Method and system for secure flag generation and synchronization based on distributed environment

Abstract

This invention provides a method and system for secure FLAG generation and synchronization in a distributed environment, comprising: constructing a secret share generation algorithm and reconstruction mechanism based on the residual theorem to establish a distributed key management foundation; using attention networks and optimization algorithms to process multi-source random factors and generate a high-entropy random factor set; then designing a multi-dimensional representation space mapping and a distributed consensus protocol to coordinate FLAG generation among nodes and perform encrypted protection; and constructing a multi-layer caching architecture and synchronization protocol to realize FLAG storage, transmission, and verification. This invention achieves a highly secure and highly available distributed FLAG system.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to a method and system for generating and synchronizing security flags in a distributed environment, which is mainly applied to scenarios such as user authentication, anti-fraud detection, and secure transaction verification in distributed systems. Background Technology

[0002] In the field of information security, FLAGs (flags or tokens) are key elements for verifying user identity, preventing fraud, and ensuring system security. These flags are commonly used in various scenarios such as anti-fraud systems, authentication mechanisms, and secure transaction verification.

[0003] Traditional flag generation techniques typically employ simple random number generation or basic hash algorithms. For example, some systems use a combination of timestamps and random strings as flags, or use hash algorithms such as MD5 / SHA to process user information one-way to generate verification tokens. These methods can meet basic needs in a standalone environment, but their functionality is relatively simple.

[0004] More advanced technical solutions use a hash algorithm combining a timestamp, user ID, and random salt to generate the flag. This approach increases the unpredictability of the flag by introducing a random salt value, while ensuring the uniqueness of the identifier by combining it with user-specific information. Such solutions use cryptographic hash functions like SHA-256 to process the combined information, generating a fixed-length flag string, effectively preventing simple replay attacks.

[0005] However, such technical solutions still face many challenges in a distributed environment: First, the lack of a unified coordination mechanism for FLAG generation among distributed nodes makes it difficult to guarantee FLAG consistency; second, the random generation mechanism of existing algorithms is easily predicted and cracked by advanced computing technologies; in addition, the complex FLAG generation and verification process consumes a lot of system resources, which may lead to performance bottlenecks in a high-concurrency environment; finally, there is a difficult-to-balance contradiction between FLAG security and complexity and system performance.

[0006] Therefore, there is an urgent need for a technical solution that can efficiently generate and synchronize secure flags in a distributed environment to solve the technical problems of poor flag consistency, insufficient randomness, performance bottlenecks, and difficulty in balancing security and efficiency in existing technologies. Summary of the Invention

[0007] The purpose of this invention is to provide a method and system for secure FLAG generation and synchronization in a distributed environment, aiming to solve technical problems such as poor FLAG consistency, insufficient randomness, and performance bottlenecks in FLAG generation and verification in a distributed environment in the prior art.

[0008] To achieve the above objectives, the technical solution provided by the present invention is as follows:

[0009] This invention provides a method for generating and synchronizing security flags in a distributed environment, comprising:

[0010] Based on the residual theorem, we design a set of coprime moduli, a security parameter threshold, and the number of participants. We construct a hierarchical transformation function and design a secret sharding algorithm to map the secret into multiple shares, thus obtaining a secret share generation algorithm and a secret reconstruction mechanism.

[0011] According to the secret share generation algorithm and the secret reconstruction mechanism, multi-source random factors are collected, the correlation weight matrix between the multi-source random factors is calculated through an attention network, the multi-source random factors are allocated according to the correlation weight matrix using an optimization algorithm, and the multi-source random factors are fused using the secret share generation algorithm to obtain a random factor set.

[0012] Based on the secret share generation algorithm, the secret reconstruction mechanism, and the random factor set, a mapping function set is designed to map the random factor set to different representation spaces. A distributed consensus protocol is applied to coordinate the FLAG generation process among distributed nodes. The secret reconstruction mechanism is used to collaboratively generate FLAG identifiers in a distributed environment and perform encryption protection to obtain encrypted FLAG identifiers and corresponding verification information.

[0013] Based on the encrypted FLAG identifier and corresponding verification information, a cache architecture is constructed to store the encrypted FLAG identifier, a synchronization protocol is designed to transmit the encrypted FLAG identifier and corresponding verification information, and a verification mechanism is designed to verify the encrypted FLAG identifier based on the verification information, thus obtaining a secure FLAG generation and synchronization system in a distributed environment.

[0014] Furthermore, the method involves designing a set of coprime moduli based on the remainder theorem, along with security parameter thresholds and the number of participants. This includes constructing a hierarchical transformation function and designing a secret sharding algorithm to map the secret into multiple shares, resulting in a secret share generation algorithm and a secret reconstruction mechanism.

[0015] Based on the mathematical principle of the Remainder Theorem, a set of coprime moduli is selected, and the safety parameter threshold and the number of participants are determined. The product of moduli and the multiplicative inverse of each moduli are calculated to obtain the CRT parameter set.

[0016] Based on the CRT parameter set, a unidirectional asymptotic ideal disjunction hierarchical transformation function is designed such that any number of shares less than t cannot obtain any information about the secret to be fragmented, thus obtaining the asymptotic ideal disjunction hierarchical transformation function;

[0017] Based on the asymptotic ideal disjunction hierarchical transformation function and the secret to be fragmented, the asymptotic ideal disjunction hierarchical transformation function is applied to the secret to be fragmented to transform it, and the transformed secret is mapped into n secret shares by combining the CRT parameter set, thus obtaining the secret share generation algorithm;

[0018] Based on the secret share generation algorithm and the CRT parameter set, a reconstruction function is constructed that can recover the secret to be fragmented based on at least t secret shares using the residual theorem, and a verification mechanism is designed to ensure the validity of the secret shares through hash verification or digital signature, thus obtaining the secret reconstruction mechanism.

[0019] Further, the process of collecting multi-source random factors, calculating the correlation weight matrix among the multi-source random factors using an attention network, and applying an optimization algorithm to allocate the multi-source random factors according to the correlation weight matrix includes:

[0020] Based on the system environment collection timestamp, user identity features, device environment fingerprint, and system entropy pool random value as the multi-source random factors, the multi-source random factors are standardized and feature extracted to obtain the original random factor set;

[0021] Based on the original set of random factors, a cross-attention network is designed. The relevance score of each random factor in the original set of random factors is calculated through a query-key-value mechanism and normalized into a weight matrix, thus obtaining the weight matrix and the attention-weighted factor representation.

[0022] Based on the attention-weighted factor representation and the weight matrix, a masking strategy optimization algorithm is designed. According to the weight values ​​in the weight matrix, the randomness of each factor component in the attention-weighted factor representation is allocated to different regions. The algorithm also uses a dynamic masking mechanism to suppress the redundancy and predictability of the attention-weighted factor representation, thereby obtaining the optimized random factor distribution.

[0023] Furthermore, the application of the secret share generation algorithm to fuse the multi-source random factors to obtain a random factor set includes:

[0024] Based on the optimized random factor distribution and the secret share generation algorithm, the timestamp, user identity features, device environment fingerprint and system entropy pool random value in the optimized random factor distribution are respectively used as secret inputs to be sharded. The secret share generation algorithm is applied to shard each random factor to obtain the secret share set corresponding to each random factor.

[0025] Based on the set of secret shares corresponding to each random factor, random shares from different sources in the set of secret shares corresponding to each random factor are merged by XOR operation or hash chain, and the Shannon entropy of the merged random factor is calculated to verify that it meets the cryptographic security requirements, thereby obtaining a set of random factors whose entropy value meets the preset threshold.

[0026] Furthermore, the design mapping function set maps the random factor set to different representation spaces, and the distributed consensus protocol coordinates the FLAG generation process among distributed nodes, including:

[0027] Based on the set of random factors, k different embedding space mapping functions are designed, including linear transformation, polynomial mapping and nonlinear neural network mapping. Each random factor in the set of random factors is mapped to k different representation spaces through the k different embedding space mapping functions to obtain a multidimensional representation vector set.

[0028] Based on the multidimensional representation vector set, a distributed consensus protocol is designed. The multidimensional representation vector set is transmitted between distributed nodes through a message passing mechanism, and a consensus algorithm is used to ensure that each distributed node reaches a consensus on the multidimensional representation vector set, thus obtaining the consensus algorithm and node coordination mechanism.

[0029] Furthermore, the step of collaboratively generating a FLAG identifier in a distributed environment using the secret reconstruction mechanism and encrypting it to obtain an encrypted FLAG identifier and corresponding verification information includes:

[0030] Based on the consensus algorithm and node coordination mechanism, the multidimensional representation vector set and the secret reconstruction mechanism, each distributed node uses the secret reconstruction mechanism to collect the secret share corresponding to the multidimensional representation vector set from at least t nodes and reconstructs the complete random factor. The hash function is applied to the reconstructed random factor to generate a FLAG identifier, and the original FLAG identifier is obtained.

[0031] Based on the original FLAG identifier, a key pair is generated, the original FLAG identifier is encrypted using the private key in the key pair, and the encrypted FLAG identifier is digitally signed using the private key in the key pair, resulting in an encrypted FLAG identifier and a corresponding digital signature.

[0032] Based on the encrypted FLAG identifier and the corresponding digital signature, verification information including the digital signature, the public key in the key pair, the timestamp, and the validity period is generated, thus obtaining the encrypted FLAG identifier and the corresponding verification information.

[0033] Furthermore, after obtaining the encrypted FLAG identifier and corresponding verification information, and before constructing the cache architecture, the process also includes:

[0034] Based on the encrypted FLAG identifier and corresponding verification information, historical usage data is used to extract features and perform cluster analysis on multi-protocol traffic in the historical usage data through an unsupervised learning model. This identifies abnormal behaviors and potential attack patterns that deviate from the normal pattern, and yields a security threat assessment report.

[0035] Based on the system operating environment, CPU utilization, memory usage, network latency, and request queue length are collected in real time to calculate the system load index and obtain a system load report;

[0036] Based on the security threat assessment report and the system load report, an adaptive decision-making algorithm is designed. Through a multi-objective optimization model, the security threat level in the security threat assessment report and the system performance constraints in the system load report are weighed, and the optimal parameters of FLAG generation complexity, length and update frequency are dynamically calculated to obtain the FLAG complexity parameter set.

[0037] Based on the FLAG complexity parameter set, the threshold in the secret reconstruction mechanism is updated according to the generation complexity parameter in the FLAG complexity parameter set, the random source weight in the random factor selection strategy is updated according to the length parameter in the FLAG complexity parameter set, and the time interval and event threshold in the triggering conditions are updated according to the update frequency parameter in the FLAG complexity parameter set, to obtain the optimized FLAG strategy configuration.

[0038] Furthermore, a caching architecture is constructed to store the encrypted FLAG identifier, and a synchronization protocol is designed to transmit the encrypted FLAG identifier and corresponding verification information, including:

[0039] Based on the encrypted FLAG identifier and corresponding verification information, a multi-layer cache architecture including local fast cache, regional shared cache and global persistent storage is constructed. The encrypted FLAG identifier is stored in the multi-layer cache architecture, and a cache eviction policy is designed to obtain a cache management policy.

[0040] Based on the cache management strategy and the encrypted FLAG identifier and corresponding verification information, a synchronization protocol is designed to identify changes in the encrypted FLAG identifier through a version number mechanism, transmit the encrypted FLAG identifier and corresponding verification information, and use a compression algorithm to reduce the amount of data transmitted, thus obtaining the synchronization protocol.

[0041] Furthermore, the design verification mechanism verifies the encrypted FLAG identifier based on the verification information, resulting in a secure FLAG generation and synchronization system in a distributed environment, comprising:

[0042] Based on the synchronization protocol and the verification information, a multi-level verification mechanism is designed. This mechanism verifies the format of the encrypted FLAG identifier by using the version number mechanism in the synchronization protocol to check the length and character set legality; it also verifies the validity of the digital signature in the verification information by using the public key in the verification information; it verifies the validity of the encrypted FLAG identifier by using the validity period in the verification information; and it verifies the consistency between the encrypted FLAG identifier and the user identity and device environment by using the timestamp in the verification information. This completes the FLAG verification process.

[0043] Based on the FLAG verification process, an exception handling strategy is designed. When the format verification, signature verification, timeliness verification, or context verification in the FLAG verification process fails, the FLAG regeneration process is triggered. When a node fails, a backup node is started and the encrypted FLAG identifier is restored from the global persistent storage in the multi-layer caching architecture. When the FLAG verification process detects a FLAG consistency conflict, a conflict resolution mechanism based on the version number mechanism in the synchronization protocol is used to select the valid FLAG version, thus obtaining the secure FLAG generation and synchronization system in the distributed environment.

[0044] This invention also provides a system for generating and synchronizing secure flags in a distributed environment, comprising:

[0045] The secret sharding module is used to design a set of coprime moduli, a security parameter threshold, and the number of participants based on the residual theorem. It constructs a hierarchical transformation function and designs a secret sharding algorithm to map the secret into multiple shares, thus obtaining a secret share generation algorithm and a secret reconstruction mechanism.

[0046] The random factor fusion module is used to collect multi-source random factors according to the secret share generation algorithm and the secret reconstruction mechanism, calculate the correlation weight matrix between the multi-source random factors through an attention network, apply an optimization algorithm to allocate the multi-source random factors according to the correlation weight matrix, and apply the secret share generation algorithm to fuse the multi-source random factors to obtain a random factor set.

[0047] The FLAG generation module is used to design a mapping function set to map the random factor set to different representation spaces based on the secret share generation algorithm, the secret reconstruction mechanism and the random factor set, apply a distributed consensus protocol to coordinate the FLAG generation process among distributed nodes, and use the secret reconstruction mechanism to collaboratively generate FLAG identifiers in a distributed environment and perform encryption protection to obtain encrypted FLAG identifiers and corresponding verification information.

[0048] The synchronization verification module is used to construct a cache architecture to store the encrypted FLAG identifier and the corresponding verification information, design a synchronization protocol to transmit the encrypted FLAG identifier and the corresponding verification information, and design a verification mechanism to verify the encrypted FLAG identifier based on the verification information, thereby obtaining a secure FLAG generation and synchronization system in a distributed environment.

[0049] The present invention has the following beneficial effects:

[0050] 1. By constructing a secret sharing model based on the residual theorem and asymptotic ideal disjunction hierarchy, the FLAG is fragmented and reconstructed, ensuring that attackers who obtain partial information cannot deduce the complete FLAG, while supporting efficient reconstruction in a distributed environment;

[0051] 2. Apply the cross-attention mechanism to calculate the correlation between different random factors, and preferentially allocate randomness to regions with high security relevance, thereby reducing redundancy and predictable components in FLAG generation and improving system security;

[0052] 3. By utilizing a multi-embedding model consensus mechanism to map random factors to multiple representation spaces, and by using a lightweight Byzantine fault-tolerant protocol to achieve FLAG consistency among distributed nodes, the problem of poor consistency in traditional methods in distributed environments is solved.

[0053] 4. By analyzing abnormal behavior in multi-protocol traffic through unsupervised learning, the complexity and update strategy of FLAG are dynamically adjusted to balance security and system performance, enabling the system to adaptively adjust according to threat level and load conditions.

[0054] 5. By adopting a hierarchical caching architecture and incremental synchronization protocol, network transmission overhead is reduced, ensuring real-time consistency of FLAG data in a distributed environment, while improving system response speed and adapting to the needs of high-concurrency scenarios. Attached Figure Description

[0055] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0056] Figure 1 This is a flowchart illustrating the method for generating and synchronizing secure flags in a distributed environment according to the present invention.

[0057] Figure 2 This is a flowchart illustrating the multi-source random factor fusion process of the present invention;

[0058] Figure 3 This is a schematic diagram of the system for generating and synchronizing secure flags in a distributed environment, as described in this invention. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

[0060] Example 1

[0061] like Figure 1 As shown, this invention provides a method for generating and synchronizing security flags in a distributed environment, comprising:

[0062] Step S1: Based on the residual theorem, design a set of coprime moduli, a security parameter threshold, and the number of participants. Construct a hierarchical transformation function and design a secret sharding algorithm to map the secret into multiple shares, thus obtaining a secret share generation algorithm and a secret reconstruction mechanism.

[0063] Step S2: Based on the secret share generation algorithm and the secret reconstruction mechanism, collect multi-source random factors, calculate the correlation weight matrix between the multi-source random factors through an attention network, apply an optimization algorithm to allocate the multi-source random factors according to the correlation weight matrix, and apply the secret share generation algorithm to fuse the multi-source random factors to obtain a random factor set.

