Industrial internet of things lightweight post-quantum blockchain edge security processing system and method

Abstract

The application relates to the technical field of blockchains, in particular to an industrial Internet of Things lightweight post-quantum blockchain edge security processing system and method, which comprises a client, an ordering node and an edge peer node; wherein: a hybrid identity generation module and a post-quantum hybrid signature module are arranged in the client; the client is used for initiating a transaction request, generating a transaction message and completing identity authentication and transaction signature; the ordering node is arranged with a hybrid identity generation module and a post-quantum hybrid signature module; the ordering node is used for receiving a transaction message, performing ordering processing, generating a block and broadcasting the block; the edge peer node is arranged with a hybrid identity generation module, a post-quantum hybrid signature module, a certificate and public key cache module, a group signature verification module and a block verification and submission module; and the edge peer node is used for receiving a block, performing hybrid signature verification, block verification, ledger submission and state updating.

Description

Technical Field

[0001] This invention relates to the field of blockchain technology, specifically to a lightweight post-quantum blockchain edge security processing system and method for industrial IoT. Background Technology

[0002] The Industrial Internet of Things (IIoT) connects production equipment, sensor terminals, industrial gateways, and control systems to enable real-time data acquisition, transmission, collaborative processing, and intelligent decision-making in industrial settings. With the development of the Industrial Internet, intelligent manufacturing, and edge collaborative control, industrial scenarios are placing higher demands on node identity reliability, message integrity, data traceability, and multi-node collaborative processing capabilities.

[0003] Blockchain technology, with its characteristics of distributed ledger, immutability, traceability, and decentralized collaboration, can provide trusted data sharing and processing capabilities for the Industrial Internet of Things (IIoT). In particular, consortium blockchain frameworks such as Hyperledger Fabric, with their member access control, modular architecture, and strong engineering deployment capabilities, are suitable for IIoT applications with high requirements for privacy protection, access control, and transaction efficiency.

[0004] However, existing industrial IoT blockchain systems largely rely on traditional public-key cryptography mechanisms for node authentication, transaction signing, and secure communication. With the development of quantum computing technology, traditional public-key cryptography is theoretically vulnerable to efficient cracking, thus exposing blockchain systems to security risks such as identity forgery, message tampering, replay attacks, and long-term data loss.

[0005] Furthermore, post-quantum signatures typically feature long public keys, long signatures, and large certificate sizes. If directly integrated into existing consortium blockchain frameworks, this can significantly increase the overhead of certificate parsing, public key recovery, hash calculation, serialization transmission, and block verification.

[0006] Therefore, existing technologies need further development. Summary of the Invention

[0007] In view of the shortcomings of the prior art described above, the purpose of this invention is to provide a lightweight post-quantum blockchain edge security processing system and method for the Industrial Internet of Things (IIoT), which can meet the heterogeneous device reality of the IIoT and reduce the computing and memory overhead of edge devices.

[0008] To achieve the above objectives, the present invention adopts the following technical solution.

[0009] The first aspect of this invention provides a lightweight post-quantum blockchain edge security processing system for industrial IoT, comprising: Client, sorting node, and edge peer node; where: The client is equipped with a hybrid identity generation module and a post-quantum hybrid signature module; the client is used to initiate transaction requests, generate transaction messages, and complete identity authentication and transaction signing. The sorting node is equipped with a hybrid identity generation module and a post-quantum hybrid signature module; the sorting node is used to receive transaction messages, perform sorting processing, generate blocks, and broadcast blocks. The edge peer nodes are equipped with a hybrid identity generation module, a post-quantum hybrid signature module, a certificate and public key caching module, a block signature verification module, and a block verification and submission module; the edge peer nodes are used to receive blocks, perform hybrid signature verification, block verification, ledger submission, and state updates; The hybrid identity generation module is used to generate a hybrid identity for each node that simultaneously contains classical cryptographic identity materials and post-quantum cryptographic identity materials, and associate the post-quantum public key with the digital certificate of that node. The post-quantum hybrid signature module is used to generate classical digital signatures and post-quantum digital signatures for messages to be signed, and encapsulates the two into a hybrid signature byte string, which is then written into the signature field of the existing message structure. The certificate and public key caching module is used to maintain an intra-block local cache table, a channel-level certificate cache table, a public key cache table, and / or a signer index table in the edge peer nodes. The grouped signature verification module is used to group the signatures to be verified based on the signer's identity characteristics, and reuse the pre-verification results based on the grouping results, prioritizing the classical signature verification, and only performing the post-quantum signature verification when the classical signature verification passes. The block verification and submission module is used to perform block structure verification, endorsement verification, read / write set verification, ledger submission, and status database update after the signature verification is successful.

[0010] As an optional implementation, the client, sorting nodes, and edge peer nodes are built on a unified upgraded version of the Hyperledger Fabric consortium blockchain framework. The system also includes a consensus coordination module that is adapted to the SmartBFT sorting service, enabling sorting nodes to complete transaction sorting, block packaging, and block broadcasting, and edge peer nodes to complete block reception, verification, and submission. The unified upgraded version is used to support the parsing and signature verification of hybrid signature fields and certificate extension information.

[0011] As an optional implementation, the hybrid identity generation module is used to generate dual-track identity materials for each node. These dual-track identity materials include at least a classic signature public-private key pair, a post-quantum signature public-private key pair, a node certificate, and a node role identifier; wherein, the first... i The hybrid identity information of each node satisfies the following formula: ; in, Indicates the first i The classic public key of each node, Indicates the first i The post-quantum public key of each node, Indicates the first i Certificates corresponding to each node Indicates the first i The role identifier of each node.

[0012] As an optional implementation, the message to be signed includes at least transaction messages, block metadata, or node communication messages; The post-quantum hybrid signature module generates both classical and post-quantum signature values ​​for the same message to be signed, encapsulates them into a hybrid signature byte string according to a preset encoding rule, and writes it into the signature field of the existing message structure in Hyperledger Fabric. The post-quantum public key is written as certificate extension information into the node's X.509 certificate for extraction during the identity deserialization stage. Its hybrid signature satisfies the following formula: ; in, Indicates the first Each node sends a message The generated hybrid signature payload, This refers to the classic signature section. This represents the post-quantum signature portion.

[0013] As an optional implementation, during the signer identity deserialization stage of the block verification path, the edge peer node extracts the certificate fingerprint from the serialized identity information or node certificate, uses it as the main index to query the signer index table, and then obtains the corresponding certificate cache data and public key cache data.

[0014] As an optional implementation, the signer identity features include at least a signer identifier, a certificate fingerprint, and / or a node role; The group signature verification module is used to group multiple transactions to be verified based on the signer identifier, certificate fingerprint, or node role within the same block; wherein, the first k Each group satisfies the following formula: ; in, Indicates the first The set of transactions corresponding to each signer Indicates the first in the block This transaction, Indicates transaction The signer's identifier, This indicates the total number of transactions in the block.

