic clarifies the final form and location of the time judgment logic. The time verification instruction sequence is a series of low-level machine instructions or bytecode generated by the compiler to obtain the current time and compare it with the preset time conditions in the policy. Direct compilation into the verification logic means that these time verification instructions are seamlessly integrated into the final generated executable verification logic program, becoming an integral part of its code body. Therefore, time verification is no longer a service called externally at runtime, but rather an internal, self-contained functional module of the program.

[0072] This application embodiment collaboratively constructs an offline, self-consistent, time-dependent adjudication system by supporting the expression of time conditions at the policy layer and the built-in generation of time verification code at the compilation layer. The policy compilation engine's support for "future time unlocking conditions" allows for the formal definition of dynamic security policies based on absolute time; while directly compiling the verification logic into an instruction sequence within the verification program transforms this time dependency into a self-contained, offline-running functional module. The combination of these two aspects materializes an access control policy containing future unlocking conditions into a verification program capable of autonomously determining time in a completely offline environment. During reassembly, the program does not need to connect to any external network service; it only needs to obtain a reliable "current time" from its bound, local, trusted time source (such as the TEE's internal clock) to execute its built-in instruction sequence and independently determine whether the preset future time conditions have been met, thereby implementing advanced security policies such as "timed automatic decryption" or "timed permission revocation." While strictly adhering to the offline constraints of optical storage, this mechanism cleverly transforms the dynamic variable of "time" into static program logic, greatly enhancing the system's automation capabilities and policy flexibility in long-term archiving scenarios.

[0073] By pre-compiling and encapsulating the verification logic of a trusted time source within the verification program, this approach enables the verification program, embedded in read-only media, to autonomously and reliably determine whether preset time conditions are met. This allows for the execution of dynamic access control policies dependent on precise time points even when completely offline, significantly expanding the time dimension representation capability of offline adjudication and the reliability of automated execution.

[0074] In some embodiments disclosed in this application, step S6 further includes: recording the policy identifier corresponding to the current execution of the executable verification logic and the verification credentials of the current adjudication result into a protected storage area associated with the secure execution environment of the execution of the executable verification logic in an append-only manner, thereby forming an immutable local audit trail.

[0075] Understandably, a "policy identifier" refers to an information label that uniquely identifies a specific access control policy procedure executed during the adjudication process. Its core function is to establish a precise link from a specific adjudication event back to the policy rule it was based on, which is crucial for achieving operational traceability. In practice, policy identifiers are typically represented as cryptographic hashes (such as SHA-256 digests) of executable verification logic code, or globally unique numbers assigned during the policy compilation and encapsulation phase. Recording these in the audit trail ensures that any subsequent review can accurately confirm the policy version that was in effect and executed at that time, which is essential for policy compliance auditing, policy evolution tracking, and problem localization in multi-policy environments. An "adjudication result verification credential" refers to cryptographic evidence generated based on the access control adjudication conclusion, which can be verified in the future without revealing the conclusion itself. Its design aims to provide non-repudiable proof of the authenticity and integrity of the result while protecting the sensitivity of the adjudication result. A typical implementation uses a cryptographic commitment scheme, such as combining the ruling result ("pass" or "reject") with a random number and performing a hash operation; the resulting commitment value serves as the credential. When verification is needed in the future, the authenticity of the commitment value can be verified by publicly disclosing the random number and the ruling result. This mechanism cleverly transforms dynamic ruling outputs into static, long-term verifiable evidence, balancing auditing needs with privacy protection. "Protected storage area associated with a secure execution environment" describes a data storage area that is logically and securityly bound to the secure execution environment in which the authorization ruling occurs. "Associated" means that access control of this storage area is dominated by the secure environment or synchronized with its security state; "protected" indicates that the area has safeguards against unauthorized read / write and tampering. Its implementation is diverse, ranging from isolated persistent memory within the secure execution environment (such as sealed storage in a TEE) to external encrypted flash memory partitions managed by the same trusted hardware. As the final carrier of audit evidence, the security attributes of this storage area directly determine the trust level of the stored evidence, serving as a bridge linking virtual ruling events with physically persistent evidence. "Append-only write" describes a specific data storage operation constraint mode where data can only be written to the storage medium sequentially, and no modification, overwriting, or erasure of previously written historical data is permitted. This is a critical security attribute, not simply a storage feature. It is implemented through physical or logical means, such as write-once storage media, storage units with write-protected locks, or append-only journaling file systems. This mode ensures the natural chronological order and irreversibility of audit logs; any attempt to delete or modify historical records will be prevented or leave a trace due to violation of this fundamental constraint, thus constructing a unidirectional, incremental, and reliable timeline."Immutable local audit trails" are the final product of the combined effect of all the aforementioned characteristics. They refer to a series of chronologically ordered records of operational evidence generated and solidified at the location where the decision occurred (logically local to the secure execution environment), and which cannot be altered afterward. "Immutability" is its core attribute, ensured by the security foundation of "protected storage" and the "append-only" operational rule. "Local" emphasizes that evidence generation and solidification are completed within the same trusted computing context, avoiding risks from intermediate links such as network transmission. Overall, audit trails constitute a series of continuous, self-consistent "snapshots" of the system's runtime security state, providing a raw and reliable data foundation for system behavior auditing, security incident forensics, and compliance verification.

