Iot edge server data security storage and privacy protection management system

Abstract

The application relates to the technical field of computer information security and encryption algorithm, and particularly discloses an Internet of Things edge server data security storage and privacy protection management system. The system comprises: a decentralized identity and permission management module, which realizes real-time synchronization of fine-grained permissions based on a distributed ledger; a dynamic data sharding module and a distributed storage module, which store the encrypted and fragmented data; a privacy calculation module based on attribute-based encryption and proxy re-encryption, which realizes fine-grained access control and secure calculation of data in an encrypted state; and a trusted operation auditing and tracing module, which solidifies all key operations into a chain to form a trusted evidence chain. The application improves the robustness, data security and privacy protection strength of the system, and provides an unalterable auditing and tracing capability.

Description

Technical Field

[0001] This invention belongs to the field of computer information security and encryption algorithm technology, specifically relating to an IoT edge server data security storage and privacy protection management system. Background Technology

[0002] With the rapid development of IoT technology, the data generated by massive terminal devices is growing exponentially. Traditional cloud computing models are no longer able to meet the real-time requirements of application scenarios due to data transmission latency and bandwidth pressure. Edge computing has emerged to address this issue. By deploying servers at the network edge for data processing and storage, it effectively reduces cloud load and improves response speed.

[0003] Secure data storage and privacy protection for IoT edge servers are core components for ensuring the reliable operation of the entire edge computing system. The goal is to prevent data leakage, tampering, or unauthorized access while processing sensitive data locally.

[0004] Existing technologies typically employ centralized key management or access control strategies to protect the data security of edge servers. However, this centralized architecture has significant drawbacks when facing distributed, dynamically changing edge environments. Centralized permission management nodes are prone to becoming performance bottlenecks and single points of failure. Once attacked, they can cause the entire system's security mechanisms to fail, and they are also ill-suited to the need for fine-grained, real-time dynamic adjustments to data access permissions when edge devices frequently join or leave the network.

[0005] Auditing and tracing data operations rely on central logs, which are susceptible to tampering or loss, making it impossible to achieve irrefutable and reliable traceability in a distributed environment. The security capabilities of edge servers vary widely, and the sensitive data they store lacks effective privacy protection mechanisms against physical theft or cyberattacks. For example, data stored in plaintext or statically encrypted form cannot defend against malicious internal operations by those with server privileges.

[0006] Therefore, the aforementioned issues pose challenges to the secure storage and privacy protection of data in IoT edge computing environments. Data leakage risks are high and security incidents are difficult to trace and hold accountable. There is an urgent need for a comprehensive solution that can adapt to the dynamic characteristics of the edge, achieve decentralized access control, and enhance privacy protection. Summary of the Invention

[0007] This invention provides a data security storage and privacy protection management system for IoT edge servers to solve the technical contradictions of existing centralized security architectures in dynamic edge environments, such as single point of failure, delayed permission adjustment, unreliable audit traceability, and weak data privacy protection.

[0008] The technical solution of this invention is an IoT edge server data security storage and privacy protection management system. The system is built on a distributed network composed of multiple IoT edge server nodes. The system includes: a decentralized identity and permission management module, a dynamic data sharding module and a distributed storage module, a privacy computing module based on attribute-based encryption and proxy re-encryption, and a trusted operation audit and traceability module.

[0009] The decentralized identity and permission management module is used to create and manage decentralized identity identifiers based on asymmetric cryptography for each entity in the network, including edge servers, user terminals, and data resources.

[0010] The decentralized identity and permission management module further maintains a distributed permission ledger based on an improved practical Byzantine fault-tolerant consensus mechanism. This distributed permission ledger records the identity identifiers of all entities and their corresponding fine-grained access policies. Access policies are defined in a machine-readable declarative form, specifically specifying the logical relationships between subject identity, operation type, data object, and environmental conditions.

[0011] When any entity initiates a data access request, the decentralized identity and permission management module invokes a policy enforcement point deployed locally on the requester's machine. The policy enforcement point retrieves the relevant access policy declaration from the distributed permission ledger and performs real-time logical calculations based on the current request's context information to generate a deterministic decision to allow or deny access. The decentralized identity and permission management module also defines a dynamic permission update protocol. Any granting, revocation, or modification of permissions requires the permission grantor to initiate a transaction signed with their private key. This transaction is broadcast in the distributed network and, after consensus verification, is permanently and immutably recorded in the distributed permission ledger, thus achieving real-time, globally synchronized permission updates.

[0012] The dynamic data sharding module and distributed storage module are used to perform secure preprocessing and distributed redundant storage of sensitive raw data that needs to be stored in the edge environment. First, the dynamic data sharding module and distributed storage module perform a sharding operation on the raw data, dividing the data into multiple data shards. The number and size of the shards are dynamically determined based on a preset redundancy coefficient and network topology. Further, the dynamic data sharding module and distributed storage module encrypt each data shard using a different symmetric encryption key, generating encrypted data shards.