[0015] As an optional implementation, when performing signature verification, the group signature verification module reuses the identity deserialization result, public key recovery result, message digest calculation result, and endorsement policy preprocessing result for transactions within the same group, and prioritizes performing classic signature verification based on the reused message digest and classic public key; when the classic signature verification passes, it then reads the post-quantum public key cache item or certificate parsing result to perform post-quantum signature verification; when the classic signature verification fails, it directly determines that the transaction signature verification has failed and skips post-quantum signature verification; the total verification overhead of the edge peer node for a block satisfies the following formula: ; in, This represents the total cost of block verification. Indicates the cost of certificate resolution. Indicates the cost of public key recovery. Indicates the signature verification cost. This indicates the overhead of ledger commits and status updates.

[0016] As an optional implementation, after the certificate works in conjunction with the public key caching module and the block signature verification module, the total overhead of block verification at the edge node is significantly reduced. The reduction in verification overhead can be quantified by the following formula: ; in, This represents the total cost of optimized block verification. This indicates the certificate processing overhead after introducing certificate caching. This indicates the overhead of public key processing after introducing public key caching. This indicates the overhead of signature processing after introducing grouped signature verification.

[0017] As an optional implementation, the edge peer nodes are deployed in Raspberry Pi, industrial gateways, and / or embedded computing boards, and the system supports at least one of the following lightweight deployment methods: the edge peer nodes simultaneously serve as endorsement nodes and commit nodes; or the edge peer nodes only serve as commit nodes; or the virtual machine nodes serve as endorsement nodes, while the edge peer nodes serve as block verification and ledger commit functions.

[0018] A second aspect of the present invention provides a security processing method based on the lightweight post-quantum blockchain edge security processing system for industrial IoT described in the first aspect of the present invention, comprising: The client generates a transaction message and calls the hybrid identity generation module and the post-quantum hybrid signature module to complete identity authentication and hybrid signature, wherein the hybrid signature is written into the signature field of the existing message structure, and the post-quantum public key is written into the node certificate extension information. The sorting node receives the transaction message and invokes the consensus coordination module to perform sorting processing, block generation, and block broadcasting; After receiving a block, the edge peer node extracts the signer certificate fingerprint during the signer identity deserialization stage of the block verification path, prioritizes querying the local cache within the block, queries the channel-level cache if no match is found, and establishes a node certificate and public key cache if no match is found in the cache. Edge peer nodes call the group signature verification module to group the transactions to be verified based on the signer identifier, certificate fingerprint or node role, and perform identity deserialization result reuse, public key recovery result reuse, digest reuse and endorsement strategy preprocessing reuse on each group; For transactions within the same group, edge peer nodes prioritize classical signature verification and only perform post-quantum signature verification by reading the post-quantum public key cache or certificate resolution result if classical signature verification passes. Edge peer nodes perform block verification and submission for transactions that have passed dual signature verification, thus completing ledger updates and state database updates.

[0019] This invention has at least the following technical effects: 1. Without changing the existing main transaction process of the consortium blockchain, this invention improves the identity credibility, message integrity and ledger security of the blockchain system in the industrial Internet of Things scenario under the threat of quantum computing, and reduces the verification latency and resource consumption of resource-constrained edge devices such as Raspberry Pi. It is applicable to scenarios such as industrial Internet, intelligent manufacturing and edge collaborative control. 2. This invention reuses existing signature fields to carry hybrid signatures and carries post-quantum public keys through certificate extensions, thus achieving the collaborative deployment of classical signatures and ML-DSA without reconstructing the top-level transaction structure; 3. This invention proposes a two-level caching mechanism of in-block local caching and channel-level bounded caching, and combines certificate fingerprint indexing, configuration block / CRL-aware failure detection and classic priority short-circuit signature verification strategy to enable edge devices such as Raspberry Pi to avoid repeatedly performing large-volume certificate parsing, public key recovery and post-quantum signature verification for invalid transactions; 4. This invention adopts a role-aware heterogeneous deployment architecture of "cloud reordering and edge lightweight verification". It entrusts the complex SmartBFT consensus to cloud sorting nodes, and pushes cache reuse, group signature verification and ledger submission, which are strongly related to the locality of signers, to edge peer nodes, thereby improving throughput and resource utilization without changing the main process of the consortium blockchain. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a block diagram of a lightweight post-quantum blockchain edge security processing system for industrial IoT, according to a specific embodiment of the present invention.

[0022] Figure 2 This is a schematic diagram of a lightweight post-quantum blockchain edge security processing system based on the Industrial Internet of Things in a specific embodiment of the present invention.

[0023] Figure 3 This is a flowchart illustrating another specific embodiment of the present invention of a lightweight post-quantum blockchain edge security processing system based on the Industrial Internet of Things.

[0024] Figure 4 This is a flowchart illustrating a lightweight post-quantum blockchain edge security processing method based on the Industrial Internet of Things in a specific embodiment of the present invention. Detailed Implementation

[0025] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application. Furthermore, it should be understood that the specific embodiments described herein are only for illustration and explanation of this application and are not intended to limit this application.

[0026] It should be noted that the order of description of the following embodiments is not intended to limit the preferred order of the embodiments of this application. Furthermore, the descriptions of each embodiment in the following embodiments have their own emphasis; for parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0027] like Figures 1-3As shown, the first aspect of this invention provides a lightweight post-quantum blockchain edge security processing system for the Industrial Internet of Things (IIoT), comprising: an IIoT blockchain network consisting of a client, multiple sorting nodes, and at least one edge peer node; wherein: the client is used to initiate transaction requests, generate transaction messages, and complete identity authentication and transaction signing; the sorting nodes are at least used to receive transaction messages, perform sorting processing, generate blocks, and broadcast blocks; the edge peer node is used to receive blocks, perform hybrid signature verification, block verification, ledger submission, and status update; wherein, hybrid signature verification, also known as dual signature verification, is a dual verification of classical signatures and post-quantum signatures.

[0028] In this application, unless otherwise specified, "each network participant" or "each node" refers to the set consisting of the client, the sorting node, and the edge peer nodes.

[0029] The client submits transaction requests to the consortium blockchain network through the application programming interface. The sorting node completes transaction sorting and block packaging. The edge peer nodes complete block reception, signature verification, status update and ledger submission. The sorting node is deployed in a high-performance server or virtual machine environment, and the edge peer nodes are deployed in resource-constrained devices.

[0030] Specifically, the edge peer nodes are deployed in resource-constrained devices such as Raspberry Pi, industrial gateways, and / or embedded computing boards, and the system supports at least one of the following lightweight deployment methods: the edge peer node simultaneously performs the functions of an endorser node and a commit node; or the edge peer node only performs the function of a commit node; or a virtual machine node performs the function of an endorser node, while the edge peer node performs the functions of block verification and ledger commit. The edge peer node can perform both endorser and commit node functions simultaneously, or it can perform only the function of a commit node. When the edge peer node only performs the function of a commit node, it mainly performs block reception, group signature verification, release of local cache within the block, and ledger commit processing. When the edge peer node simultaneously performs the functions of an endorser node and a commit node, it can also endorse the chaincode call results during the transaction execution phase and participate in the subsequent block verification process.

