An attack tracing method and system for end-to-end data transmission of optical communication

Abstract

This invention discloses an attack tracing method and system for end-to-end data transmission in optical communication, belonging to the field of optical fiber communication technology. The method includes: processing an initial key value using a hash function and DNA encoding to generate a DNA sequence; concatenating the DNA sequence to generate a session key and calculating its hash value; calculating a single-byte XOR checksum of the original data to generate extended data, generating ciphertext based on the extended data, and calculating a digest of the ciphertext; decrypting the ciphertext and performing XOR checksum consistency verification to obtain an event digest; calculating a root hash based on the key digest, parameter digest, ciphertext digest, and event digest, storing the root hash in the block header, and performing attack tracing on the block header to obtain the attack tracing result. This invention introduces four-dimensional chaos and DNA encoding to generate a high-entropy key, dynamically storing and updating the key through blockchain, while simultaneously achieving single-root verifiable attack tracing and quickly locating problematic nodes.

Description

Technical Field

[0001] This invention relates to the field of optical fiber communication technology, and in particular to an attack tracing method and system for end-to-end data transmission in optical communication. Background Technology

[0002] With the rapid development of the information network era, global data traffic has exploded, and traditional telecommunications networks can no longer meet the demands for large-scale, high-speed, and low-latency transmission. Fiber optic communication, with its high bandwidth, low loss, and strong anti-interference capabilities, has become a core supporting technology for modern wide area networks, data center interconnections, and cloud computing backbone networks, and is widely used in finance, healthcare, transportation, and defense.

[0003] However, with the popularization of optical communication, the physical layer of optical fiber may be subject to attacks such as eavesdropping coupling, cut-and-replay, link degradation or equipment failure. Once the signal is leaked or the link is interrupted, not only will sensitive information be leaked, but it may also lead to service interruption and serious economic losses. Therefore, how to ensure the end-to-end security and availability of optical links has become an urgent technical problem to be solved.

[0004] Physical layer encryption (PLA) achieves encryption by altering the physical properties of signals. It does not rely on traditional encryption algorithms and mostly employs digital domain chaotic models to perturb different physical dimensions, thus encrypting the signal. To mitigate the aforementioned risks, PLA key scrambling schemes such as laser chaotic encryption and digital chaotic encryption have been proposed. These schemes use chaotic systems to generate pseudo-random sequences to perturb the data, thereby improving the randomness and tamper resistance of the key. These schemes have achieved some success in improving encryption strength and management transparency.

[0005] While the aforementioned chaotic encryption methods each offer advantages in enhancing key randomness and tamper resistance, they all remain at the algorithmic hardening level. The system cannot detect these threats immediately and lacks online monitoring and rapid response capabilities for the physical state of the optical link. Most solutions focus solely on algorithmic encryption, neglecting real-time security monitoring of the optical link. The key generation, distribution, and update processes lack end-to-end visualization. Once a physical attack occurs, the system often only passively discovers it after the attack has already caused damage, making it difficult to promptly locate the source and take appropriate action. Summary of the Invention

[0006] The purpose of this invention is to overcome the shortcomings of the prior art and provide an attack tracing method and system for end-to-end data transmission in optical communication. It introduces four-dimensional chaos and DNA encoding to generate high-entropy keys, and uses blockchain to dynamically store and update keys to enhance the randomness of chaotic sequences. At the same time, it realizes single-root verifiable attack tracing and quickly locates problem nodes.

[0007] To achieve the above objectives, the present invention is implemented using the following technical solution:

[0008] On one hand, this invention provides an attack tracing method for end-to-end data transmission in optical communication, comprising:

[0009] Obtain the original data to be transmitted and the initial key value;

[0010] The initial key value is dynamically perturbed by a hash function, and the dynamically perturbed initial key value is used to generate a random sequence through a four-dimensional chaotic system. The random sequence is then discretized and mapped to DNA bases to generate a DNA sequence.

[0011] The session key is generated by splicing DNA sequences and its hash value is calculated. The hash value of the session key is stored as a key digest on the blockchain node. The parameters of the four-dimensional chaotic system in the hyperchaotic state are stored as a parameter digest on the blockchain node.

[0012] Calculate the single-byte XOR checksum of the original data to generate extended data, generate ciphertext based on the session key and extended data, calculate the digest of the ciphertext and store it as the ciphertext digest on the blockchain node;

[0013] The ciphertext is decrypted to obtain the extended data to be verified. The extended data to be verified is split into the original data to be verified and the verification code to be verified. The single-byte XOR check code of the original data to be verified is calculated. Based on the verification code to be verified and the single-byte XOR check code of the original data to be verified, the event digest is obtained and stored on the blockchain node.

[0014] Calculate the root hash based on the key digest, parameter digest, ciphertext digest, and event digest. Store the root hash in the block header and perform attack tracing on the block header to obtain the attack tracing result.

[0015] Optionally, the initial key value is dynamically perturbed using a hash function, including:

[0016] ;

[0017] ;

[0018] in, This represents the input data used to generate the key. The hash value obtained by performing a hash operation; It is a hash algorithm; , , , These represent the 0th to 15th character segments, the 16th to 31st character segments, the 32nd to 47th character segments, and the 48th to 63rd character segments of the hexadecimal hash value, respectively. , , , This represents the initial key value after dynamic perturbation; This represents a mapping function that converts a hexadecimal value to its corresponding decimal value.