[0076] This application's embodiments construct an intrinsic, self-consistent offline audit enhancement mechanism. Policy identifiers ensure precise traceability of each ruling to a specific policy version, laying the foundation for traceability; ruling result verification credentials provide a cryptographically verifiable anchor for the ruling conclusion without disclosing sensitive information, balancing auditing and privacy. A protected storage area associated with the secure execution environment provides a highly reliable storage location for this evidence, its security inherited from the ruling execution environment itself. The mandatory append-only rule ensures the temporal continuity and irreversibility of evidence records from an operational logic perspective. Ultimately, these interconnected steps enable each ruling event to automatically generate an immutable local audit trail. This mechanism allows the system to generate a time-progressing, tamper-proof, and independently verifiable local evidence chain for all its core security operations in a completely offline environment, without relying on any external services. This significantly improves the intrinsic traceability, operational non-repudiation, and native support for security compliance requirements of the entire solution.

[0077] Please refer to Figure 2, which shows a fragmented, encrypted, and reconstructed electronic archive system based on distributed optical storage. The system includes: Preprocessing module 21 is used to divide the original electronic file into multiple data fragments, encrypt each data fragment using multiple different keys to obtain encrypted fragments, generate a policy credential encapsulated with executable verification logic for each encrypted fragment, and cryptographically bind and digitally sign each encrypted fragment with the corresponding policy credential to form a self-verifying storage unit. Multiple storage node modules 22, each storage node module includes an optical storage device and a node security agent module; the node security agent module is used to write the received self-verifying storage unit to the optical storage device, and in response to the verification command, read the specified self-verifying storage unit from the optical storage device, verify its digital signature, and run the executable verification logic within it in the local security environment to generate a decision result; The reassembly control module 23 is used to respond to the reassembly request for the original electronic file, obtain the corresponding target self-verifying storage unit from each optical storage node and perform digital signature verification, trigger the security agent module of each node to run the verification logic to make access control decisions, and decrypt and reassemble the encrypted fragments that pass the decision into the original electronic file according to the decision result.

[0078] This system architecture divides the complete data security processing flow into three specialized and collaborative hardware and logic units. The preprocessing module centrally performs data sharding, encryption, and secure encapsulation operations, helping to ensure consistency, improve efficiency, and simplify the management of initial security metadata. The distributed deployment of multiple storage node modules physically integrates and distributes optical storage media with trusted computing-enabled security agents. This provides the necessary physical foundation and parallel processing capabilities for geographically distributed data, mitigation of localized failures, and highly reliable localized permission adjudication in network-isolated environments. The reassembly control module, as the process coordination hub, is responsible for scheduling verification requests, coordinating verification tasks across nodes, summarizing adjudication results, and ultimately reassembling the data, thereby ensuring the synchronization of multi-node operations and the reliable progress of the entire process in a distributed environment. This modular, clearly defined architecture clarifies the boundaries of each core function, reduces internal complexity, and provides a solid engineering foundation for the large-scale deployment, flexible expansion, and independent maintenance of the entire technical solution. From a system implementation perspective, this architecture is the key support for transforming the core characteristics of offline controllability, secure adjudication, and reliable reconfiguration in the methodology into a stable and implementable physical system.