[0013] The dynamic data sharding module and distributed storage module incorporate a distributed storage location mapper. This mapper uses a hybrid algorithm based on consistent hashing and node reputation assessment to dynamically select a set of storage nodes for each encrypted data shard. These storage nodes are geographically and network-isolated, ensuring a preset minimum number of live replicas is met. The encrypted data shards and their storage location mappings are uploaded to a distributed ledger maintained by the decentralized identity and access control module for record-keeping. During data recovery, the decentralized identity and access control module, based on the mappings in the ledger, collects a sufficient number of encrypted data shards from the live storage nodes, decrypts and reassembles them to restore the original data.

[0014] The privacy computing module based on attribute-based encryption and proxy re-encryption is used to implement fine-grained access control and secure computing outsourcing during data storage and use, ensuring that data content is always invisible to unauthorized parties, including storage nodes and computing nodes.

[0015] The privacy computing module based on attribute-based encryption and proxy re-encryption encrypts data using a ciphertext policy attribute-based encryption algorithm during the data upload phase. The data owner defines a set of logical policies describing visitor attributes and uses these policies to encrypt the data, generating attribute-based ciphertext.

[0016] The attribute-based ciphertext is then stored on an edge storage node or sent to an edge computing node. The data user can decrypt the attribute-based ciphertext only if their attribute set satisfies the policy embedded during encryption. For scenarios requiring computation on an edge server but where plaintext data should not be exposed, a proxy re-encryption mechanism is introduced for the attribute-based ciphertext. Specifically, the data owner generates a proxy re-encryption key pair, which allows a designated, semi-trusted edge computing server to convert ciphertext encrypted with the data owner's public key into ciphertext encrypted with another authorized user's public key. During this conversion, the proxy server cannot obtain any information about the plaintext data or the decryption key. The converted ciphertext can only be decrypted by the target authorized user, thus achieving secure data transfer and delegated computation in an encrypted state.

[0017] The trusted operation auditing and tracing module is used to record all data security-related operation events in a complete and non-repudiable manner, and to construct a complete chain of evidence. This module embeds audit probes at every critical operation point in the system. These operation points include, but are not limited to: identity authentication events, permission policy evaluation events, data sharding storage and retrieval events, attribute-based encryption and decryption events, and proxy re-encryption events. Each audit probe, upon capturing an operation event, immediately generates a structured audit log entry. This audit log entry includes an operation timestamp, the identity of the operation subject, the identity of the operation object, the operation type, the hash of the operation result, and the hash of the preceding events of this operation.

[0018] The trusted operation auditing and tracing module encapsulates audit log entries into transactions and submits them in real time to the consensus network where the distributed permission ledger resides for verification and storage. Due to the immutability of the ledger, all audit logs are permanently fixed in chronological order, forming a trusted chain of evidence with interconnected hash relationships. When a security incident requires tracing analysis, the trusted operation auditing and tracing module provides a query interface that can quickly retrieve and verify the complete cause-and-effect relationship path of any operation event.

[0019] As one embodiment of the present invention, the improved practical Byzantine fault-tolerant consensus mechanism adopted in the decentralized identity and permission management module is improved by introducing a dynamic weighted voting algorithm based on the credibility of node historical behavior. The voting weight of each participating node is not fixed at 1, but is positively correlated with its credibility score over the historical consensus period. The credibility score is periodically evaluated and updated based on the correctness and timeliness of the node's proposals and network activity. This design gives nodes with good reputation and stable performance greater say in the consensus process, thereby improving consensus efficiency and the system's resistance to malicious node collusion attacks while maintaining fault tolerance.

[0020] As one embodiment of the present invention, the node reputation evaluation algorithm in the dynamic data sharding module and the distributed storage module evaluates nodes based on factors including the stability of node online duration, the completion rate of historical data storage tasks, data retrieval response latency, and the degree of participation in network consensus. The node reputation value serves as an important input to the virtual node mapping weight in the consistent hashing algorithm, ensuring that high-reputation nodes are more likely to be selected as storage locations for data shards, thereby probabilistically improving the reliability and availability of overall data storage.

[0021] In one embodiment of the present invention, the privacy computing module based on attribute-based encryption and proxy re-encryption employs a linear secret-sharing scheme to implement the access strategy, supporting complex logical operations such as AND, OR, and threshold operations. The generation of the proxy re-encryption key strictly depends on the data owner's master private key and the authorized user's public key, and the proxy re-encryption key is generated unidirectionally, meaning that the data owner's or authorized user's private key cannot be derived from the proxy re-encryption key. The proxy server performs a re-encryption operation consisting of only a deterministic mathematical transformation, designed to be completed within a finite time and with controllable computational complexity to accommodate the limited computing resources of the edge server.