[0019] Optionally, the random sequence is sequentially discretized and subjected to DNA base mapping to generate a DNA sequence, including:

[0020] Perform addition on X, subtraction on Y, XOR on Z, and XOR on W in a random sequence to generate a discrete sequence, represented as:

[0021] ;

[0022] in, , , , Represents a discrete sequence; , , , Represents a random sequence; The constant parameter representing the addition operation; A constant parameter representing the subtraction operation; A constant parameter representing the XOR operation; The constant parameter representing the XOR operation; This represents the modulo operation; This indicates the rounding operation; This represents the XOR operation; This represents the XOR operation;

[0023] According to any of the rules in the DNA base mapping rules, the binary discrete sequence is mapped to DNA bases to generate a DNA sequence;

[0024] The DNA base mapping rules include:

[0025] The first rule is 00→A, 11→T, 01→C, 10→G;

[0026] The second rule is 00→A, 11→T, 10→C, 01→G;

[0027] The third rule is 01→A, 10→T, 00→C, 11→G;

[0028] The fourth rule is 01→A, 10→T, 11→C, 00→G;

[0029] The fifth rule is 10→A, 01→T, 00→C, 11→G;

[0030] The sixth rule is 10→A, 01→T, 11→C, 00→G;

[0031] The seventh rule is 11→A, 00→T, 01→C, 10→G;

[0032] The eighth rule is 11→A, 00→T, 10→C, 01→G;

[0033] Where A represents adenine; T represents thymine; C represents cytosine; G represents guanine; and → represents mapping.

[0034] Optionally, the DNA sequence is spliced ​​to generate a session key and the hash value of the session key is calculated, using the following formula:

[0035] ;

[0036] ;

[0037] ;

[0038] in, Indicates string concatenation; This indicates that the sequence within the parentheses will be converted into a string. , , , Represents a DNA sequence; Indicates a splicing operation; Indicates the session key; Indicates the scrambling function; This indicates the first 256 characters of the concatenated string; This represents a binary sequence of length 256, consisting entirely of 1s. This represents the XOR operation; The hash value representing the session key; This represents a hash algorithm.

[0039] Optionally, the original data is divided into several data frames, each containing n bytes. The data frame of the kth frame is represented as follows:

[0040] ;

[0041] The single-byte XOR checksum of the data segment in the k-th frame is represented as:

[0042] ;

[0043] The extended data is represented as follows:

[0044] ;

[0045] The ciphertext is represented as follows:

[0046] ;

[0047] The digest of the ciphertext is represented as follows:

[0048] ;

[0049] in, This represents the data segment of the k-th frame; , , , These represent the 1st byte, 2nd byte, ith byte, and nth byte in the data segment of the kth frame, respectively. This represents a set of binary sequences of length 8 consisting of 0s and 1s. This represents a single-byte XOR checksum of the data segment in the k-th frame. This represents the XOR operation; Indicates extended data; Represents the original data; The single-byte XOR checksum representing the original data is composed of the single-byte XOR checksums of several data segments concatenated together. Indicates a splicing operation; Indicates ciphertext; Indicates the use of session keys And it uses the AES-256-GCM symmetric algorithm for encryption; This indicates a pre-defined unique initialization vector; A digest of the ciphertext; This represents a hash algorithm.

[0050] Optionally, the extended data to be verified is represented as:

[0051] ;

[0052] Split the extended data to be verified into the original data to be verified. and verification code to be verified And calculate the single-byte XOR checksum of the original data to be verified. The original data to be verified The data is divided into several frames to be verified, each frame containing n bytes to be verified. The single-byte XOR checksum of the data segment in the k-th frame is... Represented as:

[0053] ;

[0054] in, This indicates extended data to be verified; Indicates the use of session keys And the AES-256-GCM symmetric algorithm is used for decryption; Indicates ciphertext; This indicates a pre-defined unique initialization vector; , , These represent the first, second, and nth bytes to be verified in the data segment to be verified in the k-th frame, respectively. This represents the XOR operation.

[0055] Optionally, an event digest is obtained based on the checksum to be verified and the single-byte XOR checksum of the original data to be verified, including:

[0056] like If the result is positive, the verification is successful; otherwise, the verification fails.

[0057] Before statistics The number of verification failures in the frame is used to calculate the verification failure rate. When the verification failure rate If the value exceeds a preset threshold, a decryption error occurs. The error event is recorded, and an event digest is obtained based on the error event. The session key is then updated.

[0058] in, This indicates the verification code to be verified. This represents a single-byte XOR checksum of the original data to be verified. Indicates the number of verification failures; Indicates the number of verification frames.

[0059] Optionally, the event summary is represented as:

[0060] ;

[0061] ;

[0062] in, Indicates an abnormal event; Indicates the location of abnormal fiber optic segments; Indicates the error range; Indicates the occurrence of a frame; Indicates an event summary; This represents a hash algorithm.

[0063] Optionally, the root hash is represented as:

[0064] ;

[0065] in, An intermediate hash representing the key digest and parameter digest; The intermediate hash representing the ciphertext digest and the event digest; Represents the root hash; Represents a hash algorithm; , , , These represent key digest, parameter digest, ciphertext digest, and event digest, respectively. This indicates a splicing operation.