[0064] Step S3: Based on the secret share generation algorithm, the secret reconstruction mechanism, and the random factor set, design a mapping function set to map the random factor set to different representation spaces, apply a distributed consensus protocol to coordinate the FLAG generation process among distributed nodes, and use the secret reconstruction mechanism to collaboratively generate FLAG identifiers in a distributed environment and perform encryption protection to obtain encrypted FLAG identifiers and corresponding verification information.

[0065] Step S4: Based on the encrypted FLAG identifier and corresponding verification information, construct a cache architecture to store the encrypted FLAG identifier, design a synchronization protocol to transmit the encrypted FLAG identifier and corresponding verification information, and design a verification mechanism to verify the encrypted FLAG identifier based on the verification information, thereby obtaining a secure FLAG generation and synchronization system in a distributed environment.

[0066] Specifically, firstly, a secure secret-sharing mechanism is constructed based on the mathematical principles of the Congruence Remainder Theorem (CRT). The Congruence Remainder Theorem is a mathematical tool whose core idea is to uniquely determine an integer through a system of congruence equations. This system applies it to the field of secret sharing, achieving efficient and secure distributed secret management.

[0067] First, select a set of coprime moduli {m1, m2, ..., m}. n Here, "coprime" means that the greatest common divisor (GCD) of any two moduli is 1. For example, {7, 11, 13} are coprime, while {6, 15, 35} are not coprime because the GCD of 6 and 15 is 3. The property of coprime ensures that the Remainder Theorem works correctly and is a fundamental guarantee of system security. The choice of modulus needs to balance security and computational efficiency. For high-security applications, large prime numbers or powers of large prime numbers are chosen as the modulus; for applications with high performance requirements, smaller prime numbers can be chosen to reduce computational complexity.

[0068] Two key parameters also need to be determined: the security threshold t and the number of participants n. The security threshold t represents the minimum number of shares required to reconstruct the secret and is a core parameter for system security. It is usually set to more than half of the total number of participants n, i.e., t > n / 2. This setting is based on the "majority honesty" assumption, ensuring normal operation even with a few malicious nodes. The number of participants n is determined based on the scale of the distributed deployment and represents the total number of nodes participating in FLAG generation. The choice of n needs to consider the balance between system fault tolerance and communication overhead. The larger n is, the stronger the fault tolerance, but the communication complexity also increases accordingly.

[0069] After determining the set of moduli and parameters, a Hierarchical Transformation Function (HTF) is constructed. An HTF is a composite function used to transform the original secret before it is shared, enhancing security. A typical HTF implementation includes the All-or-Nothing Transform (AONT), a special cryptographic construct that ensures that even if partial output is obtained, an attacker cannot acquire any information about the input. An implemented AONT consists of two phases: a forward transformation (processing the secret S using a one-way function such as SHA-256) and a backward protection (XORing the transformation result with a random mask). This design ensures that the original input can only be recovered by obtaining all the outputs.

[0070] A secret partitioning algorithm was designed based on HTF and modular arithmetic. This algorithm transforms the original secret S using HTF and then decomposes the result into t sub-secrets {s1, s2, ..., sn}. t Then, using the Remainder Theorem, these t sub-secrets are mapped to n secret shares {share1, share2, ..., share}. nThe mapping process guarantees that any t shares can reconstruct the original secret, while fewer than t shares cannot obtain any useful information. This "t-threshold" characteristic is the foundation of system security. The sharding algorithm also includes a verification mechanism, adding verification information (such as hash values ​​or digital signatures) to each share, enabling the receiver to verify the validity of the share and preventing malicious nodes from providing invalid shares.

[0071] Corresponding to the sharding algorithm, a secret reconstruction mechanism was also designed. This mechanism is responsible for collecting at least t valid shares from the distributed environment, verifying their integrity, reconstructing the sub-secret through the inverse process of the Remainder Theorem, and finally restoring the original secret by applying the inverse transformation of the HTF. The key to the reconstruction process lies in share verification and error handling. A multi-level verification mechanism is implemented, including format verification, hash verification, and signature verification, to ensure that only legitimate and valid shares are used for reconstruction. For possible error situations, such as invalid shares or insufficient shares, the system has designed a robust handling process, including strategies such as requesting additional shares, error reporting, and graceful degradation.

[0072] Through the above design, the system successfully constructed a secure and efficient secret share generation algorithm and secret reconstruction mechanism, laying a solid cryptographic foundation for subsequent FLAG generation and synchronization. This secret sharing scheme based on the remainder theorem features high computational efficiency, low storage overhead, and strong security, making it very suitable for secure credential management in distributed environments.

[0073] Second, it innovatively combines deep learning technology and cryptographic methods to establish a high-quality random factor collection and fusion mechanism. Randomness is the foundation of cryptographic security, and the intelligent fusion of multi-source random factors significantly improves the unpredictability and security of FLAG generation.

[0074] First, random factors are collected from multiple sources, including four core random sources: timestamps, user identity features, device environment fingerprints, and system entropy pool random values. Timestamps include system and network times accurate to microseconds, with a random offset added to prevent predictability. User identity features include user ID, behavioral characteristics, and session information; these features, after processing, reflect the user's unique identity. Device environment fingerprints are datasets describing the user's device, including hardware identifiers, system configurations, and network characteristics, which are combined and hashed to form a unique device identifier. System entropy pool random values ​​are high-quality random numbers obtained from the operating system's entropy collector, typically derived from hardware events such as keyboard input and disk operations.

[0075] The collected random factors undergo standardization and feature extraction to transform them into a format that can be processed by machine learning algorithms. The standardization process includes format unification, range normalization, and outlier handling, ensuring that random factors from different sources can be analyzed within the same framework. Feature extraction includes dimensionality reduction, feature enhancement, and feature encoding, transforming the raw data into more representative and discriminative feature representations.

[0076] This system innovatively introduces an attention network to calculate the relevance weight matrix between random factors. Originating from natural language processing, the attention network is specifically optimized for this system to capture the complex interactions between different random factors. The network employs a query-key-value (QKV) mechanism, transforming each random factor into three different representations: a query vector, a key vector, and a value vector. By calculating the dot product of the query vector and all key vectors, the system generates a relevance score matrix, reflecting the degree of relevance between each pair of random factors. The relevance scores are then scaled and softmax normalized, transforming them into a weight matrix W, representing the influence of each factor on other factors.

[0077] After calculating the weight matrix, the Masking Strategy Optimization Algorithm (MSOA) is applied to intelligently allocate random factors. MSOA is one of the innovations of this system. By analyzing the weight matrix, it prioritizes the allocation of random resources to highly correlated regions, while simultaneously using a dynamic masking mechanism to suppress redundant and predictable components. MSOA comprises three main stages: weight analysis (identifying highly and low-correlation regions), random allocation (allocating random resources according to weight values), and dynamic masking (covering predictable components). This optimization significantly improves the quality and security of random factors, effectively preventing prediction attacks targeting randomness generation.

[0078] Finally, a secret share generation algorithm is applied to fuse the optimized multi-source random factors into a high-entropy set of random factors. The fusion process first treats each type of random factor as a secret to be sharded, and then performs sharding using the secret share generation algorithm to obtain a set of secret shares corresponding to each random factor. Then, using XOR operations or hash chain methods, the random shares from different sources are fused to generate the final set of random factors. The fused set of random factors is verified using Shannon entropy to ensure that its randomness meets cryptographic security requirements and that the entropy value reaches a preset threshold.

[0079] XOR fusion performs a bitwise XOR operation on secret shares from different sources to generate a new random value. This method is computationally efficient, and as long as one input share is truly random, the output will maintain high randomness. Hash chain fusion, on the other hand, combines multiple shares into a new random value through an iterative hash function. It has stronger one-wayness and avalanche effect, meaning that small changes in the input can lead to significant differences in the output. The system can choose an appropriate fusion method based on security requirements and performance constraints, or use both methods simultaneously and combine the results to further enhance randomness.

[0080] Through the above process, multi-source random factors were successfully transformed into a high-quality set of random factors, providing a reliable randomness foundation for FLAG generation. This method, combining deep learning and cryptography, solves the problems of single random source and high predictability in traditional randomness generation, significantly improving the system's security and resistance to attacks.

[0081] Third, k different embedding space mapping functions were designed to map the obtained set of random factors to multiple different representation spaces. These mapping functions include three types: linear transformation, polynomial mapping, and nonlinear neural network mapping. Linear transformation maps random factors to a new representation space through matrix multiplication, offering high computational efficiency but limited expressive power. Polynomial mapping captures the interaction relationships between random factors through polynomial functions, providing stronger expressive power but with higher computational complexity. Nonlinear neural network mapping uses a trained neural network model (such as a multilayer perceptron or autoencoder) to map random factors to a nonlinear representation space, offering the strongest expressive power but incurring significant training and inference overhead. The system applies these k different mapping functions to each random factor, generating k different representation vectors to form a multidimensional representation vector set.

[0082] After the multidimensional representation vector set is generated, a distributed consensus protocol is applied to coordinate the FLAG generation process among the nodes. The consensus protocol is based on a publish-subscribe messaging mechanism, where each node can publish its own generated representation vectors and subscribe to the representation vectors of other nodes. To ensure transmission security, end-to-end encryption and message compression algorithms are employed. Based on message passing, a lightweight Byzantine Fault-Tolerant (BFT) consensus algorithm is implemented, including a proposal phase (selecting a proposal node to collect and broadcast representation vectors), a voting phase (each node verifies the proposal and votes), and a confirmation phase (confirming the final state based on the voting results). The consensus process ensures that all honest nodes reach a consensus on the multidimensional representation vector set, laying the foundation for unified FLAG generation.

[0083] After consensus is reached, the distributed nodes collaboratively generate the FLAG identifier using a secret reconstruction mechanism. Each node first collects secret shares from at least t nodes in the distributed environment. After verification, the secret reconstruction algorithm is applied to reconstruct the complete random factor. The reconstruction process is based on the Remainder Theorem and the inverse HTF transform to recover the original random information from the valid shares. Subsequently, the nodes use a cryptographically secure hash function (such as SHA-256 or SHA-3) to perform one-way processing on the reconstructed random factor, generating the original FLAG identifier. The hash processing ensures that the FLAG has a fixed length, is irreversible, and is highly discrete, making it impossible for attackers to deduce the original random factor from the FLAG identifier.

[0084] After generating the original FLAG identifier, it is encrypted for protection. First, a key pair is generated based on the FLAG identifier. A deterministic key derivation function (KDF) is used, with the FLAG identifier as the seed, to derive an asymmetric key pair. Then, the original FLAG identifier is encrypted using the private key, employing a hybrid encryption scheme: a one-time symmetric key is generated to encrypt the FLAG identifier, and then this symmetric key is encrypted using the asymmetric private key. After encryption, the system uses the same private key to generate a digital signature for the encrypted FLAG, providing integrity guarantees and source authentication. To enhance security, the system may implement a multi-signature mechanism, requiring multiple authoritative nodes to generate signatures separately.

[0085] Finally, a complete verification information package is generated, including a digital signature, public key, timestamp, and expiration date. The digital signature is used to verify the integrity and origin of the FLAG; the public key is used to verify the signature; the timestamp marks the FLAG's creation time to ensure correct timing; and the expiration date defines the FLAG's usage period to prevent replay attacks. The system may also add other auxiliary information, such as usage context restrictions, security level identifiers, serial numbers, and version information, to further enhance security controls. The verification information is bound to the encrypted FLAG identifier to form a complete FLAG data structure, using a common data format (such as JSON, XML, or Protocol Buffers) to ensure cross-platform compatibility.

[0086] This step successfully achieved the collaborative generation and protection of FLAGs in a distributed environment. The generated FLAGs possess key security features such as anti-counterfeiting, anti-tampering, and verifiability, providing robust security for various application scenarios. Multidimensional representation space mapping and distributed consensus mechanisms significantly enhance FLAG security and system reliability, enabling the system to operate robustly in complex distributed environments.

[0087] Fourth, a multi-layered caching architecture was first constructed to provide efficient storage and access capabilities for FLAGs. This architecture comprises three layers: local fast cache, regional shared cache, and global persistent storage. The local fast cache resides within each processing node, using in-memory storage technology to provide the fastest access speed, with typical capacities ranging from hundreds of MB to several GB, offering millisecond or even microsecond-level access for hot data; the regional shared cache serves geographically proximate node groups, employing distributed in-memory caching technologies such as Redis or Memcached, with capacities reaching tens to hundreds of GB, providing millisecond-level access latency; the global persistent storage uses relational or NoSQL database technology to provide data persistence guarantees and full transaction support, storing currently valid FLAGs and historical versions. Data flow between cache layers follows a "downward penetration, upward backfilling" strategy to ensure high cache hit rates and data consistency.

[0088] A sophisticated cache management strategy was designed, including multiple eviction algorithms (such as LRU, LFU, TLRU) and an innovative security-aware eviction algorithm (SLRU). The latter considers the security importance of flags, assigning higher retention priority to flags with higher security levels. Cache consistency is managed through a versioned caching strategy, with each flag accompanied by a version identifier. The system implements write-through (strong consistency) or asynchronous update (eventual consistency) strategies based on application requirements. The system also implements an intelligent pre-filling mechanism and adaptive adjustment function, analyzing access patterns to predict demand and optimize configuration.

[0089] Based on a caching architecture, the system employs a highly efficient synchronization protocol to ensure consistent propagation of FLAG data in a distributed environment. The core of this protocol is a version number mechanism. Each FLAG is assigned a globally unique version identifier, composed of a logical clock and a node ID, ensuring clear differentiation of data versions within the distributed environment. Synchronization operations utilize a "notify-then-request" strategy: after a node generates a new FLAG, it broadcasts a change notification. Receiving nodes compare version numbers and only request the complete data when necessary, avoiding unnecessary transmission. Data transmission employs incremental synchronization and multi-level compression to optimize efficiency: semantic compression removes redundant information, structural compression uses a compact encoding format, and data compression applies general algorithms such as Gzip or LZ4. The system also implements batch processing, acknowledgment and retransmission mechanisms, and adaptive network strategies to ensure efficient and reliable transmission under various network conditions.

[0090] Secure transmission is a crucial component of the synchronization protocol. The system employs TLS / SSL encrypted communication channels, combined with end-to-end data encryption, ensuring that the FLAG content will not be leaked even if intermediate nodes are attacked. Message integrity is protected through digital signatures or MAC addresses, and authentication uses multi-factor authentication and certificate binding to ensure that only authorized nodes can participate in synchronization. The system also implements a conflict detection and resolution mechanism, using version vectors to identify conflicts caused by concurrent updates and applying deterministic rules, rule-based policies, or semantic merging to resolve conflicts, ensuring eventual system consistency.

[0091] Finally, a comprehensive FLAG verification mechanism was designed to ensure that only legitimate and valid FLAGs are accepted for use. The verification mechanism employs a multi-level design, including four main layers: format verification (checking the legality of the FLAG length and character set), signature verification (verifying the validity of the digital signature), validity period verification (checking whether the FLAG is within its validity period), and context verification (checking the consistency of the FLAG with the usage environment). Verification at each level is performed in order of increasing complexity, and immediately returns if any level fails, optimizing performance while ensuring security. Verification results include detailed metadata for audit trails and security analysis. The system also implements risk-adaptive verification, dynamically adjusting the verification severity based on operational sensitivity.

[0092] The system also features a comprehensive exception handling strategy, effectively addressing situations such as verification failures, node failures, and consistency conflicts. Upon verification failure, the system takes appropriate measures based on the failure type, ranging from simple request rejection to security alerts and account locking. Node failure handling employs a multi-layered detection and recovery mechanism, starting backup nodes and restoring data from global storage to ensure service continuity. FLAG consistency conflicts are accurately identified through a version number mechanism and effectively resolved using a combination of multiple strategies to ensure eventual system consistency.

[0093] By integrating the above components, a complete distributed security flag generation and synchronization system is formed. This system can efficiently generate, securely store, reliably transmit, and rigorously verify flags in a distributed environment, providing robust security identification services for various applications. The system design considers a balance between security, performance, reliability, and scalability, adapting to various deployment scenarios from small LANs to large cloud environments, and meeting different levels of security requirements.

[0094] This embodiment constructs a complete secure flag generation and synchronization method based on a distributed environment through four closely linked steps. This method combines modern cryptography, distributed computing, and deep learning technologies to solve problems such as insufficient randomness, single point of failure, and synchronization difficulties in traditional methods, providing an innovative solution for application scenarios requiring high-security distributed identifiers. The system's modular design makes it easy to extend and customize, allowing adjustment of component parameters according to specific application needs to balance security and performance. Experimental results show that this method outperforms existing technologies in terms of security, performance, and reliability, making it particularly suitable for applications in high-security fields such as finance, healthcare, and the Internet of Things.

