A ciphertext domain distributed storage self-healing method and system based on a causal state machine control

Abstract

The present application belongs to the technical field of distributed storage security and data fault-tolerant control, and relates to a ciphertext domain distributed storage self-healing method and system based on a causal state machine control. The present application establishes and maintains a multi-dimensional causal state machine by a kernel storage driver layer of an end-side sovereign control device, directly controls the execution authority of a block device layer I / O request queue through the execution of equivalent determination and time sequence window interval verification of the state identifier in the driver layer. Once the state machine is determined to jump to an abnormal branch, an interception decision is made immediately, and a control instruction is issued to forcibly terminate the redundant writing of the abnormal path and implement zero-residue covering erasure on the physical read-write buffer area, thereby significantly reducing the pollution risk of ghost fragments on the distributed storage ledger and effectively inhibiting time sequence replay attacks.

Description

Technical Field

[0001] This invention relates to the field of distributed storage security and data fault tolerance control technology, and in particular to a self-healing method and system for encrypted domain distributed storage based on causal state machine control. Background Technology

[0002] In distributed storage systems involving untrusted nodes, blind redundancy reconstruction and spatial self-healing of encrypted data fragments typically rely on distributed collaboration among network nodes. However, existing distributed storage systems suffer from the following architectural design flaws: First, the limitations of static verification capabilities at the storage driver layer: Existing storage system drivers (such as standard MerkleTree verification, HashChain verification, or erasure coding verification mechanisms) typically only perform equivalence verification on the final static results at the end of data I / O read / write operations, making it difficult to impose behavioral constraints on the dynamic execution trajectory of redundant self-healing computation performed by untrusted nodes. This leads to dynamic side-channel disruption modes such as execution skipping, replay attack, or illegal fragment re-injection.

[0003] Second, the risk of logical pollution due to untraceable processes: Due to the lack of behavioral constraints on process trajectories, untrusted nodes may, without changing the static hash result, feed back data fragments with a valid structure but abnormal paths (hereinafter referred to as "ghost fragments"). These fragments can usually bypass traditional driver-level static verification, but during distributed storage ledger reorganization or decryption retrieval, they are very likely to cause driver-level state forks and storage service crashes.

[0004] Third, there is a lack of blocking and linkage mechanisms at the execution path level and the physical layer: existing storage systems lack the ability to directly link the block device scheduling layer, I / O queue layer and the underlying physical memory bus to intercept and counteract abnormal data when an abnormal state is detected, which may cause abnormal data to continue to spread at the underlying storage system. Summary of the Invention

[0005] To address the aforementioned issues, this invention discloses a technical solution: a distributed storage method and system that controls the driving behavior, scheduling decisions, and I / O read / write directions of ciphertext fragments during self-healing and recall processes by using a causal state machine transition rule jointly constructed from physical execution context and time series, without decrypting plaintext data or exposing the key.

[0006] This invention establishes and maintains a multidimensional causal state machine by the kernel storage driver layer of the end-side sovereign control device. During the process of external untrusted storage nodes performing linear matrix reconstruction in the ciphertext domain to generate redundant check blocks, they must simultaneously perform cascaded hash operations based on the fingerprint of the previous valid state, the characteristics of the current ciphertext fragment, the monotonic time series, and the execution context vector reflecting the node's operating characteristics to form multidimensional constraint rules for state machine transition determination (hereinafter referred to as GSCI transition rules).

