Disaster recovery data synchronization verification method and device based on quantum key distribution and storage medium

Abstract

This application discloses a method, apparatus, and storage medium for disaster recovery data synchronization verification based on quantum key distribution. The method includes: establishing an initial quantum session key shared by the source and disaster recovery ends through a quantum key distribution channel, and generating a byte offset table; processing the data to be synchronized using a content-driven variable-length block and quantum random mask algorithm to obtain a quantum fingerprint data block and a data digest; performing quantum signature on the data digest using the quantum session key, and embedding the signature value into the data block according to the byte offset table to form a watermarked data block; generating a semantic fingerprint and a two-factor binding credential; constructing a synchronization data packet containing the watermarked data block, semantic fingerprint, binding credential, and historical chain node values, and sending it to the disaster recovery end for verification; and updating the disaster recovery end data, synchronization log chain, and quantum key chain after successful verification. This application ensures the immutability and traceability of the data synchronization process through watermark embedding, semantic fingerprinting, and a two-chain structure, achieving secure transmission of disaster recovery data.

Description

Technical Field

[0001] This application relates to the field of data disaster recovery and backup technology, and in particular to a disaster recovery data synchronization verification method, device and storage medium based on quantum key distribution. Background Technology

[0002] With the development of information technology, data has become a core asset for enterprises and organizations. To ensure data reliability and business continuity, disaster recovery backup systems are widely used. Traditional disaster recovery data synchronization methods mainly rely on classical cryptography to guarantee the security and integrity of data transmission. However, with the development of quantum computing technology, classical cryptographic algorithms face the risk of being cracked, posing a serious challenge to the security of disaster recovery data synchronization. Existing disaster recovery data synchronization solutions have the following problems: 1. Key security risks: Traditional encryption methods rely on computational complexity, and their long-term keys are threatened by future quantum computers. Furthermore, there is a risk of leakage during the key distribution and management process. 2. Data transmission risks: When data is transmitted in classical channels, it is vulnerable to man-in-the-middle attacks, data tampering, or replay attacks, making it difficult to guarantee the integrity and authenticity of the data. 3. Challenges in verifying the consistency of data between the source and disaster recovery ends: It is difficult to verify the consistency of data between the source and disaster recovery ends in a real-time and tamper-proof manner, making post-audit complex and lacking a strong chain of evidence.

[0003] 4. Insufficient ability to resist advanced persistent threats: Traditional methods lack deep security verification mechanisms that are linked to business logic when facing semantic attacks targeting data content or complex attacks that exploit system vulnerabilities. Summary of the Invention

[0004] The main purpose of this application is to provide a disaster recovery data synchronization verification method, device and storage medium based on quantum key distribution, which aims to solve the technical problems of security threats and difficulty in reliably verifying consistency in existing disaster recovery data transmission technologies.

[0005] To achieve the above objectives, this application proposes a disaster recovery data synchronization verification method based on quantum key distribution, applicable to a disaster recovery system including a source end and a disaster recovery end, wherein a quantum key distribution channel and a classical communication channel are deployed between the source end and the disaster recovery end, and the method includes: An initial quantum session key shared by the source and the disaster recovery end is established through the quantum key distribution channel, and a byte offset table is generated based on the initial quantum session key; The source end acquires the data to be synchronized, and the data to be synchronized is divided into blocks using the quantum random threshold block algorithm and the quantum random mask algorithm to obtain quantum fingerprint data blocks and calculate data digests. The data digest is quantum-signed based on the initial quantum session key, and the quantum signature value is embedded into the quantum fingerprint data block according to the byte offset table to form a watermarked data block. The quantum fingerprint data block is semantically hashed to generate a semantic fingerprint, and a two-factor binding credential is generated based on the semantic fingerprint, the initial quantum session key, the current synchronization token value, and the static device key. Based on the watermarked data block, the semantic fingerprint, the two-factor binding credential, the end node value of the synchronization log chain of the previous synchronization period, and the end node value of the quantum key chain, a synchronization data packet is constructed, and the constructed synchronization data packet is sent to the disaster recovery terminal for verification through the classical communication channel to obtain the verification result. When the verification result is successful, the watermarked data block in the synchronization data packet is written to the disaster recovery terminal to update the data of the disaster recovery terminal, and the synchronization log chain and quantum key chain of the disaster recovery terminal are updated based on the synchronization data packet.

[0006] Preferably, the step of establishing an initial quantum session key shared by the source and the disaster recovery end through the quantum key distribution channel, and generating a byte offset table based on the initial quantum session key, includes: The quantum key is negotiated and distributed between the source end and the disaster recovery end through the quantum key distribution channel to generate the original quantum bit string; The original quantum bit string is subjected to quantum error correction and privacy amplification processing to generate an initial quantum session key; The initial quantum session key is input into a key derivation function based on a cryptographic hash function to generate an extended key stream; Define a two-dimensional array structure with a preset number of rows and columns, and use the two-dimensional array structure as a byte offset table frame; Using the extended key stream as a random seed, a pseudo-random number generator is initialized, and the pseudo-random number generator generates a random offset within a preset maximum value range for each cell of the byte offset table. The random offset is embedded into the corresponding unit of the byte offset table frame to obtain the byte offset table.

[0007] Preferably, the step of acquiring the data to be synchronized from the source end, dividing the data to be synchronized into blocks using a quantum random thresholding algorithm and a quantum random masking algorithm to obtain quantum fingerprint data blocks and calculating data digests includes: A mask key is derived based on the initial quantum session key, and a quantum random number generator is invoked using the mask key as a seed to generate a quantum random mask; The quantum random mask is divided into a high-bit interval and a low-bit interval, which are used to set the upper and lower thresholds of the sliding window, respectively. The dynamic threshold interval is determined based on the upper and lower thresholds. Obtain the data to be synchronized from the source end, and perform a sliding window scan on the data to be synchronized using a rolling hash to obtain the rolling hash value; When the rolling hash value falls into the dynamic threshold range, the data in the current sliding window is used as the block boundary, and the data to be synchronized is divided according to the block boundary to obtain a quantum fingerprint data block; Calculate the quantum fingerprint of each of the quantum fingerprint data blocks, and perform aggregate hashing on the quantum fingerprints to generate a data digest.

[0008] Preferably, the step of performing quantum signature on the data digest based on the initial quantum session key, and embedding the quantum signature value into the quantum fingerprint data block according to the byte offset table to form a watermarked data block includes: A quantum signature key is derived based on the initial quantum session key; The quantum signature key is used to perform a signature operation on the data digest based on a quantum-resistant digital signature algorithm to generate a quantum signature value. The quantum signature value is compressed and encoded to generate a compact signature code; The corresponding embedding start position is determined by querying the byte offset table based on the sequence number of the quantum fingerprint data block. Starting from the embedding start position, the compact signature code is embedded into the quantum fingerprint data block in a lossless replacement or superposition manner to generate the original data block with watermark; Calculate the cryptographic hash value of the original data block with watermark, and use it as the integrity check code after watermarking; The original data block with watermark is combined and encapsulated with the watermarked integrity check code to obtain a watermarked data block.

[0009] Preferably, the step of performing semantic hashing on the quantum fingerprint data block to generate a semantic fingerprint, and generating a two-factor binding credential based on the semantic fingerprint, the initial quantum session key, the current synchronization token value, and the static device key, includes: The quantum fingerprint data block is subjected to morphological feature extraction based on topological data analysis to obtain a topological feature vector; The quantum fingerprint data block is subjected to structural feature extraction based on hypergraph construction and learning to obtain graph-level embedding vectors; Locality-sensitive hashing is performed based on the topological feature vector and the graph-level embedding vector to generate a semantic fingerprint; Based on the current timestamp and the initial quantum session key, the current synchronization token value is generated using a message authentication code algorithm; The semantic fingerprint is digitally signed based on the static device key from the source end to generate a device identity signature; The semantic fingerprint, the pre-synchronization token value, and the device identity signature are concatenated, and the concatenated data is encrypted using the initial quantum session key to generate a two-factor binding credential.

[0010] Preferably, the step of constructing a synchronization data packet based on the watermarked data block, the semantic fingerprint, the two-factor binding credential, the tail node value of the synchronization log chain from the previous synchronization period, and the tail node value of the quantum key chain, and sending the constructed synchronization data packet to the disaster recovery terminal for verification through the classical communication channel to obtain the verification result, includes: Obtain the tail node value of the synchronization log chain and the tail node value of the quantum key chain from the previous synchronization cycle, and generate a globally unique timestamp and a monotonically increasing sequence number for the synchronization data packet; The watermarked data block, semantic fingerprint, two-factor binding certificate, the end node value of the synchronization log chain of the previous synchronization period and the end node value of the quantum key chain, timestamp and sequence number are combined into the original packet body. Perform a cryptographic hash operation on the original packet body to obtain the packet body hash value; A signature random number is generated based on the temporary signature key derived from the initial quantum session key and the packet body hash value; Based on the packet body hash value, the temporary signature key, and the signature random number, a digital signature is generated by performing an elliptic curve digital signature algorithm to generate a packet body signature value. The original packet body, packet body hash value, and packet body signature value are assembled into a synchronization data packet, and the synchronization data packet is sent to the disaster recovery terminal for verification through the classic communication channel to obtain the verification result.