[0095] Example 2

[0096] In this embodiment, the step of designing a set of coprime moduli based on the residual theorem, as well as security parameter thresholds and the number of participants, constructing a hierarchical transformation function, and designing a secret sharding algorithm to map the secret into multiple shares, resulting in a secret share generation algorithm and a secret reconstruction mechanism, includes:

[0097] Based on the mathematical principle of the Remainder Theorem, a set of coprime moduli is selected, and the safety parameter threshold and the number of participants are determined. The product of moduli and the multiplicative inverse of each moduli are calculated to obtain the CRT parameter set.

[0098] Based on the CRT parameter set, a unidirectional asymptotic ideal disjunction hierarchical transformation function is designed such that any number of shares less than t cannot obtain any information about the secret to be fragmented, thus obtaining the asymptotic ideal disjunction hierarchical transformation function;

[0099] Based on the asymptotic ideal disjunction hierarchical transformation function and the secret to be fragmented, the asymptotic ideal disjunction hierarchical transformation function is applied to the secret to be fragmented to transform it, and the transformed secret is mapped into n secret shares by combining the CRT parameter set, thus obtaining the secret share generation algorithm;

[0100] Based on the secret share generation algorithm and the CRT parameter set, a reconstruction function is constructed that can recover the secret to be fragmented based on at least t secret shares using the residual theorem, and a verification mechanism is designed to ensure the validity of the secret shares through hash verification or digital signature, thus obtaining the secret reconstruction mechanism.

[0101] Specifically, based on the mathematical principle of the remainder theorem, a set of coprime moduli is selected, and the security parameter threshold and the number of participants are determined. The modulo product and the multiplicative inverse of each modulo are calculated to obtain the CRT parameter set. In this step, the number of participants *n* and the security threshold *t* are first determined according to the system security requirements. Here, *n* represents the total number of nodes participating in FLAG generation in the distributed environment, and *t* represents the minimum number of shares required to reconstruct the secret, satisfying *t ≤ n*. The security threshold *t* is a key parameter for system security, indicating that an attacker needs at least *t* shares of the secret to reconstruct the original secret. Based on information security theory, the value of *t* is usually set to more than half of *n* to balance system security and fault tolerance.

[0102] After determining n and t, a set of coprime moduli {m1, m2, ..., m} needs to be selected. n Here, "coprime" means that the greatest common divisor of any two moduli is 1, ensuring the reliability of the Remainder Theorem during computation. The choice of modulus requires a balance between computational efficiency and security. Prime numbers or prime powers are typically used as moduli, and the modulus should be large enough to resist brute-force attacks, while computational efficiency must also be considered. For example, for high-security scenarios, 512-bit or 1024-bit prime numbers can be chosen as moduli; for performance-sensitive scenarios, smaller but safer prime numbers can be chosen.

[0103] We also need to calculate the modulo product M = m1 × m2 × ... × m n And the set of multiplicative inverses of each modulus {M1, M2, ..., M} n} where Mi = M / mi, and we need to find the inverse Yi such that Mi × Yi ≡ 1 (mod mi). These calculation results constitute the CRT parameter set, which is used for subsequent secret sharding and reconstruction processes. The generation of the CRT parameter set is a one-time calculation process that can be completed in advance and securely stored to reduce real-time computation overhead.

[0104] Based on the CRT parameter set, a unidirectional asymptotic ideal disjunction level transformation function is designed such that any number of shares less than t cannot obtain any information about the secret to be fragmented, thus obtaining the asymptotic ideal disjunction level transformation function. The asymptotic ideal disjunction level (AONT) is a special type of cryptographic transformation whose core characteristic is all-or-nothing: either the complete output information is obtained, or no useful input information is obtained. In this system, the AONT transformation function is designed as a composite function, including two main stages: forward transformation and backward protection.

[0105] In the forward transformation phase, the original secret S is processed through a series of cryptographic one-way functions (such as SHA-256 or AES encryption) to generate a temporary state value. This process ensures that even if a partial output is obtained, the original input cannot be reversed. For scenarios with high security requirements, the number of iterations can be increased or more complex combinations of hash functions can be used.

[0106] In the backward protection phase, the temporary state value is XORed with the mask value generated by a secure random number generator, further increasing the difficulty of reconstruction. This design ensures that even if an attacker obtains t-1 shares, they cannot obtain any part of the original secret, achieving security in the sense of information theory. The key to this phase is that the generation of the mask value must be sufficiently random, typically using a cryptographically secure random number generator (such as a random number generator based on a hardware entropy source).

[0107] The implementation of the AONT transform function requires careful design to ensure it satisfies the following properties: unidirectionality (the input cannot be directly derived from the output), diffusivity (a small change in the input leads to a significant change in the output), and completeness (the input can only be reconstructed by obtaining the entire output). These properties collectively ensure the security of the secret-sharing mechanism, preventing attackers from deriving the complete secret from partial information.

[0108] Based on the asymptotically ideal disjunctive hierarchical transformation function and the secret to be fragmented, the asymptotically ideal disjunctive hierarchical transformation function is applied to the secret to be fragmented, and the transformed secret is mapped into n secret shares using the CRT parameter set, resulting in a secret share generation algorithm. In this step, the AONT transformation function F is first applied to the secret to be fragmented, resulting in the transformed secret S'. This transformation ensures the security property: even if an attacker obtains t-1 secret shares, they cannot obtain any information about the original secret S.

[0109] After the transformation, S' is mapped to n secret shares using the CRT parameter set. Specifically, the system first decomposes S' into t sub-secrets {s1, s2, ..., s}. t Each sub-secret represents a portion of the original secret. The decomposition can be a simple bit partition (for binary data) or polynomial coefficients (for the Shamir secret-sharing scheme).

[0110] Next, using the previously calculated CRT parameter set, the t sub-secrets are mapped to n secret shares using the Remainder Theorem. This mapping process ensures that any t shares can reconstruct the original secret, while fewer than t shares will not yield any useful information. The generation of each secret share includes: calculating the combination of the sub-secret and the corresponding CRT parameters; applying modular arithmetic to ensure the share is within a specified range; and adding verification information for subsequent validation of the share's validity.

[0111] The output of the secret share generation algorithm G is a set of secret shares {s1, s2, ..., s}. n Each share contains fragments of information needed for reconstruction and additional data for verification. The storage and transmission of shares require security measures, such as encrypted channels and access controls, to prevent unauthorized access.

[0112] Based on the secret share generation algorithm and the CRT parameter set, a reconstruction function is constructed that can recover the secret to be fragmented using the residual theorem based on at least t secret shares. A verification mechanism is designed to ensure the validity of the secret shares through hash verification or digital signature, resulting in a secret reconstruction mechanism. The secret reconstruction mechanism is another core component of the secret sharing system, responsible for collecting sufficient secret shares from the distributed environment and reconstructing the original secret. This mechanism includes three main stages: share collection, integrity verification, and secret reconstruction.

[0113] During the share collection phase, at least t secret shares are collected from distributed nodes. The collection process employs secure communication protocols (such as TLS) to ensure secure transmission and implements access control mechanisms to prevent unauthorized collection. To improve efficiency, the system can implement a parallel collection strategy, sending requests to multiple nodes simultaneously, and stopping requests once enough shares have been collected.

[0114] After collecting the shares, the integrity verification phase begins. Each collected secret share is verified to ensure it has not been tampered with or corrupted. Verification methods include hash verification (comparing the share to its pre-calculated hash value) and digital signature verification (verifying the share's signature using a public key). Hash verification is suitable for internal systems, while digital signatures are more suitable for distributed environments across organizations. For critical application scenarios, the system can also implement a dual verification mechanism, using both hash verification and digital signatures simultaneously.

[0115] After successful verification, the secret is reconstructed using the Remainder Theorem. The specific steps include: extracting information from the valid shares, applying the CRT algorithm to calculate intermediate results, and recovering the original secret through the inverse process of the AONT transformation. The computational complexity of the reconstruction process depends primarily on the modulus size and the number of shares. For typical configurations (such as a 1024-bit modulus and 10 shares), modern computing devices can complete the reconstruction in milliseconds.

[0116] To address potential errors, the secret refactoring mechanism also includes error handling functionality. When an invalid share is detected, the error is logged and an additional share is requested; if fewer than t valid shares are collected, the system will indicate refactoring failure and suggest increasing the collection scope. These measures ensure the system's reliability under various abnormal conditions.

[0117] Through the steps described above, this embodiment constructs a complete secret sharding and reconstruction mechanism, providing a theoretical foundation and algorithmic support for FLAG generation. This mechanism not only meets the security requirements of a distributed environment but also offers flexible configuration options to adapt to different application scenarios. Based on this mechanism, the system can effectively handle the needs of secret sharing and reconstruction in a distributed environment while ensuring security.

[0118] Example 3

[0119] like Figure 2 As shown, in this embodiment, the steps of collecting multi-source random factors, calculating the correlation weight matrix between the multi-source random factors using an attention network, and applying an optimization algorithm to allocate the multi-source random factors according to the correlation weight matrix include:

[0120] Step S21: Based on the system environment, collect timestamps, user identity features, device environment fingerprints, and system entropy pool random values ​​as the multi-source random factors, perform standardization processing and feature extraction on the multi-source random factors to obtain the original random factor set;

[0121] Step S22: Based on the original set of random factors, design a cross-attention network, calculate the relevance score of each random factor in the original set of random factors through a query-key-value mechanism and normalize it into a weight matrix to obtain the weight matrix and the attention-weighted factor representation;

[0122] Step S23: Based on the attention-weighted factor representation and the weight matrix, design a masking strategy optimization algorithm. According to the weight values ​​in the weight matrix, randomly allocate each factor component in the attention-weighted factor representation to different regions, and suppress the redundancy and predictability components in the attention-weighted factor representation through a dynamic masking mechanism to obtain the optimized random factor distribution.

[0123] Specifically, firstly, random factors are collected from multiple sources to ensure the randomness and unpredictability of the FLAG generation process. These random factors come from a wide range of sources, covering different dimensions of randomness, thereby enhancing the security of the system.

[0124] Timestamps are the most fundamental random factor, including system time, Network Time Protocol (NTP) synchronization time, and fine-grained clock cycle counts. Timestamps are collected with microsecond-level accuracy and combined with random offsets to reduce predictability. To prevent time backtracking attacks, historical timestamps are also recorded and consistency checks are performed.

[0125] User identity features include a user ID, behavioral characteristics, and session information. The user ID is a unique identifier that ensures the generated flag is associated with a specific user. Behavioral characteristics include the user's operation patterns, click sequences, and interaction timing; these features are specially processed to reflect the user's unique behavioral patterns. Session information includes a session identifier, login status, and permission level, providing contextual relevance for the flag.

[0126] Device environment fingerprints are data sets describing the characteristics of user devices, including hardware identifiers (such as MAC address and CPU serial number), system configuration information (such as operating system type, version, and list of installed software), and network characteristics (such as IP address, network interface configuration, and connection type). These characteristics are combined and hashed to form a unique identifier for the device, increasing the environmental relevance of the flag and improving anti-counterfeiting capabilities.

[0127] The system entropy pool random values ​​are high-quality random numbers obtained from the operating system's entropy collector. Modern operating systems typically maintain an entropy pool to collect randomness from hardware events such as keyboard input, mouse movements, and disk operations. These random values ​​are obtained through the Entropy Pool Random Number Generator (RNG) interface, and the quality of the entropy pool is periodically evaluated to ensure that the randomness meets cryptographic requirements.

[0128] After collecting the random factors, they are standardized and their features are extracted. The standardization process includes format unification (converting different types of data into a uniform format), range normalization (mapping values ​​to the [0,1] interval), and outlier handling (removing or replacing extreme values ​​that might affect the analysis). Feature extraction includes dimensionality reduction (using principal component analysis to reduce redundant features), feature enhancement (creating more discriminative new features by combining existing features), and feature encoding (converting categorical features into numerical representations). These processed random factors constitute the original set of random factors, providing the foundation for subsequent analysis.

[0129] Second, the cross-attention network is a special neural network structure that can capture the complex interactions between different random factors, providing a basis for random factor allocation. The core of this network is the query-key-value (QKV) mechanism, which originates from the Transformer architecture in the field of natural language processing, but has been specially optimized in this system to meet the needs of random factor processing.

[0130] In cross-attention networks, each random factor is first transformed into three distinct representations through a feature mapping layer: a query vector (Q), a key vector (K), and a value vector (V). The mapping process uses different weight matrices to ensure that the three representations capture different aspects of the original factor. The mapping function employs non-linear activations (such as ReLU or tanh) to enhance feature representation. The mapping dimension is flexibly adjusted according to system configuration, typically 1-4 times the original feature dimension.

[0131] After transformation, the dot product of the query vector and all key vectors is calculated to generate a relevance score matrix. This matrix reflects the correlation between each pair of random factors; a larger value indicates a stronger correlation. To prevent excessively large values ​​from causing gradient vanishing, the system scales the scores, typically by dividing by the square root of the key vector dimension. Subsequently, the system applies the softmax function to normalize the scores of each row, obtaining a weight matrix W. Normalization ensures that the sum of the weights corresponding to each query vector is 1, forming a probability distribution.

[0132] Finally, the weight matrix is ​​multiplied by the value vector to obtain the attention-weighted factor representation. This representation integrates information from all random factors but assigns different weights based on relevance, with a greater emphasis on factors with high security relevance. To further enhance expressive power, a multi-head attention mechanism can be implemented to simultaneously compute multiple different attention representations and merge the results. In high-security scenarios, it is recommended to use eight or more attention heads.

[0133] The cross-attention network is trained using unsupervised learning, optimizing network parameters by reconstructing or contrasting the target. Training data is derived from historical random factors collected by the system, ensuring the model adapts to the data distribution of the specific environment. After training, the network parameters are fixed and used to process new random factor inputs in real time.

[0134] Third, the masking strategy optimization algorithm is one of the innovations of this system. It significantly improves the security of FLAG generation by intelligently allocating randomness and suppressing predictable components. The algorithm consists of three main stages: weight analysis, randomness allocation, and dynamic masking.

[0135] In the weight analysis phase, the weight matrix generated by the cross-attention network is analyzed in depth to identify high-relevance and low-relevance regions. High-relevance regions represent factor combinations that contribute significantly to security and should be retained; low-relevance regions represent factor combinations that contribute little or are redundant and can be appropriately suppressed. Spectral clustering or hierarchical clustering algorithms are used to divide the weight matrix into multiple regions, with similar correlations within each region and significant differences between regions.

[0136] During the random allocation phase, random resources are preferentially allocated to highly correlated regions based on the values ​​in the weight matrix. Specifically, an allocation function is defined to map weight values ​​to random resources (such as bit count or entropy). This mapping function is typically non-linear to ensure that high-weight regions receive more resources. To balance resource utilization, a minimum resource guarantee is set, ensuring that even the least correlated regions receive basic randomness and preventing security risks caused by completely ignoring certain factors.

[0137] The dynamic masking stage is the core innovation of this algorithm. Based on context and historical data, a masking template is dynamically generated to cover redundant and predictable components in the attention-weighted factor representation. The masking process is similar to dropout in deep learning, but more purposeful—based on entropy estimation and pattern detection results, it identifies which locations contain predictable information and applies masks accordingly. The masking ratio is dynamically adjusted according to the security level, typically between 20% and 50%, with higher ratios used in high-security scenarios.

[0138] After masking, a compensation mechanism is applied to ensure that the overall randomness is not reduced by increasing the randomness of other regions or introducing additional entropy sources. The compensation mechanism uses an adaptive algorithm to adjust the compensation amount according to the masking ratio and the current system state, ensuring that the result meets the preset entropy requirements. After the entire optimization process is completed, the optimized random factor distribution is obtained. This distribution, while maintaining a high entropy value, focuses more on regions with high security relevance, effectively suppressing redundancy and predictable components.

[0139] Through the steps described above, this embodiment achieves the collection and optimization of multi-source random factors, providing a high-quality random source for subsequent FLAG generation. This method not only comprehensively utilizes multiple sources of randomness but also significantly improves the quality and security of randomness through cross-attention mechanisms and masking strategy optimization algorithms, effectively preventing prediction attacks targeting randomness generation.

[0140] Example 4

[0141] In this embodiment, the application of the secret share generation algorithm to fuse the multi-source random factors to obtain a random factor set includes:

[0142] Based on the optimized random factor distribution and the secret share generation algorithm, the timestamp, user identity features, device environment fingerprint and system entropy pool random value in the optimized random factor distribution are respectively used as secret inputs to be sharded. The secret share generation algorithm is applied to shard each random factor to obtain the secret share set corresponding to each random factor.