[0066] On the other hand, the present invention provides a computer system comprising:

[0067] Memory, used to store computer programs / instructions;

[0068] A processor for executing the computer program / instructions to implement the steps of the attack tracing method for end-to-end data transmission in optical communication as described in the first aspect.

[0069] Compared with the prior art, the beneficial effects achieved by the present invention are as follows:

[0070] This invention introduces four-dimensional chaos and DNA encoding to generate high-entropy keys. The key digest obtained by hash function perturbation is written into the blockchain and refreshed in rotation. Each data packet is encrypted after being appended with a single-byte XOR checksum. The consistency of the XOR checksum is monitored in real time, and the event digest is recorded on the chain. The key, parameters, ciphertext, and event are jointly stored as evidence. Any node can quickly verify the authenticity of the event and locate the source of the attack. Finally, a highly compatible and secure closed loop of key perturbation, on-chain evidence storage, online monitoring, and intelligent response is formed, which has the capabilities of autonomous protection, dynamic adaptation, and accurate tracing. This solution does not require additional optical hardware. The calculation process only involves low-complexity operations such as XOR and hashing. It can be seamlessly embedded into existing bit-level processing links. While significantly improving dynamic protection and accurate tracing capabilities, it keeps the system complexity and cost controllable. Attached Figure Description

[0071] Figure 1 The diagram shown is a flowchart of one embodiment of the attack tracing method for end-to-end data transmission in optical communication according to the present invention.

[0072] Figure 2 The figure shown is a 3D phase diagram of the four-dimensional chaotic system of the present invention in one embodiment;

[0073] Figure 3 The figure shown is a 3D phase diagram of the four-dimensional chaotic system of the present invention in a second embodiment;

[0074] Figure 4 The figure shown is a 3D phase diagram of the four-dimensional chaotic system of the present invention in a third embodiment;

[0075] Figure 5 The diagram shown is a schematic representation of the Lyapunov exponent in one embodiment of the four-dimensional chaotic system of the present invention.

[0076] Figure 6 The diagram shown is a schematic representation of the encoding and decoding principle in one embodiment of the present invention;

[0077] Figure 7 The diagram shown illustrates the encryption principle of the AES-256-GCM symmetric algorithm of this invention in one embodiment.

[0078] Figure 8 The diagram shown is a verification process diagram of one embodiment of the present invention;

[0079] Figure 9 The diagram shown is a schematic representation of a smart contract model in one embodiment of the present invention.

[0080] Figure 10 The diagram shown is a schematic representation of the Merkle tree structure tracing path in one embodiment of the present invention. Detailed Implementation

[0081] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present invention and the specific features in the embodiments are detailed descriptions of the technical solution of the present invention, rather than limitations thereof. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments can be combined with each other.

[0082] The term "and / or" simply describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. Additionally, the character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0083] Example 1

[0084] This embodiment introduces an attack tracing method for end-to-end data transmission in optical communication, including the following steps:

[0085] Obtain the original data to be transmitted and the initial key value;

[0086] The initial key value is dynamically perturbed by a hash function, and the dynamically perturbed initial key value is used to generate a random sequence through a four-dimensional chaotic system. The random sequence is then discretized and mapped with deoxyribonucleic acid (DNA) bases to generate a DNA sequence.

[0087] The session key is generated by splicing DNA sequences and its hash value is calculated. The hash value of the session key is stored as a key digest on the blockchain node. The parameters of the four-dimensional chaotic system in the hyperchaotic state are stored as a parameter digest on the blockchain node.

[0088] The original data is calculated by performing an exclusive OR (XOR) checksum to generate extended data. Ciphertext is generated based on the session key and the extended data. The digest of the ciphertext is calculated and stored as a ciphertext digest on the blockchain node.

[0089] The ciphertext is decrypted to obtain the extended data to be verified. The extended data to be verified is split into the original data to be verified and the verification code to be verified. The single-byte XOR check code of the original data to be verified is calculated. Based on the verification code to be verified and the single-byte XOR check code of the original data to be verified, the event digest is obtained and stored on the blockchain node.

[0090] Calculate the root hash based on the key digest, parameter digest, ciphertext digest, and event digest. Store the root hash in the block header and perform attack tracing on the block header to obtain the attack tracing result.

[0091] This embodiment introduces four-dimensional chaos and DNA encoding to generate high-entropy keys. The key digest obtained by hash function perturbation is written into the blockchain and refreshed in rounds. Each data packet is encrypted after being appended with a single-byte XOR checksum. The consistency of the XOR checksum is monitored in real time and the event digest is recorded on the chain. The key, parameters, ciphertext and event are jointly stored as evidence. Any node can quickly verify the authenticity of the event and locate the source of the attack. Finally, a highly compatible and secure closed loop of key perturbation, on-chain evidence storage, online monitoring and intelligent response is formed, which has the capabilities of autonomous protection, dynamic adaptation and accurate traceability.

[0092] Example 2

[0093] Based on Example 1, such as Figure 1 As shown in the figure, this embodiment introduces an attack tracing method for end-to-end data transmission in optical communication, including the following steps:

[0094] Step 1: Obtain the original data to be transmitted and the initial key value.