[0011] Preferably, when the verification result is successful, writing the watermarked data block from the synchronization data packet to the disaster recovery terminal, updating the data on the disaster recovery terminal, and updating the synchronization log chain and quantum key chain of the disaster recovery terminal based on the synchronization data packet includes: When the verification result is successful, the watermarked data block in the synchronization data packet is written to the corresponding storage location of the disaster recovery terminal according to the preset data writing rules, and the data of the disaster recovery terminal is updated. After the data update is complete, calculate the first current hash value for the current synchronization period; The first current hash value is cross-hashed with the synchronization log chain tail node value and quantum key chain tail node value of the previous synchronization period in the synchronization data packet to generate a new synchronization log chain node and a new quantum key chain node. The new synchronization log chain node and the new quantum key chain node are bidirectionally confirmed through a quantum random challenge-response mechanism between the source end and the disaster recovery end to obtain the confirmation result. When the confirmation result is successful, the new synchronization log chain node is appended to the end of the synchronization log chain of the disaster recovery terminal, and the new quantum key chain node is appended to the end of the quantum key chain of the disaster recovery terminal.

[0012] Preferably, the step of performing bidirectional confirmation of the new synchronization log chain node and the new quantum key chain node through the quantum random challenge-response mechanism between the source end and the disaster recovery end to obtain the confirmation result includes: A quantum random challenge number is generated based on the cross-anchoring value of the new synchronous log chain node and the new quantum key chain node; A synchronization confirmation message is constructed based on the quantum random challenge number, the new synchronization log chain node, the new quantum key chain node, and the current synchronization sequence number; The synchronization confirmation message is sent to the source end for confirmation through the classical communication channel, and when the confirmation is successful, the quantum random challenge number is signed to generate a challenge response signature; A challenge-response message is constructed based on the challenge-response signature and the response verification code, and the challenge-response message is returned to the disaster recovery terminal for confirmation through the classic communication channel to obtain the confirmation result.

[0013] Furthermore, to achieve the above objectives, this application also proposes a disaster recovery data synchronization verification device based on quantum key distribution, which includes: The generation module is used to establish an initial quantum session key shared by the source and the disaster recovery end through the quantum key distribution channel, and to generate a byte offset table based on the initial quantum session key; The block segmentation module is used to acquire the data to be synchronized from the source end, and to segment the data to be synchronized into blocks using the quantum random threshold segmentation algorithm and the quantum random masking algorithm to obtain quantum fingerprint data blocks and calculate data digests. The signature module is used to perform quantum signature on the data digest based on the initial quantum session key, and embed the quantum signature value into the quantum fingerprint data block according to the byte offset table to form a watermarked data block; The processing module is used to perform semantic hashing on the quantum fingerprint data block to generate a semantic fingerprint, and generate a two-factor binding credential based on the semantic fingerprint, the initial quantum session key, the current synchronization token value, and the static device key. The construction module is used to construct a synchronization data packet based on the watermarked data block, the semantic fingerprint, the two-factor binding credential, the tail node value of the synchronization log chain of the previous synchronization period, and the tail node value of the quantum key chain, and to send the constructed synchronization data packet to the disaster recovery end for verification through a classical communication channel to obtain the verification result. The update module is used to write the watermarked data block in the synchronization data packet to the disaster recovery terminal when the verification result is successful, update the data of the disaster recovery terminal, and update the synchronization log chain and quantum key chain of the disaster recovery terminal based on the synchronization data packet.

[0014] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and which, when executed by a processor, implements the steps of the method described above.

[0015] This application proposes one or more technical solutions that, by introducing a quantum key distribution mechanism, establish a one-time, non-replicable quantum key channel between the source and disaster recovery ends, providing a quantum-level security foundation for the entire synchronization process. By embedding quantum signatures as watermarks into data blocks and combining semantic fingerprints and two-factor binding credentials, multi-dimensional secure binding of data from content to context is achieved. Finally, by constructing a dual-chain structure where the synchronization log chain and the quantum key chain are mutually anchored, every data change is ensured to be traceable and tamper-proof, forming a complete technical closed loop from key generation, data protection, secure transmission to trusted verification. This effectively solves the problems of critical key leakage, man-in-the-middle attacks, and difficulty in trusted verification of data consistency faced in existing disaster recovery data transmission processes, significantly improving the security and reliability of the data synchronization process, and is particularly suitable for scenarios with extremely high data security requirements. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating an embodiment of the disaster recovery data synchronization verification method based on quantum key distribution in this application. Figure 2This is a schematic diagram of the module structure of the disaster recovery data synchronization verification device based on quantum key distribution according to an embodiment of this application.

[0019] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0020] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0021] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0022] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device capable of performing the above functions, such as a disaster recovery data synchronization verification device based on quantum key distribution. The following description uses a disaster recovery data synchronization verification device based on quantum key distribution as an example to illustrate this embodiment and the subsequent embodiments.

[0023] Based on this, embodiments of this application provide a disaster recovery data synchronization verification method based on quantum key distribution, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the disaster recovery data synchronization verification method based on quantum key distribution of this application.

[0024] In this embodiment, the disaster recovery data synchronization verification method based on quantum key distribution is applied to a disaster recovery system including a source end and a disaster recovery end. A quantum key distribution channel and a classical communication channel are deployed between the source end and the disaster recovery end. The method includes steps S10 to S60: Step S10: Establish an initial quantum session key shared by the source and the disaster recovery end through the quantum key distribution channel, and generate a byte offset table based on the initial quantum session key.

[0025] It should be noted that in this embodiment, the disaster recovery system includes a source end and a disaster recovery end. The source end is the origin of the original data generation and storage, responsible for initiating data synchronization operations. The disaster recovery end is a backup endpoint used to provide data recovery and business continuity assurance when the source end fails or data is lost. A quantum key distribution channel and a classical communication channel are deployed between the source end and the disaster recovery end. The quantum key distribution channel is used to securely distribute quantum keys between the source end and the disaster recovery end. These keys have the characteristics of being one-time use and non-replicable, providing quantum-level security for the data synchronization process. The classical communication channel is used to transmit other data and instructions besides quantum keys, such as synchronization data packets and verification results.

[0026] Understandably, the initial quantum session key established by the quantum key distribution channel is for one-time use. A new initial quantum session key is generated for each data synchronization process to ensure key security and unpredictability. Furthermore, the initial quantum session key is shared between the source and recovery ends, meaning that both possess the same initial quantum session key, enabling subsequent encryption and decryption operations. Based on the initial quantum session key, a byte offset table is further generated. This table is used to determine the embedding position of the quantum signature value within the quantum fingerprint data block, ensuring the accuracy and uniqueness of the signature embedding.

[0027] In the specific implementation, the source and disaster recovery ends execute a quantum key distribution process based on the BB84 or E91 protocol through a quantum key distribution channel. After successfully generating the initial quantum session key, both parties process the key using a specific hash function and combine it with the preset offset calculation rules to generate a byte offset table. Each offset in the offset table corresponds to a specific byte position in the quantum fingerprint data block, which is used to accurately embed the quantum signature value into the specified position in the future.

[0028] In one feasible implementation, step S10 may include: negotiating and distributing quantum keys between the source and the disaster recovery end through the quantum key distribution channel to generate an original quantum bit string; performing quantum error correction and privacy amplification processing on the original quantum bit string to generate an initial quantum session key; inputting the initial quantum session key into a key derivation function based on a cryptographic hash function to generate an extended key stream; defining a two-dimensional array structure with a preset number of rows and columns, and using the two-dimensional array structure as a byte offset table framework; initializing a pseudo-random number generator using the extended key stream as a random seed, and generating a random offset within a preset maximum value range for each unit of the byte offset table through the pseudo-random number generator; embedding the random offset into the corresponding unit of the byte offset table framework to obtain the byte offset table.

[0029] It should be noted that in this embodiment, the source and disaster recovery ends execute a quantum key distribution process based on the decoy state BB84 protocol through a quantum key distribution channel to generate an original qubit string. This original qubit string is a raw quantum information sequence without any processing, and may contain erroneous bits introduced by factors such as channel noise and detector efficiency. To ensure the accuracy and security of the key, quantum error correction and privacy amplification processing are required on the original qubit string. Quantum error correction uses specific quantum error correction codes, such as Shor's codes and Steane codes, to detect and correct erroneous bits in the original qubit string, improving the accuracy of the key. The privacy amplification process uses further mathematical transformations, such as hash functions and random extraction, to reduce the amount of information that may be obtained by eavesdroppers during the quantum key distribution process, enhancing the security of the key. After the above processing, an initial quantum session key is generated. This key has the characteristics of being one-time use and non-copyable, providing quantum-level security for subsequent data synchronization processes.

[0030] Understandably, the initial quantum session key is used as a seed and input into a SHA-3-based cryptographic security key derivation function to generate an extended key stream of a specified length. The extended key stream not only increases the complexity of the key but also provides a rich random source for the subsequent generation of the byte offset table.

[0031] Subsequently, a two-dimensional array structure with a preset number of rows and columns is defined as the byte offset table framework. The size of this framework can be adjusted according to actual needs to ensure that it can meet the embedding requirements of quantum fingerprint data blocks of different sizes. Using the extended keystream as a random seed, a cryptographically secure pseudo-random number generator, such as a pseudo-random number generator based on the Mersenne Twister algorithm or AES-CTR mode, is initialized. This pseudo-random number generator generates a random offset within a preset maximum range for each cell of the byte offset table. These random offsets will determine the specific embedding position of the quantum signature value in the quantum fingerprint data block. Finally, the calculated offset values ​​are sequentially filled into the corresponding cells of the byte offset table framework in row-major or column-major order to form a complete byte offset table.