[0143] Based on the set of secret shares corresponding to each random factor, random shares from different sources in the set of secret shares corresponding to each random factor are merged by XOR operation or hash chain, and the Shannon entropy of the merged random factor is calculated to verify that it meets the cryptographic security requirements, thereby obtaining a set of random factors whose entropy value meets the preset threshold.

[0144] Specifically, firstly, the various random factors in the optimized random factor distribution are segmented, and each type of factor is converted into multiple safe shares to prepare for subsequent fusion.

[0145] First, four core random factors are extracted from the optimized random factor distribution: timestamp, user identity features, device environment fingerprint, and system entropy pool random value. These factors, after optimization processing as described in Example 3, have higher security relevance and lower predictability. The extraction process uses a masking template as a guide, prioritizing the selection of unmasked areas to ensure that the selected factors have sufficient randomness and security.

[0146] For timestamp randomness factors, not only is the original time information extracted, but also the time difference and incremental changes are calculated. For example, the time interval between the current request and the last request, and the offset of today's time from a reference time point can be recorded. These derived features increase the entropy of the timestamp and reduce its predictability. For high-security scenarios, time obfuscation techniques are also introduced, such as adding random delays or using time-segment hashes instead of precise times, to further enhance security.

[0147] For user identity features, the system extracts user ID, permission level, behavioral characteristics, and session information. The system hashes the user ID and combines it with a random salt value from the session to generate a unique user identifier for each session, avoiding direct exposure of the user ID. Behavioral feature extraction includes operation sequences, time interval patterns, and interaction habits. A sliding window technique is used to capture the behavioral patterns of the most recent N operations and compare them with historical patterns, extracting the differences as a component of a random factor.

[0148] Device environment fingerprinting is more complex, involving the extraction and combination of hardware identifiers, software configurations, and network features. A device fingerprint generation algorithm is used to comprehensively consider various device characteristics and generate a unique identifier for each device. To enhance security, the fingerprint generation rules are updated periodically, incorporating a time factor to ensure the device fingerprint maintains stability while possessing a degree of dynamism, thus preventing replay attacks.

[0149] The system entropy pool random values ​​are the most direct source of randomness, obtaining high-quality random numbers through the random number generation interface provided by the operating system. To ensure the quality of randomness, the entropy pool status is monitored. When the entropy value is insufficient, a delay strategy is adopted to wait for the entropy pool to re-accumulate, or a backup random source (such as a hardware random number generator) is activated. The obtained random values ​​are statistically tested to ensure that they meet the randomness test standards.

[0150] After factor extraction, each type of random factor is used as a secret to be sharded, and sharding is performed using the secret share generation algorithm in Example 2. The sharding process follows these principles: the security threshold t is dynamically adjusted according to the importance of the factors, with higher thresholds used for important factors; the number of shares n is determined based on the system size and performance requirements, typically set to 1.5-2 times the number of nodes to ensure sufficient redundancy to handle node failures; different AONT transformation functions and CRT parameter sets are used in the sharding process to avoid leakage of correlations between different factors.

[0151] After sharding, four sets of secret shares are obtained, each corresponding to a type of random factor, and each set contains n secret shares. These shares will be merged in the next step to generate the final set of random factors.

[0152] Second, the random factor shares from different sources are merged to generate a final high-entropy random factor set, providing a high-quality random source for FLAG generation.

[0153] First, suitable shares need to be selected from the four sets of secret shares for fusion. The selection strategy is based on two principles: maximizing security and optimizing entropy. For maximizing security, shares from different nodes are preferred to reduce the risk of single points of failure; for optimizing entropy, based on preliminary entropy estimation, share combinations with high entropy values ​​are preferred. In most configurations, t shares (where t is the security threshold) are selected for each type of random factor to form the fusion basis.

[0154] There are two main methods for fusion: XOR fusion and hash chain fusion. XOR fusion performs a bitwise XOR operation on secret shares from different sources to generate a new random value. This method is computationally efficient, but requires all input shares to be of the same length, usually requiring preprocessing to ensure consistency. The characteristic of XOR fusion is that as long as at least one input share has true randomness, the output will maintain high randomness, making it particularly suitable for mixing random sources of different qualities.

[0155] Hash chain fusion combines multiple shares into a new random value through iterative hash functions. First, an initial seed (usually a timestamp share) is chosen. Then, other shares are sequentially concatenated with the current hash value and a hash function is applied, forming a hash chain. The hash function chosen must satisfy cryptographic security requirements; commonly used ones include SHA-256 and SHA-3. The advantage of hash chain fusion is that it can generate a fixed-length output even with different input share lengths, and it exhibits an avalanche effect—small changes in the input can lead to significant differences in the output.

[0156] In practical applications, appropriate fusion methods can be selected based on security requirements and performance constraints, or two methods can be used simultaneously and their results combined to further enhance randomness. The fusion process can be hierarchical, first fusing within each type of random factor, and then performing cross-type fusion to form the final set of random factors.

[0157] After fusion, the generated random factor set undergoes rigorous quality checks, with the most important metric being Shannon entropy. Shannon entropy is a fundamental metric in information theory for measuring randomness; a higher value indicates better randomness. The Shannon entropy of the random factor set is calculated and compared to a preset threshold. For high-security scenarios, the entropy value is typically required to be close to the theoretical maximum (approximately 1 per bit). In addition to entropy, other randomness tests are performed, including frequency testing (checking the distribution of 0s and 1s), run-length testing (checking the length distribution of consecutive identical bits), and sequence correlation testing (checking the correlation between adjacent bits or blocks).

[0158] If the random factor set fails the quality check (e.g., the entropy value is below a preset threshold), remedial measures will be initiated, including: reselecting different share combinations, adjusting fusion parameters, introducing additional entropy sources (such as hardware random number generators), and reallocating randomness resources. This process may require multiple iterations until a random factor set that meets the requirements is generated.

[0159] Ultimately, a set of random factors with entropy values ​​satisfying a preset threshold is obtained. This set contains multiple high-quality random factors that can be used in the subsequent FLAG generation process. These random factors not only have high entropy values ​​but also incorporate randomness from various sources, greatly enhancing the system's security and resistance to attacks.

[0160] Through the random factor fusion process in this embodiment, multi-source random factors are successfully transformed into a high-quality set of random factors, providing a reliable randomness foundation for FLAG generation. The innovation of this method lies in combining secret sharing technology with randomness fusion, which not only ensures the security of random factors but also achieves effective fusion of random sources, solving the problems of single random source and high predictability in traditional randomness generation methods.

[0161] Example 5

[0162] In this embodiment, the design mapping function set maps the random factor set to different representation spaces, and the distributed consensus protocol is applied to coordinate the FLAG generation process among distributed nodes, including:

[0163] Based on the set of random factors, k different embedding space mapping functions are designed, including linear transformation, polynomial mapping and nonlinear neural network mapping. Each random factor in the set of random factors is mapped to k different representation spaces through the k different embedding space mapping functions to obtain a multidimensional representation vector set.

[0164] Based on the multidimensional representation vector set, a distributed consensus protocol is designed. The multidimensional representation vector set is transmitted between distributed nodes through a message passing mechanism, and a consensus algorithm is used to ensure that each distributed node reaches a consensus on the multidimensional representation vector set, thus obtaining the consensus algorithm and node coordination mechanism.

[0165] Specifically, firstly, the obtained set of high-entropy random factors is mapped to multiple different representation spaces, increasing system security and preparing for subsequent distributed consensus. Embedded space mapping is a technique that transforms raw data into vector representations of a specific dimension, employing various types of mapping functions to ensure the diversity and security of the representations.

[0166] First, determine the number of embedding spaces, k, by balancing security requirements and computational resources. For general applications, k can be set to 3-5; for high-security scenarios, k can be increased to 8-12. A larger k value results in higher system security, but also increases computational and storage overhead. After determining the k value, the system designs different types of mapping functions for each embedding space to ensure mapping diversity and prevent the exploitation of potential weaknesses in a single mapping function.

[0167] Linear transformations are the most basic type of mapping function, mapping random factors to a new representation space through matrix multiplication. The system generates a random projection matrix for each linear transformation; the matrix elements are generated using a cryptographically secure random number generator and are periodically updated to enhance security. The advantages of linear transformations are their high computational efficiency and simplicity of implementation, making them suitable for handling large amounts of data; their disadvantage is their limited expressive power, potentially failing to capture complex nonlinear relationships between random factors. To compensate for this deficiency, the system typically combines them with other nonlinear mapping functions.

[0168] Polynomial mapping is a nonlinear mapping method that maps random factors to a higher-dimensional representation space using polynomial functions. The system designs polynomial functions of different orders (typically from order 2 to 5) to capture the interactions between random factors. The coefficients of the polynomials are also generated securely and randomly, and rotated periodically. Polynomial mapping can express more complex relationships, but the computational complexity increases rapidly with increasing order and number of features. To control complexity, the system employs sparse polynomial representation, retaining only important interaction terms and discarding higher-order terms with less influence.

[0169] Nonlinear neural network mapping is the most complex and expressive mapping method, using a trained neural network model to map random factors to a nonlinear representation space. The system employs a multilayer perceptron or autoencoder architecture, containing multiple hidden layers and nonlinear activation functions (such as ReLU, tanh, or sigmoid). Network parameters are obtained through pre-training, aiming to maximize the discriminative power of samples in the representation space. To enhance security, the system introduces techniques such as weight perturbation and random deactivation, causing the same input to produce subtly different representations at different times, increasing the difficulty for attackers to predict.

[0170] For each random factor, the aforementioned k different mapping functions are applied to generate k different representation vectors. These representation vectors may have different dimensions and encoding methods, but they all retain the key information of the original random factor, forming a multidimensional representation vector set. The advantage of multidimensional representation is that it provides redundant representation of information; even if one mapping function has a vulnerability, other mapping functions can still maintain system security, achieving in-depth security defense.

[0171] In addition, metadata identifiers are added to each representation vector, including generation time, mapping function type used, version number, etc., to facilitate subsequent processing and verification. For particularly important random factors, the system also calculates the fingerprint of the representation vector (such as SHA-256 hash value) for subsequent integrity verification.

[0172] Second, distributed consensus is a key mechanism to ensure that nodes in a distributed system reach a consensus on a specific state or data. In this system, the distributed consensus protocol is used to coordinate the FLAG generation process among distributed nodes, ensuring that different nodes generate the same FLAG identifier, thereby guaranteeing the consistency and reliability of the system.

[0173] First, a dedicated message passing mechanism was designed for the efficient and secure transmission of multidimensional representation vector sets between distributed nodes. Message passing is based on a publish-subscribe model, where each node can both publish its own generated representation vectors and subscribe to representation vectors published by other nodes. To ensure transmission security, end-to-end encryption is employed, with each pair of nodes establishing an independent encrypted channel and using shared keys or Public Key Infrastructure (PKI) for authentication and encryption. Message compression is another important consideration, especially when the representation vector dimension is high. Compression algorithms optimized for vector data, such as Principal Component Analysis (PCA) dimensionality reduction or sparse coding, are used to significantly reduce the amount of data transmitted.

[0174] Based on message passing, a lightweight Byzantine Fault Tolerance (BFT) consensus algorithm is implemented, which can still reach consensus even if some nodes may fail or engage in malicious behavior. The BFT consensus process consists of three main phases: the proposal phase, the voting phase, and the confirmation phase.

[0175] During the proposal phase, proposing nodes are determined through rotation or random selection. Each proposing node collects all available multidimensional representation vectors, combines them into a proposal block, and broadcasts it to all participating nodes. A proposal block contains the complete set of multidimensional representation vectors, a timestamp, the proposing node's signature, and a hash reference to the previous block (if applicable). To prevent Byzantine nodes from proposing multiple proposals (i.e., the "double-spending" problem), the system implements strict proposal rules and an evidence mechanism, allowing other nodes to detect and punish violations.

[0176] During the voting phase, each node verifies the received proposal block. The verification process includes format checking, signature verification, timestamp validity checking, and vector content verification. Vector content verification is particularly important; nodes check whether the representation vector conforms to the expected pattern and whether it contains outliers or obvious signs of tampering. If verification passes, the node votes in favor of the proposal and broadcasts the vote message; otherwise, it votes against it. The voting message includes the node ID, the proposal block hash, the voting result, and the node signature, ensuring the transparency and verifiability of the voting process.

[0177] The confirmation phase is the final decision-making stage. A weighted majority decision-making mechanism is employed; a proposal is confirmed as valid when it receives more than a preset threshold (typically 2 / 3) of the votes. The threshold setting must balance security and liveness—an excessively high threshold may hinder consensus, while an excessively low threshold may reduce security. After confirmation, the multidimensional representation vector set in the proposal block is accepted by all nodes as a final consensus state, used for subsequent FLAG generation. To handle extreme cases such as network partitioning, a recovery mechanism is also implemented. When different sub-networks are detected to have different consensuses, conflicts are resolved using preset rules (such as "longest chain first").

[0178] In addition to the basic BFT consensus, a node coordination mechanism is implemented to address practical issues such as node heterogeneity, dynamic joining / leaving, and load balancing. This mechanism includes member management (tracking the list of active nodes), role assignment (assigning different responsibilities based on node capabilities), and fault recovery (detecting and handling node failures). For large-scale deployments, a hierarchical coordination strategy is adopted, grouping nodes for management to reduce communication complexity.

[0179] Through the above design, a highly efficient and reliable distributed consensus protocol is achieved, ensuring that all participating nodes reach a consensus on the multi-dimensional representation vector set, laying the foundation for unified FLAG generation. While guaranteeing security, this protocol considers various challenges in real-world environments, such as network instability, node failures, and malicious attacks, demonstrating strong practicality and robustness.

[0180] Example 6

[0181] In this embodiment, the step of collaboratively generating a FLAG identifier in a distributed environment using the secret reconstruction mechanism and encrypting it to obtain an encrypted FLAG identifier and corresponding verification information includes:

[0182] Based on the consensus algorithm and node coordination mechanism, the multidimensional representation vector set and the secret reconstruction mechanism, each distributed node uses the secret reconstruction mechanism to collect the secret share corresponding to the multidimensional representation vector set from at least t nodes and reconstructs the complete random factor. The hash function is applied to the reconstructed random factor to generate a FLAG identifier, and the original FLAG identifier is obtained.

[0183] Based on the original FLAG identifier, a key pair is generated, the original FLAG identifier is encrypted using the private key in the key pair, and the encrypted FLAG identifier is digitally signed using the private key in the key pair, resulting in an encrypted FLAG identifier and a corresponding digital signature.

[0184] Based on the encrypted FLAG identifier and the corresponding digital signature, verification information including the digital signature, the public key in the key pair, the timestamp, and the validity period is generated, thus obtaining the encrypted FLAG identifier and the corresponding verification information.

[0185] Specifically, firstly, by leveraging a consensus-based multidimensional representation vector set and a secret reconstruction mechanism, FLAG identifiers are collaboratively generated to ensure the consistency and security of FLAGs in a distributed environment.

[0186] First, each distributed node prepares to begin the FLAG generation process based on the final multi-dimensional representation vector set determined by the consensus algorithm. Nodes participating in FLAG generation undergo authentication and permission checks to ensure that only authorized nodes can participate. Authentication employs a multi-factor authentication method, combining digital certificates, node feature verification, and behavioral analysis to effectively prevent identity forgery. Permission checks are based on preset policy rules, determining a node's participation permissions according to its role, trust level, and historical performance. Through these security measures, the system establishes a trusted participant environment, providing a guarantee for subsequent collaborative generation.

[0187] Secret share collection is the first step in collaborative generation. Each node needs to collect secret shares from at least t nodes in the distributed environment, where t is the security threshold defined in Example 2. The collection process adopts an active request model, where nodes send share request messages with digital signatures to other participating nodes. After verifying the legitimacy of the request, the receiving nodes return the secret shares they hold. To prevent network eavesdropping and man-in-the-middle attacks, the share transmission process uses end-to-end encryption, and each transmission uses a one-time session key. A share traffic obfuscation technique is also implemented, which prevents the inference of share content or transmission pattern through traffic analysis by adding interference traffic and random delays.

[0188] Once a sufficient number of shares have been collected, the node enters the share verification phase. Each received secret share needs to pass integrity verification and consistency verification. Integrity verification uses additional verification data (such as hash values ​​or digital signatures) to ensure that the share has not been tampered with; consistency verification checks whether the share corresponds to the multidimensional representation vector set reached in consensus, preventing the use of expired or irrelevant shares. Shares that fail verification are discarded, and the system requests additional shares to replace them until enough valid shares are obtained. To improve efficiency, the verification process uses batch processing, verifying multiple shares simultaneously, and uses a caching mechanism to store the state of verified shares.