[0007] The technical solution of this invention is implemented as follows: The first aspect of this invention discloses: 1. A self-healing method for distributed storage of encrypted domains based on causal state machine control, which is executed in conjunction with the kernel storage driver layer, block device layer, and underlying hardware controller of the end-side sovereign control device, characterized by comprising the following steps: S1, Distributed State Initialization and Channel Isolation: The encrypted ciphertext data blocks after segmented authentication are distributed and stored to multiple external untrusted storage nodes. The kernel storage driver layer initializes a distributed multidimensional causal state machine, and a state-level asynchronous latch buffer (SLBL) is opened in the end-side sovereign control device. S2, Blind Redundancy Computation and Feature Mapping: The external untrusted storage node is scheduled to perform linear matrix combination operations on the ciphertext data block to generate a ciphertext redundancy check block under blind conditions without decrypting data or exposing the key; simultaneously, the kernel storage driver layer constrains the external untrusted storage node to perform Global State Causal Integrity (GSCI) transition rule calculation during the generation of the ciphertext redundancy check block; the kernel storage driver layer generates a dynamic state identifier stream for the current evolution stage based on the calculation results; the dynamic state identifier stream is generated by mapping and using the legal preceding state features of the previous stage, the current ciphertext data block features, the monotonic time series, and the execution context vector reflecting the node's operating characteristics as inputs; S3, Asynchronous State Isolation Latch and Exclusive Custody of the Certification Domain: When the end-side sovereign control device is in an asynchronous offline state that is not continuously online, the SLBL is activated to implement exclusive control of the state credential domain. The SLBL exclusively and unidirectionally latches the dynamic state identifier stream, which contains the GSCI transfer rules, and the encrypted metadata buffer sequence calculated and returned by the external untrusted storage node, and forces the state ownership control stream and the data entity stream to be strongly decoupled and isolated at the physical layer. Among them, the SLBL is strictly prohibited from carrying or temporarily storing any decrypted plaintext data block or encrypted data block entity, and any operation that writes non-state credential feature data to the SLBL is directly intercepted by the kernel. S4, End-side heartbeat recovery and delayed causal final verification: After the end-side sovereign control device returns to online status and detects the recovery of communication heartbeat, the kernel storage driver layer asynchronously pulls the GSCI transfer rules and encrypted metadata buffer sequence latched in SLBL, and performs equivalence judgment and timing window interval verification at the kernel privilege level; if the verification passes, it is determined that a legitimate control flow state transition has occurred, and the multidimensional causal state machine seamlessly updates the transition branch and releases the corresponding physical control channel, formally incorporating the encrypted metadata buffer sequence into the main storage file system to drive the streaming self-healing reconstruction of the block device layer I / O request queue; S5, Boundary Fuse and Zero-Residual Erasure of Physical Buffer: If the dynamic state identifier stream is found to have timing non-monotonicity, step jump, or ghost fragment injection anomaly during the verification in step S4, the multidimensional causal state machine is forced to jump to the abnormal isolation state branch and triggers hardware-level bus fuse; the State Priority Bus Arbitration Unit (SPBA) performs I / O stream privilege deprivation in the Kernel Privileged Execution Environment, forcibly terminates redundant writing of the abnormal path, and coordinates with the stateless transient page buffer cleanup module to perform zero-residual overwrite erasure of the corresponding physical read and write buffer.

[0008] Furthermore, in step S3, the execution context vector is generated by the kernel storage driver layer by reading a snapshot of the hardware register context of the current physical execution thread; The snapshot includes at least one of the program counter features and the page table base address register features; The kernel storage driver layer maps the snapshot to the input operator of the causal state machine to establish a hardware-level association between the transition determination of the causal state machine and the physical running state of the underlying hardware.

[0009] further, In step S5, the interception scheduling behavior performed at the block device request scheduling layer or I / O request queue layer includes: the kernel storage driver layer reconstructs and rewrites the descriptor structure or linked list topology of the current physical I / O request queue according to the abnormal jump instruction of the causal state machine, and forcibly strips, redirects or silently drops all pending I / O requests pointing to abnormal storage paths from the queue, thereby realizing I / O-level logical path gating interception.

[0010] Furthermore, in step S5, the standardized control instructions include: The kernel storage driver layer issues page update instructions to the hardware memory management unit through the driver extension mechanism provided by the operating system kernel, and revokes the IOMMU hardware physical level mapping permission of the corresponding storage page or memory buffer. The kernel storage driver layer writes a suspend register instruction to the standard bus controller, forcibly suspending the underlying physical direct memory access data bus channel, thus restricting the continued transmission of abnormal state data at the hardware level.

[0011] Furthermore, the kernel storage driver layer performs dynamic access control on the read and write paths of asset shards based on the state transition results of the multidimensional causal state machine. When an abnormal state transition, missing state identifier, broken state chain, or failed consistency check is detected, the system blocks the data exchange between the asset shard and the external storage node, and transfers the data to be confirmed to the decoupled temporary storage layer for isolated storage.

[0012] Furthermore, the system includes a decoupled slack queue independent of the external storage nodes. When the sovereign status identifier corresponding to an asset fragment is missing, unverifiable, or does not meet the preset causal transfer conditions, the system will write the corresponding data into the decoupling temporary storage layer. Once the conditions for subsequent status verification are met, status confirmation, data migration, or redundancy reconstruction operations will be performed.

[0013] Furthermore, the system uses the validity verification result of the status identifier as a prerequisite for the migration, copying, reconstruction and recovery operations of asset fragments; The corresponding data persistence operation is prohibited until the status verification is completed.

[0014] Furthermore, when the end device is continuously offline and the number of valid ciphertext redundancy blocks surviving in the network is lower than the preset security threshold, the cloud scheduling module remotely schedules surviving healthy nodes to directly perform blind computation, derivation, reorganization, and redundancy completion in the ciphertext domain under blind state conditions of no key, no plaintext, and anonymous nodes. The state characteristics carried by the generated pending self-healing results must be attached to a temporary queue and suspended to wait for the causal state machine to finally confirm the rights after the end device is restored to online.

[0015] Furthermore, the hybrid trusted input source of the causal state machine is provided collaboratively by the hardware trust anchor (HTA) and the software trust anchor (STA): the hardware trust anchor (HTA) reads the system hardware state through the physical security chip and performs initialization signature to generate an initial state seed; the software trust anchor (STA) collects the dynamic operating characteristic metrics of the untrusted storage nodes in real time, which are used to jointly construct the execution context vector.