[0095] Step 2: Obtain the parameters of the four-dimensional chaotic system in the hyperchaotic state, specifically:

[0096] Chaotic systems are widely used in encryption due to their initial value sensitivity, boundedness, and unpredictability. This embodiment uses a four-dimensional Chen chaotic system to implement chaotic encryption of data processing and signals. The four-dimensional Chen chaotic system is represented as follows:

[0097] ;

[0098] in, , , , The variable representing the (n+1)th iteration of the four-dimensional Chen's chaotic system; , , , The variable representing the nth iteration of the four-dimensional Chen's chaotic system; , , , , This represents the parameters of a four-dimensional Chen's chaotic system.

[0099] The initial values ​​of the variables in the four-dimensional Chen chaotic system are x0=1.2, y0=-2.3, z0=5.4, w0=0.8. When the parameters of the four-dimensional Chen chaotic system are a=35, b=7, c=12, d=3, and e∈(0.085,0.798], it can be calculated that the Lyapunov exponent (λ) of the system has two positive values, where λ1 is the largest Lyapunov exponent, λ2 is the second largest Lyapunov exponent, and the system is in a hyperchaotic state when λ1>0 and λ2>0. λ3 is the third Lyapunov exponent, which is generally close to 0 or negative, and λ4 is the smallest Lyapunov exponent, which is usually significantly negative and represents the direction of strongest contraction. Figure 5 The spectral curves of λ1 to λ4 as a function of e are given. It can be seen that within the interval e∈(0.085,0.798], the two curves corresponding to λ1 and λ2 are consistently above 0, indicating that the system has two independent divergent directions. At this point, the four-dimensional Chen's chaotic system satisfies the definition of a hyperchaotic state, that is, the system is a hyperchaotic system, as shown below. Figure 2 The figure shown is a three-dimensional (3D) phase diagram of a four-dimensional Chen chaotic system in xyz, as follows: Figure 3 The figure shown is a three-dimensional (3D) phase diagram of a four-dimensional Chen chaotic system under xyw conditions, as follows: Figure 4 The figure shows the three-dimensional (3D) phase diagram of the four-dimensional Chen chaotic system under yzw, with the parameters of the hyperchaotic system at this time used as a parameter summary. The parameter digest is stored on the blockchain node and denoted as A2. Hyperchaotic systems are more complex internally than high-dimensional and low-dimensional systems, resulting in better encryption.

[0100] Step 3: Blockchain hash processing, specifically:

[0101] like Figure 6The diagram illustrates the principle of blockchain hash encoding and decoding. First, the sending end uses a four-dimensional chaotic mapping to generate a random sequence from the original data. Through a key-driven dynamic scrambling and diffusion mechanism, the encryption strength is significantly improved. Then, DNA encoding technology is used to map the binary random sequence to a DNA sequence. The diversity and complexity of biological sequences are leveraged to perform further XOR operations, enhancing the system's security and privacy protection capabilities. Furthermore, the system uses dynamic XOR checksum generation to achieve real-time verification of data integrity during transmission, preventing tampering and replay attacks.

[0102] All encrypted data and authentication digests are automatically uploaded to the blockchain via smart contracts, leveraging the distributed ledger structure and hashing mechanism of the blockchain to ensure the immutability and traceability of the data. Each data block contains the hash value of the previous block, the encryption key index, the identity identifier, and the authentication digest, forming a continuous chain structure, i.e., a block. δ Including blocks δ -1 hash value, encryption key index, identity identifier and authentication digest, block δ -1 includes blocks δ The hash value of -2, the encryption key index, the identity identifier, and the authentication digest are used. The receiving end uses a smart contract to first verify the identity, then completes operations such as secure key reading, data decryption, and XOR verification. Finally, the hash digest of the decrypted data is uploaded to the blockchain again, forming a secure closed loop at the end of the chain, which can be used by the detection party for traceability.

[0103] To save storage space and protect data privacy on the blockchain, this embodiment chooses to store the hash value of the data in the blockchain. Hash functions are irreversible, effectively protecting data content, ensuring data security, and significantly reducing the risk of data leakage. The initial key value is dynamically perturbed using a hash function. Due to the irreversibility and randomness of the hash function, the result will be different each time. The signal matrix is ​​used as a parameter in the hash function, expressed as:

[0104] ;

[0105] Since the output hash value of the 256-bit Secure Hash Algorithm (SHA-256) is a 64-character hexadecimal number, this embodiment extracts specific segments, i.e., different parts of the hash value, for conversion, dividing the hash value into four 16-character segments (each 16-character segment represents 64 bits, or 16 bytes). The hash function is then updated as follows:

[0106] ;

[0107] By transforming characters 0-15, 16-31, 32-47, and 48-63 of the hash value—that is, dynamically perturbing the initial key value—we obtain the dynamically perturbed initial key value, represented as:

[0108] ;

[0109] in, This represents the input data used to generate the key. The hash value obtained by performing a hash operation; It is a hash algorithm; , , , These represent the 0th to 15th character segments, the 16th to 31st character segments, the 32nd to 47th character segments, and the 48th to 63rd character segments of the hexadecimal hash value, respectively. , , , This represents the initial key value after dynamic perturbation; This represents a mapping function that converts a hexadecimal value to its corresponding decimal value.

[0110] Initial key value after dynamic perturbation , , , Generating random sequences using a four-dimensional Chen's chaotic system , , , random sequence , , , These are the variables in a four-dimensional Chen's chaotic system.