[0189] Subsequently, the nodes reconstruct the complete random factor using a secret reconstruction mechanism. The reconstruction process strictly follows the algorithm designed in Example 2, recovering the original random information from the effective shares based on the residual theorem and the inverse AONT transform. For each vector in the multidimensional representation vector set, the reconstruction process is performed individually to obtain the corresponding random factor. To ensure the correctness of the reconstruction results, a result verification mechanism is implemented, such as using redundant shares for cross-validation or applying a pre-embedded CAPTCHA to check the reconstruction output. If a reconstruction anomaly is detected, an anomaly handling process is triggered, which may include recollecting shares, enabling the backup reconstruction algorithm, or adjusting the threshold parameters.

[0190] Finally, the reconstructed set of random factors is processed one-way using a hash function to generate a FLAG identifier. The choice of hash function must meet cryptographic security requirements, typically using standard hash algorithms such as SHA-256 or SHA-3. To enhance security, multiple hashing (e.g., applying SHA-256 first, then BLAKE2) or a custom hash function (based on standard hashing but with additional transformation steps) may be used. The hashing process ensures that the FLAG identifier has a fixed length, is irreversible, and is highly discrete, making it impossible for attackers to deduce the original random factors from the FLAG identifier. The generated FLAG identifier is then normalized to ensure a consistent format that meets application requirements, such as truncating to a specific length, converting to a specific character set (e.g., Base64 encoding), or adding a checksum.

[0191] Through the above process, the original FLAG identifier was successfully generated. This identifier integrates consensus information and random contributions from multiple nodes, possessing high security and uniqueness, laying the foundation for subsequent encryption protection and verification information generation.

[0192] Second, the original FLAG logo is encrypted and signed to enhance its anti-counterfeiting capabilities and security.

[0193] First, a key pair is generated based on the original FLAG identifier. Key generation uses a deterministic key derivation function (KDF), using the FLAG identifier as a seed to derive stable key material. The KDF design adheres to cryptographic security principles, ensuring that even with similar seeds, the generated keys will be significantly different. Commonly used KDFs include HKDF (HMAC-based key derivation function) and PBKDF2 (cryptographic key derivation function). HKDF is usually chosen because it is designed for high-entropy inputs and is suitable for handling FLAG identifiers that already possess randomness. After the KDF output, it is split into private and public key material, and then the final key pair is generated using an asymmetric cryptographic algorithm (such as RSA, ECC, or EdDSA). For resource-constrained scenarios such as mobile environments, elliptic curve cryptography algorithms (such as ECDSA or EdDSA) are preferred because they provide equivalent security but with shorter key lengths and lower computational overhead.

[0194] After the key pair is generated, the original FLAG identifier is encrypted using the private key. This "encryption" is actually a special protection mechanism, as asymmetric encryption is generally not used for encrypting long data (such as potentially long FLAG identifiers). A hybrid encryption scheme is employed: first, a one-time symmetric key (such as an AES-256 key) is generated and used to encrypt the FLAG identifier; then, this symmetric key is encrypted using the asymmetric private key. This scheme combines the high efficiency of symmetric encryption with the secure key management of asymmetric encryption. The choice of encryption mode affects both security and efficiency; typically, GCM (Galovar Counter Mode) or AEAD (Authenticated Encryption and Associated Data) modes such as ChaCha20-Poly1305 are used to provide dual protection of encryption and authentication.

[0195] After encryption, a digital signature is generated for the encrypted FLAG identifier using the same private key. The signing process first calculates the hash digest of the encrypted FLAG (using a hash function such as SHA-256), and then performs a signing operation on the digest using the private key. The signing algorithm matches the key type used; for example, RSA keys use RASSA-PSS or RASSA-PKCS1-v1_5, and elliptic curve keys use ECDSA or EdDSA. The signature provides integrity guarantees and source authentication, ensuring that the FLAG has not been tampered with and comes from a legitimate system. To enhance security, a multi-signature mechanism may be implemented, requiring multiple authoritative nodes to generate signatures separately, forming a signature chain or signature tree structure.

[0196] Key management is a key challenge in this step. Private keys must be stored securely, typically using a Hardware Security Module (HSM) or Trusted Platform Module (TPM) for physical isolation; for environments without dedicated hardware, software cryptographic vaults are used, combined with access control and monitoring mechanisms. Keys also need to be rotated periodically, usually based on time periods (e.g., every 7 or 30 days) or usage frequency (e.g., after every 1000 flags generated). During rotation, key updates across all nodes need to be coordinated to ensure a smooth transition without impacting service.

[0197] Through the above processing, an encrypted FLAG identifier and its corresponding digital signature are obtained. Encryption protection prevents unauthorized parties from accessing the FLAG content, while signature protection ensures the FLAG's origin is verifiable and its content is complete. Together, they provide strong security guarantees.

[0198] Based on the encrypted FLAG identifier and corresponding digital signature, verification information including the digital signature, the public key in the key pair, the timestamp, and the validity period is generated, resulting in the encrypted FLAG identifier and corresponding verification information. In this step, a complete verification information package is constructed around the encrypted FLAG identifier, enabling the recipient to verify the validity, origin, and timeliness of the FLAG.

[0199] The core component of the verification message is the digital signature, which was generated in the previous step. This signature is embedded in the verification message package as fundamental evidence of the FLAG's integrity and source authentication. In addition to the original signature, signature metadata, such as the signature algorithm identifier, signature generation time, and signature version number, may be added to facilitate the recipient's correct verification of the signature.

[0200] The public key is the second crucial component for verifying the message; the recipient uses it to verify the digital signature. The system needs to encode the public key in the key pair into a standard format (such as an X.509 certificate or PEM format) and embed it into the verification message packet. To enhance the trustworthiness of the public key, a public key certificate chain is typically added, tracing the public key back to a pre-trusted root certificate to form a complete chain of trust. In complex multi-organizational environments, cross-domain certificate verification mechanisms may be implemented to support interoperability between different trust domains.

[0201] The timestamp is the third component verifying the information, marking the exact time the FLAG was generated. The generated timestamp must meet accuracy and verifiability requirements. To ensure accuracy, Network Time Protocol (NTP) or Precision Time Protocol (PTP) are typically used to synchronize time sources, and internal clocks are periodically calibrated. To enhance verifiability, trusted timestamp services may be used to obtain time proofs with authoritative signatures, or a blockchain-based distributed timestamp mechanism may be implemented, utilizing consensus algorithms to ensure the immutability of timestamps. In some high-security scenarios, timestamps from multiple time sources may be recorded, and reliability is enhanced through comparison.

[0202] The expiration date defines the time limit for a flag's use and is a key mechanism to prevent replay attacks. A reasonable expiration date should be set based on security requirements and use cases, typically ranging from a few minutes to several hours. The expiration date can be an absolute time (e.g., "Valid until 14:30:00 on 2023-04-01") or a relative time (e.g., "Valid within 30 minutes of generation"). For high-risk scenarios, a stricter one-time use policy may be implemented, requiring the flag to expire immediately after use, regardless of whether the expiration date has been reached. The expiration date setting needs to balance security and user experience—a too short expiration date increases security but may lead to frequent refreshes, impacting user experience; a too long expiration date improves the experience but increases the risk of attacks.

[0203] In addition to the four core components mentioned above, the verification information packet may also contain other auxiliary information: usage context (such as allowed application IDs, IP ranges, geographical locations, etc.), security level identifier (indicating the security strength and applicable scenarios of the flag), serial number (for tracking and auditing), and version information (indicating the flag format and processing rule version). This auxiliary information enhances the system's flexibility and security, supporting more granular access control and audit trails.

[0204] Finally, the verification message packet is bound to the encrypted FLAG identifier to form a complete FLAG data structure. The binding method can be a simple concatenation (appending the verification message to the end of the FLAG) or a complex embedding (encoding the verification message at a specific location on the FLAG). A format header and checksum are also added to the overall structure to ensure reliable transmission and parsing. The final output FLAG and verification message use a common data format (such as JSON, XML, or binary formats like Protocol Buffers) to ensure cross-platform compatibility.

[0205] This embodiment successfully realizes the collaborative generation and protection of FLAGs in a distributed environment. The generated FLAG identifiers have key characteristics such as anti-counterfeiting, anti-tampering, and verifiability, providing strong security for applications.

[0206] Example 7

[0207] In this embodiment, after obtaining the encrypted FLAG identifier and corresponding verification information and before constructing the cache architecture, the following steps are also included:

[0208] Based on the encrypted FLAG identifier and corresponding verification information, historical usage data is used to extract features and perform cluster analysis on multi-protocol traffic in the historical usage data through an unsupervised learning model. This identifies abnormal behaviors and potential attack patterns that deviate from the normal pattern, and yields a security threat assessment report.

[0209] Based on the system operating environment, CPU utilization, memory usage, network latency, and request queue length are collected in real time to calculate the system load index and obtain a system load report;

[0210] Based on the security threat assessment report and the system load report, an adaptive decision-making algorithm is designed. Through a multi-objective optimization model, the security threat level in the security threat assessment report and the system performance constraints in the system load report are weighed, and the optimal parameters of FLAG generation complexity, length and update frequency are dynamically calculated to obtain the FLAG complexity parameter set.

[0211] Based on the FLAG complexity parameter set, the threshold in the secret reconstruction mechanism is updated according to the generation complexity parameter in the FLAG complexity parameter set, the random source weight in the random factor selection strategy is updated according to the length parameter in the FLAG complexity parameter set, and the time interval and event threshold in the triggering conditions are updated according to the update frequency parameter in the FLAG complexity parameter set, to obtain the optimized FLAG strategy configuration.

[0212] Specifically, firstly, an intelligent security analysis mechanism was established to identify potential security threats by analyzing historical usage data of FLAG, providing a basis for decision-making in subsequent adaptive adjustments.

[0213] First, historical FLAG usage data is collected and preprocessed. This data comes from multiple sources: FLAG validation logs (recording detailed information for each validation request), system audit logs (recording system operations and status changes), and network traffic logs (recording network interactions related to FLAGs). The preprocessing includes data cleaning (removing noise and outliers), feature extraction (extracting structured features from raw logs), and data standardization (unifying the format and scale of data from different sources). To handle large-scale data, a streaming processing architecture is adopted to extract key features in real time and generate summary statistics, reducing storage and computational burden.

[0214] A key innovation in data collection is multi-protocol traffic analysis. Traditional security analysis often focuses on a single protocol layer, while this system can collect and correlate data across protocol layers, including the application layer (HTTP, HTTPS, WebSocket, etc.), transport layer (TCP, UDP), and network layer (IP, ICMP). Through protocol semantic understanding and session reconstruction, a complete interactive view is established to capture evidence of cross-protocol attacks. For example, it can correlate the use of flags in HTTP requests with corresponding TCP connection characteristics and IP traffic patterns, discovering complex attacks that traditional single-protocol analysis cannot detect.

[0215] The collected data undergoes feature engineering to convert it into a format that can be processed by machine learning algorithms. Three key feature categories are extracted: temporal features (describing the time pattern of FLAG usage, such as usage frequency and time interval distribution), behavioral features (describing usage methods, such as request parameter patterns, error rates, and retry patterns), and contextual features (describing the usage environment, such as source IP distribution, device type, and geographical location). For high-dimensional features, dimensionality reduction techniques such as Principal Component Analysis (PCA) or t-SNE are applied to preserve information while reducing computational complexity.

[0216] After feature extraction, unsupervised learning models are applied for anomaly detection and pattern discovery. Unsupervised learning does not require pre-labeled attack samples, making it suitable for discovering unknown threats. Several unsupervised learning algorithms are implemented: density-based algorithms (such as DBSCAN, which identifies anomalies with significantly lower density than their surroundings), distance-based algorithms (such as Local Outlier Factor (LOF), which calculates the relative density of a sample with its neighbors), and deep learning methods (such as autoencoders, which learn compressed representations of normal data and use reconstruction errors to identify anomalies). To enhance detection capabilities, the system employs an ensemble learning approach, combining the results of multiple base models to reduce false positives and false negatives.

[0217] Cluster analysis is a crucial step in anomaly pattern classification. Using hierarchical clustering or spectral clustering algorithms, detected anomalies are grouped to identify attack patterns with similar characteristics. Clustering results are evaluated using various metrics, such as the silhouette coefficient (measuring cluster tightness and separation) and the Davies-Bouldin index (assessing the ratio of intra-cluster similarity to inter-cluster difference). The clustering process is iterative and optimized; the system tries different clustering parameters and algorithms, selecting the result that best reflects the inherent structure of the data.

[0218] Finally, a security threat assessment report is generated based on the analysis results. The report includes the following key components: anomaly detection summary (number, type, and severity of detected anomalies), attack pattern analysis (types, characteristics, and potential impact of identified attacks), risk trends (the changing trend of threat levels over time), and system vulnerability assessment (potential vulnerabilities or design flaws in FLAG systems). The report employs a hierarchical structure, providing multi-level views from high-level summaries to detailed technical analysis to meet the needs of different users. The report also includes visualization components such as anomaly distribution heatmaps, time-series trend charts, and attack pattern relationship diagrams to intuitively present the security posture.

[0219] Security threat assessment reports not only describe the current situation but also provide predictive analysis and recommended actions. Predictive analysis, based on historical trends and patterns, estimates the likelihood and potential impact of future attacks. Recommended actions, addressing detected threats, propose specific defense strategies and system optimization directions, providing direct input for subsequent adjustments to FLAG (Fly, Grow, Achieve) strategies.

[0220] Second, a comprehensive performance monitoring mechanism has been established to collect and analyze the system's operating status, assess the current load level, and provide performance constraints for adjusting the FLAG strategy.

[0221] Performance monitoring covers all aspects of the system, from the underlying hardware to the application layer. CPU utilization monitoring not only tracks overall utilization but also records the user-mode / kernel-mode ratio, context switching frequency, and interrupt handling time, providing a comprehensive assessment of processor load. For multi-core / multi-processor systems, monitoring tracks the load distribution of each core, identifying potential imbalances. CPU monitoring employs low-overhead sampling techniques, collecting multiple sampling points per second to generate accurate utilization curves. For critical operations (such as flag generation and verification), CPU time consumption is also recorded to assess computational intensity.

[0222] Memory usage monitoring includes physical memory usage, virtual memory swapping, and memory allocation patterns. It tracks overall memory utilization, available physical memory, and page swapping frequency to assess memory pressure. For components implemented in garbage-collected languages, monitoring also includes heap memory usage patterns and garbage collection frequency / duration to identify potential memory leaks or garbage collection bottlenecks. Memory monitoring pays particular attention to the memory usage of FLAG-related data structures (such as caches and session storage) to assess the impact of different FLAG strategies on memory requirements.

[0223] Network latency monitoring is a key metric for evaluating the performance of distributed systems. Multi-level latency monitoring was implemented, including TCP connection establishment time, request-response round-trip time, and message passing latency between nodes. Monitoring employed a combination of proactive and reactive methods—passively monitoring the latency of actual business traffic, and proactively sending probe packets periodically to assess network conditions. To assess network quality fluctuations, the mean, variance, and percentile distribution of latency were calculated to identify transient congestion and long-tail latency issues. In geographically distributed deployments, latency matrices across different regions were also monitored to assess global network conditions.

[0224] Request queue length monitoring reflects the balance between system processing capacity and request load. It tracks queue lengths at each processing stage, including inbound request queues, processing queues, and queues waiting for resources. Queue monitoring not only records lengths but also tracks the distribution of request waiting times within the queues, identifying potential processing bottlenecks. A queue alert mechanism is implemented; when queue length or waiting time exceeds preset thresholds, an alert is triggered and detailed context is recorded for subsequent analysis. For distributed queuing systems, monitoring also includes queue balance metrics to assess the uniformity of load distribution.

[0225] Based on collected multidimensional performance metrics, the Comprehensive Load Index (CLI) is calculated, providing a single measure of the overall system load status. The CLI is calculated by weighting various metrics, with the weights dynamically adjusted according to system characteristics and business importance. For example, CPU utilization has a higher weight for compute-intensive operations; network latency and queue length have higher weights for I / O-intensive operations. CLI values ​​range from 0 to 100, representing states from idle to extremely overloaded, typically divided into five intervals: Normal (0-40), Light Load (41-60), Moderate Load (61-75), Heavy Load (76-90), and Extreme Load (91-100).

[0226] The system load report is a structured output of monitoring results, containing the following core components: load summary (CLI values ​​and their constituent components), resource usage trends (curves showing changes in various metrics over time), bottleneck analysis (identifying performance bottlenecks in the system and their causes), and capacity assessment (estimating the system's maximum processing capacity and current utilization). The report also includes predictive analytics, which, based on historical data and load patterns, predicts short-term (minute-level) and medium-term (hour-level) load changes, providing a basis for proactive resource scheduling.