[0031] Specifically, the Raspberry Pi device primarily handles block reception, in-block local caching, channel-level caching, classic-first short-circuit signature verification, and ledger commit functions, while the virtual machine environment mainly handles ordering consensus and high-load processing functions. By separating high-computational-load tasks from edge-side verification tasks, resource-constrained devices can complete consortium blockchain block processing while maintaining post-quantum security capabilities.

[0032] Here, by deploying computationally intensive sorting services on high-performance servers or virtual machines, while decentralizing verification and submission functions to resource-constrained edge devices such as Raspberry Pi and industrial gateways, and supporting edge peer nodes to tailor their function stacks as needed (such as only undertaking the submission node function or collaborating with virtual machines to share the endorsement load), the post-quantum blockchain security processing capabilities are flexibly extended to the edge of the industrial IoT. This layered heterogeneous deployment method effectively reduces the single-point computing pressure and resource requirements of edge devices, making heavy-load operations such as post-quantum hybrid signature verification feasible at the edge, taking into account both the lightweight constraints of edge scenarios and the requirements for quantum security resistance, and improving the system's engineering adaptability and feasibility under diverse industrial IoT deployment conditions.

[0033] Specifically, the client, sorting node, and edge peer node are respectively deployed with combinations of different modules including a hybrid identity generation module, a post-quantum hybrid signature module, a certificate and public key caching module, a block signature verification module, a block verification and submission module, and / or a consensus coordination module.

[0034] Specifically, the client is equipped with at least a hybrid identity generation module and a post-quantum hybrid signature module.

[0035] Specifically, the sorting node is equipped with at least a hybrid identity generation module and a post-quantum hybrid signature module.

[0036] Specifically, the edge peer nodes are equipped with at least a hybrid identity generation module, a post-quantum hybrid signature module, a certificate and public key caching module, a block signature verification module, and a block verification and submission module.

[0037] Specifically, the hybrid identity generation module is used to generate a hybrid identity for each node that simultaneously contains classical cryptographic identity materials and post-quantum cryptographic identity materials, and associate the post-quantum public key with the digital certificate of that node.

[0038] Specifically, the post-quantum hybrid signature module is used to generate classical digital signatures and post-quantum digital signatures for the message to be signed, and encapsulates the two into a hybrid signature byte string before writing it into the signature field of the existing message structure; the message to be signed includes at least transaction messages, block metadata, or node communication messages.

[0039] For example, when generating a hybrid signature, the client generates a classic signature and a post-quantum signature for the same transaction message, and encapsulates them according to a preset encoding rule and writes them into the signature field corresponding to the transaction proposal, endorsement response or transaction envelope; the node certificate contains certificate extension information for recovering the post-quantum public key.

[0040] Specifically, the certificate and public key caching module is used to maintain an intra-block local cache table, a channel-level certificate cache table, a public key cache table, and / or a signer index table in the edge peer nodes.

[0041] Specifically, the grouped signature verification module is used to group the signatures to be verified based on the signer's identity characteristics, and reuse the pre-verification processing results based on the grouping results, prioritizing the execution of classical signature verification, and only performing post-quantum signature verification when the classical signature verification passes; the signer's identity characteristics include at least the signer identifier, certificate fingerprint, node role and / or message type.

[0042] For example, the group signature verification module is deployed in the verification path of the edge peer node or in a custom verification plugin to perform block grouping and pre-processing reuse for transactions of duplicate signers within a block.

[0043] Here, this application enables high-load sorting processing and edge-side security verification to operate collaboratively through node division of labor.

[0044] Specifically, the block verification and submission module is used to perform block structure verification, endorsement verification, read / write set verification, ledger submission, and status database update after the signature verification is passed.

[0045] Specifically, the consensus coordination module is used at least to coordinate the sorting nodes and edge peer nodes in the consortium blockchain network to complete the consistency processing and ensure the consistency of the ledger state.

[0046] Specifically, the hybrid signature reuses the signature field in the existing message structure, and then the quantum public key is written into the node's X.509 certificate extension information. The edge peer nodes combine in-block local caching, channel-level bounded caching, and classic priority short-circuit signature verification in the verification path during the peer submission phase to complete block processing.

[0047] In one embodiment of the present invention, the system is built on a unified upgraded version of the Hyperledger Fabric consortium blockchain framework and adapted to the SmartBFT sorting service; wherein the unified upgraded version is used to support the parsing and verification of hybrid signature fields and certificate extension information.

[0048] Specifically, the consensus collaboration module is adapted to the SmartBFT sorting service, enabling sorting nodes to complete transaction sorting, block packaging and block broadcasting, and edge peer nodes to complete block reception, verification and submission.

[0049] In one embodiment of the present invention, the hybrid identity generation module is used to generate dual-track identity materials for each node. The dual-track identity materials include at least a classic signature public-private key pair, a post-quantum signature public-private key pair, a node certificate, and a node role identifier; wherein, the first... iThe hybrid identity information of each node satisfies the following formula: .

[0050] in, Indicates the first i The classic public key of each node, Indicates the first i The post-quantum public key of each node, Indicates the first i Certificates corresponding to each node Indicates the first i The role identifier of each node.

[0051] Here, by generating both classical cryptographic identity materials and post-quantum cryptographic identity materials for the same node, the messages sent by the node can be verified by classical signatures in the current computing environment and can also resist future quantum computing attacks, thus achieving long-term security and forward and backward compatibility of identity credentials. At the same time, binding the node role identifier with the identity material makes it easier to group by role and reuse the processing results during subsequent signature verification, reducing the computational overhead of edge nodes.

[0052] In one embodiment of the present invention, the post-quantum hybrid signature module is used to generate classical signature values ​​and post-quantum signature values ​​for the same message to be signed, and encapsulates them into a hybrid signature byte string according to a preset encoding rule before writing them into the signature field of the existing message structure in Hyperledger Fabric; the post-quantum public key is written as certificate extension information into the node's X.509 certificate for extraction by the node during the identity deserialization stage; its hybrid signature satisfies the following formula: .

[0053] in, Indicates the first Each node sends a message The generated hybrid signature payload, This refers to the classic signature section. This represents the post-quantum signature portion.

[0054] Specifically, the classical signature algorithm is ECDSA or Ed25519, and the post-quantum signature algorithm is ML-DSA. The hybrid signature payload contains both classical and post-quantum signature verification data to ensure the verifiability of transaction messages under both classical and quantum attack scenarios. After the hybrid identity is generated, the client, sorting nodes, and edge peer nodes all have the ability to perform hybrid signatures and hybrid verifications on transaction messages and block metadata. For classical nodes that are not adapted to hybrid signature parsing logic, they can maintain the ability to parse certificate structures and transaction structures, but cannot directly verify the hybrid signature byte string. Therefore, this embodiment is applicable to consortium blockchain networks using a unified upgraded version.