[0016] Furthermore, the storage system constructed from the sequence of ciphertext data blocks containing causal state machine constraints serves as a memory privacy base or retrieval enhancement context storage layer for the data-consuming intelligent agent during runtime. When the edge device performs high-dimensional semantic feature matrix recall and reconstruction, the block device layer reuses the stateless transient page buffer for streaming assembly, instantaneous decryption, and nonlinear similarity sorting of the ciphertext stream, and drives the buffer to perform overwrite erasure after a single computation task is completed.

[0017] Furthermore, the method constructs a cloud-based sovereignty control plane; The cloud-based sovereign control plane uses lightweight heartbeat monitoring to periodically capture the temporal domain continuous availability fingerprint, transport layer throughput bandwidth and transient latency jitter, and block device layer I / O physical page write latency of each external untrusted storage node, and jointly construct a multi-dimensional physical performance profile of each storage node. The cloud-based sovereign control plane assesses (classifies) the physical performance of each untrusted storage node based on the physical performance profile. Simultaneously, the edge-side sovereign control device categorizes data blocks to be stored into different popularity and importance levels based on the access frequency and high-dimensional semantic features of the data assets. The cloud-based sovereign control plane, according to the mapping relationship between performance and popularity levels, executes differentiated physical deployment scheduling for distributed streaming storage and self-healing reconstruction: high-popularity or high-importance data blocks, along with their corresponding GSCI active status identifiers, are prioritized for deployment on high-availability storage nodes; low-access-frequency cold data or purely redundant checksum blocks are deployed on low-availability backup storage nodes.

[0018] The second aspect of this invention discloses a distributed storage and self-healing system for encrypted domains based on sovereign kernel control. The system is characterized by being deployed on the kernel storage driver layer of the end-side sovereign operating system (Mirror Memo OS) and interconnected with the hardware peripheral sovereign anchor (SEPS) via a secure physical bus. The distributed storage and self-healing system includes a unified resource entity abstraction module, a blind redundancy matrix collision control module, and a spatial topology distribution scheduling module. The unified resource entity abstraction module is used to intercept kernel space file write requests and divide the original personal digital asset data stream (including human interview audio, historical images and agent cognitive parameter snapshots) into unstructured data block sequences with monotonic temporal identifiers; The blind redundancy matrix collision control module is used to call the stateless transient page buffer and perform high-dimensional linear matrix combination encoding operation based on Galois field under blind conditions without decrypting the data block sequence and without exposing the system root key, to generate a redundant ciphertext fragment matrix containing blind check operators. The spatial topology distribution scheduling module is used to call the kernel CR3 register and physical page frame allocator to isolate the bypass detection of the software layer and virtualized host environment. The spatial topology distribution scheduling module does not rely on any single kind of asymmetric encryption algorithm system based on large number prime factorization or elliptic curve discrete logarithm problem. Instead, it is based on the Spatial Topology Neighborhood Restricted Domain (PSD) protocol to asynchronously distribute the redundant ciphertext fragment matrix to multiple physically isolated untrusted distributed heterogeneous storage nodes through a peer-to-peer (P2P) network. The blind redundancy matrix collision control module satisfies the following constraints when performing encoding and distribution: 1) Resistance to high-dimensional computational power decryption constraints: The mathematical structure of the redundant ciphertext fragment matrix is ​​represented by a spatial discrete probability distribution. The original semantics can be reconstructed within the physical isolation domain of the hardware peripheral sovereign anchor only when the number of fragments recalled by the system through the spatial topological neighborhood restricted neighborhood graph (PSD) reaches or exceeds a preset threshold k. In the incomplete state where the number of fragments is less than k, the ciphertext fragments exhibit a semantic vacuum that is computationally unsolvable when reversed by high-dimensional parallel computing power based on the quantum Shor algorithm or Grover algorithm. 2) Unauthorized Access Physical Feature Disturbance Detection Constraint: During the distributed node storage, the physical carrier of the redundant ciphertext fragment matrix is ​​controlled by the physical feature micro-disturbance collision audit chain of the end-side kernel; any unauthorized heterogeneous computing power from outside will inevitably cause perceptible physical feature micro-disturbance between the storage medium and the relevant bus channel by unauthorized reading, bypass scanning or micro-physical feature detection of the ciphertext fragments; the hardware peripheral sovereign anchor captures the physical timing impedance change or hardware state shift caused by the detection behavior in real time, and instantly triggers runtime execution freeze, forcibly determining the fragment identifier of the corresponding node as Blocked (abnormal isolation state), and physically rejecting any subsequent data overwriting or bus transmission at the hardware level; Specifically, by utilizing the performance monitoring unit (PMU), trusted execution environment (TEE), trusted platform module (TPM), direct memory access (DMA) monitor, and bus anomaly detection circuit of the end-side device, high-frequency blind state perception and micro-disturbance collision are performed on the physical bus and memory status. Once physical characteristic disturbances such as hardware performance counter overflow, bus timing impedance abnormality, or illegal memory scan caused by unauthorized access are captured, a hardware-level non-maskable interrupt event is immediately triggered, forcing the distributed multidimensional causal state machine to directly jump to the Blocked state, thereby achieving physical-level data access freeze and full-path hard isolation.