[0227] To support performance management in complex environments, the system load report provides multi-dimensional views: a component view (analyzing the load status of each functional component), a node view (comparing the performance characteristics of different physical / virtual nodes), and a time view (showing load fluctuations and periodic patterns over time). These multi-dimensional views help administrators comprehensively understand system performance and identify complex issues that may be masked by a single metric.

[0228] Third, it implements an adaptive decision-making mechanism that intelligently balances security and performance requirements, providing dynamic optimization for the FLAG strategy.

[0229] The core of the adaptive decision-making algorithm is a multi-objective optimization model, which balances safety and performance as two competing objectives. Traditional methods often simplify multi-objectives into single-objectives using fixed weights, while this system employs a more advanced Pareto optimization method to find a set of non-dominated solutions (i.e., solutions that cannot simultaneously improve all objectives), and then selects the optimal solution based on the current environment. This method avoids the subjectivity of predefined fixed weights and can adapt to the dynamic needs of different scenarios.

[0230] The decision-making process begins with constructing objective functions. The security objective function, based on a security threat assessment report, quantifies threat level, attack complexity, and impact scope into security risk scores. The performance objective function, based on a system load report, quantifies resource utilization, response time, and throughput into performance cost scores. The objective function design employs a non-linear model to reflect the complex relationship between security measures and resource consumption—for example, security improvements typically require increasing resource investment, exhibiting diminishing marginal returns.

[0231] The optimization variables include three key parameters of a FLAG: generation complexity, length, and update frequency. Generation complexity controls the computational intensity of the FLAG generation algorithm, including the number of encryption rounds, hash iterations, and random number quality requirements; FLAG length affects its resistance to brute-force attacks and storage / transmission overhead; update frequency determines the FLAG's lifespan, impacting security and system load. These parameters have complex interactions and require holistic optimization rather than independent adjustment.

[0232] The optimization process is subject to various constraints: performance constraints (such as maximum acceptable latency and minimum throughput requirements), resource constraints (such as available computing resources and memory limitations), and security constraints (such as minimum entropy requirements and minimum validity period). These constraints are set according to business needs and system capabilities to ensure that the optimization results remain within the feasible region. Constraint handling employs a penalty function method, transforming the degree of constraint violation into a penalty term in the objective function, guiding the optimization process towards a feasible solution.

[0233] The optimization algorithm is selected based on the problem size and characteristics. For low-dimensional parameter spaces, the system uses grid search or Bayesian optimization; for complex parameter relationships, evolutionary algorithms (such as the NSGA-II non-dominated sorting genetic algorithm) or multi-objective variants of particle swarm optimization are employed. To handle dynamic environments, the algorithm implements online learning capabilities, adjusting the optimization direction based on newly observed system responses. The algorithm employs a progressive strategy, first performing coarse-grained exploration to identify promising regions, then performing fine-grained search to find the exact solution, balancing computational efficiency and optimization quality.

[0234] The optimization result is a set of FLAG complexity parameters, containing optimal values ​​for three key parameters: generation complexity (e.g., encryption strength level, number of hash iterations), length (FLAG length or number of characters), and update frequency (validity period, update trigger conditions). The parameter set also includes acceptable ranges for each parameter, allowing the system to make minor adjustments under specific conditions to improve adaptability. For different application scenarios (e.g., login verification, payment authorization, API access control), independent parameter configuration files are maintained and optimized for the characteristics of each scenario.

[0235] Another important characteristic of decision-making algorithms is their adaptive learning capability. The actual effects of parameter adjustments (such as changes in security incident rates and system response times) are recorded, and these observations are fed back into the decision model to continuously optimize the decision rules. This closed-loop feedback mechanism allows the system to learn from experience, and the quality of decisions gradually improves with increasing runtime. To prevent over-adaptation to short-term fluctuations, a smoothing mechanism is implemented, combining short-term observations with long-term trends in decision-making.

[0236] Fourth, the optimization results are applied to all aspects of FLAG generation and management to achieve dynamic adjustment of strategies.

[0237] First, based on the generation complexity parameters in the FLAG complexity parameter set, update the threshold settings in the secret reconstruction mechanism. This mainly involves adjusting the security threshold t, which is the minimum number of shares required to reconstruct the secret. When the security threat level increases, the threshold may be increased to require more nodes to participate in the reconstruction process, increasing the difficulty of the attack; when the system load is too high, the threshold may be appropriately reduced to reduce communication and computational overhead. The threshold adjustment follows these rules: the security threshold t must be greater than half of the total number of nodes n (t > n / 2) to ensure the system's resistance to Byzantine faults; the threshold change range is limited to ±25% of the previous setting to avoid drastic fluctuations leading to instability; in high-security scenarios, a minimum threshold lower limit is set to ensure that basic security is not excessively affected by performance considerations.

[0238] In addition to the threshold t, other refactoring parameters are also updated: validation strength (controlling the strictness of share validation), refactoring timeout (limiting the maximum waiting time for a refactoring operation), and error tolerance (specifying the allowed proportion of invalid shares). These parameters work in conjunction with the master threshold to determine the balance between security and efficiency in the secret refactoring process. The parameter update process is an atomic operation, ensuring that all relevant components are updated synchronously, avoiding errors or vulnerabilities caused by parameter inconsistencies.

[0239] Secondly, based on the length parameter in the FLAG complexity parameter set, the random source weights in the random factor selection strategy are updated. Different random sources have varying entropy quality and generation costs; by adjusting the weights, the system can optimize the balance between randomness and performance. Specific adjustments include: timestamp random factor weight (controlling the proportion of time-related randomness), user identity feature weight (controlling the influence of user-related information), device environment fingerprint weight (controlling the importance of environmental factors), and system entropy pool random value weight (controlling the proportion of purely random numbers). These weight adjustments reflect the level of trust in different random sources and the resource allocation strategy.

[0240] Weight updates follow a normalization constraint that sums to 1, ensuring a reasonable allocation of relative importance among random sources. A minimum weight guarantee is also implemented, ensuring that each random source maintains a minimum weight (typically no less than 5%) even in extreme cases, preventing the complete neglect of potential vulnerabilities caused by certain types of randomness. For high security requirements, the weight of entropy pool random values ​​is increased to enhance unpredictability; for resource-constrained environments, the weights of computationally less expensive timestamps and user features may be increased to save resources.

[0241] Random source weight adjustment also includes secondary parameter updates: random factor sampling rate (controlling the data collection frequency of each type of random source), preprocessing intensity (specifying the complexity of random data processing), and entropy estimation threshold (setting the minimum entropy requirement for accepting random factors). These parameters collectively determine the quality and generation efficiency of random factors, and have a significant impact on FLAG security.

[0242] Next, based on the update frequency parameter in the FLAG complexity parameter set, the time interval and event threshold in the trigger conditions are updated. The FLAG update mechanism includes two triggering methods: time-based periodic updates and event-based condition-triggered updates. The time interval parameter controls the frequency of periodic updates and is dynamically adjusted according to security requirements and system load. High-security environments may require more frequent updates (e.g., every 5 minutes or hour), while low-load scenarios can tolerate longer intervals (e.g., daily or weekly). The time interval setting considers user experience factors; overly frequent updates may annoy users, especially in scenarios requiring user interaction.

[0243] Event threshold parameters control the sensitivity of update triggers, including multiple trigger conditions: usage threshold (maximum number of times a flag is verified), security event threshold (number of detected suspicious activities), and environmental change threshold (magnitude of system state changes). These thresholds are dynamically adjusted based on the current security threat level and system load. Thresholds are lowered under high-threat conditions to increase update frequency, while thresholds are raised under high load conditions to reduce update overhead. An update rate limiting mechanism is also implemented to prevent excessively frequent updates from overloading the system in extreme cases; typically, a minimum update interval (e.g., not less than 30 seconds) is set as a safety valve.

[0244] The update triggering conditions also include a priority mechanism, with different types of triggering events having different priorities. For example, detecting a possible attack pattern is a high-priority trigger, which may immediately force a FLAG update; while a normal usage count reaching a threshold is a low-priority trigger, which may only execute the update when the system load allows. This hierarchical mechanism ensures that system resources are prioritized for responding to urgent security threats.

[0245] Finally, all updated parameters are integrated to generate the optimized FLAG strategy configuration. The configuration is stored in a structured format (such as JSON or XML), containing a complete set of parameters and metadata (such as generation time, optimization basis, and version number). The system implements a configuration version control mechanism to record historical configuration changes and support rollback to previous versions when necessary. Configuration distribution uses a secure channel to ensure that all distributed nodes receive the latest, consistent configuration, maintaining the consistency of the overall system behavior.

[0246] The adaptive FLAG complexity adjustment mechanism in this embodiment can intelligently balance security and performance requirements, maximize system efficiency while ensuring security, and provide the optimal FLAG protection strategy for different scenarios and changing environments.

[0247] Example 8

[0248] In this embodiment, a caching architecture is constructed to store the encrypted FLAG identifier, and a synchronization protocol is designed to transmit the encrypted FLAG identifier and corresponding verification information, including:

[0249] Based on the encrypted FLAG identifier and corresponding verification information, a multi-layer cache architecture including local fast cache, regional shared cache and global persistent storage is constructed. The encrypted FLAG identifier is stored in the multi-layer cache architecture, and a cache eviction policy is designed to obtain a cache management policy.

[0250] Based on the cache management strategy and the encrypted FLAG identifier and corresponding verification information, a synchronization protocol is designed to identify changes in the encrypted FLAG identifier through a version number mechanism, transmit the encrypted FLAG identifier and corresponding verification information, and use a compression algorithm to reduce the amount of data transmitted, thus obtaining the synchronization protocol.

[0251] Specifically, firstly, an efficient multi-level caching architecture was established to provide fast access and persistent storage capabilities for FLAG identifiers, while also taking into account the data consistency and fault tolerance requirements in a distributed environment.

[0252] A multi-tiered caching architecture is a layered storage design that distributes data across different tiers of the storage system based on access frequency, performance requirements, and persistence requirements. In this embodiment, the architecture comprises three main tiers: local fast cache, regional shared cache, and global persistent storage, each with specific functions and optimization goals.

[0253] Local fast caching is the caching layer closest to the application, directly integrated within each processing node, providing the fastest access speed. This caching layer uses memory storage technologies, such as in-heap caching or off-heap direct memory caching. In-heap caching uses Java heap memory, which is simple to implement but is affected by garbage collection; off-heap caching uses direct memory allocated by the operating system, avoiding garbage collection pauses, but requires additional memory management logic. The appropriate implementation method should be chosen based on the deployment environment. Generally, off-heap caching is used for scenarios requiring extremely low latency, while in-heap caching is used for simpler scenarios.

[0254] The typical size of the local cache ranges from several hundred MB to several GB, adjusted according to node hardware configuration and load characteristics. To optimize memory usage, compact data structures are implemented, such as using bitmap indexes, prefix trees, or perfect hash functions to reduce indexing overhead; variable-length encoding is used to store FLAG data, dynamically allocating space based on the actual content length. For FLAGs that are accessed particularly frequently, the system also provides a locking mechanism to prevent them from being removed by the cache eviction algorithm, ensuring fast access to critical data.

[0255] Regional shared caching is an intermediate layer between local caching and global storage, serving groups of nodes that are geographically close or have good network connectivity. This layer typically employs distributed memory caching technologies, such as Redis clusters or Memcached grids. Regional caching is characterized by large capacity (typically tens to hundreds of GB), moderate latency (milliseconds), and configurable consistency. The appropriate technology is chosen based on the deployment scale and consistency requirements. For example, for scenarios requiring strong consistency, Redis Sentinel or Redis Cluster might be chosen; for scenarios where eventual consistency is acceptable, a multi-replica Memcached configuration might be selected.

[0256] The regional cache employs sharding technology to distribute data across multiple cache nodes. Each flag is routed to a specific shard based on its unique identifier (usually a hash of the flag ID). Sharding strategies can range from simple hash sharding to more complex consistent hashing, the latter minimizing data migration when nodes are added or removed. To improve availability, each shard is typically configured with a primary and backup node; when the primary node fails, it automatically switches to the backup node to ensure service continuity. A cache preheating mechanism is also implemented, proactively loading hot flag data during startup or after a primary / backup switch to reduce performance degradation during cold starts.

[0257] Global persistent storage is the bottom layer of the caching architecture, responsible for the long-term reliable storage of FLAG data. This layer employs persistent database technologies, such as relational databases (MySQL, PostgreSQL) or NoSQL databases (MongoDB, Cassandra), selected based on the data model and scaling requirements. Global storage provides data persistence guarantees, full transaction support, and complex query capabilities, but its access latency is relatively high (typically tens to hundreds of milliseconds).

[0258] Global storage not only stores currently valid FLAG data but also retains historical versions and audit logs, supporting backtracking queries and compliance audits. The data model design considers query patterns and scalability, typically employing a wide table design (for relational databases) or a document model (for document databases) to avoid complex table join operations. For ultra-large-scale deployments, data partitioning strategies may be implemented, such as partitioning by time or by user ID, distributing data across multiple physical storage units to improve overall throughput.

[0259] Data flow between multi-layered caches follows a specific strategy. When an application requests a FLAG, it first checks the local cache; if a match is found, the data is returned directly. If no match is found, the regional cache is queried. If the regional cache also misses, the data is retrieved from global storage and populated back into the cache level by level. This "downward penetration, upward backfilling" strategy ensures a high cache hit rate and data consistency. To prevent cache avalanche (where a large number of cache misses cause a sudden increase in storage pressure), a staggered expiration mechanism is implemented, adding random expiration time offsets to cache entries.

[0260] Cache eviction policies are a core component of cache management, determining which data should be removed when capacity is limited. This system implements multiple eviction algorithms and dynamically selects the appropriate one based on the scenario: the Least Recently Used (LRU) algorithm is suitable for scenarios with stable access patterns; the Least Frequently Used (LFU) algorithm is suitable for scenarios with obvious hotspots; and the Time-Aware Least Recently Used (TLRU) algorithm combines LRU and expiration time, prioritizing the eviction of infrequently used items that are close to expiration. For the characteristics of the FLAG system, a Security-Aware Eviction Algorithm (SLRU) was developed. This algorithm considers the security importance of FLAGs, assigning higher retention priority to high-security FLAGs to ensure the availability of critical security data.

[0261] Cache consistency management is a significant challenge in distributed caching, and a versioned caching strategy is employed to address this issue. Each FLAG data item is accompanied by a version identifier (usually a timestamp or an incrementing counter), and update operations always increment the version number. During reads, the version number is checked to identify expired data, and a refresh process is triggered when expired data is found. For scenarios requiring strong consistency, a write-through strategy is implemented (write operations simultaneously update global storage and all cache layers); for scenarios where eventual consistency is acceptable, an asynchronous update strategy is adopted, propagating updates asynchronously through message queues or change logs to reduce the burden of write operations.

[0262] A smart cache pre-filling mechanism was also designed to analyze FLAG access patterns, predict potentially requested FLAGs, and pre-load them into the cache. The prediction algorithm is based on multiple factors: historical access frequency, time patterns (such as the difference between weekdays and weekends), correlation analysis (some FLAGs are frequently accessed together), and contextual information (such as user behavior patterns). The pre-filling operation is performed when the system load is low to avoid competing for resources with normal requests.

[0263] Cache monitoring and adaptive tuning are crucial for ensuring efficient cache operation. Collecting key metrics such as hit rate, latency distribution, memory usage, and eviction frequency establishes a comprehensive view of cache performance. Based on these metrics, adaptive tuning mechanisms can modify cache configurations, such as adjusting capacity allocation, changing eviction algorithms, or rebalancing shards, to optimize overall performance. For abnormal situations (such as sudden traffic spikes or cache pollution), automatic recovery strategies are implemented, such as partially or completely flushing the cache, rebalancing the load, or activating backup cache resources.

[0264] Based on the above design, a comprehensive cache management strategy is formed, including layered architecture design, data flow rules, eviction algorithm selection, consistency management mechanism, pre-filling strategy, and monitoring and adjustment measures. This strategy provides the FLAG system with high-performance, highly available data access capabilities, while taking into account various challenges and constraints in a distributed environment.

[0265] Second, an efficient synchronization protocol was designed to ensure the consistency and efficient transmission of FLAG data in a distributed environment.

[0266] Synchronization protocols are sets of rules for coordinating data updates and propagation in distributed systems. For FLAG systems, efficient synchronization protocols need to address challenges in areas such as data consistency, network efficiency, conflict handling, and secure transmission. By employing a version number-based incremental synchronization mechanism combined with optimized transmission strategies, efficient and reliable FLAG synchronization is achieved.