[0032] It's worth noting that the byte offset table uses a dynamic update mechanism. When the amount of data transmitted reaches a preset threshold, or the session time exceeds a preset period, the byte offset table update process is triggered. A new initial quantum session key is negotiated through the quantum key distribution channel, and based on this new initial quantum session key, the steps for generating the byte offset table are repeated to generate a completely new byte offset table. This new byte offset table is then switched to in the next data transmission to adapt to new data synchronization requirements, ensuring the randomness and unpredictability of the data embedding position. This dynamic update mechanism effectively prevents security risks that may arise from using the same byte offset table for a long time. For example, an attacker could potentially deduce the embedding position of the quantum signature value in the quantum fingerprint data block through long-term observation and analysis, and then launch a targeted attack. By dynamically updating the byte offset table, the security of the data synchronization process is significantly enhanced, making it difficult for attackers to crack the data embedding mechanism through long-term observation and analysis.

[0033] It is worth noting that the source and disaster recovery ends use the same algorithm and seed, and can independently generate completely identical offset tables without transmitting table content over the network, thus avoiding security risks during the synchronization process.

[0034] Step S20: Obtain the data to be synchronized from the source end, divide the data to be synchronized into blocks using the quantum random thresholding algorithm and the quantum random masking algorithm to obtain quantum fingerprint data blocks and calculate the data digest.

[0035] It should be noted that in this embodiment, the data to be synchronized is the data that needs to be synchronized from the source end to the disaster recovery end. This data may include various forms such as files, database records, and configuration information. To ensure the security and integrity of the data during the synchronization process, this embodiment uses a quantum random thresholding algorithm and a quantum random masking algorithm to process the data to be synchronized into blocks. The quantum random thresholding algorithm, based on the characteristics of quantum random numbers, can generate block thresholds with high randomness and unpredictability. These thresholds are used to divide the data to be synchronized into multiple quantum fingerprint data blocks of varying sizes. Each quantum fingerprint data block contains a portion of the information of the original data, and due to the randomness of the block division process, it is difficult for attackers to infer the content of the entire original data by analyzing partial data blocks.

[0036] During the data segmentation process, a quantum random masking algorithm is applied to each quantum fingerprint data block to generate a unique quantum random mask. This mask, combined with the content of the data block, creates an encryption effect, further enhancing data security. The mask generation is also based on quantum random numbers, ensuring its unpredictability and uniqueness.

[0037] After completing the segmentation and masking processes, this embodiment also calculates a data digest for each quantum fingerprint data block. The data digest is a hash representation of the data block's content, possessing uniqueness and irreversibility. By calculating the data digest, the integrity of the data block can be verified in subsequent steps, ensuring that the data has not been tampered with or corrupted during transmission.

[0038] In the specific implementation, the source end first reads the data to be synchronized and generates a series of random block thresholds based on block parameters (such as maximum block size, minimum block size, etc.) and a quantum random thresholding algorithm. Then, the data to be synchronized is divided into multiple quantum fingerprint data blocks according to these thresholds. For each data block, the source end uses a quantum random masking algorithm to generate a corresponding quantum random mask and XORs it with the data block content to obtain an encrypted data block. Finally, the source end calculates a data digest for each encrypted data block and stores the digest information along with the data block for later use.

[0039] In one feasible implementation, step S20 may include: deriving a mask key based on the initial quantum session key, and using the mask key as a seed, calling a quantum random number generator to generate a quantum random mask; dividing the quantum random mask into a high-bit interval and a low-bit interval, respectively used to set the upper and lower thresholds of the sliding window, and determining a dynamic threshold interval based on the upper and lower thresholds; acquiring the data to be synchronized from the source end, and performing a sliding window scan on the data to be synchronized using a rolling hash to obtain a rolling hash value; when the rolling hash value falls into the dynamic threshold interval, using the data in the current sliding window as the block boundary, and dividing the data to be synchronized according to the block boundary to obtain quantum fingerprint data blocks; calculating the quantum fingerprint of each quantum fingerprint data block, and performing aggregate hashing on the quantum fingerprint to generate a data digest.

[0040] It should be noted that the HKDF algorithm uses the initial quantum session key K_q as the input key and a fixed string mask as the salt value to output a 256-bit mask key. This mask key is the fundamental key used to generate the quantum random mask, ensuring the randomness and security of the mask generation. Using the mask key as a seed, a quantum random number generator based on a physical entropy source is invoked to generate a 128-bit quantum random mask. This mask is unpredictable and cannot be copied.

[0041] The generated quantum random mask is divided into two parts: the high 64 bits are used as the high bit range and the low 64 bits are used as the low bit range. The high bit range is used to set the upper limit threshold of the sliding window, and the low bit range is used to set the lower limit threshold of the sliding window. Based on these two thresholds, a dynamic threshold range can be determined, which will be dynamically adjusted as the quantum random mask changes.

[0042] The source acquires the data to be synchronized, which can be files, database records, or any other information requiring synchronization. An 8KB sliding window is set, and a rolling hash algorithm is used to scan the data to be synchronized. The rolling hash algorithm can quickly calculate hash values ​​within the data stream without storing the entire stream. Through the sliding window scan, a series of rolling hash values ​​are obtained. When a rolling hash value falls within a dynamic threshold range, it indicates that the data within the current sliding window meets the block segmentation conditions. At this point, the data within the current sliding window is used as the block boundaries, and the data to be synchronized is segmented based on these boundaries, resulting in multiple quantum fingerprint data blocks. Each quantum fingerprint data block contains a portion of the original data, and due to the influence of quantum random masks during the segmentation process, the block boundaries exhibit high randomness and unpredictability.

[0043] For each quantum fingerprint data block, a quantum fingerprint is calculated. A quantum fingerprint is a unique representation of the data block's content, reflecting its essential characteristics. By performing aggregate hashing on the quantum fingerprints, a data digest is generated. This data digest is unique and irreversible, and can be used for subsequent data integrity verification.

[0044] Specifically, hash algorithms such as SHA-256 can be used to aggregate hash the quantum fingerprint, generating a fixed-length data digest. These data digests will be stored along with the corresponding quantum fingerprint data blocks and play a crucial role in subsequent data synchronization. By calculating the data digest, it can be ensured that the data has not been tampered with or corrupted during transmission, thereby guaranteeing the integrity and security of data synchronization. The formula for calculating the data digest is: in, For data summary, This indicates byte-level concatenation. , These represent the quantum fingerprints of quantum fingerprint data blocks 1, 2, and n, respectively.

[0045] Step S30: Perform quantum signature on the data digest based on the initial quantum session key, and embed the quantum signature value into the quantum fingerprint data block according to the byte offset table to form a watermarked data block.

[0046] It should be noted that quantum signature is a signature technology based on the principles of quantum mechanics. It utilizes the uniqueness and non-cloning properties of quantum states to ensure the authenticity and unforgeability of the signature. In this embodiment, a dedicated quantum signature key is derived from the initial quantum session key. Using this quantum signature key, combined with a specific quantum signature algorithm, such as a quantum state-based digital signature algorithm, a quantum signature operation is performed on the previously calculated data digest. The quantum signature process fully utilizes the unique properties of quantum states, making the generated signature highly secure and unforgeable. Any attempt to forge or tamper with the signature will destroy the integrity of the quantum state and can therefore be easily detected.

[0047] After the quantum signature is completed, the quantum signature value is accurately embedded into the corresponding quantum fingerprint data block according to the previously generated byte offset table. The embedding process strictly follows the position information specified by the byte offset table, ensuring that each quantum signature value is precisely placed. Due to the randomness and dynamic updating characteristics of the byte offset table, the embedding position of the quantum signature value is highly unpredictable, which greatly enhances the security of the data synchronization process. After embedding the quantum signature value, the original quantum fingerprint data block is transformed into a watermarked data block. These data blocks not only contain the information of the original data but also embed a signature value with quantum security properties, enabling the data to maintain its integrity and authenticity even when facing potential security threats during the synchronization process.

[0048] It is worth noting that quantum signatures can also employ hash-based signature schemes, the execution of which includes: using the private key in the quantum signature key as a seed, generating a sequence of one-time signature private keys through a cryptographically secure pseudo-random number generator; constructing a Merkle tree for the public keys corresponding to the one-time signature private key sequence, and using the Merkle tree root as the long-term public key commitment for this signature; dividing the data digest into several fragments, signing each fragment using the one-time signature private key of the corresponding index, generating a one-time signature set; and assembling the one-time signature set, the corresponding Merkle tree authentication path, and the long-term public key commitment together to form the quantum signature value.

[0049] In one feasible implementation, step S30 may include: deriving a quantum signature key based on the initial quantum session key; using the quantum signature key to perform a signature operation on the data digest based on a quantum-resistant digital signature algorithm to generate a quantum signature value; compressing and encoding the quantum signature value to generate a compact signature code; querying the byte offset table according to the sequence number of the quantum fingerprint data block to determine the corresponding embedding start position; starting from the embedding start position, embedding the compact signature code into the quantum fingerprint data block in a lossless replacement or superposition manner to generate a watermarked original data block; calculating the cryptographic hash value of the watermarked original data block as a watermarked integrity check code; and combining and encapsulating the watermarked original data block with the watermarked integrity check code to obtain a watermarked data block.