[0055] Here, by encapsulating classical and post-quantum signatures into a unified format hybrid signature byte string and writing it into the signature field of the existing message structure, the intrusion into the existing blockchain message format is minimized. It can provide both classical security and quantum computing resistance without modifying the underlying communication protocol. The post-quantum public key is stored as certificate extension information in the X.509 certificate, which enables the distribution and binding of the post-quantum public key to reuse the existing public key infrastructure and identity deserialization process, reducing the engineering complexity and deployment cost of system transformation.

[0056] Specifically, in the certificate and public key caching module, the intra-block local cache table is used to store the identity deserialization results and pre-signature processing results during the current block verification period, and is released after the block verification is completed; the channel-level certificate cache table and the public key cache table are used to store the verified node certificates, classic public keys, and post-quantum public key recovery results reused across blocks, and are managed in a bounded manner according to the maximum number of entries and the maximum number of bytes threshold, and cache entries are evicted according to the least recently used strategy or a sliding window strategy based on block height; the signer index table is used to obtain the corresponding certificate cache data and public key cache data. The signer index table is used to establish a mapping relationship between certificate fingerprints and certificate cache data and public key cache data to quickly obtain the corresponding cache data.

[0057] In one embodiment of the present invention, during the signer identity deserialization stage of the block verification path, the edge peer node extracts the certificate fingerprint from the serialized identity information or node certificate and uses it as the main index to query the signer index table; when it receives a configuration block containing MSP updates, certificate rotation, or certificate revocation list (CRL) updates, it performs targeted invalidation or cleanup on the cached items of the affected signers.

[0058] In one embodiment of the present invention, when processing a block, the edge peer node performs a complete certificate parsing and public key extraction during the identity deserialization stage for signer certificates that are not cached, and writes the parsing results into the local cache and channel-level cache corresponding to the current block; for signer certificates that are cached, the cached results are directly called for signature verification; the local cache is released after the block verification is completed; when a configuration block or certificate revocation list (CRL) update is received, the affected cache items are invalidated or cleaned up.

[0059] Here, by establishing a hierarchical caching system in edge peer nodes, the certificate parsing, public key recovery, and identity deserialization results required for signature verification are reused within blocks and at the channel level, respectively. This avoids repeatedly performing complete certificate chain verification and public key extraction operations on the identity materials of the same signer between different transactions or different blocks, significantly reducing the additional computational overhead introduced by post-quantum hybrid signature verification. At the same time, by combining bounded cache management based on the least recently used strategy or sliding window strategy, and a targeted invalidation mechanism for MSP updates, certificate rotation, or CRL updates, signature verification is accelerated while ensuring controllable memory usage of edge nodes, meeting the blockchain security processing needs under resource-constrained conditions of industrial IoT edge devices.

[0060] In one embodiment of the present invention, the group signature verification module is used to group multiple transactions to be verified based on the signer identifier, certificate fingerprint, or node role within the same block; wherein, the first k Each group satisfies the following formula: .

[0061] in, Indicates the first The set of transactions corresponding to each signer Indicates the first in the block This transaction, Indicates transaction The signer's identifier, This indicates the total number of transactions in the block.

[0062] Here, by grouping transactions to be verified within a block according to the signer's identifier, certificate fingerprint, or node role, multiple transactions belonging to the same signer can reuse the results of identity deserialization and public key recovery once. This avoids repeated parsing of the same signer's identity and repeated pre-verification processing operations, effectively reducing redundant computations in the block verification process, thereby reducing the overall processing latency and computational resource consumption of edge peer nodes in the post-quantum hybrid verification scenario.

[0063] In one embodiment of the present invention, when performing signature verification, the group signature verification module reuses the identity deserialization result, public key recovery result, message digest calculation result, and endorsement policy preprocessing result of transactions within the same group, and prioritizes performing classic signature verification based on the reused message digest and classic public key; when the classic signature verification passes, it then reads the post-quantum public key cache item or certificate parsing result to perform post-quantum signature verification; when the classic signature verification fails, it directly determines that the transaction signature verification has failed and skips post-quantum signature verification; the total verification overhead of the edge peer node for a block satisfies the following formula: .

[0064] in, This represents the total cost of block verification. Indicates the cost of certificate resolution. Indicates the cost of public key recovery. Indicates the signature verification cost. This indicates the overhead of ledger commits and status updates.

[0065] Specifically, "same group" refers to the process where, before edge peer nodes verify the signatures of multiple transactions within a block, all transactions to be verified are divided into several subsets based on the signer's identity characteristics (such as signer identifier, certificate fingerprint, or node role). Each subset is a group. Transactions belonging to the same group are all initiated and signed by the same signer. The purpose of grouping is to enable on-demand reuse of pre-verification processing results, that is, to perform a complete identity deserialization and public key recovery only once for the same signer, thereby avoiding repeating these computationally intensive operations for each transaction.

[0066] This invention avoids redundant calculations caused by multiple transactions initiated by the same signer by grouping transactions within a block according to the signer before signature verification, and reusing the identity deserialization result, public key recovery result, message digest calculation result, and endorsement policy preprocessing result within the same group. This reduces the overhead of certificate parsing and public key recovery from "once per transaction" to "once per signer," effectively reducing the total computational load of block verification. At the same time, it adopts a "classical priority, failure skip" signature verification strategy, directly determining failure and skipping post-quantum signature verification when classical signature verification fails, avoiding invalid post-quantum signature verification calculations, further reducing the computational overhead and block processing latency of edge peer nodes in hybrid signature verification scenarios, enabling resource-constrained industrial IoT edge devices to efficiently complete block verification with post-quantum security enhancements.

[0067] In one embodiment of the present invention, after the certificate and public key caching module and the block signature verification module work together, the total block verification overhead of the edge node is significantly reduced. The effect of reducing verification overhead can be quantified by the following formula: ; in, This represents the total cost of optimized block verification. This indicates the certificate processing overhead after introducing certificate caching. This indicates the overhead of public key processing after introducing public key caching. This indicates the signature processing overhead after introducing grouped signature verification. Furthermore, the system characterizes the lightweight benefits by comparing the block verification overhead before and after optimization, and the overhead reduction rate satisfies the following formula: ; in, This indicates the reduction rate of verification overhead at edge nodes after adopting certificate caching, public key caching, and block signature verification mechanisms.

[0068] Here, by working together with certificate caching, public key caching, and block signature verification, the certificate parsing and public key recovery operations in the block verification process are optimized from "per-transaction execution" to "per-signer execution," fundamentally reducing the redundant computation steps in the signature verification path. At the same time, by defining quantitative formulas for verification overhead before and after optimization and overhead reduction rate indicators, a quantifiable metric is provided for evaluating and verifying the lightweight benefits of this system on resource-constrained edge devices, enabling the additional computational burden brought by quantum security enhancement to be accurately evaluated and controllably optimized in engineering.