[0022] In one embodiment of the present invention, the preceding event hash of the audit log entry in the trusted operation auditing and tracing module refers to the hash value of the log entry of the previous operation event that the operation directly depends on. For example, the preceding event hash of a successful data read operation must point to a successful permission policy verification operation. This design forcibly establishes logical dependencies between operations. Any attempt to tamper with or delete intermediate logs will cause the hash verification of all subsequent logs to fail, thereby immediately exposing the tampering behavior.

[0023] In one embodiment of the present invention, the system is deployed using a microservice architecture. The decentralized identity and permission management module, the dynamic data sharding module, the distributed storage module, the privacy computing module based on attribute-based encryption and proxy re-encryption, and the trusted operation auditing and tracing module run as independent services. These modules communicate and exchange data through well-defined application programming interfaces and event message queues. The system can be deployed in a containerized form on heterogeneous IoT edge server hardware platforms.

[0024] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. This invention completely eliminates the single point of failure and performance bottleneck risks of centralized permission management nodes by constructing a decentralized identity and permission management module and maintaining a distributed permission ledger based on an improved consensus mechanism. Permission updates are globally synchronized through the consensus network, enabling fine-grained and real-time adjustments to data access permissions in dynamic edge environments. The deployment and effectiveness of the overall system security policy no longer depend on any single trusted center, significantly improving the robustness and adaptability of the security architecture.

[0025] 2. This invention utilizes a dynamic data sharding module and a distributed storage module to encrypt and shard sensitive data, distributing it across multiple geographically isolated edge nodes. Combined with a storage location selection algorithm based on node reputation, this achieves a balance between data confidentiality, availability, and integrity. Even if individual edge nodes are compromised or physically lost, attackers can only obtain encrypted shards from which the original data cannot be recovered. Simultaneously, the system can automatically recover data from other surviving nodes, significantly enhancing the data's resilience against both physical and cyberattacks.

[0026] 3. This invention deeply integrates attribute-based encryption and proxy re-encryption technologies, achieving strong privacy protection of "unauthorized visibility" throughout the entire data lifecycle. Attribute-based encryption provides fine-grained access control based on attributes, without the need for pre-shared keys; proxy re-encryption allows data to be securely delegated for computation in an encrypted state, meeting the privacy-preserving computation requirements of edge computing scenarios. The combination of these two technologies ensures that the plaintext content of data is effectively protected whether it is in a static storage or dynamic computation state, effectively defending against privacy theft by external attackers and internal malicious operators.

[0027] 4. This invention designs and implements a trusted operation auditing and traceability module based on a distributed ledger, permanently embedding all security-critical operations in an immutable ledger in the form of a hash chain. This establishes a distributed, highly reliable auditing and traceability system, where any data operation can be uniquely and irrefutably recorded and verified. It provides a complete and authoritative chain of technical evidence for post-incident analysis, liability determination, and compliance verification, solving the inherent defects of traditional centralized logs, such as susceptibility to tampering and difficulty in traceability. Attached Figure Description

[0028] Figure 1 This is a schematic diagram of the overall technical solution architecture of the present invention; Figure 2 This is a schematic diagram of the core principle framework of the decentralized identity and permission management module in this invention; Figure 3 This is a logical flow diagram of the dynamic data sharding module and the distributed storage module in this invention; Figure 4 This is a schematic diagram of the core principle framework of the privacy computing module based on attribute-based encryption and proxy re-encryption in this invention; Figure 5 This is a schematic diagram illustrating the principle of building a trusted evidence chain in the trusted operation audit and tracing module of this invention. Detailed Implementation

[0029] Example 1: The overall technical architecture of the IoT edge server data security storage and privacy protection management system proposed in this invention is shown in the attached figure. Figure 1As shown in the figure. The IoT edge server data security storage and privacy protection management system is deployed on a distributed network composed of multiple IoT edge server nodes. These edge server nodes are physically located in different geographical locations and logically interconnected through low-latency, high-reliability communication links, collectively forming a decentralized edge computing and storage infrastructure. The following will be combined with the attached... Figure 1 To be continued Figure 5 This section provides a detailed implementation description of each functional module of the system, expanding upon it layer by layer.

[0030] The system comprises four core functional modules: a decentralized identity and access control module, a dynamic data sharding and distributed storage module, a privacy computing module based on attribute-based encryption and proxy re-encryption, and a trusted operation auditing and tracing module. These modules operate independently as microservices, communicating asynchronously with each other through standardized application programming interfaces (APIs) and event message queues. This ensures the system possesses high cohesion and low coupling, and supports containerized deployment on heterogeneous hardware platforms.