[0050] It should be noted that, based on the initial quantum session key, a dedicated quantum signature key can be derived using a specific key derivation function, such as the HKDF algorithm. This process ensures the secure association between the quantum signature key and the initial quantum session key, while enhancing the independence and security of the signature key.

[0051] Quantum-resistant digital signature algorithms are signature mechanisms specifically designed to resist quantum computing attacks. They do not rely on the difficulty of traditional mathematical problems, but rather utilize principles of quantum mechanics, such as the no-cloning and measurement collapse properties of quantum states, to ensure the security and unforgeability of the signature. In this embodiment, a specific quantum-resistant digital signature algorithm, such as a lattice-based signature algorithm or a hash-based signature algorithm, is employed, using a derived quantum signature key to perform signature operations on the data digest. These algorithms exhibit high security in a quantum computing environment, effectively preventing signature forgery or tampering even in the face of the powerful computing capabilities of quantum computers. The signature operation involves complex quantum state operations and mathematical transformations, ultimately generating a quantum signature value tightly bound to the data digest. This signature value is unique and inseparable, uniquely identifying the authenticity and integrity of the original data digest. The formula for calculating the quantum signature value is: S = Sign(SK_q, H_data) Where S represents the quantum signature value, Sign represents the signature function of the quantum-resistant digital signature algorithm, SK_q represents the quantum signature key, and H_data represents the data digest.

[0052] After generating the quantum signature value, it needs to be compressed and encoded to improve transmission efficiency and storage space utilization. Using specific compression algorithms, such as Huffman coding or arithmetic coding, the quantum signature value is converted into a compact signature code. This compact signature code significantly reduces the data size while retaining key signature information. Subsequently, the corresponding embedding start position is looked up in the byte offset table based on the sequence number of the quantum fingerprint data block. The byte offset table, through the dynamically generated and updated mechanism described earlier, assigns a unique and highly random embedding position to each quantum fingerprint data block, ensuring the security and unpredictability of the signature embedding process. The lookup process uses the data block's sequence number as an index to quickly locate the corresponding entry in the byte offset table, thereby obtaining the precise embedding start byte position.

[0053] Starting from a determined embedding position, a compact signature code is embedded into the quantum fingerprint data block using either lossless replacement or superposition. Lossless replacement means directly replacing the corresponding length of original data in the data block with the compact signature code, while superposition involves adding the signature information onto the data using specific encoding techniques without damaging the original data, ensuring that the integrity and readability of the data block are not affected. The specific method used depends on the content characteristics and security requirements of the data block. After the embedding operation is completed, the original quantum fingerprint data block is transformed into a watermarked original data block. These data blocks retain all the information of the original data while embedding signature information with quantum security properties.

[0054] To ensure the integrity and authenticity of watermarked data blocks are not tampered with during transmission, their cryptographic hash value must be calculated as a post-watermark integrity verification code. This step utilizes the one-wayness and collision resistance of hash functions to perform a hash operation on the original watermarked data block, generating a fixed-length hash value. This hash value acts like a digital fingerprint of the data block; any minor alteration to the data block will result in a significant change in the hash value, thus enabling timely detection and prevention of data tampering.

[0055] The original watermarked data block is combined with a watermarked integrity checksum to form the final watermarked data block. The encapsulation process may involve data format conversion, encryption (if further security enhancement is needed), and the addition of necessary metadata (such as timestamps and version information) to ensure the data block can be correctly identified and processed during subsequent synchronization, storage, and verification. After encapsulation, the watermarked data block possesses a high level of security and integrity, enabling secure transmission to the disaster recovery endpoint for synchronized storage.

[0056] Step S40: Perform semantic hashing on the quantum fingerprint data block to generate a semantic fingerprint, and generate a two-factor binding credential based on the semantic fingerprint, the initial quantum session key, the current synchronization token value, and the static device key.

[0057] It should be noted that semantic fingerprints are unique identifiers generated after deep semantic analysis and feature extraction of quantum fingerprint data blocks. They can reflect the core content and meaning of the data block at the semantic level. Unlike traditional hash values ​​based on data surface features, semantic fingerprints focus more on the semantic information contained in the data. This means that even if two data blocks differ at the byte level, they can generate similar semantic fingerprints as long as they are semantically similar.

[0058] After generating the semantic fingerprint, a two-factor binding credential is generated using the initial quantum session key, the current synchronization token value, and the static device key through a specific algorithm and encryption mechanism. The initial quantum session key provides a quantum-safe foundation for the entire process, ensuring the randomness and unpredictability of the key; the current synchronization token value reflects the uniqueness and timeliness of the current synchronization operation, preventing security threats such as replay attacks; and the static device key is associated with a specific device, establishing a fixed binding relationship between the data block and the device.

[0059] The semantic fingerprint, the pre-synchronization token value, and the device identity signature are concatenated into an intermediate data structure. A hash operation is performed on this intermediate data structure to generate a fixed-length hash value. This hash value is the two-factor binding credential, which is unique and unforgeable. It can effectively bind the quantum fingerprint data block to a specific device, synchronization operation, and quantum-secure environment.

[0060] Two-factor authentication credentials play a crucial role in subsequent data synchronization and verification processes. During data synchronization, the disaster recovery system can verify the legitimacy and integrity of received quantum fingerprint data blocks by checking the two-factor authentication credentials, ensuring that the data originates from a legitimate source and has not been tampered with during transmission. Simultaneously, two-factor authentication credentials can also be used for device authentication and access control; only devices with the correct credentials can perform data synchronization operations, thereby further enhancing system security.

[0061] In one feasible implementation, step S40 may include: extracting morphological features from the quantum fingerprint data block based on topological data analysis to obtain a topological feature vector; extracting structural features from the quantum fingerprint data block based on hypergraph construction and learning to obtain a graph-level embedding vector; performing local sensitive hashing calculation based on the topological feature vector and the graph-level embedding vector to generate a semantic fingerprint; generating a current synchronization token value based on the current timestamp and the initial quantum session key using a message authentication code algorithm; digitally signing the semantic fingerprint based on the source's static device key to generate a device identity signature; concatenating the semantic fingerprint, the previous synchronization token value, and the device identity signature, and encrypting the concatenated data using the initial quantum session key to generate a two-factor binding credential.

[0062] It should be noted that morphological feature extraction based on topological data analysis is an effective method for mining the inherent morphological and structural features of quantum fingerprint data blocks. It extracts key information reflecting the morphological characteristics of the data blocks by performing topological transformations and analyses, and represents this information as a topological feature vector. This feature extraction method does not depend on the specific form of the data, but focuses on the inherent connections and structural relationships between the data, thus exhibiting stronger robustness and generalization ability.

[0063] Morphological feature extraction based on topological data analysis specifically includes: mapping the byte sequence of each quantum fingerprint data block to a set of points in a high-dimensional space or a time series through a sliding window mean; applying persistent cohomology techniques from topological data analysis to this high-dimensional point set or time series. This technique can capture the topological features of the data at multiple scales, such as the number and lifetime of "holes" and "connected components." The results of persistent cohomology analysis are encoded into one or more persistent graphs, which record the "birth" and "death" scales of these topological features in the form of a two-dimensional scatter plot. The persistent graphs are then transformed into a fixed-length, numerical topological feature vector using persistent graph vectorization techniques, such as Betti curves and persistent landscapes.

[0064] The structural feature extraction based on hypergraph construction and learning specifically includes: parsing quantum fingerprint data blocks into multiple basic units, such as specific patterns in binary sequences, tokens in code, or keywords in text. A hypergraph structure is constructed, where nodes are the basic units, and a hyperedge can connect multiple nodes to represent the complex relationships between them. A hypergraph neural network combined with an attention mechanism is used to process this structure. The model learns the importance of each node and each hyperedge. Through graph pooling operations, the information from the entire hypergraph is aggregated into a unified graph-level embedding vector.

[0065] Understandably, Locality Sensitive Hashing (LSH) maps similar data points to the same or nearby hash buckets, thus preserving the similarity between data. In generating semantic fingerprints, LSH calculations based on topological feature vectors and graph-level embedding vectors can effectively fuse the morphological and structural features of data blocks into a compact semantic fingerprint. This fingerprint not only possesses high uniqueness but also reflects the semantic similarity between data blocks to a certain extent.

[0066] The current timestamp, as a carrier of time information, provides uniqueness in the time dimension for synchronization operations. Combined with the initial quantum session key, the current synchronization token value generated through the message authentication code algorithm not only ensures the timeliness of synchronization operations but also enhances its resistance to replay attacks. This token value is dynamically generated during each synchronization, making each synchronization operation independent and uncopyable. The current synchronization token value is a unique identifier for the current synchronization cycle, and its generation process strictly relies on both the current timestamp and the initial quantum session key, ensuring the randomness and unpredictability of the token value. In the data synchronization process, the disaster recovery end can effectively identify and reject any replay or delayed synchronization requests by verifying the current synchronization token value, thereby ensuring the security and timeliness of the data synchronization process. The formula for calculating the current synchronization token value is: T = MAC(K_q, T_current) Where T represents the current synchronization token value, MAC represents the message authentication code algorithm, K_q represents the initial quantum session key, and T_current represents the current timestamp.

[0067] Digitally signing semantic fingerprints using static device keys from the source device is a crucial step in ensuring device authenticity and data integrity. The static device key, serving as a unique identifier for the device, is combined with the semantic fingerprint to generate a device identity signature using a digital signature algorithm. This signing process leverages the advantages of asymmetric encryption, using a private key for signing and a public key for verification, thus ensuring the signature's unforgeability and ease of verification. During subsequent data synchronization and verification, the disaster recovery system can verify this device identity signature to confirm the authenticity of the data block's originating device, preventing unauthorized device access and data tampering. Simultaneously, this digital signature mechanism provides a reliable basis for data integrity verification; if data is tampered with during transmission, its corresponding device identity signature will fail verification.