[0019] 3) Causal self-healing transaction constraint: When the system detects that some distributed nodes have been abnormally tampered with, ghost fragments have been injected, or fragments have been lost due to quantum coherence failure, the system does not need to recall all plaintext. Instead, it directly uses the blind state verification operator in the kernel state driver layer to perform distributed algebraic collision in the ciphertext domain through the remaining valid ciphertext fragments of heterogeneous neighboring nodes. The damaged fragments are asynchronously reconstructed and automatically migrated to the new trusted end-side node, ensuring the lossless continuation of the global cognitive consistency state (CCS).

[0020] This system can run on specific multi-domain isolated hardware-side control devices.

[0021] The advantages of this invention are as follows: This invention achieves cascading path integrity enforcement constraints in distributed encrypted storage operations by completely reducing the constraint logic and embedding it as the driving layer jump trigger condition of the state machine.

[0022] This invention implements execution path-level control over distributed encrypted storage and blind self-healing processes through a multi-dimensional causal state machine. The Global State Causal Integrity (GSCI) transition rules and derived state identifiers serve as the core logic gating trigger conditions and driver layer identifier entities for the causal state machine to implement branch jumps and drive behavior control. They directly determine the execution state of the block device layer, I / O request queue layer, and the underlying physical bus and page buffer.

[0023] This invention implements path-level constraints jointly constructed by driving behavior, scheduling decisions, and I / O read / write directions in distributed encrypted storage operations through a multidimensional causal state machine.

[0024] This invention deeply embeds state transition rules and generated driver-layer state identifiers as triggering conditions for the linkage between underlying block device scheduling and physical hardware countermeasures. This constitutes a tightly coupled and inseparable joint engineering entity consisting of kernel drivers, block device schedulers, physical buses, and memory buffers.

[0025] This invention employs physical device countermeasures such as rewriting the device queue pointer of the causal state machine through abnormal jumps, issuing IOMMU mapping cancellation and DMA bus suspension instructions through the device control interface provided by the operating system kernel, triggering pending transaction abandonment and sovereign instruction overwriting at the driver layer during multi-master collisions, and hard-writing overwriting the transient page buffer.

[0026] This invention uses the state characteristics fed back by untrusted nodes as one of the triggering conditions for the causal state machine transition update through the kernel storage driver layer, and the driver layer generates the corresponding state identifier. By performing equivalence determination and timing window interval verification of the state identifier in the driver layer, the execution permissions of the block device layer I / O request queue are directly controlled. Once the state machine is determined to have transitioned to an abnormal branch, the system immediately makes an interception decision at the block device scheduling layer, and issues control instructions to the hardware controller through the device control interface or driver extension mechanism provided by the operating system kernel, forcibly terminating the redundant writing of the abnormal path, and performing zero-residual overwrite erasure on the physical read and write buffer, significantly reducing the risk of spectral fragments polluting the distributed storage ledger and effectively suppressing timing replay attacks.

[0027] This invention can significantly reduce the probability of storage ledger forks and decryption crashes caused by abnormal behavior of untrusted nodes, effectively suppress time-series replay attacks and ghost fragment injection, and make a non-obvious industrial-grade technical contribution to improving the security of distributed blind storage systems. Attached Figure Description

[0028] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only one embodiment of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 This is a general architecture diagram of an embodiment of the present invention; Figure 2 for Figure 1 The flowchart of the ciphertext field self-healing method of the embodiment shown is shown. Figure 3 for Figure 1 The GSCI state machine and sovereign transition diagram of the embodiment shown; Figure 4 for Figure 1 The illustrated embodiment is a flowchart of dynamic sovereignty hierarchical scheduling based on the physical performance profile of untrusted nodes. Figure 5 Access to personal digital assets Figure 1 The illustrated embodiment is a schematic diagram of the entire path linkage and interaction from blind spatial topological distribution to offline encrypted streaming self-healing reconstruction.

[0030] The symbols in the above figures have the following meanings: 100, End-side sovereignty control equipment; 110, Kernel storage driver layer; 111, Multidimensional Causal State Machine Module (GSCI); 112, State transition verification module; 115, Status Priority Bus Arbitration Unit; 113, State-driven I / O controller; 114, Stateless transient face buffer cleanup module; 120, User-space application layer; 121, Data Consumption Agent; 122, State-level asynchronous latch buffer; 200, SovereignVault private storage sovereign domain; 300, cloud-based sovereignty control surface; 310, Redundant water level monitoring module; 320, Asynchronous Sovereign Status Addition and Legal-Level Supplementary Signature Module; 400, external untrusted storage node; 410, Ciphertext Streaming Reconstruction Module; 420, Distributed Causal Ledger Audit Module; 430, Dynamic Performance Fingerprint Sensor. Detailed Implementation

[0031] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0032] Unless otherwise defined, all technical and scientific terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains; the terminology used in the detailed description is for the purpose of describing particular embodiments only and is not intended to limit the invention; the terms “comprising” and “having” and any variations thereof in the specification and claims of this invention are intended to cover non-exclusive inclusion.