[0031] First, the decentralized identity and access control module will be described in detail. Please refer to the attached document. Figure 2 The centralized identity and access control module serves as the root of trust and policy hub for the entire system. Its primary task is to generate and maintain unique decentralized identity identifiers for all participating entities in the network—including but not limited to edge server nodes, user terminal devices, application processes, and data resources to be protected. Each identity identifier is supported by a pair of asymmetric cryptographic key pairs, where the public key serves as the public representation of the identity, and the private key is securely stored locally by the entity for digital signatures and authentication. The generation of identity identifiers follows a deterministic algorithm, ensuring global uniqueness and unforgeability.

[0032] The centralized identity and permission management module further constructs and maintains a distributed permission ledger. This distributed permission ledger is not a centralized database, but a blockchain-like data structure that is synchronously replicated among all nodes in the network through an improved practical Byzantine fault-tolerant consensus mechanism. Each record in the ledger is a digitally signed permission statement, the content of which adopts a machine-readable structured format and precisely describes the Boolean logic relationship between "subject identity identifier", "operation type" (such as read, write, execute, delegate), "data object identifier", and "environmental conditions" (such as time window, geographical location, device security status). For example, a typical permission statement can be expressed as: "If and only if the requester's identity attribute set contains 'department = R&D department' and 'job level ≥ 3', and the current time is between 9:00 and 18:00 on a working day, and the request source IP address belongs to the company's intranet segment, then the requester is allowed to perform a read operation on the data object identified as 'PROJECT_X_DATA'."

[0033] When any entity initiates a data access request, the centralized identity and permission management module does not directly process the request. Instead, it triggers a policy enforcement point deployed locally on the requester's machine. The policy enforcement point first verifies the requester's identity and then retrieves all permission claims related to the request from the distributed permission ledger. The retrieval process is based on a multi-dimensional index, including data object identifiers, operation types, and possible environment context tags. After obtaining the relevant claims, the policy enforcement point substitutes the actual context information of the current request—including the requester's real-time attributes, operation type, target data object, precise timestamp, network location, device fingerprint, etc.—into the logical expression in the claim for real-time calculation. The calculation engine employs formal verification methods to ensure the determinism and unambiguity of the decision result. If all conditions are met, an "allow" decision is generated; otherwise, a "deny" decision is generated. This decision result, along with the original request context, is encapsulated for use by the subsequent auditing module.

[0034] The centralized identity and permission management module also defines a complete set of dynamic permission update protocols. The creation, modification, or revocation of any permission is initiated by the permission grantor (i.e., the data owner or authorized administrator) on their local client. The client generates a permission transaction containing a new permission declaration or revocation instruction, and digitally signs it using the grantor's private key. This transaction is broadcast throughout the edge network. Upon receiving the transaction, the consensus nodes in the network first verify the validity of the signature, and then check whether the transaction content conforms to the preset policy syntax specifications. After successful verification, the transaction enters the consensus process. The consensus mechanism used here is an improved version of the traditional practical Byzantine fault-tolerant algorithm, its core innovation being the introduction of a dynamic weighted voting algorithm based on the credibility of node historical behavior.

[0035] Specifically, each consensus node is assigned an initial weight value, which is dynamically adjusted based on its behavior at the end of each consensus cycle. The calculation model for the behavioral credibility score comprehensively considers three dimensions: first, whether the proposal submitted by the node is logically correct and consistent with the current ledger state; second, whether the node's response latency to consensus messages is lower than the network's average latency threshold; and third, whether the node's online rate over the past several cycles is higher than 95%. The higher the credibility score, the greater its voting weight in the next round of consensus. This design allows high-reputation, high-performance nodes to have greater influence in determining the ledger state, thereby significantly improving the speed of consensus achievement and the overall throughput of the system, while tolerating no more than 1 / 3 of the total number of malicious or faulty nodes. Permission transactions verified by consensus are permanently written into the distributed permission ledger, achieving global, real-time, and tamper-proof synchronization of permission states.

[0036] The dynamic data sharding module and the distributed storage module are described in detail below. Please refer to the appendix. Figure 3 The dynamic data sharding module and distributed storage module are responsible for the secure preprocessing and redundant storage of sensitive raw data that needs to be persisted in the edge environment. Their workflow begins with a data upload event. When the raw data stream arrives at the edge entry node, the dynamic data sharding module and distributed storage module first perform integrity verification, calculating its SHA-256 hash value as a data fingerprint. Subsequently, the module starts the sharding engine. The sharding strategy is driven by two key parameters: the redundancy coefficient K and the number of shards N. Here, N is the preset total number of shards, and K is the minimum number of shards required to recover the original data, typically satisfying K... <N。

[0037] For example, the system can be configured with N=5 and K=3, meaning the original data is divided into 5 fragments, and any 3 fragments are sufficient to recover the original data. The fragmentation algorithm uses erasure coding technology based on Reed-Solomon codes to encode the original data into N equal-length data blocks, each of which is called an original fragment. This process ensures that even if (NK) fragments are lost, the original data can still be reconstructed without loss.