[0069] In one embodiment of the present invention, the block verification and submission module performs block processing in the edge peer nodes in the following order: "block header verification, block source verification, group establishment, hybrid signature verification with classic signature priority, endorsement strategy verification, read-write set verification, ledger submission, and state update".

[0070] Here, by placing the group creation step before the hybrid signature verification and prioritizing classical signature verification over post-quantum signature verification, the verification stage can fully utilize the computational optimization brought by group reuse and classical priority strategies. At the same time, arranging block header verification and block source verification before signature verification can intercept blocks with incorrect format or invalid source at an early stage, avoiding the expensive and time-consuming post-quantum hybrid signature verification calculation for invalid blocks, and reducing the invalid computation overhead and block processing latency of resource-constrained edge peer nodes.

[0071] like Figure 2 As shown, in one embodiment of the present invention, the industrial IoT lightweight post-quantum blockchain edge security processing system executes steps S1-S8.

[0072] Step S1: Establish an industrial IoT blockchain network, which includes a client, multiple sorting nodes, and at least one edge peer node; wherein, a hybrid identity generation module and a post-quantum hybrid signature module are deployed in the client, a hybrid identity generation module, a post-quantum hybrid signature module, and a consensus collaboration module are deployed in the sorting nodes, and a hybrid identity generation module, a post-quantum hybrid signature module, a certificate and public key caching module, a block signature verification module, and a block verification and submission module are deployed in the edge peer node.

[0073] Step S1 includes: S11: Configure consortium blockchain network parameters, initialize channel information, member organization information, node roles and ledger storage paths, and deploy unified upgraded versions of software components for clients, sorting nodes and edge peer nodes; S12: Load the member service, cryptographic service, and block signature verification components into the client, sorting node, and edge peer node respectively, so that the node has the ability to register identity, generate hybrid signatures, verify hybrid signatures, and process blocks. S13: Establish a consistent connection between sorting nodes and a block broadcast connection between sorting nodes and edge peer nodes, so that transaction sorting and block synchronization can be completed within the consortium blockchain network.

[0074] S2: The hybrid identity generation module generates hybrid identity information for the client, sorting node, and edge peer node respectively; among which, the first... i The hybrid identity information of each node satisfies the following formula: ; in, Indicates the first i The classic public key of each node, Indicates the first i The post-quantum public key of each node, Indicates the first i Certificates corresponding to each node Indicates the first i The role identifier of each node.

[0075] Step S2 includes: S21: The hybrid identity generation module generates classical signature key pairs and post-quantum signature key pairs for each node; S22: Write the node identifier, role information, and classic public key into the regular identity material of the node certificate, and write the post-quantum public key into the extended field of the node X.509 certificate to form the node identity material for subsequent member authentication and transaction signature verification; S23: Distribute node identity materials to the corresponding nodes, and establish a mapping relationship between node identifiers, certificate fingerprints and cache indexes on the sorted nodes and edge peer nodes.

[0076] S3: The client generates a transaction message and calls the post-quantum hybrid signature module to perform a hybrid signature on the transaction message. The node then processes the transaction message. The generated hybrid signature satisfies the following formula: ; in, Indicates the first Each node sends a message The generated hybrid signature payload, This refers to the classic signature section. This represents the post-quantum signature portion.

[0077] Step S3 includes: S31: After generating the message digest to be signed, the node calls the classical signature algorithm and the post-quantum signature algorithm respectively to generate the classical signature value and the post-quantum signature value, and encapsulates them into a hybrid signature byte string according to the preset ASN.1 or equivalent encoding rules; S32: The hybrid signature byte string is carried by the signature field in the existing message structure of Hyperledger Fabric. The message structure includes transaction proposal, endorsement response, transaction envelope and other message structures to be signed, while the serialization identity structure remains unchanged. S33: The post-quantum public key is not written separately into the transaction payload, but is written as node identity material into the X.509 certificate extension information to verify that the node extracts the classical public key and the post-quantum public key during MSP identity deserialization or certificate parsing.

[0078] S4: After receiving a block, the edge peer node performs signer index building and hierarchical cache lookup during the signer identity deserialization phase of the block verification path.

[0079] Step S4 includes: S41: Edge peer nodes extract ASN.1 format certificate fingerprints from serialized identities or node certificates. Using the certificate fingerprint as the primary index and the signer identifier and channel identifier as secondary indexes, they first query the local cache within the current block. If the local cache within the block is not found, they query the channel-level certificate cache table, public key cache table, and signer index table, and if a match is found, they fill the result back into the local cache within the block. If the channel-level cache is not found, they perform certificate parsing, public key recovery, and signer mapping establishment. S42: The in-block local cache exists only during the verification of a single block and is used to reuse the signature identity deserialization result, certificate parsing result, public key recovery result and endorsement policy preprocessing result that occur repeatedly in the same block. It is released immediately after the block is committed or discarded. S43: The channel-level cache adopts dual threshold constraints of maximum number of entries and maximum number of bytes, and evicts inactive cache entries based on the least recently used strategy or the sliding window strategy based on block height, in order to avoid memory overflow in edge devices such as Raspberry Pi due to holding large-volume post-quantum public key objects for a long time. S44: When an edge peer node receives a configuration block containing MSP updates, certificate rotation, or certificate revocation list (CRL) updates, it performs targeted invalidation or clearing of the certificate cache, public key cache, and index entries corresponding to the affected signer.

[0080] S5: Edge peer nodes invoke the block signature verification module to perform hybrid signature verification of transactions within the same block. The total verification cost for an edge peer node for a block satisfies the following formula: ; in, This represents the total cost of block verification. Indicates the cost of certificate resolution. Indicates the cost of public key recovery. Indicates the signature verification cost. This indicates the overhead of ledger commits and status updates.

[0081] Step S5 includes: S51: The group signature verification module groups the transactions to be verified within the same block according to the signer identifier, certificate fingerprint or node role, and reuses the identity deserialization result, public key recovery result, message digest calculation result and endorsement policy preprocessing result for the transactions within the same group; S52: Prioritize performing classic signature verification based on the reused message digest and the classic public key; S53: When classical signature verification fails, the transaction is directly deemed to have failed hybrid signature verification, and the post-quantum public key cache reading, public key recovery, and ML-DSA signature verification are skipped. S54: Post-quantum signature verification is performed only when the classical signature verification passes; S55: When both classical signature and post-quantum signature are verified, the transaction is deemed to have passed the signature verification, and the verification result is passed to the subsequent endorsement strategy verification and read-write set verification; otherwise, the transaction is deemed to have failed the verification.

[0082] In a preferred embodiment, intra-block group signature verification does not change the security determination conditions of the final double signature verification. Instead, it reduces the number of quantum public key readings, certificate parsing, and ML-DSA signature verifications after invalid transactions are triggered by a classical priority short-circuit scheduling strategy, thereby improving the resilience of edge devices such as Raspberry Pi to large-scale invalid transaction attacks.