[0068] By concatenating the semantic fingerprint, the pre-synchronization token value, and the device identity signature, and then encrypting the concatenated data using the initial quantum session key to generate a two-factor binding credential, data security is further enhanced. The randomness and unpredictability of the initial quantum session key make the encrypted two-factor binding credential difficult to crack and forge. This encryption method ensures that only legitimate devices possessing the correct initial quantum session key can generate valid two-factor binding credentials, thereby safeguarding system security during data synchronization and verification.

[0069] During data synchronization, the disaster recovery terminal receives a watermarked data block and its corresponding two-factor binding credential. It first decrypts and verifies the two-factor binding credential. Verifying the device identity signature in the credential confirms the legitimacy of the data block's originating device; verifying the current synchronization token value ensures the timeliness of the synchronization operation and prevents replay attacks; and combining this with semantic fingerprints and other information confirms that the data block has not been tampered with during transmission, guaranteeing data integrity. Only when all verifications pass will the disaster recovery terminal synchronize and store the watermarked data block; otherwise, it will reject the synchronization request and issue a security alert.

[0070] Step S50: Construct a synchronization data packet based on the watermarked data block, the semantic fingerprint, the two-factor binding credential, the end node value of the synchronization log chain of the previous synchronization period, and the end node value of the quantum key chain, and send the constructed synchronization data packet to the disaster recovery terminal for verification through the classical communication channel to obtain the verification result.

[0071] It's important to note that the tail node value of the synchronization log chain from the previous synchronization cycle records key information about the data synchronization operations within that cycle, including the synchronized data block identifier, synchronization timestamp, and synchronization operation results. It provides a traceable historical reference point for the current synchronization cycle. By introducing the tail node value of the synchronization log chain from the previous cycle, a more comprehensive check of data continuity and consistency can be performed during data synchronization verification. For example, the changes between the currently synchronized data and the synchronized data from the previous cycle can be compared to determine if any abnormal data modifications or loss have occurred.

[0072] The tail node value of the quantum key chain from the previous synchronization cycle records information about the quantum key used in that cycle, such as the key generation time and its usage status. As a core element ensuring secure data transmission, the state and historical usage of the quantum key are crucial for assessing the security of the current synchronization cycle. By introducing the tail node value of the quantum key chain from the previous synchronization cycle, it is possible to verify whether the quantum key used in the current synchronization process matches the historical records, and whether there has been any unauthorized acquisition or reuse of the key, thereby further ensuring the security of the data synchronization process.

[0073] When constructing the synchronization data packet, watermarked data blocks, semantic fingerprints, two-factor binding credentials, the tail node value of the synchronization log chain from the previous synchronization cycle, and the tail node value of the quantum key chain are organically integrated to form a complete data packet containing rich security information. This data packet not only contains the data itself, but also various credentials and historical records used to verify the data's legitimacy, integrity, and security.

[0074] After the constructed synchronization data packet is sent to the disaster recovery terminal via a classic communication channel, the terminal will perform a comprehensive verification of the data packet according to a predetermined verification process. This verification process includes decryption and verification of the two-factor binding credential, confirmation of the device identity signature, checking the timeliness of the current synchronization token value, verifying semantic fingerprint matching, and conducting traceability checks on the tail node values ​​of the synchronization log chain and quantum key chain from the previous synchronization cycle. Only when all verification steps pass will the disaster recovery terminal consider the synchronization data packet legitimate and secure, and issue a corresponding verification result; otherwise, it will reject the data packet and issue a security alert to ensure the security and reliability of the entire data synchronization process.

[0075] It is worth noting that classical communication channels utilize traditional physical media such as electromagnetic waves and optical fibers to transmit information. In the disaster recovery data synchronization verification method involved in this invention, the classical communication channel plays a crucial role in securely and stably transmitting the constructed synchronization data packets from the source to the disaster recovery end. Although classical communication channels may have certain limitations in terms of transmission speed and bandwidth, they possess advantages such as mature technology, relatively low cost, and wide coverage, meeting the needs of most disaster recovery data synchronization scenarios. Furthermore, to ensure the security of the synchronization data packets during transmission, advanced technologies such as quantum key distribution are incorporated to encrypt the transmitted data, effectively preventing data theft or tampering during transmission. Through the organic combination of classical communication channels and quantum security technology, both high efficiency and security are achieved in the disaster recovery data synchronization process.

[0076] In one feasible implementation, step S50 may include: obtaining the tail node value of the synchronization log chain and the tail node value of the quantum key chain from the previous synchronization period, and generating a globally unique timestamp and a monotonically increasing sequence number for the synchronization data packet; combining the watermarked data block, semantic fingerprint, two-factor binding credential, tail node value of the synchronization log chain and the tail node value of the quantum key chain from the previous synchronization period, the timestamp, and the sequence number into an original packet body; performing a cryptographic hash operation on the original packet body to obtain a packet body hash value; generating a signature random number based on the temporary signature key derived from the initial quantum session key and the packet body hash value; performing a digital signature using an elliptic curve digital signature algorithm based on the packet body hash value, the temporary signature key, and the signature random number to generate a packet body signature value; assembling the original packet body, the packet body hash value, and the packet body signature value together into a synchronization data packet, and sending the synchronization data packet to the disaster recovery end through the classical communication channel for verification to obtain a verification result.

[0077] It should be noted that the synchronization log chain tail node value H_prev and the quantum key chain tail node value K_id_prev of the previous synchronization cycle are read from the local secure storage of the source.

[0078] Understandably, after obtaining these two tail node values, a globally unique timestamp and a monotonically increasing sequence number are generated for the synchronization data packet. The current Coordinated Universal Time (UTC) is obtained from the network time protocol client or high-precision hardware clock deployed at the source end, and appended with the device identifier of the source device to generate an initial timestamp. This initial timestamp is concatenated with a locally maintained monotonically increasing counter value for the previous data packet's timestamp, and the concatenation result is cryptographically hashed to generate the final globally unique timestamp. The previous sequence number status value maintained by the current data stream is read from the source end's non-volatile memory; in the source end's memory, the previous sequence number status value is atomically incremented by a fixed step to obtain a new sequence number candidate value; this new sequence number candidate value is written to the non-volatile memory, the sequence number status is updated, and it is officially assigned as the monotonically increasing sequence number of the current data packet.

[0079] After generating a globally unique timestamp and a monotonically increasing sequence number, the watermarked data block, semantic fingerprint, two-factor binding credential, the tail node value of the synchronization log chain from the previous synchronization cycle, the tail node value of the quantum key chain, the generated globally unique timestamp, and the monotonically increasing sequence number are combined into the original packet body. This combination process needs to ensure the accurate placement and orderly arrangement of each element for subsequent cryptographic processing. Cryptographic hashing is performed on the original packet body using a suitable hash algorithm, such as SHA-256. Through a series of complex mathematical operations on the original packet body, a fixed-length packet body hash value is obtained. This hash value is unique and irreversible, accurately representing the content characteristics of the original packet body and providing a reliable foundation for subsequent digital signatures.

[0080] Based on the initial quantum session key, a one-time temporary signature key pair is derived through a key derivation function. Using the private key from the temporary signature key pair, the packet body hash value is digitally signed. A deterministic digital signature algorithm is then used to generate the required signature random number. The signature random number is a crucial parameter in the digital signature process, ensuring the uniqueness and unpredictability of each signature operation. Specifically, this includes: deriving a message authentication code key from the temporary signature private key to generate the random number; performing a message authentication code operation on the packet body hash value using the message authentication code key; and using the output as the signature random number.

[0081] Elliptic Curve Digital Signature Algorithm (ECD) is an advanced signature algorithm based on elliptic curve cryptography, offering high security and efficiency. This algorithm uses the packet body hash value, a temporary signing key, and a signature random number as input to generate the original signature point coordinates. These coordinates are then encoded into a standardized byte sequence to generate the final packet body signature value, which uniquely identifies the origin and integrity of the original packet body. Specifically, the process involves: performing a scalar multiplication of the base point of the elliptic curve with the signature random number to obtain the x-coordinate of the point; performing a modulo operation to obtain the first signature component; performing modular inverse and modular multiplication operations on the temporary signing key, the first signature component, the packet body hash value, and the signature random number to obtain the second signature component; the first and second signature components constitute the signature point coordinates; and combining them according to a predetermined encoding rule into a standardized byte sequence, which is the final packet body signature value. The first and second signature components are expressed as follows: Where r is the first signature component, s is the second signature component, k is the signature random number, G is the base point of the elliptic curve, n is the order of the base point G, H(m) is the packet body hash value, and d is the temporary signature private key.

[0082] The original packet body, packet body hash value, and packet body signature value are assembled into a synchronization data packet. This synchronization data packet contains rich security information, including the data itself, a hash value used to verify data integrity, and a signature value used to verify the data source and integrity. The assembled synchronization data packet is sent to the disaster recovery terminal for verification via a classic communication channel. After receiving the synchronization data packet, the disaster recovery terminal will perform a comprehensive verification of the data packet according to a predetermined verification process, including verification of packet body hash value matching and verification of packet body signature value. Only when all verification steps pass will the corresponding verification result be given.