[0038] After obtaining N original data shards, the module independently generates a high-strength symmetric encryption key for each shard. The key length is 256 bits, and encryption is performed using either the SM4 algorithm or the AES-256 algorithm conforming to the standards of the State Cryptography Administration, generating N encrypted data shards. Each encryption key is encapsulated as a key object and bound to a corresponding data shard identifier. Subsequently, the module calls the built-in distributed storage location mapper to select a set of physical storage nodes for each encrypted data shard. The core algorithm of the distributed storage location mapper is a hybrid strategy that integrates consistent hashing and node reputation assessment. A consistent hashing ring is built on top of the edge server nodes across the entire network, and each physical node is mapped to multiple virtual nodes based on its computing power and storage capacity. Based on this, the node reputation assessment algorithm calculates a dynamic reputation value for each physical node. The formula for calculating the node reputation value is as follows:

[0039] in, This represents the overall reputation value of node i; Its online duration stability score is calculated based on the normalized average daily online hours over the past 7 days; Its historical data storage task completion rate is the ratio of the number of successfully completed storage / read tasks to the total number of tasks. It is the reciprocal of the average response latency for data retrieval, after standardization. The degree to which they actively participate in consensus voting is measured by participation rate. (Coefficient) These are configurable weights, summing to 1, with system default values ​​of 0.3, 0.3, 0.2, and 0.2 respectively. Node reputation is used as a weighting factor for virtual nodes on the consistent hash ring; virtual nodes with higher reputation occupy larger hash intervals, thus having a higher probability of being selected during hash mapping.

[0040] For each encrypted data shard, the mapper searches clockwise on the hash ring, selecting M unique nodes that satisfy geographical isolation constraints as its storage targets. Geographical isolation constraints require that the selected nodes cannot be located in the same data center, city, or autonomous system to prevent regional disasters. The value of M is usually equal to N, but at least K nodes must meet the minimum number of live replicas requirement. After selecting storage nodes, the module pushes the encrypted data shards to each target node in parallel via a secure transmission channel (such as TLS 1.3). Simultaneously, the metadata of the encrypted data shard—including shard identifier, encryption key object (in encrypted form), storage node list, data fingerprint, etc.—is constructed as a notarization record and submitted to the distributed permission ledger maintained by the aforementioned decentralized identity and permission management module. This notarization record and permission declaration coexist in the same ledger, ensuring the immutability and global verifiability of data location information.

[0041] When original data needs to be recovered, the module first queries the ledger for all fragment metadata corresponding to the target data object. Based on the list of storage nodes in the metadata, the module concurrently sends read requests to each node. Upon receiving a request, each storage node first calls the decentralized identity and permission management module to verify the requester's access permissions. After successful verification, the node returns the corresponding encrypted data fragment. After collecting at least K valid fragments, the module decrypts them one by one using the corresponding decryption keys to obtain K original fragments. Subsequently, using the Reed-Solomon decoding algorithm, the complete original data is reconstructed losslessly from these K fragments, and its hash value is recalculated and compared with the original fingerprint to verify data integrity.

[0042] Part Three details the privacy computing module based on attribute-based encryption and proxy re-encryption. Please refer to the appendix. Figure 4The privacy computing module based on attribute-based encryption and proxy re-encryption is key to achieving the core goal of "usable but invisible" data. Its operation spans the entire process of data upload, storage, and computation. During the data upload phase, the data owner first defines an access control policy. This policy is presented as an attribute logic expression, such as "(Department = Finance Department ∧ Job Level ≥ 4) ∨ (Project Team = Audit Team ∧ Security Clearance = High)". Subsequently, the module calls the ciphertext policy attribute-based encryption algorithm to encrypt the original data (or its encrypted fragments) using the ciphertext policy. This invention employs attribute-based encryption based on a linear secret sharing scheme, which efficiently supports complex logic gate operations such as AND, OR, and threshold operations. The encryption process outputs attribute-based ciphertext, which itself does not contain any plaintext information, and its decryption capability is entirely determined by whether the receiver's attribute set satisfies the embedding policy. This attribute-based ciphertext is then processed and stored by the dynamic data fragmentation module and the distributed storage module.