[0033] In the description of specific embodiments of the present invention, technical terms such as "first" and "second" are used only to distinguish different objects and should not be construed as indicating or implying relative importance or implicitly specifying the number, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of the present invention, "multiple" means two or more, unless otherwise explicitly defined.

[0034] In this invention, the reference to "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described in this invention can be combined with other embodiments.

[0035] In the description of the embodiments of this invention, the term "and / or" is merely a description of the relationship between associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, in this invention, the character " / " generally indicates that the preceding and following associated objects have an "or" relationship.

[0036] Throughout this invention, numerical values ​​represent approximate measures or limits of a range to cover minute deviations from a given value, as well as embodiments with approximately the mentioned value and embodiments with the exact mentioned value. Except for the working examples provided at the end of the detailed description, all numerical values ​​of parameters (e.g., quantities or conditions) in this specification (including the appended claims) should be understood to be modified in all cases by the term “about,” regardless of whether “about” actually appears before the numerical value. “About” indicates that the stated numerical value allows for some minor inaccuracy (approaching the exact value in some way; approximately or reasonably approaching the value; almost). If the inaccuracy provided by “about” is not otherwise understood in this general sense in the art, then “about” as used in this invention at least indicates a variation that can be produced by common methods of measuring and using such a parameter. For example, “about” may include a variation of less than or equal to 5%, optionally less than or equal to 4%, optionally less than or equal to 3%, optionally less than or equal to 2%, optionally less than or equal to 1%, optionally less than or equal to 0.5%, and in some respects, optionally less than or equal to 0.1%.

[0037] Additionally, the disclosure of the range includes the disclosure of all values ​​across the entire range and the disclosure of further subdivided ranges, including the endpoints and subranges given for these ranges.

[0038] In this invention, the technical terms are defined as follows: Causal state machine: refers to a finite state machine logical entity maintained by the kernel storage driver layer, whose state transitions are strictly dependent on the cryptographic topology of the historical I / O sequence.

[0039] GSCI transition rules: refers to a set of multi-dimensional constraint rules that serve as the basis for determining transitions in a causal state machine. Its inputs are strongly bound to historical state fingerprints, timing windows, and kernel hardware context features.

[0040] The GSCI transition rule is determined by the kernel storage driver layer of the end-side sovereign device through a three-dimensional concatenation of state characteristics, data characteristics, and timing windows. The state transition function T satisfies the following logical closed loop: Statenext=T(Statepre,Shardcrypto,Δt) The specific constraint rules include the following three-dimensional verification steps: Rule 1: Chain algebra constraint of preceding valid states (State_pre) During the initialization phase, the kernel storage driver layer allocates a confused state feature value, Statepre, for each I / O transaction. This value is generated by concatenating a monotonic clock with a kernel random entropy source. Untrusted nodes must use this feature value as a basis operator in linear combination operations when performing ciphertext redundancy calculations. If the intermediate state feature returned by the untrusted node is inconsistent with the expected state topology fingerprint maintained locally by the kernel driver layer, it is determined to be a "step jump" or "history replay attack," and the GSC1 state machine forcibly jumps to the abnormal circuit breaker branch.

[0041] Rule 2: Streaming Shard_crypto verification of encrypted data blocks During blind redundancy generation, the ciphertext redundancy check block fed back by untrusted nodes must satisfy the linear computability constraint of the ciphertext field. The kernel storage driver layer introduces a residual check matrix R to perform congruential collision on the returned data fragment fingerprints: R⋅Shardcrypto≡0(modγ) Among them, the dynamically generated verification parameter γ. Only when the congruence equation holds true does it indicate that the linear combination path of the data in the ciphertext domain has not been maliciously injected with "ghost fragments".

[0042] Rule 3: Monotonic temporal window dynamic collision constraint (Δt) The system uses the Token Generation Clock (TGC) signal as the macroscopic reference axis. When the kernel storage driver layer issues a computation command, it records the physical timestamp tstart; when an untrusted node returns a computation status identifier, it records the receiving timestamp tend. Let the time consumption Δt = tend − tstart.

[0043] The system sets a dynamic security time window [Δtmin, Δtmax], where Δtmax dynamically adjusts according to the current entropy debt state (EntropyDebt) of the storage bus queue. If Δt overflows this interval (due to delays caused by network hijacking or man-in-the-middle proxy auditing), the GSC1 transfer rule directly outputs a blocking signal.

[0044] Status identifier: refers to a non-volatile data entity generated by the kernel storage driver layer according to the GSCI transfer rules, used to identify the system state at the current I / O evolution stage.

[0045] Storage path strong control boundary: refers to the physical and logical control boundary that forcibly discards or suspends a specific I / O request by modifying the block device scheduler request queue pointer or calling bus control instructions.

[0046] Stateless transient page buffer: refers to a stateless, temporary virtual page buffer (EphemeralBuffer) allocated in physical memory for streaming the assembly of ciphertext data blocks.

[0047] The calculation scheme of the present invention will be described in detail below through examples.