[0083] S6: Edge peer nodes call the block verification and submission module to perform block verification and ledger submission.

[0084] Step S6 includes: S61: Verify the block header information to confirm the correctness of the block number, the hash value of the previous block, and the hash value of the current block; S62: Verify the source of the block to confirm that the block was broadcast by a legitimate sorting node; S63: Receive the hybrid signature verification result output in step S5, and perform consistency verification on the endorsement result according to the endorsement policy. S64: Verify the read / write set corresponding to the transaction, and write the block to the ledger after the verification is successful, while updating the state database; S65: When there are failed verification transactions in a block, mark or remove the failed verification transactions, and retain the block submission results corresponding to the valid transactions.

[0085] In one embodiment, edge peer nodes can statistically analyze and calculate the optimized block verification overhead after block submission in order to evaluate the performance gains of the lightweight mechanism.

[0086] S7: Based on the collaborative processing results of the certificate and public key caching module and the block signature verification module, the edge peer nodes obtain the optimized total block verification cost. The optimized edge node block verification cost satisfies the following formula: ; in, This represents the total cost of optimized block verification. This indicates the certificate processing overhead after introducing certificate caching. This indicates the overhead of public key processing after introducing public key caching. This indicates the signature processing overhead after introducing grouped signature verification; To quantify the performance improvement brought about by the lightweight mechanism, a reduction rate in verification overhead is introduced, which satisfies the following formula: ; in, η This indicates the reduction rate of verification overhead after edge nodes adopt certificate caching, public key caching, and group signature verification mechanisms.

[0087] Step S7 includes: S71: Edge peer nodes record the number of certificate parsing attempts, public key recovery attempts, classic signature verification attempts, post-quantum signature verification attempts, cache hits, cache eviction attempts, and ledger commit times during block processing. S72: Calculate the block verification overhead without using the lightweight mechanism and the block verification overhead after using the two-level caching, block signature verification, and classic priority short-circuit signature verification mechanism respectively. S73: Calculate the verification overhead reduction rate and combine it with cache hit rate, cache eviction rate and peak memory usage as an evaluation metric for the benefits of lightweighting edge nodes.

[0088] In one embodiment, if there are multiple transactions from the same signer in the same block, the hit rate of the local cache and channel-level cache within the block is improved, and the overhead of certificate parsing and public key recovery is significantly reduced. Meanwhile, since grouped signature verification reduces the repetitive identity deserialization, principal preprocessing, and digest calculation processes, and the classic priority short-circuit strategy reduces the number of ML-DSA signature verifications triggered by invalid transactions, the optimized total verification overhead is less than the total verification overhead without the above mechanism.

[0089] S8: In the event of a sorting node failure, network latency jitter, or block synchronization anomaly, the consensus coordination module performs consistency recovery processing to ensure the consistency of the ledger state of edge peer nodes.

[0090] Step S8 includes: S81: When an edge peer node does not receive a new block within a preset time, it initiates a synchronization request to the sorting service. S82: When a sorting node failure or master node failure is detected, a view switch is triggered between sorting nodes and a new master node is elected. S83: When block synchronization fails, edge peer nodes perform completion synchronization for missing blocks and continue to perform block verification and ledger commit after synchronization is completed.

[0091] This invention introduces hybrid identity generation, post-quantum hybrid signature, certificate and public key caching, block signature verification, and lightweight edge verification mechanisms on top of a consortium blockchain architecture. This enables resource-constrained edge devices in industrial IoT scenarios to perform post-quantum blockchain processing with low overhead, while ensuring identity trustworthiness, message integrity, and ledger security. Specifically, two-level caching, configuration block / CRL failure detection, and classic-priority short-circuit signature verification together constitute an engineered, lightweight, and optimized path for resource-constrained edge nodes. All equivalent substitutions, improvements, and adjustments made within the spirit and principles of this invention should fall within the scope of protection of this invention.

[0092] The above embodiments construct a lightweight post-quantum blockchain edge security processing system for the Industrial Internet of Things from four levels: network deployment, identity generation, signature encapsulation, and signature verification optimization. By deploying the sorting service on virtual machines and sinking edge verification to resource-constrained devices such as Raspberry Pi, a heterogeneous collaborative network architecture is formed. By generating dual-track identities for each node and embedding the post-quantum public key into the X.509 certificate extension field, compatibility with the existing identity system is achieved. By encapsulating classical signatures and post-quantum signatures according to preset rules and writing them into the existing message signature field, quantum security enhancement is achieved without shaking the original transaction structure. By establishing a hierarchical caching and grouped signature verification mechanism at edge peer nodes and adopting a verification strategy that prioritizes classical signatures and skips post-quantum signatures in case of failure, the signature verification computation overhead is compressed from "per transaction" to "per signer".

[0093] Regarding heterogeneous network initialization and role allocation: A unified upgraded version of the heterogeneous consortium blockchain network is established based on the Fabric V3 framework. Virtual machines with strong computing power are deployed as sorting nodes, responsible for executing SmartBFT consensus and block packaging; resource-constrained devices such as Raspberry Pis are deployed as edge peer nodes, used to perform block reception, group signature verification, ledger submission, and optional endorsement processing.

[0094] Regarding hybrid identity generation and certificate extension: Clients, sorting nodes, and edge peer nodes generate classic signature key pairs and post-quantum signature key pairs, respectively. Node identifiers, role information, and classic public keys are written into the regular identity material, and the post-quantum public key is written into the non-critical extension field of the node's X.509 certificate. The serialized identity structure remains unchanged, and the verification node extracts the certificate extension information during the MSP identity deserialization or certificate parsing stage.

[0095] Regarding hybrid signature encapsulation and delivery: Nodes generate classic signature values ​​and post-quantum signature values ​​for the same message to be signed, and encapsulate them into a hybrid signature byte string according to preset encoding rules. The hybrid signature byte string does not change the top-level transaction structure of Hyperledger Fabric, but is directly written into the signature field of the transaction proposal, endorsement response, transaction envelope or other existing message structure, so as to reuse the original signature call chain in the unified upgraded version of the network.

[0096] Regarding edge lightweight caching and classic-first signature verification: During the signer identity deserialization stage of the block verification path, edge peer nodes extract the node certificate from the serialized identity, calculate or extract the ASN.1 certificate fingerprint, and establish an intra-block local cache and a channel-level bounded cache using the certificate fingerprint as the primary index and the signer identifier and channel identifier as secondary indexes. The intra-block local cache is released immediately after the verification of a single block. The channel-level cache is controlled by dual thresholds of maximum number of entries and maximum number of bytes, and low-activity entries are eliminated by a combination of the least recently used strategy or a sliding window strategy based on block height. During the block verification stage, edge peer nodes group multiple transactions within the same block according to the signer or certificate fingerprint, reuse the deserialized identity, endorsement strategy preprocessing results, and reusable digests, and perform classic signature verification first for each transaction. Only when the classic signature verification passes is the post-quantum public key read or recovered and ML-DSA verification performed. When the classic signature verification fails, the post-quantum verification process for that transaction is terminated directly.