[0043] For scenarios requiring computational tasks to be performed on edge servers without exposing plaintext data, the privacy computing module based on attribute-based encryption and proxy re-encryption enables a proxy re-encryption mechanism. Assume data owner A wants to delegate their encrypted data to user B for specific computations. A first submits a re-encryption delegation request to the privacy computing module, containing B's public key. After verifying A's complete ownership of the target data, the module uses A's master private key and B's public key to generate a proxy re-encryption key through a one-way trapdoor function.

[0044] The mathematical properties of the proxy re-encryption key ensure that it cannot be used to deduce any private key information of A or B. The generated re-encryption key is securely transmitted to a designated, semi-trusted edge computing server (i.e., the proxy server). When the proxy server receives ciphertext encrypted with A's public key, it uses the proxy re-encryption key to perform a deterministic mathematical transformation, converting the original ciphertext into new ciphertext that can only be decrypted by B's private key. Throughout the conversion process, the proxy server has no knowledge of the original plaintext, nor of A's or B's private keys; it performs only a black-box cryptographic operation. The converted ciphertext is sent to B, who can then decrypt it using their own private key to obtain the original data. This mechanism allows data to flow and be delegated securely in an encrypted state, perfectly meeting the privacy requirements of data outsourcing in edge computing.

[0045] Finally, the trusted operation auditing and tracing module is described in detail. Please refer to the appendix. Figure 5The design philosophy of the trusted operation auditing and tracing module is "all operations are traceable, and all traceability is verifiable." The module embeds lightweight audit probes into the key execution paths of the system's four core modules. These probes cover operation points including: entity identity authentication success / failure events, permission adjudication events at policy execution points, data shard storage write and read events, attribute-based encryption / decryption operation events, and proxy re-encryption key generation and usage events. Whenever a monitored operation is executed, the corresponding audit probe is immediately triggered. The probe captures the complete context of the operation, including a timestamp accurate to nanoseconds, the decentralized identity of the operation subject, the unique identifier of the operation object, the operation type code, the operation result (success / failure), and the hash digest of the operation's input / output data.

[0046] Most importantly, each audit log entry also includes a "preceding event hash" field. The value of this "preceding event hash" field is the hash value of the log entry of the previous operation event that the current operation directly depends on. For example, a successful data read operation necessarily requires a successful authorization verification, so its preceding event hash points to the log hash of that authorization verification event. This design enforces a causal dependency chain between operations. The audit probe assembles all the captured information into a structured log entry and immediately calculates the SHA-3-256 hash value of the log entry as its unique identifier.

[0047] Subsequently, the audit log entry is encapsulated as a special audit transaction and submitted to the consensus network of the decentralized identity and permission management module via the internal message bus. The consensus network treats the audit transaction the same as other permission transactions, subjecting it to the same consensus verification process before permanently recording it in a dedicated area of ​​the distributed permission ledger. Due to the chain structure of the ledger and the unidirectional nature of cryptographic hashes, all audit log entries form a tightly interlocking and inseparable chain of trusted evidence in chronological order. Any attempt to tamper with historical logs will cause a change in its hash value, leading to the failure of the preceding hash verification of all subsequent log entries, thus immediately exposing the tampering at the system level. In the event of a security incident, authorized auditors can input the hash identifier of any operation event through the query interface provided by the module. The system will then traverse the evidence chain forward or backward to quickly reconstruct the complete operation sequence and context, providing a solid technical basis for liability determination and compliance review.

[0048] In summary, this embodiment constructs a comprehensive security system integrating decentralized identity management, dynamic secure storage, strong privacy computing, and trusted audit traceability through the deep collaboration of four major modules. This comprehensive security system fully leverages the immutability of distributed ledgers, the strong security of cryptography, and the distributed characteristics of edge networks, fundamentally solving many challenges of traditional centralized security architectures in IoT edge scenarios.

[0049] Example 2: Building upon Example 1, this example deeply optimizes the deployment and operation strategy of the system on resource-constrained edge nodes to adapt to the numerous low-power, low-computing-power edge devices present in the Industrial Internet of Things (IIoT). These devices are typically equipped with ARM Cortex-M series microcontrollers, have less than 512KB of memory and less than 4MB of storage, and rely on batteries or energy harvesting for power. For this scenario, the functions of each module in the system are redefined and tailored to achieve the optimal balance between security features and resource consumption.