[0079] Please see Figure 3 , Figure 3 This is a schematic block diagram of an electronic device provided according to an embodiment of this application. Figure 3 The electronic device 300 in this embodiment may include one or more processors 301, one or more input devices 302, one or more output devices 303, and one or more memories 304. The processors 301, input devices 302, output devices 303, and memories 304 communicate with each other via a communication bus 305. The memories 304 store computer programs, including program instructions. The processors 301 execute the program instructions stored in the memories 304. Specifically, the processors 301 are configured to invoke the program instructions to execute the aforementioned method for fragmented, encrypted, and reconstructed electronic archives based on distributed optical storage.

[0080] It should be understood that, in the embodiments of this application, the processor 301 may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0081] Input device 302 may include a touchpad, a fingerprint sensor (for collecting the user's fingerprint information and fingerprint orientation information), a microphone, etc., and output device 303 may include a display (LCD, etc.), a speaker, etc.

[0082] The memory 304 may include read-only memory and random access memory, and provides instructions and data to the processor 301. A portion of the memory 304 may also include non-volatile random access memory. For example, the memory 304 may also store device type information.

[0083] In specific implementations, the processor 301, input device 302, and output device 303 described in the embodiments of this application can execute the implementation methods described in any embodiment of the electronic archive fragmentation encryption and reassembly method based on distributed optical storage provided in the embodiments of this application, or they can execute the implementation methods of the electronic devices described in the embodiments of this application, which will not be repeated here.

[0084] In another embodiment of this application, an electronic device is provided. The electronic device stores a computer program, which includes program instructions. When executed by a processor, the program instructions implement all or part of the processes in the above-described method for fragmenting, encrypting, and reconstructing electronic archives based on distributed optical storage. Alternatively, the computer program can instruct related hardware to complete the process. The computer program can be stored in an electronic device, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. Computer-readable media can include any entity or device capable of carrying computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0085] The computer-readable storage medium can be an internal storage unit of the electronic device in any of the foregoing embodiments, such as a hard disk or memory of the electronic device. The computer-readable storage medium can also be an external storage device of the electronic device, such as a plug-in hard disk, smart media card (SMC), secure digital card (SD), flash card, etc., equipped on the electronic device. Furthermore, the computer-readable storage medium can include both internal and external storage units of the electronic device. The computer-readable storage medium is used to store computer programs and other programs and data required by the electronic device. The computer-readable storage medium can also be used to temporarily store data that has been output or will be output.

[0086] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0087] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the electronic devices and units described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0088] In the several embodiments provided in this application, it should be understood that the disclosed electronic devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces or units, or it may be an electrical, mechanical, or other form of connection.

[0089] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of the embodiments of this application, depending on actual needs.

[0090] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0091] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for fragmented, encrypted, and reconstructed electronic archives based on distributed optical storage, characterized in that, Includes the following steps: S1. Divide the original electronic file into multiple data fragments, and encrypt each data fragment using multiple different keys to obtain multiple encrypted fragments; S2. For each of the encrypted fragments, define an access control policy based on the attributes of the original electronic file, and use a policy compilation engine to compile the access control policy into an independently runnable executable verification logic, thereby generating a policy credential encapsulating the executable verification logic. S3. Cryptographically bind each of the encrypted fragments to the corresponding policy credential, and generate a digital signature based on the result of the cryptographic binding, thereby forming multiple self-verifying storage units; S4. According to the preset scheduling algorithm, the multiple self-verifying storage units are distributed and stored in multiple physically isolated optical storage nodes; S5. In response to the reassembly request for the original electronic file, obtain the corresponding target self-verifying storage unit from each of the optical storage nodes, and perform digital signature verification on each of the target self-verifying storage units; S6. For each of the target self-verifying storage units that has passed digital signature verification, in the secure execution environment associated with the optical storage node where the target self-verifying storage unit is stored, the executable verification logic encapsulated in the policy credential within the target self-verifying storage unit is run to make access control decisions based on the input requester credentials; S7. Based on the result of the access control decision, decryption is performed only on the encrypted fragments in the target self-verification storage unit that passed the decision, and all data fragments obtained after decryption are reassembled into the original electronic file.