[0111] Perform addition on X, subtraction on Y, XOR on Z, and XOR on W in a random sequence to generate a discrete sequence, represented as:

[0112] ;

[0113] in, , , , Represents a discrete sequence; , , , Represents a random sequence; The constant parameter representing the addition operation; A constant parameter representing the subtraction operation; A constant parameter representing the XOR operation; The constant parameter representing the XOR operation; This represents the modulo operation. `mod(·, 8)` outputs a range of 0–7. When represented using 3 bits, it can be mapped and combined with DNA (2 bits). Used to disturb low-level modes; This indicates the rounding operation; When j=4, the first 4 decimal places of the chaotic real random sequence are retained, and then rounding is performed. This can effectively break up the correlation between high and low bits, and at the same time, it will not cause an excessively long bit string. This represents the XOR operation; This represents the XOR operation.

[0114] DNA sequences have four nucleic acid bases: adenine (A), thymine (T), cytosine (C), and guanine (G). A and T are complementary, and G and C are complementary. For binary numbers, 0 and 1 are complementary, so 00 and 11, and 01 and 10 are also complementary. Using the four bases A, T, C, and G to encode 00, 01, 10, and 11, there are 24 encoding combinations, but only 8 satisfy the Watson-Crick complement rule, known as the DNA base mapping rule, as shown in Table 1. These include:

[0115] The first rule is 00→A, 11→T, 01→C, 10→G;

[0116] The second rule is 00→A, 11→T, 10→C, 01→G;

[0117] The third rule is 01→A, 10→T, 00→C, 11→G;

[0118] The fourth rule is 01→A, 10→T, 11→C, 00→G;

[0119] The fifth rule is 10→A, 01→T, 00→C, 11→G;

[0120] The sixth rule is 10→A, 01→T, 11→C, 00→G;

[0121] The seventh rule is 11→A, 00→T, 01→C, 10→G;

[0122] The eighth rule is 11→A, 00→T, 10→C, 01→G;

[0123] Here, → represents a mapping.

[0124] Table 1 DNA base mapping rules

[0125] rule 1 2 3 4 5 6 7 8 A 00 00 01 01 10 10 11 11 T 11 11 10 10 01 01 00 00 C 01 10 00 11 00 11 01 10 G 10 01 11 00 11 00 10 01

[0126] When data is encrypted, if the encryption algorithm uses one rule from the DNA base mapping rules and the decryption algorithm uses another rule from the DNA base mapping rules, the data can be effectively encrypted and cannot be recovered, thus ensuring data security.

[0127] A DNA sequence is generated by mapping a discrete binary sequence to DNA bases according to any of the DNA base mapping rules.

[0128] The DNA sequence is assembled into a string, and the resulting concatenated string is... The length must be at least 256 bits to ensure sufficient randomness in the SHA-256 input, and the string must be concatenated. Represented as:

[0129] ;

[0130] Extract concatenated strings The first 256 bits are inverted and shuffled to obtain a 256-bit session key. , is represented as:

[0131] ;

[0132] Calculate the hash value of the session key, and store this hash value as a key digest on the blockchain node. The key digest is denoted as A1. The key itself is securely stored only at the two ends of the communication; it is not stored on the blockchain to prevent key leakage. The hash value of the session key... Represented as:

[0133] ;

[0134] in, This indicates that the sequence within the parentheses will be converted into a string. , , , Represents a DNA sequence; Indicates a splicing operation; This represents a scrambling function that performs a scrambling operation on a bit sequence of length 256. This indicates the first 256 characters of the concatenated string; This represents a binary sequence of length 256, consisting entirely of 1s. The XOR operation is equivalent to performing a bit-by-bit inversion on the scrambled bit sequence, which enhances the spreadability of the sequence. The hash value representing the session key.

[0135] Step 4: Encrypt optical communication data with additional XOR checksum, specifically as follows:

[0136] Deploying smart contracts at the blockchain's underlying layer orchestrates the entire process of key generation, verification, distribution, and rotation into automatically executable on-chain logic. Smart contracts automate the key distribution process, ensuring that only authorized parties can obtain the keys, and each key distribution is recorded on the blockchain for easy traceability. Figure 9 The image shows a smart contract model, where the first column represents the business triggering model, the second column represents the corresponding security objective, the third column represents the corresponding result, and the arrows indicate the order of calls and the output relationship within the contract.

[0137] By adopting a dual identity and certificate binding mechanism, when identity and certificate management services are triggered, the communication entity must submit the local private key signing identity binding and authentication (Certificate Authority, CA) certificate before it can call the key distribution interface, thereby enhancing system trust.

[0138] When the key dynamic management business is triggered, hash storage and key negotiation are performed to ensure that the key is tamper-proof and traceable. The smart contract receives the key digest and parameter digest. If the digest update is detected on the chain, the session key for the current round is issued to both communicating parties, and the block height and timestamp of the distribution event are recorded at the same time.

[0139] When the decryption service is triggered, decryption verification and XOR verification are performed and uploaded to the blockchain. After the receiving end completes the tag and XOR verification, it uploads the ciphertext digest and event digest of the success frame to the blockchain. Once the contract verification is passed, the plaintext delivery permission is granted, realizing on-chain auditable decryption authorization.

[0140] When the anomaly monitoring and response service is triggered, the monitoring event triggers and security policy execution, implements adaptive protection, and generates and broadcasts an anomaly event summary when the XOR failure rate counted by the receiving end exceeds a threshold. When the smart contract detects an anomaly on-chain, it will automatically execute the security policy, rotate the session key for the next round, and suspend the current communication session to prevent the anomaly from spreading.