[0050] The decentralized identity and permission management module deploys only a simplified version of the policy enforcement point on lightweight nodes. This simplified policy enforcement point does not maintain a complete copy of the distributed permission ledger, but instead uses an on-demand retrieval strategy. When a local application initiates a data access request, the policy enforcement point first checks whether the relevant permission declaration exists in the local cache. If it exists and has not expired (the cache validity period is 5 minutes by default), the cache is used directly for adjudication; if it does not exist or has expired, a lightweight query request is initiated to the nearest "super edge node" in the network that has a complete copy of the ledger. The query request uses a compact binary encoding format, containing only the necessary identity identifier and data object identifier. After processing the query, the super edge node returns an equally compact adjudication result and a summary of the relevant policy. This mechanism significantly reduces the storage and bandwidth overhead of lightweight nodes. In addition, lightweight nodes do not participate in consensus voting; their identity registration and initial permissions are handled by the super edge node, and a trust chain is established through a one-time secure pairing protocol.

[0051] The dynamic data sharding module and distributed storage module on the lightweight node serve only as passive storage carriers for data shards, without performing sharding, encryption, or mapping calculations. When the system needs to store data shards on the lightweight node, the upstream super edge node completes all preprocessing work and pushes the final encrypted data shards to the lightweight node. The lightweight node only needs to provide a simple key-value storage interface to store the shard data and its verification hash. When reading data, after receiving a read request, the lightweight node first verifies the temporary access token attached to the request (issued by the policy enforcement point). If the verification is successful, it directly returns the stored encrypted shards without performing any decryption or reassembly operations. The node reputation evaluation algorithm is also adjusted accordingly. For lightweight nodes, their reputation value is mainly based on storage reliability (i.e., shard read success rate) and response timeliness, and their consensus participation or computing power is no longer assessed.

[0052] The core cryptographic operations of the privacy computing module based on attribute-based encryption and proxy re-encryption are completely offloaded to the super edge node. If an application on the lightweight node needs to encrypt data, it only needs to call a local security element (such as an SE or TPM chip) to generate a session key and use that session key to symmetrically encrypt the data. Then, the encrypted data and the encapsulated session key are sent to the super edge node. The super edge node uses an attribute-based encryption algorithm to encrypt the session key and stores the double-encrypted data packet in the distributed network. The decryption process is the reverse. Proxy re-encryption is also performed only on the super edge node; the lightweight node does not hold any re-encryption key and does not perform any re-encryption transformation.

[0053] The trusted operation auditing and tracing module employs a batch processing and compression strategy on lightweight nodes. Local event logs captured by the audit probe are first accumulated in a local buffer. When the buffer reaches a preset threshold (e.g., 100 entries) or after a fixed time interval (e.g., 30 seconds), the log entries are batch compressed (using the LZ4 algorithm) and a local aggregate hash is added. Then, they are submitted as a whole to the super edge node. The super edge node is responsible for disassembling, verifying, and injecting these aggregated logs into the global evidence chain. This design significantly reduces the frequency of network communication and energy consumption on lightweight nodes.

[0054] Through the above-mentioned targeted optimizations, this embodiment successfully extends the core security capabilities of the present invention to the extremely resource-constrained edge of the Internet of Things, achieving full coverage of security protection while ensuring the overall performance and energy efficiency of the system.

Claims

1. An IoT edge server data security storage and privacy protection management system, characterized in that, The system is built on a distributed network consisting of multiple IoT edge server nodes, and includes: The module includes a decentralized identity and access control module, a dynamic data sharding module and a distributed storage module, a privacy computing module based on attribute-based encryption and proxy re-encryption, and a trusted operation auditing and tracing module. The decentralized identity and permission management module also defines a dynamic permission update protocol. Any permission granting, revocation, or modification operation must be initiated by the permission grantor through a transaction signed by its private key. The private key-signed transaction is broadcast in the distributed network and, after consensus verification, is permanently recorded in the distributed permission ledger. For scenarios where computation needs to be performed on edge servers but plaintext data is not desired to be exposed, the privacy computing module based on attribute-based encryption and proxy re-encryption, as well as the trusted operation audit and traceability module, introduce a proxy re-encryption mechanism. The data owner generates a proxy re-encryption key, which allows a designated edge computing server to convert ciphertext encrypted with the data owner's public key into ciphertext encrypted with another authorized user's public key. The dynamic data sharding module and the distributed storage module are used to perform secure preprocessing and distributed redundant storage on sensitive raw data that needs to be stored in the edge environment. The dynamic data sharding module and the distributed storage module first perform sharding operations on the original data, dividing the data into multiple data shards, and encrypting each data shard using a different symmetric encryption key to generate encrypted data shards. The encrypted data fragments and their storage location mappings are uploaded to the distributed permission ledger for evidence storage. The dynamic data sharding module and the distributed storage module have a built-in distributed storage location mapper. The distributed storage location mapper dynamically selects a group of storage nodes for each encrypted data shard based on a hybrid algorithm based on consistent hashing and node reputation evaluation. These storage nodes are isolated from each other in terms of geographical location and network affiliation. The evaluation dimensions of the node reputation evaluation algorithm include the stability of the node's online duration, the completion rate of historical data storage tasks, the data retrieval response latency, and the degree of participation in network consensus. The node reputation value serves as an important input to the virtual node mapping weight in the consistent hashing algorithm; The privacy computing module based on attribute-based encryption and proxy re-encryption is used to implement fine-grained access control and secure computational outsourcing during data storage and use; the trusted operation auditing and tracing module is used to record all operation events related to data security throughout the process and build a complete chain of evidence.