[0083] Step S60: When the verification result is successful, write the watermarked data block in the synchronization data packet to the disaster recovery terminal, update the data of the disaster recovery terminal, and update the synchronization log chain and quantum key chain of the disaster recovery terminal based on the synchronization data packet.

[0084] It should be noted that once the disaster recovery system passes verification—that is, after confirming the legality and security of the synchronization data packets—it will initiate the data writing process to accurately write the watermarked data blocks from the synchronization data packets into the disaster recovery system's storage system. This write operation involves not only the physical storage of the data but also the rational planning of the data storage structure to ensure efficient data access and management.

[0085] With the successful writing of the watermarked data block, the data status of the disaster recovery terminal was updated, maintaining consistency with the data at the source terminal. However, this process is not yet complete. To ensure the continuity and traceability of subsequent data synchronization, the disaster recovery terminal also needs to synchronize and update its internal synchronization log chain and quantum key chain based on the relevant information in the synchronization data packet.

[0086] When synchronizing and updating the synchronization log chain and quantum key chain, the disaster recovery terminal parses the synchronization data packet containing the tail node values ​​of the synchronization log chain and quantum key chain from the previous synchronization cycle, as well as information such as new data identifiers, timestamps, and operation results generated during the current synchronization process. This information is then added sequentially to the corresponding positions in the synchronization log chain and quantum key chain according to a predetermined data structure, achieving dynamic extension of the chain structure. In this way, the synchronization log chain can completely record the key details of each data synchronization operation, including the synchronized data content, synchronization time, and operator or device identifiers, providing strong support for data auditing and fault diagnosis. Meanwhile, the quantum key chain can accurately track the entire lifecycle information of quantum keys, including generation, distribution, use, and destruction, ensuring the security and compliance of key management. During the update of the synchronization log chain and quantum key chain, the disaster recovery terminal also encrypts and controls access to the newly added node information to prevent unauthorized access and tampering, further ensuring data security and integrity.

[0087] This embodiment provides a disaster recovery data synchronization verification method based on quantum key distribution. By introducing a quantum key distribution mechanism, a one-time, non-replicable quantum key channel is established between the source and the disaster recovery end, providing a quantum-level security foundation for the entire synchronization process. By embedding quantum signatures into data blocks as watermarks and combining semantic fingerprints and two-factor binding credentials, multi-dimensional secure binding of data from content to context is achieved. Finally, by constructing a dual-chain structure where the synchronization log chain and the quantum key chain are mutually anchored, every data change is ensured to be traceable and tamper-proof, forming a complete technical closed loop from key generation, data protection, secure transmission to trusted verification. This effectively solves the problems of key key leakage, man-in-the-middle attacks, and difficulty in trusted verification of data consistency faced in existing disaster recovery data transmission processes, significantly improving the security and reliability of the data synchronization process, and is especially suitable for scenarios with extremely high data security requirements.

[0088] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in the first embodiment described above can be referred to the above description and will not be repeated hereafter. Based on this, step S50 includes steps S601 to S605: Step S601: When the verification result is successful, the watermarked data block in the synchronization data packet is written to the corresponding storage location of the disaster recovery terminal according to the preset data writing rules, and the data of the disaster recovery terminal is updated.

[0089] It's important to note that pre-defined data write rules are crucial for ensuring that watermarked data blocks are accurately and efficiently written to the corresponding storage location at the disaster recovery endpoint. These rules are typically carefully designed based on factors such as the disaster recovery endpoint's storage architecture, data organization, and business requirements. During the write process, the disaster recovery endpoint first parses the watermarked data block, extracting key information such as data identifiers and storage paths. Then, based on this information, the disaster recovery endpoint locates the corresponding storage location within its storage system. Next, the disaster recovery endpoint writes the watermarked data block to the designated storage location according to a pre-defined write strategy, such as overwrite or append write. After the write is complete, the disaster recovery endpoint also verifies the write result to ensure that the data is stored completely and accurately in the appropriate location. By adhering to pre-defined data write rules, the disaster recovery endpoint can achieve efficient and reliable writing of watermarked data blocks, thereby updating their internal data state and ensuring consistency with the source data.

[0090] Step S602: After the data update is completed, calculate the first current hash value of the current synchronization period.

[0091] It should be noted that after the data update is completed, the first current hash value of the current synchronization period is calculated as Hcurr = Hash(all newly written data blocks), where Hcurr represents the first current hash value, Hash represents the hash function, and all newly written data blocks are the set of watermarked data blocks successfully written to the disaster recovery storage system within this synchronization period. This hash value is a digital summary of the disaster recovery data status during the current synchronization period; it uniquely represents the characteristics of the disaster recovery data at this time using a fixed-length byte sequence. By calculating this hash value, important reference information can be provided for subsequent data verification and synchronization status tracking, ensuring that it is possible to accurately identify whether the data has changed and the extent of the change during the data synchronization process.

[0092] Step S603: Cross-hash the first current hash value with the synchronization log chain tail node value and quantum key chain tail node value of the previous synchronization period in the synchronization data packet to generate a new synchronization log chain node and a new quantum key chain node.

[0093] It should be noted that cross-hashing is a technique that merges data from multiple different sources using a hash function to generate a comprehensive hash value. In this embodiment, the first current hash value is cross-hashed with the tail node value of the synchronization log chain and the tail node value of the quantum key chain from the previous synchronization period in the synchronization data packet. The purpose is to deeply integrate the data state information of the current synchronization period with the tail information of the chain structure from the previous period.

[0094] Specifically, a suitable hash function is selected, and the current hash value, the tail node value of the synchronization log chain from the previous synchronization cycle, and the tail node value of the quantum key chain are used as input parameters. Through the hash function's calculation, a completely new hash value is generated. This new hash value serves two purposes: firstly, as the new synchronization log chain node value, it carries the data state of the current synchronization cycle and its association with the log chain of the previous cycle, accurately recording key node changes during data synchronization; secondly, as the new quantum key chain node value, it associates the use and flow of the quantum key across different synchronization cycles, ensuring the continuity and integrity of the quantum key chain. The new synchronization log chain node and the new quantum key chain node generated through this cross-hashing provide a solid foundation for the subsequent dynamic extension of the synchronization log chain and the quantum key chain, enabling the entire dual-chain structure to more accurately reflect the entire data synchronization process and the lifecycle management of the quantum key. The cross-hashing formula is: in, Represents the value of the new synchronized log chain node. This represents the value of the tail node in the synchronization log chain from the previous synchronization cycle. Represents the first current hash value. The value of the tail node of the quantum key chain representing the previous synchronization cycle. Represents the new quantum keychain node value, where Hash represents the hash function. This indicates a string concatenation operation.

[0095] The cross-hashing formula described above can accurately generate new synchronous log chain nodes and new quantum key chain nodes, ensuring the accuracy and integrity of the dual-chain structure.

[0096] Step S604: The new synchronization log chain node and the new quantum key chain node are confirmed bidirectionally through the quantum random challenge-response mechanism between the source end and the disaster recovery end to obtain the confirmation result.

[0097] It should be noted that the quantum random challenge-response mechanism is a highly secure authentication and communication confirmation mechanism based on the principles of quantum mechanics. In this embodiment, the source and disaster recovery ends use this mechanism to perform bidirectional confirmation of the new synchronization log chain node and the new quantum key chain node. Specifically, the source first generates a random quantum state challenge message. This quantum state challenge message has properties such as quantum non-cloning, which ensures its uniqueness and security.

[0098] The disaster recovery endpoint generates a quantum random challenge number based on the cross-anchoring value and embeds it into a synchronization confirmation message before sending it to the source endpoint. Upon receiving the synchronization confirmation message, the source endpoint extracts the quantum random challenge number and decrypts and verifies it using a pre-shared quantum key, then sends a challenge response message back to the disaster recovery endpoint. Upon receiving the challenge response message, the disaster recovery endpoint also decrypts and verifies it using the pre-shared quantum key. If both verifications pass, the new synchronization log chain node and the new quantum key chain node receive bidirectional confirmation, and the confirmation result is valid. Conversely, if either verification fails, the confirmation result is invalid, and the relevant operations need to be repeated to ensure the accuracy and security of data synchronization. This quantum random challenge-response mechanism fully utilizes the properties of quantum mechanics, providing extremely high security for node confirmation during data synchronization and effectively resisting security threats such as man-in-the-middle attacks and eavesdropping that may occur in traditional communication.

[0099] Because the quantum random challenge-response mechanism is based on the principles of quantum mechanics, its unique quantum state characteristics ensure that any attempt to eavesdrop on or tamper with the challenge information will be immediately detected, thus guaranteeing a high level of security in the two-way confirmation process of the new synchronization log chain node and the new quantum key chain node. This mechanism ensures that the newly generated synchronization log chain node and quantum key chain node are authentic, reliable, and tamper-proof during data synchronization, further enhancing the credibility of the entire data synchronization verification system.

[0100] In one feasible implementation, step S604 may include: generating a quantum random challenge number based on the cross-anchoring value of the new synchronization log chain node and the new quantum key chain node; constructing a synchronization confirmation message based on the quantum random challenge number, the new synchronization log chain node, the new quantum key chain node, and the current synchronization sequence number; sending the synchronization confirmation message to the source end for confirmation through the classical communication channel, and signing the quantum random challenge number to generate a challenge response signature upon successful confirmation; constructing a challenge response message based on the challenge response signature and the response verification code, and returning the challenge response message to the disaster recovery end for confirmation through the classical communication channel to obtain a confirmation result.