2. The method according to claim 1, characterized in that, In S2, the policy compilation engine compiles the access control policy in text format into a bytecode program that can be executed across different software and hardware platforms; the bytecode program is deterministic, and its execution result depends only on the input requester credentials and the program's own logic.

3. The method according to claim 1, characterized in that, In step S3, the generation of the cryptographic binding and digital signature specifically includes: S31. Calculate the first cryptographic hash value of the encrypted fragment and the second cryptographic hash value corresponding to the policy credential, respectively; S32. The first cryptographic hash value and the second cryptographic hash value are combined in a predetermined order to generate a combined hash value, so as to establish an inseparable association between the encrypted fragment and the policy credential; S33. Use the signing private key to digitally sign the combined hash value, and use the digital signature as a component of the self-verifying storage unit for subsequent verification of association and data integrity.

4. The method according to claim 1, characterized in that, In S4, the preset scheduling algorithm is a consistent hashing algorithm, which maps the unique identifier of each self-verifying storage unit to the identifier of an optical storage node, so that the multiple self-verifying storage units corresponding to the original electronic archive are stored on different physical optical storage nodes.

5. The method according to claim 1, characterized in that, In step S6, the secure execution environment is a trusted execution environment provided by a hardware security module or a security chip; the executable verification logic is loaded within the trusted execution environment, its integrity is verified, and then it runs.

6. The method according to claim 5, characterized in that, Before the executable verification logic is executed in step S6, the following step is also included: the trusted execution environment performs integrity verification on the encrypted fragment data read from the optical storage node based on the hash value of the encrypted fragment encapsulated in the policy credential.

7. The method according to claim 1, characterized in that, In S6, the executable verification logic is configured to perform attribute-based access control decision, which determines whether at least one condition in the access control policy regarding data security level, department, and time validity is met by parsing the attribute declaration in the requester's credentials.

8. The method according to claim 5, characterized in that, In step S6, after the executable verification logic performs access control adjudication within the trusted execution environment, a local audit digest of the adjudication is generated. This local audit digest includes at least the identifier of the executable verification logic and a cryptographic commitment value of the adjudication result. The method further includes: S8. Aggregate the local audit digests corresponding to all the target self-verifying storage units, and combine them with the reorganization request identifier and the timestamp of the reorganization operation to generate a structured reorganization audit record; S9. Submit the reorganized audit record itself or its cryptographic hash value to a blockchain network or distributed ledger for evidence storage, so as to form an immutable audit trail.

9. The method according to claim 1, characterized in that, The policy credential generated in S2 also encapsulates the policy version number and policy validity period information; in S6, before running the adjudication, the executable verification logic first checks whether the current time is within the policy validity period, so as to dynamically implement access control based on time conditions.

10. A fragmented, encrypted, and reconstructed electronic archive system based on distributed optical storage, used to implement the method described in any one of claims 1-9, characterized in that, The system includes: The preprocessing module is used to divide the original electronic archive into multiple data fragments, encrypt each data fragment using multiple different keys to obtain encrypted fragments, generate policy credentials encapsulated with executable verification logic for each encrypted fragment, and cryptographically bind and digitally sign each encrypted fragment with the corresponding policy credentials to form a self-verifying storage unit. Multiple storage node modules, each storage node module including an optical storage device and a node security proxy module; the node security proxy module is used to write the received self-verifying storage unit into the optical storage device, and in response to a verification command, read the specified self-verifying storage unit from the optical storage device, verify its digital signature, and run the executable verification logic within it in a local security environment to generate a decision result. The reassembly control module is used to respond to the reassembly request for the original electronic file, obtain the corresponding target self-verifying storage unit from each of the optical storage nodes and perform digital signature verification, trigger the security proxy module of each node to run the verification logic to perform access control adjudication, and according to the adjudication result, only decrypt and reassemble the encrypted fragments that pass the adjudication into the original electronic file.

Images