2. The IoT edge server data security storage and privacy protection management system according to claim 1, characterized in that: The decentralized identity and permission management module is used to create and manage decentralized identity identifiers based on asymmetric cryptography for each entity in the network, and maintain a distributed permission ledger based on an improved practical Byzantine fault-tolerant consensus mechanism. The distributed permission ledger records the identity identifiers of all entities and their corresponding fine-grained access policies. When any entity initiates a data access request, the decentralized identity and permission management module calls the policy execution point deployed locally on the request initiator's local machine. The policy execution point on the request initiator's local machine obtains the relevant access policy declaration from the distributed permission ledger and performs real-time logical calculations in combination with the context information of the current request to generate a deterministic decision to allow or deny access. The improvement of the practical Byzantine fault-tolerant consensus mechanism lies in the introduction of a dynamic weighted voting algorithm based on the credibility of node historical behavior. The voting weight of each node participating in the consensus is positively correlated with its credibility score during the historical consensus period; The behavioral credibility score is periodically evaluated and updated based on the correctness and timeliness of the proposals submitted by nodes, as well as network activity.

3. The IoT edge server data security storage and privacy protection management system according to claim 1, characterized in that, In the data upload phase, the privacy computing module based on attribute-based encryption and proxy re-encryption uses a ciphertext policy attribute-based encryption algorithm to encrypt the data. The data owner defines a set of logical policies describing visitor attributes and uses the logical policies to encrypt the data, generating attribute-based ciphertext. The ciphertext policy attribute-based encryption algorithm uses a linear secret sharing scheme to implement the access policy and supports complex logical operations such as AND, OR, and threshold.

4. The IoT edge server data security storage and privacy protection management system according to claim 1, characterized in that: The generation of the proxy re-encryption key strictly depends on the data owner's master private key and the authorized user's public key, and the proxy re-encryption key is generated in a one-way manner; The proxy server performs a re-encryption operation using only a specific mathematical transformation; Each key operation point of the trusted operation audit and tracing module is embedded with an audit probe. After each audit probe captures an operation event, it immediately generates a structured audit log entry. The audit log entry includes the operation timestamp, operation subject identity identifier, operation object identifier, operation type, operation result hash, and the hash of the preceding event of this operation. The proxy re-encryption key encapsulates audit log entries into transactions and submits them in real time to the consensus network where the distributed permission ledger resides for verification and storage.

5. The IoT edge server data security storage and privacy protection management system according to claim 4, characterized in that... : The preceding event hash of the audit log entry refers to the hash value of the log entry of the previous operation event that the operation directly depends on.

6. The IoT edge server data security storage and privacy protection management system according to claim 1, characterized in that... : The system is deployed in a microservice architecture. The decentralized identity and permission management module, the dynamic data sharding module and the distributed storage module, the privacy computing module based on attribute-based encryption and proxy re-encryption, and the trusted operation auditing and tracing module run as independent services. The modules communicate and exchange data through well-defined application programming interfaces and event message queues.

7. The IoT edge server data security storage and privacy protection management system according to claim 2, characterized in that... : The calculation model for the behavioral credibility score comprehensively considers three dimensions: the logical correctness of the node's proposal submission and its consistency with the current ledger state; whether the node's response latency to consensus messages is lower than the network's average latency threshold; and whether the node's online rate has been higher than 95% over the past few periods.

8. The IoT edge server data security storage and privacy protection management system according to claim 1, characterized in that... : In the node reputation evaluation algorithm, the formula for calculating the overall node reputation value is as follows: ,in This represents the overall reputation value of node i; Its online duration stability score is calculated based on the normalized average daily online hours over the past 7 days; Its historical data storage task completion rate is the ratio of the number of successfully completed storage / read tasks to the total number of tasks. It is the reciprocal of the average response latency for data retrieval, after standardization. The degree to which they actively participate in consensus voting is measured by participation rate, with a coefficient. Configurable weights.

9. The IoT edge server data security storage and privacy protection management system according to claim 1, characterized in that... : The dynamic data sharding module and the distributed storage module use Reed-Solomon code erasure coding technology to encode the original data into N original shards of equal length, and preset the minimum number of shards required to recover the original data to be K, where K is less than N.

Images