[0048] In one specific embodiment, such as Figure 1 As shown, a self-healing system for encrypted domain distributed storage based on causal state machine control operates within the SovereignVault private storage sovereign domain 200, which is constructed from an edge-side and multi-cloud peer-to-peer topology.

[0049] To ensure control is not leaked and data can be autonomously recovered in extreme scenarios such as offline end devices and dynamic fluctuations of untrusted nodes, the functions and physical interaction paths of the newly added core components of the system are defined as follows: End-side sovereign control device 100: includes user-mode application layer 120 and kernel storage driver layer 110.

[0050] User-space application layer 120 includes data consumption Agent 121 and state-level asynchronous latch buffer 122 (SLBL) for executing control flow anti-tampering interception.

[0051] The kernel storage driver layer 110 includes a multidimensional causal state machine module (GSCI) 111, a state transition verification module 112, a state priority bus arbitration unit 115, a state-driven I / O controller 113, and a stateless transient page buffer cleanup module 114.

[0052] Cloud-based sovereignty control plane 300: includes a redundant water level monitoring module 310 and an asynchronous sovereignty status addition and legal-level supplementary signing module 320.

[0053] The redundant water level monitoring module 310 is used for real-time high-frequency static monitoring of the survival status of external storage nodes and the redundant block water level, and issues a blind calculation warning when the end side is offline and the water level falls below the red line. The asynchronous sovereignty state appending and legal-level signature module 320 is used to generate a control flow fingerprint as a signature credential during the offline asynchronous self-healing period of the end-side sovereignty control device 100. This fingerprint is then latched in the state-level asynchronous latch buffer 122 of the end-side sovereignty control device 100, thus strongly decoupling it from the real data entity.

[0054] External untrusted storage node 400: includes a ciphertext streaming reconstruction module 410 (performs matrix combination blind calculation reconstruction in the ciphertext domain), a distributed causal ledger audit module 420 (performs historical causal chain topology audit), and a dynamic performance fingerprint acquisition sensor 430 (high-frequency non-sensory acquisition of block device layer I / O write latency and latency jitter, and reports to the redundant water level monitoring module 310 to construct a "multi-dimensional physical performance profile" of the node).

[0055] In this embodiment, the redundancy level monitoring module 310 is deployed on the cloud sovereign control plane 300 to statically and dynamically monitor the writable capacity, available redundant block ratio, and survival status of each external untrusted storage node 400 distributed in the network in real time. When the redundancy level monitoring module 310 statically detects that the external surviving redundant block level of a certain data shard is lower than the preset minimum security fault tolerance threshold (red line), and simultaneously detects that the end-side sovereign control device 100 is offline due to being in a network blind zone or actively hibernating, the module immediately sends a "low water level self-healing early warning signal" to the cloud scheduling layer as a rigid boundary condition for triggering cloud blind computing reconstruction.

[0056] The asynchronous sovereignty state appending and legal-level signature module 320 is used to provide "control flow ownership guarantee" for the encrypted self-healing reconstruction action temporarily scheduled in the cloud when the end-side sovereignty control device 100 is offline. It does not touch or generate any plaintext data entities, but only generates a control flow state fingerprint that conforms to GSCI rules for the topology transfer path of the new encrypted fragments generated by the reconstruction.

[0057] The asynchronous sovereignty state appending and legal-level supplementary signature module 320 packages the self-healing state features into a "legal-level state supplementary signature certificate" with state preservation semantics. When the terminal is offline, it is forcibly injected securely into and latched in the state-level asynchronous latch buffer 122 (SLBL) of the terminal device to suspend and isolate it, waiting for the terminal heartbeat to recover before the terminal kernel performs the final review and confirmation of rights.

[0058] The dynamic performance fingerprint sensor 430 is a hardware or low-level driver probe that resides in the physical layer and block device layer of each external untrusted storage node 400. It is used to collect the node's continuous availability fingerprint in the time domain, transient latency jitter in the transport layer, and physical page write latency of the block device layer I / O during operation in a high-frequency, unobtrusive manner.

[0059] The sensor collects low-level physical metrics and reports them in real time to the cloud control plane. This data is used to jointly construct a "multi-dimensional physical performance profile" of each untrusted node, serving as the absolute underlying data support for the system's dynamic sovereignty hierarchical scheduling (differentiated physical deployment of hot and cold data). The ciphertext streaming reconstruction module 410 responds to sovereign scheduling instructions from the cloud or the edge. Under blind conditions without decryption or exposing the key, it schedules each healthy storage node to directly perform blind calculation of high-dimensional linear matrix combination in the Galois field under the ciphertext domain, and stream reconstructs the missing data fragments.

[0060] The distributed causal ledger audit module 420 is used to perform chain-like topology auditing of the fragment evolution history in the distributed storage array, forcibly colliding the control flow transfer fingerprints of each node, and immediately reporting to the end side to implement circuit breaking once any unauthorized ghost fragment injection or causal rollback tampering is detected.