[0267] The version number mechanism is a core component of the synchronization protocol, used to track the change history of FLAG data. Each FLAG entity is assigned a globally unique version identifier, consisting of two parts: a logical clock and a node identifier. The logical clock is a monotonically increasing counter that increments with each FLAG update; the node identifier is the unique ID of the node that generated the update. This combination ensures the global uniqueness of the version number in a distributed environment, distinguishing the order of updates even when different nodes generate them simultaneously.

[0268] Version numbers not only identify changes but also serve multiple functions: determining data freshness (higher version numbers indicate updated data), detecting conflicts (different updates on the same base version), maintaining causal relationships (ensuring updates are applied in the order of dependencies), and supporting rollback operations (restoring to a specific version when necessary). For high-security scenarios, version numbers may also include security verification components, such as cryptographic hashes of the version content, to prevent security issues caused by version number tampering.

[0269] The synchronization process follows these steps: When a node generates or receives a new version of the FLAG, it first updates its local cache and then broadcasts a change notification to relevant nodes. The change notification includes the FLAG identifier, the new version number, and the change type (e.g., creation, update, or deletion), but not complete data. Receiving nodes compare the version number in the notification with their local version. If the notification version is newer, they request detailed data from the source node; otherwise, the notification is ignored. This "notify first, request later" strategy avoids unnecessary data transmission and is particularly suitable for scenarios with frequent updates.

[0270] Data transmission employs an incremental synchronization strategy, transmitting only the changed portions rather than the complete FLAG data. Multiple incremental formats are supported: for simple updates, field-level incremental transmission (transmitting only the modified fields); for complex updates, operation-based incremental transmission (transmitting a series of transformation operations); and for significant changes, full transmission is degraded. Incremental calculations utilize structured difference algorithms, such as JSON Patch (for JSON data) or binary difference algorithms (for binary format), efficiently identifying and representing changes.

[0271] Optimizing transmission efficiency is a crucial aspect of synchronization protocols. A multi-level compression strategy is implemented: first, semantic compression, removing redundant information and unnecessary fields; second, structural compression, replacing redundant formats like JSON with compact encoding formats such as Protocol Buffers or MessagePack; and finally, data compression, applying general compression algorithms such as Gzip, LZ4, or Zstandard. The choice of compression algorithm is based on data characteristics and performance requirements. For example, for scenarios requiring extremely low latency, the lightweight LZ4 might be chosen; for bandwidth-constrained scenarios, the higher compression ratio of Zstandard might be selected. An adaptive compression mechanism is also implemented, dynamically selecting the compression level based on data size, network conditions, and processor load, balancing compression ratio and computational overhead.

[0272] Batch processing is another key optimization for improving network efficiency. Multiple flag updates are merged into batches for transmission at appropriate times, reducing network round trips and protocol overhead. The batching strategy balances real-time performance and efficiency, employing adaptive batch sizes and dynamic triggering conditions: small batches or immediate transmission are used during low load periods to ensure low latency; large batches are used during high load periods to increase throughput. A prioritization mechanism is also implemented, allowing high-priority updates (such as security-sensitive flag updates) to skip the batch queue and be transmitted immediately.

[0273] Guaranteeing reliable transmission is a fundamental requirement of synchronization protocols. An acknowledgment and retransmission mechanism ensures reliable data delivery: the receiver must acknowledge received updates, and the sender maintains a queue of unacknowledged updates and retransmits them after a timeout. To prevent repeated retransmissions caused by network jitter, an exponential backoff algorithm is implemented, increasing the retransmission interval with each retrieval. For persistently failing transmissions, alternative transmission paths are attempted, or a fallback to a more reliable but less efficient transmission mode is implemented to ensure eventual consistency.

[0274] Conflict handling is a core challenge in distributed synchronization, especially in scenarios where multiple nodes can update concurrently. The system implements a version vector-based conflict detection mechanism that can accurately identify conflicts caused by concurrent updates. When a conflict is detected, a predefined resolution strategy is applied: priority-based selection (e.g., prioritizing updates with higher security levels), timestamp-based "last write wins," three-way merging (automatically merging non-conflicting fields and marking conflicting fields for manual resolution), or a custom resolution function. The conflict resolution result generates a new version, records the resolution history, and propagates it through the normal synchronization process.

[0275] Secure transmission is a critical requirement for FLAG synchronization. The communication channel is encrypted using TLS / SSL protocols at the transport layer to prevent eavesdropping and man-in-the-middle attacks. In addition to channel encryption, end-to-end encryption is applied to the FLAG data itself, ensuring that the FLAG content will not be leaked even if an intermediate node is attacked. Message integrity is protected through digital signatures or Message Authentication Codes (MACs) to prevent data tampering during transmission. Authentication employs multi-factor authentication and certificate binding to ensure that only authorized nodes can participate in the synchronization process.

[0276] Adaptive network strategies enable the synchronization protocol to cope with different network environments. By proactively probing and assessing network conditions (bandwidth, latency, packet loss rate), transmission parameters are adjusted accordingly: large data transfers and parallel connections are used in high-quality networks; data blocks are reduced and redundancy is increased in unstable networks; and store-and-forward mechanisms are implemented in environments with intermittent connections to temporarily store updates that cannot be transmitted immediately. For mobile environments or edge computing scenarios, battery consumption and computing resource limitations are also considered, optimizing transmission strategies to reduce energy consumption.

[0277] Finally, the synchronization protocol design incorporates comprehensive monitoring and diagnostic capabilities. Key metrics such as synchronization latency, collision rate, retransmission count, and bandwidth usage are collected to assess synchronization health in real time. Anomaly detection mechanisms can identify synchronization issues, such as one-way connection failures, version inconsistencies, or data corruption. When a serious problem is detected, the system may initiate recovery procedures, such as full resynchronization, consistency checks, or rollback to a known good state. Monitoring data is also used for long-term optimization, adjusting protocol parameters and strategies to adapt to the characteristics of specific deployment environments.

[0278] The above design forms a complete FLAG synchronization protocol, which can efficiently and reliably transmit and synchronize FLAG data in a distributed environment, supports large-scale deployment and complex network conditions, and ensures data security and consistency.

[0279] Example 9

[0280] In this embodiment, the design verification mechanism verifies the encrypted FLAG identifier based on the verification information, resulting in a secure FLAG generation and synchronization system in a distributed environment, comprising:

[0281] Based on the synchronization protocol and the verification information, a multi-level verification mechanism is designed. This mechanism verifies the format of the encrypted FLAG identifier by using the version number mechanism in the synchronization protocol to check the length and character set legality; it also verifies the validity of the digital signature in the verification information by using the public key in the verification information; it verifies the validity of the encrypted FLAG identifier by using the validity period in the verification information; and it verifies the consistency between the encrypted FLAG identifier and the user identity and device environment by using the timestamp in the verification information. This completes the FLAG verification process.

[0282] Based on the FLAG verification process, an exception handling strategy is designed. When the format verification, signature verification, timeliness verification, or context verification in the FLAG verification process fails, the FLAG regeneration process is triggered. When a node fails, a backup node is started and the encrypted FLAG identifier is restored from the global persistent storage in the multi-layer caching architecture. When the FLAG verification process detects a FLAG consistency conflict, a conflict resolution mechanism based on the version number mechanism in the synchronization protocol is used to select the valid FLAG version, thus obtaining the secure FLAG generation and synchronization system in the distributed environment.

[0283] Specifically, firstly, a comprehensive FLAG verification mechanism was designed to ensure that only legitimate and valid FLAGs can be verified and accepted by the system.

[0284] The multi-level verification mechanism employs a defense-in-depth strategy, comprehensively verifying the legitimacy and security of the FLAG identifier through a series of progressive verification layers. This layered design ensures that even if one verification layer is bypassed, other layers still provide protection, significantly improving system security. Multi-level verification proceeds in order from simple to complex, from basic to advanced, optimizing performance while maintaining security.

[0285] Format validation is the first and most basic step in the validation process, primarily checking whether the FLAG's format conforms to system specifications. First, it checks if the FLAG's length is within a preset range to prevent excessively short FLAGs (insufficient security) or excessively long FLAGs (potentially allowing injection attacks). Second, it verifies the FLAG's character set to ensure it only contains system-allowed characters (usually letters, numbers, and specific symbols) to prevent the injection of special characters that could cause security issues. Format validation also includes structural checks to ensure the FLAG conforms to predefined format patterns, such as specific prefixes / suffixes or fixed-position markers.

[0286] Format validation utilizes the version number mechanism in the synchronization protocol to identify the FLAG format version, applying different validation rules to different versions. This versioned validation allows the system to smoothly upgrade the FLAG format without service interruption, and the old and new formats can coexist during the transition period. Format validation is typically implemented using regular expressions or dedicated parsers; to improve performance, pre-compiled expressions or hardware-accelerated string matching may be used.

[0287] Signature verification is a crucial step in ensuring the integrity and authenticity of a flag's origin. The digital signature of the flag is verified using the public key from the verification message to confirm that the flag has not been tampered with and originates from a trusted source. The signature verification process includes: extracting the flag and signature data, checking the signature validity using a public-key verification algorithm, and verifying the binding relationship between the signature and the flag content. The choice of signature algorithm depends on security requirements and computational resources. Common options include RSA-PSS, ECDSA, and EdDSA. For resource-constrained environments such as mobile devices, elliptic curve algorithms such as ECDSA or EdDSA are preferred, offering equivalent security with lower computational overhead.

[0288] Public key management is a core challenge in signature verification. Typically, a list of trusted public keys or a certificate store is maintained and updated regularly to track key rotation. Public key distribution uses secure channels, coupled with certificate chain verification to ensure public key authenticity. For high security requirements, hardware roots of trust, such as TPMs or hardware security modules, may be implemented to provide a higher level of key protection. A key revocation mechanism is also implemented to quickly revoke a public key and notify all verification nodes when it is deemed no longer secure (e.g., private key leakage).

[0289] Timeliness verification ensures that the flag is used within its valid time frame, preventing replay attacks and the use of expired credentials. Validity data, including start and expiration times, is extracted from the verification information and compared with the current system time to verify the flag's validity. The security of timeliness verification highly depends on an accurate time source. Systems typically use Network Time Protocol (NTP) for time synchronization, or, in high-security scenarios, a trusted time source such as a GPS-based clock or hardware time module.

[0290] The timeliness verification also considers a time window strategy, allowing for a certain degree of clock skew, typically within the range of a few seconds to a few minutes, balancing security and system fault tolerance. For cross-time zone deployments, Coordinated Universal Time (UTC) is used uniformly for comparison to avoid time zone conversion issues. Anti-replay protection measures are also implemented, such as maintaining a list of recently used flag identifiers (for one-time flags) or using an incrementing counter (for serialized flags) to prevent flags within their validity period from being used multiple times.

[0291] Contextual verification is the highest level of verification, checking whether a flag is used in the correct context. It analyzes the timestamps and contextual data in the verification information to verify the consistency between the flag and the user's identity and device environment. This verification prevents sophisticated threats such as cross-session attacks, identity impersonation, and environment tampering. Contextual data may include user identifiers, session IDs, IP addresses, geographic locations, device identifiers, and network characteristics. The system compares this data with the context recorded when the flag was created to ensure consistency in the usage environment.

[0292] Contextual verification employs a multi-factor analysis approach, not requiring all context elements to match perfectly. Instead, it calculates a context similarity score, and verification passes when the score exceeds a threshold. This resilient strategy adapts to minor changes that may occur in legitimate usage scenarios, such as IP address changes or slight variations in device parameters. For highly dynamic scenarios such as mobile users, a gradual contextual change recognition is implemented, allowing the context to change smoothly over time while preventing abrupt changes, effectively balancing security and user experience.

[0293] Optimizing verification processing performance is a crucial consideration in system design. Several strategies are employed to improve verification efficiency: cascading verification execution, immediately returning if any level fails to avoid unnecessary computation; hardware acceleration or optimized algorithms are used for computationally intensive verifications (such as signature verification); FLAG results from frequent verifications are cached to avoid redundant computation; and the verification load is evenly distributed across multiple processor cores to fully utilize parallel processing capabilities. For high-load scenarios, a verification priority mechanism may be implemented to ensure that verification requests for critical operations are processed first.

[0294] The verification result is not just a simple pass / fail binary answer, but also includes detailed metadata: verification time, specific verification steps for pass / fail, verification environment information, and risk score. This information is used for subsequent audit trails, anomaly detection, and security analysis, helping the system continuously improve its security strategies. High-risk operations may require more stringent verification standards; the verification level can be dynamically adjusted based on the sensitivity of the operation to achieve risk-adaptive verification.

[0295] Through the above multi-level verification mechanism, a complete FLAG verification process is formed, which can comprehensively verify the legality, validity, and applicability of FLAGs, providing strong security guarantees for applications. The verification process design takes into account the balance between security, performance, and user experience, and adapts to different security needs and use cases.

[0296] Second, a comprehensive anomaly handling strategy was designed to ensure that the system can maintain stable operation and security and service continuity in the event of various verification failures, node failures or data conflicts.

[0297] Anomaly handling strategies are a key component of system resilience and are essential for building reliable distributed FLAG systems. This system adopts a classification-based approach, implementing different handling measures according to anomaly types to ensure relevance and efficiency while maintaining overall system consistency.

[0298] Validation failure handling is the first category of exception handling, with corresponding measures taken for different levels of validation failure. Format validation failure usually indicates an abnormal FLAG structure or a potential injection attack. Detailed error information will be logged (including the reason for failure and the submitted FLAG content), triggering a security alert and immediately rejecting the request without further validation. Severe or patterned format validation failures may trigger temporary IP blocking or account locking to prevent brute-force attacks.

[0299] Signature verification failure indicates that the FLAG has been tampered with or its source is untrusted, which is a serious security issue. Detailed verification parameters (such as the public key used, signature value, and hash of the FLAG content) will be recorded, triggering a high-level security alert and immediately terminating request processing. For signature verification failures, proactive defense mechanisms may be activated, such as increasing the complexity of subsequent verifications, temporarily raising the security policy level, or notifying a security administrator for manual review. The system will also analyze failure modes to identify whether they are due to system vulnerabilities (such as expired verification algorithms) or external attacks.

[0300] Timeliness verification failures fall into two categories: the flag is not yet valid or the flag has expired. For flags that are not yet valid, this may be due to clock synchronization issues or premature use of pre-signed flags. A specific error code will be returned instructing the client to wait, and the time difference will be recorded for clock adjustment. For expired flags, the system will adopt different strategies depending on how close the expiration date is: recently expired flags may trigger a grace period, allowing continued use for a short period; long-expired flags will be rejected outright, and the client may be requested to re-authenticate.

[0301] Context verification failure indicates that the flag was used in an incompatible environment, potentially due to session hijacking or credential theft. The system will record the differences between the expected and actual contexts in detail and assess the risk level. For minor differences (such as slight changes in IP address), additional verification processes, such as two-factor authentication or behavioral analysis, may be initiated. For significant differences (such as sudden changes in geographical location or completely different devices), the request will be rejected and a security event will be triggered, potentially requiring the user to log in again or contact customer service.

[0302] Regenerating the FLAG after verification failure is a crucial mechanism for ensuring service continuity. An intelligent regeneration strategy is designed to determine whether to initiate the regeneration process based on the cause of failure and security risks. The general principle is: failures attributable to system factors (such as clock skew or network latency) are prioritized for automatic regeneration; failures potentially caused by malicious activity are subject to additional manual review. The regeneration process reuses the FLAG generation process from Examples 4-6, but may use stricter parameter settings or additional verification steps.

[0303] Before a regeneration is triggered, a pre-check is performed to assess the necessity and security of the regeneration. The pre-check includes user authentication, risk assessment, and resource availability checks to ensure that the regeneration is not abused or causes system overload. For high-risk scenarios, a gradual regeneration strategy may be implemented, using a temporary flag with limited functionality upon initial failure, and gradually restoring full functionality as additional verifications are passed, balancing security and user experience.

[0304] Node failure handling is a core issue that distributed systems must address. This system implements a multi-layered fault detection and recovery mechanism to ensure that a single point of failure does not affect the overall service. Fault detection is based on a combination of health checks, heartbeat mechanisms, and performance monitoring, capable of identifying different types of faults: complete failure (node ​​is completely unresponsive), partial failure (node ​​responds but functions abnormally), and performance degradation (node ​​responds but latency is too high). Detection uses adaptive thresholds, dynamically adjusting judgment criteria based on historical performance and network conditions to reduce false positives.