[0097] Based on the above system architecture and optimization mechanism, the specific execution steps of this security processing method are further explained below.

[0098] like Figure 4 As shown, a second aspect of the present invention provides a security processing method for the lightweight post-quantum blockchain edge security processing system for industrial IoT as described in any of the above embodiments, comprising the following: The client generates a transaction message and calls the hybrid identity generation module and the post-quantum hybrid signature module to complete identity authentication and hybrid signature, wherein the hybrid signature is written into the signature field of the existing message structure, and the post-quantum public key is written into the node certificate extension information. The sorting node receives the transaction message and invokes the consensus coordination module to perform sorting processing, block generation, and block broadcasting; After receiving a block, the edge peer node extracts the signer certificate fingerprint during the signer identity deserialization stage of the block verification path, prioritizes querying the local cache within the block, queries the channel-level cache if no match is found, and establishes a node certificate and public key cache if no match is found in the cache. Edge peer nodes call the group signature verification module to group the transactions to be verified based on the signer identifier, certificate fingerprint or node role, and perform identity deserialization result reuse, public key recovery result reuse, digest reuse and endorsement strategy preprocessing reuse on each group; For transactions within the same group, edge peer nodes prioritize classical signature verification and only perform post-quantum signature verification by reading the post-quantum public key cache or certificate resolution result if classical signature verification passes. Edge peer nodes perform block verification and submission through dual signature verification, completing ledger updates and state database updates, thereby reducing the overhead of repeated parsing, signature verification, and block processing latency of resource-constrained edge devices in the post-quantum blockchain environment.

[0099] In one embodiment of the present invention, when generating a hybrid signature, the client generates a classical signature and a post-quantum signature for the same transaction message, and encapsulates the two signatures according to a preset encoding rule and writes them into the signature field corresponding to the transaction proposal, endorsement response or transaction envelope; the node certificate contains certificate extension information for recovering the post-quantum public key.

[0100] By generating classical and post-quantum signatures for the same transaction message on the client side, and encapsulating them according to preset encoding rules, the signatures are written into the signature field of existing transaction proposals, endorsement responses, or transaction envelopes. At the same time, the post-quantum public key is stored as certificate extension information in the node certificate. This allows the hybrid signature to be fully compatible with the existing message structure and identity management process of Hyperledger Fabric. Quantum-resistant security enhancement can be achieved without modifying the underlying communication protocol or transaction processing logic, reducing the engineering complexity of system upgrades and the scope of impact on existing business.

[0101] In one embodiment of the present invention, when processing a block, the edge peer node performs a complete certificate parsing and public key extraction during the identity deserialization stage for signer certificates that are not cached, and writes the parsing results into the local cache and channel-level cache corresponding to the current block; for signer certificates that are cached, the cached results are directly called for signature verification; the local cache is released after the block verification is completed; when a configuration block or certificate revocation list (CRL) update is received, the affected cache items are invalidated or cleaned up.

[0102] By performing a complete parsing of signer certificates that are not cached during block processing and writing them to the local cache within the block and the channel-level cache, and directly reusing existing results for those that are cached, and releasing the local cache within the block after block verification, on-demand computation and cross-transaction reuse of pre-verification processing results are achieved, avoiding repeated parsing of the same signer's identity materials. At the same time, when receiving configuration blocks or CRL updates, targeted invalidation or cleanup is performed on affected cache items, ensuring the timeliness and security of cached data. This enables edge peer nodes to achieve significant signature verification acceleration with relatively small memory overhead under resource-constrained conditions.

[0103] In one embodiment of the present invention, in the event of sorting node failure, network latency jitter, or block broadcast anomaly, the consensus coordination module triggers view switching, consistency restoration, or block resynchronization to ensure the consistency of the ledger state of edge peer nodes.

[0104] By triggering view switching, consistency restoration, or block resynchronization in the event of sorting node failure, network latency jitter, or block broadcast anomalies, the consensus coordination module enables the system to automatically detect and respond to common communication failures in industrial IoT scenarios, such as sorting service anomalies and network instability. This ensures that edge peer nodes can reacquire the correct block data and maintain the consistency of the ledger state after anomaly recovery, thereby improving the robustness and availability of the post-quantum blockchain system in unreliable network environments at the edge.

[0105] In one application scenario of this invention, the client first generates a transaction message containing the business payload and writes the corresponding message's signature field after generating a hybrid signature byte string. After receiving the transaction message, the sorting node sorts and packages it into blocks using the SmartBFT consensus protocol. After receiving the block, the edge peer node extracts the certificate fingerprint during the signer identity deserialization stage and queries the local cache and channel-level cache within the block to group the transactions to be verified by the same signer. For transactions that fail classical signature verification, the post-quantum signature verification process is terminated directly. For transactions that pass classical signature verification, the post-quantum public key is read from or recovered from the cache and post-quantum signature verification is performed. Subsequently, the edge peer node calculates the block verification overhead and the verification overhead reduction rate, writes the transactions that pass the signature verification and meet the endorsement policy and read / write set verification into the ledger, and updates the state database.

[0106] The security processing method described in this embodiment of the invention can be further elaborated upon by referring to the security processing system provided in the first aspect of the invention. Specifically, the hybrid identity generation method, the encapsulation and verification logic of post-quantum hybrid signatures, the hierarchical caching management strategy for certificates and public keys, the grouped signature verification process based on the signer's identity characteristics, the verification order of classical signatures taking precedence and skipping post-quantum signatures upon failure, the block verification and submission processing pipeline, the anomaly recovery mechanism of the consensus collaboration module, and the functional layering and interaction relationships between clients, sorting nodes, and edge peer nodes can all be implemented by referring to and combining with the structural features and workflows of the corresponding modules in the aforementioned system embodiments.

[0107] The security processing method provided by this invention, based on the system implementation, utilizes cache reuse, group batch processing, and priority signature verification strategies to effectively reduce the overhead of repeated parsing, signature verification, and block processing latency of resource-constrained edge devices in the post-quantum blockchain environment, thereby achieving lightweight post-quantum security protection in industrial IoT edge scenarios.

[0108] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of the invention pertain.

[0109] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus or device (such as a computer-based system, a system including a processing module or other system that can fetch and execute instructions from, an instruction execution system, apparatus or device).