[0101] It should be noted that the disaster recovery terminal calculates the new synchronized log chain nodes locally. With new quantum keychain nodes Then, a cross-anchor hash operation is performed on it to generate a unique and unpredictable context binding value, i.e., the cross-anchor value, as follows: Where A represents the cross anchorage value, This represents a cryptographically secure hash function, such as SHA3-256 or BLAKE3. This represents a string concatenation operation, which can be reused. To enhance asymmetry and prevent swap attacks, the formula generates a unique value closely related to the states of both the new synchronized log chain node and the new quantum key chain node by performing a hash operation on them.

[0102] Understandably, the disaster recovery unit utilizes a locally integrated quantum random number generator, which can exist independently or reuse the true random source from the quantum key distribution channel. To enhance the unpredictability of the challenge and bind it to the current context, the challenge number is generated in the following manner: in, Representing quantum random challenge numbers, QRNGseeded indicates a quantum random number generator based on seed A.

[0103] The quantum random challenge numbers generated in this way not only possess the true randomness endowed by quantum random number generators, but also have contextual relevance due to their binding with the cross-anchor value A, greatly enhancing the unpredictability and security of the challenge.

[0104] The disaster recovery end embeds the generated quantum random challenge number Ch into the synchronization confirmation message. This message, in addition to the quantum random challenge number, also contains key information such as the new synchronization log chain node, the new quantum key chain node, and the current synchronization sequence number, and can be encoded using structured formats such as TLV or Protocol Buffers. This information together constitutes a complete and secure synchronization confirmation message body, used to convey the status of the new node within the current synchronization cycle and the confirmation request to the source end.

[0105] After receiving the synchronization confirmation message, the source end will perform timing verification, sequence number verification, node consistency verification, and cross-anchor value reconstruction. Cross-anchor value reconstruction means that the source end uses the same formula to reconstruct the cross-anchor value and verify that it is consistent with the challenge generation context.

[0106] If all verifications pass, the initial quantum session key at the source end derives a challenge-response signature key. Based on this key, a quantum-resistant digital signature algorithm is used to sign the challenge number Ch, generating a challenge-response signature to prove that the response message indeed originated from a legitimate source. To further prevent man-in-the-middle tampering with the response message, a response verification can be introduced. This verification code is calculated by the source end and appended to the response message, allowing the disaster recovery end to quickly verify message integrity and initially filter forged packets without requiring full signature verification.

[0107] The source end constructs a challenge-response message based on the challenge-response signature and response verification code, using structured formats such as TLV or Protocol Buffers, and returns the message to the disaster recovery end through a classic communication channel.

[0108] Upon receiving the challenge-response message, the disaster recovery terminal performs further verification. First, it performs integrity verification by checking if the response verification code matches the expected value to preliminarily determine if the message has been tampered with. If the response verification code passes, it proceeds to signature verification. The disaster recovery terminal uses a verification key derived from a pre-shared quantum key chain and employs the same quantum-resistant digital signature algorithm as the source terminal to verify the challenge-response signature. If the signature verification also passes, it indicates that the challenge-response message is authentic and reliable, and both the new synchronization log chain node and the new quantum key chain node have received bidirectional confirmation, indicating the confirmation result is valid.

[0109] If any of the above verification steps fail, such as timing verification failure, sequence number mismatch, inconsistent node states, cross-anchor value reconstruction anomaly, integrity verification error, or signature verification failure, the disaster recovery terminal will immediately terminate the current confirmation process and return a failure response containing the specific error type to the source terminal. Upon receiving the failure response, the source terminal will trigger the corresponding fault tolerance mechanism based on the error type: if it is a temporary communication failure (such as network jitter), it will automatically retransmit the synchronization confirmation message; if it is a critical error such as inconsistent node states or mismatched cross-anchor values, it will initiate a data rollback procedure to restore the disaster recovery terminal data to the state of the previous valid synchronization cycle and re-execute the entire process from data update to two-way confirmation.

[0110] Step S605: When the confirmation result is passed, the new synchronization log chain node is appended to the end of the synchronization log chain of the disaster recovery terminal, and the new quantum key chain node is appended to the end of the quantum key chain of the disaster recovery terminal.

[0111] It should be noted that when the confirmation result is successful, it indicates that the new synchronization log chain node and the new quantum key chain node have undergone a rigorous two-way confirmation process, effectively ensuring their authenticity and integrity. At this point, the new synchronization log chain node is appended to the end of the synchronization log chain at the disaster recovery end. This operation allows the synchronization log chain to record the status information of each key node sequentially according to time order and synchronization cycle, forming a complete and continuous log record chain. In this way, every step and change in the data synchronization process can be clearly traced, providing important evidence for subsequent data auditing, fault diagnosis, and data recovery operations.

[0112] Similarly, appending new quantum keychain nodes to the tail of the faulty keychain ensures the continuity and integrity of the quantum keychain. The quantum keychain records the usage and flow of quantum keys across different synchronization cycles; the addition of each new node signifies the start or end of a new phase in the quantum key's lifecycle. This continuous recording method facilitates effective management and monitoring of quantum key usage, preventing leakage or misuse and ensuring the security of the quantum key distribution system.

[0113] During the process of adding new nodes, the disaster recovery system updates the synchronization log chain and quantum key chain accordingly, including updating the chain length and the tail node pointer, to ensure the correctness and consistency of the chain structure. Simultaneously, the disaster recovery system synchronizes these updates to the local storage system, enabling rapid reading and querying of the relevant chain structure information when needed. Through this operation of adding new nodes to the tail of the chain, the entire dual-chain structure can dynamically extend and expand, accurately reflecting the entire data synchronization process and the lifecycle management of the quantum key.

[0114] In this embodiment, by generating new synchronization log chain nodes and new quantum key chain nodes through cross-hashing, performing bidirectional confirmation using a quantum random challenge-response mechanism, and then appending the confirmed new nodes to the end of the chain, it is ensured that only the synchronization state confirmed cryptographically by both parties can be persisted, thereby guaranteeing the integrity and trustworthiness of the dual-chain structure.

[0115] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the disaster recovery data synchronization verification method based on quantum key distribution in this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0116] This application also provides a disaster recovery data synchronization verification device based on quantum key distribution. Please refer to [link / reference]. Figure 2 The disaster recovery data synchronization and verification device based on quantum key distribution includes: The generation module 10 is used to establish an initial quantum session key shared by the source and the disaster recovery end through the quantum key distribution channel, and to generate a byte offset table based on the initial quantum session key.

[0117] The segmentation module 20 is used to acquire the data to be synchronized from the source end, segment the data to be synchronized into blocks using the quantum random threshold segmentation algorithm and the quantum random masking algorithm, obtain quantum fingerprint data blocks, and calculate data digests.

[0118] The signature module 30 is used to perform quantum signature on the data digest based on the initial quantum session key, and embed the quantum signature value into the quantum fingerprint data block according to the byte offset table to form a watermarked data block.

[0119] The processing module 40 is used to perform semantic hashing on the quantum fingerprint data block to generate a semantic fingerprint, and generate a two-factor binding credential based on the semantic fingerprint, the initial quantum session key, the current synchronization token value, and the static device key.

[0120] The construction module 50 is used to construct a synchronization data packet based on the watermarked data block, the semantic fingerprint, the two-factor binding credential, the end node value of the synchronization log chain of the previous synchronization period, and the end node value of the quantum key chain, and to send the constructed synchronization data packet to the disaster recovery terminal for verification through the classical communication channel to obtain the verification result.

[0121] The update module 60 is used to write the watermarked data block in the synchronization data packet to the disaster recovery terminal when the verification result is successful, update the data of the disaster recovery terminal, and update the synchronization log chain and quantum key chain of the disaster recovery terminal based on the synchronization data packet.

[0122] The disaster recovery data synchronization verification device based on quantum key distribution provided in this application, employing the disaster recovery data synchronization verification method based on quantum key distribution in the above embodiments, can solve the technical problems of security threats and difficulty in reliably verifying consistency in disaster recovery data transmission in the prior art. Compared with the prior art, the beneficial effects of the disaster recovery data synchronization verification device based on quantum key distribution provided in this application are the same as those of the disaster recovery data synchronization verification method based on quantum key distribution provided in the above embodiments, and other technical features in the disaster recovery data synchronization verification device based on quantum key distribution are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0123] This application also provides a storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the disaster recovery data synchronization verification method based on quantum key distribution in the above embodiments.

[0124] The storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described disaster recovery data synchronization verification method based on quantum key distribution. This solves the technical problems of security threats and difficulty in reliably verifying consistency in disaster data transmission in the prior art. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the disaster recovery data synchronization verification method based on quantum key distribution provided in the above embodiments, and will not be repeated here.