[0305] Once a node failure is detected, the backup node startup process is triggered. The backup node can be a pre-assigned standby node (active-passive mode) or a dynamically selected healthy node (active-active mode). In active-passive mode, a clear primary-backup relationship is maintained, and the failover path is predefined, resulting in fast failover speed but low resource utilization. In active-active mode, all nodes share the load, and in the event of a failure, load redistribution is used to adapt to node loss, resulting in high resource utilization but more complex failover logic.

[0306] After the backup node starts, FLAG data needs to be restored from global persistent storage. The recovery process consists of three phases: initial batch loading (retrieving the basic dataset from storage), incremental synchronization (retrieving changes after the initial load), and real-time catch-up (processing new changes during the recovery process). To optimize recovery performance, techniques such as parallel loading, data preheating, and priority recovery are used to ensure that critical FLAGs are restored first, quickly restoring basic service capabilities. For large-scale systems, recovery may employ a segmented strategy, restoring hot data first and then gradually restoring cold data, balancing recovery time and service availability.

[0307] After recovery, consistency verification is performed to ensure the integrity and consistency of the recovered data. Verification methods include checksum comparison, sampling testing, and version number checking. A repair process is triggered if inconsistencies are detected. To prevent data loss during recovery, operation logs are maintained to record all write operations during recovery. These operations are replayed after recovery to ensure consistency. A smooth failover mechanism is also implemented to ensure a seamless transition of service from the failed node to the backup node, with clients experiencing no or only a very brief interruption.

[0308] FLAG consistency conflict handling is another core challenge in distributed systems, especially in environments that allow parallel updates from multiple nodes. A conflict detection and resolution framework based on a version number mechanism is designed, capable of accurately identifying and effectively resolving data conflicts. Conflict detection is based on version vector comparison; when two FLAG versions have incomparable version vectors (i.e., neither is an ancestor of the other), a conflict is identified.

[0309] Conflict resolution employs a multi-strategy combination approach, selecting the appropriate resolution strategy based on the conflict type and context: deterministic strategies (such as "highest version number wins" or "most recent timestamp wins") are suitable for simple conflicts; rule-based strategies (selecting or merging versions according to predefined rules) are suitable for predictable conflict patterns; semantic merging (intelligently merging different versions based on the structure and meaning of FLAGs) is suitable for complex situations with clear merging logic; and manual intervention (marking conflicts as requiring manual resolution) is used for complex conflicts that the system cannot handle automatically.

[0310] To improve the accuracy of conflict resolution, conflict context information is used to assist decision-making, such as the type of the conflict flag, the semantics of the changed content, and the source and priority of the modification operation. Conflict prevention measures are also implemented, such as operation sequencing (forcing potentially conflicting operations to be ordered), pessimistic locking (locking the target flag before modification), and optimistic concurrency control (detecting conflicts before committing), to reduce the probability of conflicts occurring.

[0311] After a conflict is resolved, a new FLAG version is generated, containing the resolution result and conflict history. The new version is propagated to all nodes through normal synchronization mechanisms, ensuring eventual system consistency. The conflict resolution history is also maintained for auditing and improving conflict resolution strategies. For frequently occurring similar conflicts, data models or access patterns may be adjusted to fundamentally reduce conflicts.

[0312] A comprehensive anomaly monitoring and reporting mechanism has also been designed to track the frequency, type, and scope of impact of anomalies. Monitoring data is used to identify system weaknesses, optimize anomaly handling strategies, and predict potential problems. Key metrics include verification failure rate, node failure frequency, failure recovery time, conflict occurrence rate, and resolution success rate. The system generates regular reports and real-time alerts to support timely responses from operations and security teams to anomalies.

[0313] By integrating multi-level verification mechanisms, exception handling strategies, and conflict resolution mechanisms, a complete secure flag generation and synchronization system for distributed environments has been formed. It can provide high availability and consistency guarantees while ensuring high security, adapting to the challenges of complex and ever-changing distributed environments. The design considers a balance between security, reliability, performance, and scalability, providing a reliable flag service foundation for various application scenarios.

[0314] Example 10

[0315] like Figure 3 As shown, the present invention also provides a system for generating and synchronizing secure flags in a distributed environment, comprising:

[0316] The secret sharding module 301 is used to design a set of coprime moduli, a security parameter threshold, and the number of participants based on the residual theorem. It constructs a hierarchical transformation function and designs a secret sharding algorithm to map the secret into multiple shares, thereby obtaining a secret share generation algorithm and a secret reconstruction mechanism.

[0317] The random factor fusion module 302 is used to collect multi-source random factors according to the secret share generation algorithm and the secret reconstruction mechanism, calculate the correlation weight matrix between the multi-source random factors through an attention network, apply an optimization algorithm to allocate the multi-source random factors according to the correlation weight matrix, and apply the secret share generation algorithm to fuse the multi-source random factors to obtain a random factor set.

[0318] The FLAG generation module 303 is used to design a mapping function set to map the random factor set to different representation spaces based on the secret share generation algorithm, the secret reconstruction mechanism and the random factor set, apply a distributed consensus protocol to coordinate the FLAG generation process among distributed nodes, and use the secret reconstruction mechanism to collaboratively generate FLAG identifiers in a distributed environment and perform encryption protection to obtain encrypted FLAG identifiers and corresponding verification information.

[0319] The synchronization verification module 304 is used to construct a cache architecture to store the encrypted FLAG identifier and the corresponding verification information, design a synchronization protocol to transmit the encrypted FLAG identifier and the corresponding verification information, and design a verification mechanism to verify the encrypted FLAG identifier based on the verification information, thereby obtaining a secure FLAG generation and synchronization system in a distributed environment.

[0320] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for generating and synchronizing secure flags in a distributed environment, characterized in that, include: Based on the residual theorem, we design a set of coprime moduli, a security parameter threshold, and the number of participants. We construct a hierarchical transformation function and design a secret sharding algorithm to map the secret into multiple shares, thus obtaining a secret share generation algorithm and a secret reconstruction mechanism. According to the secret share generation algorithm and the secret reconstruction mechanism, multi-source random factors are collected, the correlation weight matrix between the multi-source random factors is calculated through an attention network, the multi-source random factors are allocated according to the correlation weight matrix using an optimization algorithm, and the multi-source random factors are fused using the secret share generation algorithm to obtain a random factor set. Based on the secret share generation algorithm, the secret reconstruction mechanism, and the random factor set, a mapping function set is designed to map the random factor set to different representation spaces. A distributed consensus protocol is applied to coordinate the FLAG generation process among distributed nodes. The secret reconstruction mechanism is used to collaboratively generate FLAG identifiers in a distributed environment and perform encryption protection to obtain encrypted FLAG identifiers and corresponding verification information. Based on the encrypted FLAG identifier and corresponding verification information, a cache architecture is constructed to store the encrypted FLAG identifier, a synchronization protocol is designed to transmit the encrypted FLAG identifier and corresponding verification information, and a verification mechanism is designed to verify the encrypted FLAG identifier based on the verification information, thus obtaining a secure FLAG generation and synchronization system in a distributed environment.

2. The method according to claim 1, characterized in that, The method involves designing a set of coprime moduli based on the residual theorem, along with security parameter thresholds and the number of participants. A hierarchical transformation function is constructed, and a secret sharding algorithm is designed to map the secret into multiple shares, resulting in a secret share generation algorithm and a secret reconstruction mechanism, including: Based on the mathematical principle of the Remainder Theorem, a set of coprime moduli is selected, and the safety parameter threshold and the number of participants are determined. The product of moduli and the multiplicative inverse of each moduli are calculated to obtain the CRT parameter set. Based on the CRT parameter set, a unidirectional asymptotic ideal disjunction hierarchical transformation function is designed such that any number of shares less than t cannot obtain any information about the secret to be fragmented, thus obtaining the asymptotic ideal disjunction hierarchical transformation function; Based on the asymptotic ideal disjunction hierarchical transformation function and the secret to be fragmented, the asymptotic ideal disjunction hierarchical transformation function is applied to the secret to be fragmented to transform it, and the transformed secret is mapped into n secret shares by combining the CRT parameter set, thus obtaining the secret share generation algorithm; Based on the secret share generation algorithm and the CRT parameter set, a reconstruction function is constructed that can recover the secret to be fragmented based on at least t secret shares using the residual theorem, and a verification mechanism is designed to ensure the validity of the secret shares through hash verification or digital signature, thus obtaining the secret reconstruction mechanism.

3. The method according to claim 1, characterized in that, The process of collecting multi-source random factors, calculating the correlation weight matrix among the multi-source random factors using an attention network, and applying an optimization algorithm to allocate the multi-source random factors according to the correlation weight matrix includes: Based on the system environment collection timestamp, user identity features, device environment fingerprint, and system entropy pool random value as the multi-source random factors, the multi-source random factors are standardized and feature extracted to obtain the original random factor set; Based on the original set of random factors, a cross-attention network is designed. The relevance score of each random factor in the original set of random factors is calculated through a query-key-value mechanism and normalized into a weight matrix, thus obtaining the weight matrix and the attention-weighted factor representation. Based on the attention-weighted factor representation and the weight matrix, a masking strategy optimization algorithm is designed. According to the weight values ​​in the weight matrix, the randomness of each factor component in the attention-weighted factor representation is allocated to different regions. The algorithm also uses a dynamic masking mechanism to suppress the redundancy and predictability of the attention-weighted factor representation, thereby obtaining the optimized random factor distribution.

4. The method according to claim 3, characterized in that, The application of the secret share generation algorithm fuses the multi-source random factors to obtain a random factor set, including: Based on the optimized random factor distribution and the secret share generation algorithm, the timestamp, user identity features, device environment fingerprint and system entropy pool random value in the optimized random factor distribution are respectively used as secret inputs to be sharded. The secret share generation algorithm is applied to shard each random factor to obtain the secret share set corresponding to each random factor. Based on the set of secret shares corresponding to each random factor, random shares from different sources in the set of secret shares corresponding to each random factor are merged by XOR operation or hash chain, and the Shannon entropy of the merged random factor is calculated to verify that it meets the cryptographic security requirements, thereby obtaining a set of random factors whose entropy value meets the preset threshold.

5. The method according to claim 1, characterized in that, The design mapping function set maps the random factor set to different representation spaces, and the distributed consensus protocol coordinates the FLAG generation process among distributed nodes, including: Based on the set of random factors, k different embedding space mapping functions are designed, including linear transformation, polynomial mapping and nonlinear neural network mapping. Each random factor in the set of random factors is mapped to k different representation spaces through the k different embedding space mapping functions to obtain a multidimensional representation vector set. Based on the multidimensional representation vector set, a distributed consensus protocol is designed. The multidimensional representation vector set is transmitted between distributed nodes through a message passing mechanism, and a consensus algorithm is used to ensure that each distributed node reaches a consensus on the multidimensional representation vector set, thus obtaining the consensus algorithm and node coordination mechanism.

6. The method according to claim 5, characterized in that, The process of collaboratively generating and encrypting a FLAG identifier in a distributed environment using the secret reconstruction mechanism, resulting in an encrypted FLAG identifier and corresponding verification information, includes: Based on the consensus algorithm and node coordination mechanism, the multidimensional representation vector set and the secret reconstruction mechanism, each distributed node uses the secret reconstruction mechanism to collect the secret share corresponding to the multidimensional representation vector set from at least t nodes and reconstructs the complete random factor. The hash function is applied to the reconstructed random factor to generate a FLAG identifier, and the original FLAG identifier is obtained. Based on the original FLAG identifier, a key pair is generated, the original FLAG identifier is encrypted using the private key in the key pair, and the encrypted FLAG identifier is digitally signed using the private key in the key pair, resulting in an encrypted FLAG identifier and a corresponding digital signature. Based on the encrypted FLAG identifier and the corresponding digital signature, verification information including the digital signature, the public key in the key pair, the timestamp, and the validity period is generated, thus obtaining the encrypted FLAG identifier and the corresponding verification information.

7. The method according to claim 1, characterized in that, After obtaining the encrypted FLAG identifier and corresponding verification information, and before constructing the cache architecture, the following is also included: Based on the encrypted FLAG identifier and corresponding verification information, historical usage data is used to extract features and perform cluster analysis on multi-protocol traffic in the historical usage data through an unsupervised learning model. This identifies abnormal behaviors and potential attack patterns that deviate from the normal pattern, and yields a security threat assessment report. Based on the system operating environment, CPU utilization, memory usage, network latency, and request queue length are collected in real time to calculate the system load index and obtain a system load report; Based on the security threat assessment report and the system load report, an adaptive decision-making algorithm is designed. Through a multi-objective optimization model, the security threat level in the security threat assessment report and the system performance constraints in the system load report are weighed, and the optimal parameters of FLAG generation complexity, length and update frequency are dynamically calculated to obtain the FLAG complexity parameter set. Based on the FLAG complexity parameter set, the threshold in the secret reconstruction mechanism is updated according to the generation complexity parameter in the FLAG complexity parameter set, the random source weight in the random factor selection strategy is updated according to the length parameter in the FLAG complexity parameter set, and the time interval and event threshold in the triggering conditions are updated according to the update frequency parameter in the FLAG complexity parameter set, to obtain the optimized FLAG strategy configuration.

8. The method according to claim 1, characterized in that, Construct a caching architecture to store the encrypted FLAG identifier, and design a synchronization protocol to transmit the encrypted FLAG identifier and corresponding verification information, including: Based on the encrypted FLAG identifier and corresponding verification information, a multi-layer cache architecture including local fast cache, regional shared cache and global persistent storage is constructed. The encrypted FLAG identifier is stored in the multi-layer cache architecture, and a cache eviction policy is designed to obtain a cache management policy. Based on the cache management strategy and the encrypted FLAG identifier and corresponding verification information, a synchronization protocol is designed to identify changes in the encrypted FLAG identifier through a version number mechanism, transmit the encrypted FLAG identifier and corresponding verification information, and use a compression algorithm to reduce the amount of data transmitted, thus obtaining the synchronization protocol.

9. The method according to claim 8, characterized in that, The design verification mechanism verifies the encrypted FLAG identifier based on the verification information, resulting in a secure FLAG generation and synchronization system in a distributed environment, including: Based on the synchronization protocol and the verification information, a multi-level verification mechanism is designed. This mechanism verifies the format of the encrypted FLAG identifier by using the version number mechanism in the synchronization protocol to check the length and character set legality; it also verifies the validity of the digital signature in the verification information by using the public key in the verification information; it verifies the validity of the encrypted FLAG identifier by using the validity period in the verification information; and it verifies the consistency between the encrypted FLAG identifier and the user identity and device environment by using the timestamp in the verification information. This completes the FLAG verification process. Based on the FLAG verification process, an exception handling strategy is designed. When the format verification, signature verification, timeliness verification, or context verification in the FLAG verification process fails, the FLAG regeneration process is triggered. When a node fails, a backup node is started and the encrypted FLAG identifier is restored from the global persistent storage in the multi-layer caching architecture. When the FLAG verification process detects a FLAG consistency conflict, a conflict resolution mechanism based on the version number mechanism in the synchronization protocol is used to select the valid FLAG version, thus obtaining the secure FLAG generation and synchronization system in the distributed environment.

10. A system for generating and synchronizing secure flags in a distributed environment, applied to the method for generating and synchronizing secure flags in a distributed environment as described in any one of claims 1-9, characterized in that, include: The secret sharding module is used to design a set of coprime moduli, a security parameter threshold, and the number of participants based on the residual theorem. It constructs a hierarchical transformation function and designs a secret sharding algorithm to map the secret into multiple shares, thus obtaining a secret share generation algorithm and a secret reconstruction mechanism. The random factor fusion module is used to collect multi-source random factors according to the secret share generation algorithm and the secret reconstruction mechanism, calculate the correlation weight matrix between the multi-source random factors through an attention network, apply an optimization algorithm to allocate the multi-source random factors according to the correlation weight matrix, and apply the secret share generation algorithm to fuse the multi-source random factors to obtain a random factor set. The FLAG generation module is used to design a mapping function set to map the random factor set to different representation spaces based on the secret share generation algorithm, the secret reconstruction mechanism and the random factor set, apply a distributed consensus protocol to coordinate the FLAG generation process among distributed nodes, and use the secret reconstruction mechanism to collaboratively generate FLAG identifiers in a distributed environment and perform encryption protection to obtain encrypted FLAG identifiers and corresponding verification information. The synchronization verification module is used to construct a cache architecture to store the encrypted FLAG identifier and the corresponding verification information, design a synchronization protocol to transmit the encrypted FLAG identifier and the corresponding verification information, and design a verification mechanism to verify the encrypted FLAG identifier based on the verification information, thereby obtaining a secure FLAG generation and synchronization system in a distributed environment.

Images