[0141] This method not only ensures the security of the key, preventing key leakage or misuse, but also guarantees the security of the distribution process. The hash value serves as a key integrity verification value, ensuring that the key is not tampered with during distribution and storage. Upon detecting anomalies, blockchain technology can be used to trace the optical communication data, ensuring that the source and transmission path of the data can be traced in the event of a security incident or abnormal behavior. Key information is recorded on the blockchain with each data transmission.

[0142] Complete session key After interception and hash verification, the sending end immediately enters the data integrity marking stage, whereby the sending end sends the original data... The data is divided into several frames, each containing n bytes. The data segment of the k-th frame is... This data stream originates from the front-end digital signal processing (DSP) unit, specifically the data segment of the k-th frame. Represented as:

[0143] ;

[0144] Using the data segment of the kth frame Calculate the single-byte XOR checksum of the data segment in the k-th frame. Represented as:

[0145] ;

[0146] Single-byte XOR checksum of the raw data It is composed of single-byte XOR checksums of several data segments, and the sending end treats the original data as plaintext. Calculate the single-byte XOR checksum of the original data Then, the single-byte XOR checksum of the original data is... Directly appended to plaintext At the tail, extended data is formed. Expanding data Represented as:

[0147] ;

[0148] The sending end generates extended data Then, use the session key. and preset unique initialization vector It then uses the Advanced Encryption Standard (AES) 256-bit Galois / Counter Mode (AES-256-GCM) symmetric algorithm for encryption to obtain the ciphertext. ciphertext Represented as:

[0149] ;

[0150] Compute the digest of the ciphertext , is represented as:

[0151] ;

[0152] in, , , , These represent the 1st byte, 2nd byte, ith byte, and nth byte in the data segment of the kth frame, respectively. This represents a set of binary sequences of length 8 consisting of 0s and 1s. Indicates the use of session keys It also uses the AES-256-GCM symmetric algorithm for encryption.

[0153] The digest of the ciphertext is stored on the blockchain node as a ciphertext digest, denoted as A3.

[0154] like Figure 7 The diagram shown illustrates the principle of the AES-256-GCM symmetric algorithm, where a unique initialization vector is preset. It consists of a 32-bit timestamp and a 64-bit random number, ensuring that it is used within the same session key. The globally unique Advanced Encryption Standard (AES) counter module will convert plaintext... Single-byte XOR checksum of the original data After concatenation, streaming encryption is performed to ensure confidentiality; the Galois Message Authentication Code (GMAC) message authentication module uses a preset unique initialization vector. With ciphertext The system performs a Galois hash (GHASH) operation to generate a 128-bit tag, ensuring integrity and preventing tampering. The control module coordinates the encryption and authentication processes according to commands and outputs the tag along with the ciphertext in the response. The receiving end needs to verify the tag during decryption.

[0155] Step 5: Data transmission and anomaly detection based on XOR failure rate, specifically:

[0156] After completing the XOR encrypted encapsulation of the extended message at the sending end, the system enters the security verification process at the receiving end, such as... Figure 8 As shown.

[0157] First, based on the round information stored on the blockchain, the receiving end securely retrieves the session key corresponding to this frame through a smart contract. ; This represents a set of binary sequences of length 256 consisting of 0s and 1s.

[0158] After obtaining the session key, the same AES-256-GCM decryption algorithm as the sender is used, along with a 96-bit preset unique initialization vector. Regarding the received ciphertext Decryption is performed to obtain the extended data to be verified. , is represented as:

[0159] ;

[0160] in, Indicates the use of session keys And the AES-256-GCM symmetric algorithm is used for decryption.

[0161] If the 128-bit authentication tag provided by the algorithm fails to verify during this process, it indicates that the data has been corrupted in the link. The system will immediately discard the frame data and record a verification failure.

[0162] When tag verification passes, the data to be verified will be expanded. Split into raw data to be verified and verification code to be verified And calculate the single-byte XOR checksum of the original data to be verified. The original data to be verified The data is divided into several frames to be verified, each frame containing n bytes to be verified. The single-byte XOR checksum of the data segment in the k-th frame is... Represented as:

[0163] ;

[0164] in, , , These represent the first, second, and nth bytes to be verified in the data segment to be verified in the k-th frame, respectively.

[0165] Compare the verification codes to be verified Single-byte XOR checksum of the original data to be verified ,like If the result is correct, record a successful verification; otherwise, record a failed verification.

[0166] Before using the sliding window mechanism for statistics The number of verification failures in the frame is used to calculate the verification failure rate. When the verification failure rate If the percentage exceeds a preset threshold θ (θ=1%), a decryption anomaly is detected, indicating that the link has been tampered with, replayed, or degraded. Once an anomaly is detected, the receiving end immediately constructs an anomaly event. And obtain an event summary based on the abnormal event. Update the session key and store the event digest on the blockchain node; the event digest is denoted as A4. Represented as:

[0167] ;

[0168] ;

[0169] in, Indicates the location of abnormal fiber optic segments; Indicates the error range; This indicates that a frame has occurred.

[0170] Event Summary Only when When the value is greater than θ, the data is generated and added to the chain; a normal frame is written to the placeholder constant 0. 256 If the verification is successful, the frame is submitted to the DSP link for normal decoding.