[0061] State Priority Bus Arbiter 115 (used to enforce absolute sovereignty of state control flow over I / O scheduling flow, unauthorized state requests are physically denied at the hardware level here); State-Governed I / O Controller 113 (deeply bound to DMA / IOMMU / HAL / device control interface, serving as the physical access channel controller after authorization); In this embodiment, the external untrusted storage node 400 is a physical bearer grid composed of multiple heterogeneous and geographically dispersed distributed storage nodes.

[0062] This embodiment is used to perform, as follows: Figure 2 The self-healing method for distributed storage of encrypted domains based on causal state machine control is executed in conjunction with the kernel storage driver layer 110, block device layer, and underlying hardware controller of the end-side device. Specific steps include: S1: The kernel storage driver layer 110 completes the initialization of the multidimensional causal state machine, distributes the encrypted ciphertext block to multiple external untrusted storage nodes 400, and opens a state-level asynchronous latch buffer 122 (SLBL) in the end-side sovereign control device 100.

[0063] S2: External nodes perform ciphertext domain matrix operations in blind state; the kernel driver layer constrains them to perform GSCI transition rule calculations, cascading to generate dynamic state identifier streams.

[0064] S3: During the offline period of an external untrusted node, the state-level asynchronous latch buffer 122 (SLBL) is activated to implement exclusive control of the state credential domain. The cloud-based sovereign control plane 300 monitors the water level. If it is lower than the preset safety red line and the end-side sovereign control device 100 is offline, the encrypted streaming reconstruction module 410 is triggered to perform blind computation reconstruction in the encrypted domain. The asynchronous sovereign state appending and legal-level supplementary signing module 320 forcibly latches the state characteristics carried by the unresolved self-healing result as "legal state supplementary signing" in the state-level asynchronous latch buffer 122 to perform isolation suspension.

[0065] S4: After the heartbeat of the end-side sovereign control device 100 is restored online, the kernel storage driver layer 110 asynchronously pulls the GSCI rules and pending self-healing state characteristics latched in the state-level asynchronous latch buffer 122 to perform privilege-level equivalence determination and timing interval verification; if the verification is successful, the jump branch is seamlessly updated, the physical control channel is released and merged into the main storage file system to perform streaming self-healing reconstruction.

[0066] S5: If the verification determines that there is an anomaly, the state machine is forced to jump to the abnormal isolation state and triggers the hardware-level bus fuse. The state priority bus arbitration unit 115 deprives the I / O stream permission, terminates the writing, and links the stateless transient page buffer cleanup module 114 to perform zero-residual overwrite erasure on the corresponding physical read and write buffer.

[0067] The method performed in this embodiment will now be described in detail: S1, the encrypted ciphertext data blocks after segmented authentication are distributed and stored to multiple untrusted nodes, and a distributed causal state machine is initialized by the kernel storage driver layer 110; The ciphertext data block c is obtained from the original data P through fixed-length block division, segmented authentication encryption (AEAD), and independent initialization vector (Ⅳ). The generated ciphertext set C not only supports ciphertext field calculation but also does not destroy encryption integrity and supports subsequent encoding operations.

[0068] The ciphertext set C = {c_1, c_2, ..., c_k}, where k is the number of ciphertext blocks.

[0069] The ciphertext data block is generated from the original plaintext data through fixed-length block segmentation, segmented authentication encryption (AEAD), and independent initialization vectors (IVs). To maintain the blind-state segmented authentication integrity of the ciphertext set C = {c_1, c_2, ..., c_k} while endowing it with algebraic homomorphic properties supporting linear combination computations in the ciphertext domain, segmented authentication encryption introduces a composite encryption scheme based on a homomorphic linear authenticator (HLA), or by stripping the authentication verification tag of segmented authentication encryption to an independent consistency topology metric space for asynchronous chain concatenation. The resulting ciphertext set C possesses additive homomorphic or scalar multiplicative homomorphic characteristics in the ciphertext domain, thereby constraining untrusted nodes to directly perform preset linear matrix combination encoding operations on the ciphertext without compromising the underlying encryption integrity verification.

[0070] The data blocks to be stored are subjected to segmented authentication encryption (AEAD), and verifiable coding tags are generated based on the ciphertext data blocks. The tags are used to support linear parity combination calculations within a finite field (GF) on the external untrusted storage node 400. During this process, the entity of the data block remains in a blind state that is not decryptable and is not homomorphically exposed.

[0071] S2 schedules untrusted nodes to perform linear matrix combination operations on the ciphertext data block without decrypting the data or exposing the key. This operation is a blind-state erasure coding transformation performed on a finite field (Galois field GF(2w)) based on homomorphic algebraic features. The specific mathematical implementation path is as follows: 1) Constructing a dynamic encoding generator matrix (GeneratorMatrix) The kernel storage driver layer 110 constructs a one-dimensional encoding generation matrix G on GF(2w) based on the current active untrusted node (computing power node) topology in the network: Where I is a k×k identity matrix, corresponding to the original ciphertext block set C={c1,c2,...,ck}; Λm×k is a coefficient construction matrix derived from a Vandermonde matrix or a Cauchy matrix, and any k×k submatrix within it is invertible.