[0125] The above are only some embodiments of this application and do not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A disaster recovery data synchronization verification method based on quantum key distribution, characterized in that, The method is applied to a disaster recovery system comprising a source end and a disaster recovery end, wherein a quantum key distribution channel and a classical communication channel are deployed between the source end and the disaster recovery end, and the method includes: An initial quantum session key shared by the source and the disaster recovery end is established through the quantum key distribution channel, and a byte offset table is generated based on the initial quantum session key; The source end acquires the data to be synchronized, and the data to be synchronized is divided into blocks using the quantum random threshold block algorithm and the quantum random mask algorithm to obtain quantum fingerprint data blocks and calculate data digests. The data digest is quantum-signed based on the initial quantum session key, and the quantum signature value is embedded into the quantum fingerprint data block according to the byte offset table to form a watermarked data block. The quantum fingerprint data block is semantically hashed to generate a semantic fingerprint, and a two-factor binding credential is generated based on the semantic fingerprint, the initial quantum session key, the current synchronization token value, and the static device key. Based on the watermarked data block, the semantic fingerprint, the two-factor binding credential, the end node value of the synchronization log chain of the previous synchronization period, and the end node value of the quantum key chain, a synchronization data packet is constructed, and the constructed synchronization data packet is sent to the disaster recovery terminal for verification through the classical communication channel to obtain the verification result. When the verification result is successful, the watermarked data block in the synchronization data packet is written to the disaster recovery terminal to update the data of the disaster recovery terminal, and the synchronization log chain and quantum key chain of the disaster recovery terminal are updated based on the synchronization data packet.

2. The method as described in claim 1, characterized in that, The step of establishing an initial quantum session key shared by the source and the disaster recovery end through the quantum key distribution channel, and generating a byte offset table based on the initial quantum session key, includes: The quantum key is negotiated and distributed between the source end and the disaster recovery end through the quantum key distribution channel to generate the original quantum bit string; The original quantum bit string is subjected to quantum error correction and privacy amplification processing to generate an initial quantum session key; The initial quantum session key is input into a key derivation function based on a cryptographic hash function to generate an extended key stream; Define a two-dimensional array structure with a preset number of rows and columns, and use the two-dimensional array structure as a byte offset table frame; Using the extended key stream as a random seed, a pseudo-random number generator is initialized, and the pseudo-random number generator generates a random offset within a preset maximum value range for each cell of the byte offset table. The random offset is embedded into the corresponding unit of the byte offset table frame to obtain the byte offset table.

3. The method as described in claim 1, characterized in that, The process of acquiring the data to be synchronized from the source end, dividing the data into blocks using a quantum random thresholding algorithm and a quantum random masking algorithm to obtain quantum fingerprint data blocks, and calculating data digests includes: A mask key is derived based on the initial quantum session key, and a quantum random number generator is invoked using the mask key as a seed to generate a quantum random mask; The quantum random mask is divided into a high-bit interval and a low-bit interval, which are used to set the upper and lower thresholds of the sliding window, respectively. The dynamic threshold interval is determined based on the upper and lower thresholds. Obtain the data to be synchronized from the source end, and perform a sliding window scan on the data to be synchronized using a rolling hash to obtain the rolling hash value; When the rolling hash value falls into the dynamic threshold range, the data in the current sliding window is used as the block boundary, and the data to be synchronized is divided according to the block boundary to obtain a quantum fingerprint data block; Calculate the quantum fingerprint of each of the quantum fingerprint data blocks, and perform aggregate hashing on the quantum fingerprints to generate a data digest.

4. The method as described in claim 1, characterized in that, The process of performing a quantum signature on the data digest based on the initial quantum session key, and embedding the quantum signature value into the quantum fingerprint data block according to the byte offset table to form a watermarked data block includes: A quantum signature key is derived based on the initial quantum session key; The quantum signature key is used to perform a signature operation on the data digest based on a quantum-resistant digital signature algorithm to generate a quantum signature value. The quantum signature value is compressed and encoded to generate a compact signature code; The corresponding embedding start position is determined by querying the byte offset table based on the sequence number of the quantum fingerprint data block. Starting from the embedding start position, the compact signature code is embedded into the quantum fingerprint data block in a lossless replacement or superposition manner to generate the original data block with watermark; Calculate the cryptographic hash value of the original data block with watermark, and use it as the integrity check code after watermarking; The original data block with watermark is combined and encapsulated with the watermarked integrity check code to obtain a watermarked data block.

5. The method as described in claim 1, characterized in that, The step of performing semantic hashing on the quantum fingerprint data block to generate a semantic fingerprint, and generating a two-factor binding credential based on the semantic fingerprint, the initial quantum session key, the current synchronization token value, and the static device key, includes: The quantum fingerprint data block is subjected to morphological feature extraction based on topological data analysis to obtain a topological feature vector; The quantum fingerprint data block is subjected to structural feature extraction based on hypergraph construction and learning to obtain graph-level embedding vectors; Locality-sensitive hashing is performed based on the topological feature vector and the graph-level embedding vector to generate a semantic fingerprint; Based on the current timestamp and the initial quantum session key, the current synchronization token value is generated using a message authentication code algorithm; The semantic fingerprint is digitally signed based on the static device key from the source end to generate a device identity signature; The semantic fingerprint, the pre-synchronization token value, and the device identity signature are concatenated, and the concatenated data is encrypted using the initial quantum session key to generate a two-factor binding credential.

6. The method as described in claim 1, characterized in that, The process involves constructing a synchronization data packet based on the watermarked data block, the semantic fingerprint, the two-factor binding credential, the tail node value of the synchronization log chain from the previous synchronization period, and the tail node value of the quantum key chain. This constructed synchronization data packet is then sent to the disaster recovery terminal via the classical communication channel for verification, yielding the verification result, including: Obtain the tail node value of the synchronization log chain and the tail node value of the quantum key chain from the previous synchronization cycle, and generate a globally unique timestamp and a monotonically increasing sequence number for the synchronization data packet; The watermarked data block, semantic fingerprint, two-factor binding certificate, the end node value of the synchronization log chain of the previous synchronization period and the end node value of the quantum key chain, timestamp and sequence number are combined into the original packet body. Perform a cryptographic hash operation on the original packet body to obtain the packet body hash value; A signature random number is generated based on the temporary signature key derived from the initial quantum session key and the packet body hash value; Based on the packet body hash value, the temporary signature key, and the signature random number, a digital signature is generated by performing an elliptic curve digital signature algorithm to generate a packet body signature value. The original packet body, packet body hash value, and packet body signature value are assembled into a synchronization data packet, and the synchronization data packet is sent to the disaster recovery terminal for verification through the classic communication channel to obtain the verification result.

7. The method as described in claim 1, characterized in that, When the verification result is successful, the watermarked data block in the synchronization data packet is written to the disaster recovery terminal to update the data on the disaster recovery terminal, and the synchronization log chain and quantum key chain of the disaster recovery terminal are updated based on the synchronization data packet, including: When the verification result is successful, the watermarked data block in the synchronization data packet is written to the corresponding storage location of the disaster recovery terminal according to the preset data writing rules, and the data of the disaster recovery terminal is updated. After the data update is complete, calculate the first current hash value for the current synchronization period; The first current hash value is cross-hashed with the synchronization log chain tail node value and quantum key chain tail node value of the previous synchronization period in the synchronization data packet to generate a new synchronization log chain node and a new quantum key chain node. The new synchronization log chain node and the new quantum key chain node are bidirectionally confirmed through a quantum random challenge-response mechanism between the source end and the disaster recovery end to obtain the confirmation result. When the confirmation result is successful, the new synchronization log chain node is appended to the end of the synchronization log chain of the disaster recovery terminal, and the new quantum key chain node is appended to the end of the quantum key chain of the disaster recovery terminal.

8. The method as described in claim 7, characterized in that, The process of bidirectionally confirming the new synchronization log chain node and the new quantum key chain node through a quantum random challenge-response mechanism between the source end and the disaster recovery end, and obtaining the confirmation result, includes: A quantum random challenge number is generated based on the cross-anchoring value of the new synchronous log chain node and the new quantum key chain node; A synchronization confirmation message is constructed based on the quantum random challenge number, the new synchronization log chain node, the new quantum key chain node, and the current synchronization sequence number; The synchronization confirmation message is sent to the source end for confirmation through the classical communication channel, and when the confirmation is successful, the quantum random challenge number is signed to generate a challenge response signature; A challenge-response message is constructed based on the challenge-response signature and the response verification code, and the challenge-response message is returned to the disaster recovery terminal for confirmation through the classic communication channel to obtain the confirmation result.

9. A disaster recovery data synchronization verification device based on quantum key distribution, characterized in that, The device includes: The generation module is used to establish an initial quantum session key shared by the source and the disaster recovery end through the quantum key distribution channel, and to generate a byte offset table based on the initial quantum session key; The block segmentation module is used to acquire the data to be synchronized from the source end, and to segment the data to be synchronized into blocks using the quantum random threshold segmentation algorithm and the quantum random masking algorithm to obtain quantum fingerprint data blocks and calculate data digests. The signature module is used to perform quantum signature on the data digest based on the initial quantum session key, and embed the quantum signature value into the quantum fingerprint data block according to the byte offset table to form a watermarked data block; The processing module is used to perform semantic hashing on the quantum fingerprint data block to generate a semantic fingerprint, and generate a two-factor binding credential based on the semantic fingerprint, the initial quantum session key, the current synchronization token value, and the static device key. The construction module is used to construct a synchronization data packet based on the watermarked data block, the semantic fingerprint, the two-factor binding credential, the tail node value of the synchronization log chain of the previous synchronization period, and the tail node value of the quantum key chain, and to send the constructed synchronization data packet to the disaster recovery end for verification through a classical communication channel to obtain the verification result. The update module is used to write the watermarked data block in the synchronization data packet to the disaster recovery terminal when the verification result is successful, update the data of the disaster recovery terminal, and update the synchronization log chain and quantum key chain of the disaster recovery terminal based on the synchronization data packet.

10. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 8.

Images