[0171] Subsequently, the system generates four types of digests: key digest A1 Parameter Summary A2 ciphertext digest A3 and event summary A4 Calculate the root hash using the binary combination method of Merkle trees. root hash The root hash is stored along with the transaction in the block header, achieving immutable on-chain evidence storage. Represented as:

[0172] ;

[0173] in, An intermediate hash representing the key digest and parameter digest; The intermediate hash representing the ciphertext digest and the event digest.

[0174] The rules for the four types of abstracts are shown in Table 2.

[0175] Table 2 Rules for Corresponding Four Types of Abstracts

[0176] summary Generate location effect Key digest A1 Sender key distribution Verify key validity Parameter Summary A2 Initial key value and perturbation constant Data recovery and anti-counterfeiting Ciphertext Digest A3 Each frame contains SHA-256 ciphertext. Verify ciphertext integrity Event Summary A4 Abnormal frame write events only Triggering emergency response and source tracing

[0177] Step Six: Tracing the source of the blockchain attack, specifically:

[0178] Attack tracing is performed on the block header to obtain the attack tracing results.

[0179] Based on the data encoding, an index tree is constructed to build the tree, the encoding tree, and add verification information, thus achieving efficient indexing and verification of data. In this embodiment, the index tree is an inter-block index, which can quickly locate the block where the query data is located.

[0180] After the smart contract completes its call, the key digest A1 for each round... Parameter Summary A2 ciphertext digest A3 and event summary A4 All data is stored as summary data on individual blockchain nodes and broadcast across the network. Upon receiving the relevant message, other blockchain nodes aggregate the various types of summary data and index them using a Merkle tree structure. The specific storage and traceability methods are as follows: Figure 10 As shown, each root node's child nodes include intermediate hashes of the key digest and parameter digest. Intermediate hash of ciphertext digest and event digest Intermediate hash of key digest and parameter digest The child nodes include key digest A1 Calculated hash 1, parameter digest A2 The calculated hash2, the intermediate hash of the ciphertext digest and the event digest The child nodes include the ciphertext digest A3 Calculated hash 3, Event digest A4 The calculated hash 4, the intermediate hash of the key digest and parameter digest. The intermediate hash of the ciphertext digest and event digest is obtained by concatenating hash1 and hash2. It is obtained by concatenating hash3 and hash4.

[0181] Any node only needs to submit event digest A4 Intermediate hash of key digest and parameter digest Intermediate hash of ciphertext digest and event digest Root hash This allows for the verification of the event's authenticity and precise backtracking to the faulty node using the session number and group range.

[0182] Since the hash value of each digest depends on the hash values ​​of the original data and other digests, any tampering with the data will cause changes to the corresponding node hash and the root hash, ultimately leading to a discrepancy between the Merkle tree root hash and the on-chain stored value. Therefore, Merkle trees can provide strong guarantees in areas such as encryption key storage, communication behavior monitoring, and anomaly event auditing, thereby effectively improving the traceability capabilities of end-to-end data security in optical communication systems. Thus, the system completes a security closed loop from key perturbation, data encryption, online monitoring, to on-chain triggering and traceability.

[0183] Example 3

[0184] This embodiment describes a computer system, including:

[0185] Memory, used to store computer programs / instructions;

[0186] A processor for executing the computer program / instructions to implement the steps of the attack tracing method for end-to-end data transmission in optical communication as described in Embodiment 1 or 2.

[0187] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0188] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0189] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0190] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0191] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims. All of these forms are within the protection scope of the present invention.

Claims

1. A method for tracing the source of attacks on end-to-end data transmission in optical communication, characterized in that, include: Obtain the original data to be transmitted and the initial key value; The initial key value is dynamically perturbed by a hash function, and the dynamically perturbed initial key value is used to generate a random sequence through a four-dimensional chaotic system. The random sequence is then discretized and mapped to DNA bases to generate a DNA sequence. The session key is generated by splicing DNA sequences and its hash value is calculated. The hash value of the session key is stored as a key digest on the blockchain node. The parameters of the four-dimensional chaotic system in the hyperchaotic state are stored as a parameter digest on the blockchain node. Calculate the single-byte XOR checksum of the original data to generate extended data, generate ciphertext based on the session key and extended data, calculate the digest of the ciphertext and store it as the ciphertext digest on the blockchain node; The ciphertext is decrypted to obtain the extended data to be verified. The extended data to be verified is split into the original data to be verified and the verification code to be verified. The single-byte XOR check code of the original data to be verified is calculated. Based on the verification code to be verified and the single-byte XOR check code of the original data to be verified, the event digest is obtained and stored on the blockchain node. Calculate the root hash based on the key digest, parameter digest, ciphertext digest, and event digest. Store the root hash in the block header and perform attack tracing on the block header to obtain the attack tracing result. Based on the checksum to be verified and the single-byte XOR checksum of the original data to be verified, an event digest is obtained, including: like If the result is positive, the verification is successful; otherwise, the verification fails. Before statistics The number of verification failures in the frame is used to calculate the verification failure rate. When the verification failure rate If the value exceeds a preset threshold, a decryption error occurs. The error event is recorded, and an event digest is obtained based on the error event. The session key is then updated. in, This indicates the verification code to be verified. This represents a single-byte XOR checksum of the original data to be verified. Indicates the number of verification failures; Indicates the number of verification frames.