[0110] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A lightweight post-quantum blockchain edge security processing system for industrial IoT, characterized in that, include: Client, sorting node, and edge peer node; where: The client is equipped with a hybrid identity generation module and a post-quantum hybrid signature module; the client is used to initiate transaction requests, generate transaction messages, and complete identity authentication and transaction signing. The sorting node is equipped with a hybrid identity generation module and a post-quantum hybrid signature module; the sorting node is used to receive transaction messages, perform sorting processing, generate blocks, and broadcast blocks. The edge peer nodes are equipped with a hybrid identity generation module, a post-quantum hybrid signature module, a certificate and public key caching module, a block signature verification module, and a block verification and submission module; the edge peer nodes are used to receive blocks, perform hybrid signature verification, block verification, ledger submission, and state updates; The hybrid identity generation module is used to generate a hybrid identity for each node that simultaneously contains classical cryptographic identity materials and post-quantum cryptographic identity materials, and associate the post-quantum public key with the digital certificate of that node. The post-quantum hybrid signature module is used to generate classical digital signatures and post-quantum digital signatures for messages to be signed, and encapsulates the two into a hybrid signature byte string, which is then written into the signature field of the existing message structure. The certificate and public key caching module is used to maintain an intra-block local cache table, a channel-level certificate cache table, a public key cache table, and / or a signer index table in the edge peer nodes. The grouped signature verification module is used to group the signatures to be verified based on the signer's identity characteristics, and reuse the pre-verification results based on the grouping results, prioritizing the classical signature verification, and only performing the post-quantum signature verification when the classical signature verification passes. The block verification and submission module is used to perform block structure verification, endorsement verification, read / write set verification, ledger submission, and status database update after the signature verification is successful.

2. The lightweight post-quantum blockchain edge security processing system for industrial IoT according to claim 1, characterized in that, The client, sorting nodes, and edge peer nodes are built on a unified upgraded version of the Hyperledger Fabric consortium blockchain framework. The system also includes a consensus coordination module that is adapted to the SmartBFT sorting service, enabling sorting nodes to complete transaction sorting, block packaging, and block broadcasting, and edge peer nodes to complete block reception, verification, and submission. The unified upgraded version is used to support the parsing and signature verification of hybrid signature fields and certificate extension information.

3. The lightweight post-quantum blockchain edge security processing system for industrial IoT according to claim 1, characterized in that, The hybrid identity generation module is used to generate dual-track identity materials for each node. These dual-track identity materials include at least a classic signature public-private key pair, a post-quantum signature public-private key pair, a node certificate, and a node role identifier; wherein, the first... i The hybrid identity information of each node satisfies the following formula: ； in, Indicates the first i The classic public key of each node, Indicates the first i The post-quantum public key of each node, Indicates the first i Certificates corresponding to each node Indicates the first i The role identifier of each node.

4. The lightweight post-quantum blockchain edge security processing system for industrial IoT as described in claim 2, characterized in that, The pending signature message includes at least transaction messages, block metadata, or node communication messages; The post-quantum hybrid signature module generates both classical and post-quantum signature values ​​for the same message to be signed, encapsulates them into a hybrid signature byte string according to a preset encoding rule, and writes it into the signature field of the existing message structure in Hyperledger Fabric. The post-quantum public key is written as certificate extension information into the node's X.509 certificate for extraction during the identity deserialization stage. Its hybrid signature satisfies the following formula: ； in, Indicates the first Each node sends a message The generated hybrid signature payload, This refers to the classic signature section. This represents the post-quantum signature portion.

5. The lightweight post-quantum blockchain edge security processing system for industrial IoT as described in claim 1, characterized in that, During the signer identity deserialization stage of the block verification path, the edge peer node extracts the certificate fingerprint from the serialized identity information or node certificate, uses it as the main index to query the signer index table, and then obtains the corresponding certificate cache data and public key cache data.

6. The lightweight post-quantum blockchain edge security processing system for industrial IoT as described in claim 1, characterized in that, The signer identity features include at least a signer identifier, certificate fingerprint, and / or node role; The group signature verification module is used to group multiple transactions to be verified based on the signer identifier, certificate fingerprint, or node role within the same block; wherein, the first k Each group satisfies the following formula: ； in, Indicates the first The set of transactions corresponding to each signer Indicates the first in the block This transaction, Indicates transaction The signer's identifier, This indicates the total number of transactions in the block.

7. The lightweight post-quantum blockchain edge security processing system for industrial IoT as described in claim 6, characterized in that, When performing signature verification, the group signature verification module reuses the identity deserialization result, public key recovery result, message digest calculation result, and endorsement policy preprocessing result for transactions within the same group, and prioritizes performing classic signature verification based on the reused message digest and classic public key. When classic signature verification passes, it then reads the post-quantum public key cache item or certificate parsing result to perform post-quantum signature verification. When classic signature verification fails, it directly determines that the transaction signature verification has failed and skips post-quantum signature verification. The total verification overhead of the edge peer node for a block satisfies the following formula: ； in, This represents the total cost of block verification. Indicates the cost of certificate resolution. Indicates the cost of public key recovery. Indicates the signature verification cost. This indicates the overhead of ledger commits and status updates.

8. The lightweight post-quantum blockchain edge security processing system for industrial IoT as described in claim 7, characterized in that, After the certificate and public key caching module and the block signature verification module work together, the total block verification overhead of the edge node is significantly reduced. The effect of reducing verification overhead can be quantified by the following formula: ； in, This represents the total cost of optimized block verification. This indicates the certificate processing overhead after introducing certificate caching. This indicates the overhead of public key processing after introducing public key caching. This indicates the overhead of signature processing after introducing grouped signature verification.

9. The lightweight post-quantum blockchain edge security processing system for industrial IoT as described in claim 1, characterized in that, The edge peer nodes are deployed in Raspberry Pi, industrial gateways and / or embedded computing boards, and the system supports at least one of the following lightweight deployment methods: the edge peer nodes simultaneously serve as endorsement nodes and commit nodes; or the edge peer nodes only serve as commit nodes; or the virtual machine nodes serve as endorsement nodes, and the edge peer nodes serve as block verification and ledger commit functions.

10. A security processing method based on the lightweight post-quantum blockchain edge security processing system for industrial IoT as described in any one of claims 1 to 9, characterized in that, include: The client generates a transaction message and calls the hybrid identity generation module and the post-quantum hybrid signature module to complete identity authentication and hybrid signature, wherein the hybrid signature is written into the signature field of the existing message structure, and the post-quantum public key is written into the node certificate extension information. The sorting node receives the transaction message and invokes the consensus coordination module to perform sorting processing, block generation, and block broadcasting; After receiving a block, the edge peer node extracts the signer certificate fingerprint during the signer identity deserialization stage of the block verification path, prioritizes querying the local cache within the block, queries the channel-level cache if no match is found, and establishes a node certificate and public key cache if no match is found in the cache. Edge peer nodes call the group signature verification module to group the transactions to be verified based on the signer identifier, certificate fingerprint or node role, and perform identity deserialization result reuse, public key recovery result reuse, digest reuse and endorsement strategy preprocessing reuse on each group; For transactions within the same group, edge peer nodes prioritize classical signature verification and only perform post-quantum signature verification by reading the post-quantum public key cache or certificate resolution result if classical signature verification passes. Edge peer nodes perform block verification and submission for transactions that have passed dual signature verification, completing ledger updates and state database updates.

Images