2. The attack tracing method for end-to-end data transmission in optical communication according to claim 1, characterized in that, The initial key value is dynamically perturbed using a hash function, including: ； ； in, This represents the input data used to generate the key. The hash value obtained by performing a hash operation; It is a hash algorithm; , , , These represent the 0th to 15th character segments, the 16th to 31st character segments, the 32nd to 47th character segments, and the 48th to 63rd character segments of the hexadecimal hash value, respectively. , , , This represents the initial key value after dynamic perturbation; This represents a mapping function that converts a hexadecimal value to its corresponding decimal value.

3. The attack tracing method for end-to-end data transmission in optical communication according to claim 1, characterized in that, The random sequence is sequentially discretized and DNA base mapped to generate a DNA sequence, including: Perform addition on X, subtraction on Y, XOR on Z, and XOR on W in a random sequence to generate a discrete sequence, represented as: ； in, , , , Represents a discrete sequence; , , , Represents a random sequence; The constant parameter representing the addition operation; A constant parameter representing the subtraction operation; A constant parameter representing the XOR operation; The constant parameter representing the XOR operation; This represents the modulo operation; This indicates the rounding operation; This represents the XOR operation; This represents the XOR operation; According to any of the rules in the DNA base mapping rules, the binary discrete sequence is mapped to DNA bases to generate a DNA sequence; The DNA base mapping rules include: The first rule is 00→A, 11→T, 01→C, 10→G; The second rule is 00→A, 11→T, 10→C, 01→G; The third rule is 01→A, 10→T, 00→C, 11→G; The fourth rule is 01→A, 10→T, 11→C, 00→G; The fifth rule is 10→A, 01→T, 00→C, 11→G; The sixth rule is 10→A, 01→T, 11→C, 00→G; The seventh rule is 11→A, 00→T, 01→C, 10→G; The eighth rule is 11→A, 00→T, 10→C, 01→G; Where A represents adenine; T represents thymine; C represents cytosine; G represents guanine; and → represents mapping.

4. The attack tracing method for end-to-end data transmission in optical communication according to claim 1, characterized in that, The session key is generated by splicing DNA sequences and its hash value is calculated using the following formula: ； ； ； in, Indicates string concatenation; This indicates that the sequence within the parentheses will be converted into a string. , , , Represents a DNA sequence; Indicates a splicing operation; Indicates the session key; Indicates the scrambling function; This indicates the first 256 characters of the concatenated string; This represents a binary sequence of length 256, consisting entirely of 1s. This represents the XOR operation; The hash value representing the session key; This represents a hash algorithm.

5. The attack tracing method for end-to-end data transmission in optical communication according to claim 1, characterized in that, The original data is divided into several data segments, each containing n bytes. The data segment of the k-th frame is represented as follows: ； The single-byte XOR checksum of the data segment in the k-th frame is represented as: ； The extended data is represented as follows: ； The ciphertext is represented as follows: ； The digest of the ciphertext is represented as follows: ； in, This represents the data segment of the k-th frame; , , , These represent the 1st byte, 2nd byte, ith byte, and nth byte in the data segment of the kth frame, respectively. This represents a set of binary sequences of length 8 consisting of 0s and 1s. This represents a single-byte XOR checksum of the data segment in the k-th frame. This represents the XOR operation; Indicates extended data; Represents the original data; The single-byte XOR checksum representing the original data is composed of the single-byte XOR checksums of several data segments concatenated together. Indicates a splicing operation; Indicates ciphertext; Indicates the use of session keys And it uses the AES-256-GCM symmetric algorithm for encryption; This indicates a pre-defined unique initialization vector; A digest of the ciphertext; This represents a hash algorithm.

6. The attack tracing method for end-to-end data transmission in optical communication according to claim 1, characterized in that, The extended data to be verified is represented as follows: ； in, This indicates extended data to be verified; Indicates the use of session keys And the AES-256-GCM symmetric algorithm is used for decryption; Indicates ciphertext; This indicates a pre-defined unique initialization vector; Split the extended data to be verified into the original data to be verified. and verification code to be verified And calculate the single-byte XOR checksum of the original data to be verified. The original data to be verified The data is divided into several frames to be verified, each frame containing n bytes to be verified. The single-byte XOR checksum of the data segment in the k-th frame is... Represented as: ； in, , , These represent the first, second, and nth bytes to be verified in the data segment to be verified in the k-th frame, respectively. This represents the XOR operation.

7. The attack tracing method for end-to-end data transmission in optical communication according to claim 1, characterized in that, The event summary is represented as follows: ； ； in, Indicates an abnormal event; Indicates the location of abnormal fiber optic segments; Indicates the error range; Indicates the verification failure rate; Indicates the occurrence of a frame; Indicates an event summary; This represents a hash algorithm.

8. The attack tracing method for end-to-end data transmission in optical communication according to claim 1, characterized in that, The root hash is represented as: ； in, An intermediate hash representing the key digest and parameter digest; The intermediate hash representing the ciphertext digest and the event digest; Represents the root hash; Represents a hash algorithm; , , , These represent key digest, parameter digest, ciphertext digest, and event digest, respectively. This indicates a splicing operation.

9. A computer system, characterized in that, include: Memory, used to store computer programs / instructions; A processor for executing the computer program / instructions to implement the steps of the attack tracing method for end-to-end data transmission in optical communication as described in any one of claims 1-8.

Images