[0072] 2) Blind Matrix Multiplication and Parity Block Generation The kernel storage driver layer 110 sends the encoding coefficient vector λj={λj,1,λj,2,...,λj,k} (where j∈[1,m]) to each untrusted node and its corresponding node index.

[0073] Untrusted nodes (computing power nodes), in a blind state completely unaware of the plaintext and decryption key, invoke their local general-purpose computing units (GPU / CPU), treating the ciphertext data blocks they hold or collect from the network as input vectors, and perform the following streaming dot product concatenation operation within the GF(2w) domain to directly generate the ciphertext redundancy check block sk+j: Since the ciphertext data block ci introduces homomorphic linear discrimination or homomorphic algebraic encapsulation in step S1, it satisfies the distributive law of addition and the associative law of scalar multiplication over a finite field: Therefore, the ciphertext redundancy check block {sk+1,...,sk+m} generated by the untrusted node can perfectly carry multi-dimensional erasure and fault tolerance information while maintaining the ciphertext state of the entire link, so that the subsequent system can perform blind data self-healing reconstruction when the node is offline.

[0074] Each untrusted node is configured with a time-correlated state constraint (TSC) when performing combinatorial operations. This constraint is used to constrain the order of computation, state continuity, and result generation path.

[0075] State continuity constraint: During execution on external computing nodes, the dynamically constructed state variables in real time satisfy the relational expression State_local == State_global; In the above formula, State_local is the expected state fingerprint independently generated by the distributed end-side sovereign node based on the local physical clock source and process context; State_global is the global state trusted variable returned by the external computing node after performing linear operations; This constraint compares the local expected state fingerprint (State_local), which is independently derived by the end-side sovereign control terminal based on the physical hardware clock source and the current kernel process context, representing the expected correct computation path, with the global state trust variable (State_global), which represents the actual execution path, returned by the external untrusted computing power node along with the computation result payload. If and only if the two are completely equal, it is determined that the execution path of the external computing power node has not been tampered with or out of order, and the computation result is allowed to pass the state continuity verification. If the two are not equal, it is determined that the computation path has been tampered with or the execution has drifted.

[0076] Time consistency constraint: The time consistency constraint means that the sum of the physical generation timestamp and the network transmission timestamp Timej of any ciphertext block or redundant block must satisfy the constraint condition that it is contained within a preset dynamic time window interval, that is, satisfy: In a specific embodiment, the specific logic and decision boundary definitions for satisfying the condition Timej∈Valid_Window are as follows: Let tstart be the local absolute physical timestamp when the kernel storage driver layer 110 issues an I / O scheduling instruction to a specific untrusted node; and let tend be the local absolute physical timestamp when the kernel storage driver layer 110 captures the encrypted redundancy check block and status flag returned by the untrusted node. Then the actual total time of the current transaction satisfies: Δt = tend − tstart.

[0077] The dynamic time window interval Valid_Window is defined as a half-open, half-closed interval: Valid_Window=[Δtmin,Δtmax] Wherein, the lower limit Δtmin is the preset physical minimum time threshold for hardware network transmission and blind computation of homomorphic matrices under ideal conditions; the upper limit Δtmax is a dynamically adjusted window, and its calculation formula is: Δtmax=Δtbaseline⋅(1+Ωdebt) In the formula, Δtbaseline is the baseline security latency; Ωdebt is the entropy debt coefficient of the storage system bus currently monitored and maintained in real time by the end-side kernel, which reflects the current network congestion and the backlog latency of the physical I / O queue.

[0078] If and only if the actual total time Δt falls perfectly within the Valid_Window interval, and the physical timestamp in the returned data stream is not logically reversed with the monotonic hardware clock source, the time consistency constraint is satisfied, and the state machine is allowed to jump to the next valid stage; otherwise, it is determined that a timing replay attack or man-in-the-middle attack has occurred, and a blocking signal is directly output.

[0079] The causal order derivation constraint of the resulting generation path: The generation path of any redundant block S_j satisfies the iterative one-way cryptographic state transition constraint, as follows: This constraint means that the generation of the redundant block S_j with the current sequence number j must use the preceding state fingerprint State_{j-1} with sequence number j-1 as a mandatory one-way operator input. By injecting State_{j-1} into the initialization confusion factor of the current computation cycle, the computation path forms a specific topological closed loop on the cryptographic causal chain. Any redundant block that skips the preceding steps or forges the execution order cannot pass the reverse collision verification of the result verification module.

[0080] This constraint ensures that when an untrusted computing node computes the j-th redundant block, it cannot independently forge its state. It must use the fingerprint of the previous historical state as a one-way obfuscation operator, and fuse it together with the current clock source and process context. If the computation path is truncated, replayed, or executed out of order, the final checksum will completely collapse.

[0081] The dynamic state fingerprint State_t for the current time period is explicitly expressed by the function State_t=F(Data_{scope}\oplusTime\_t\oplusContext\_t); Data_{scope} is a unique metric identifier for the data block or ciphertext block participating in the current computation; Time_t is the current sequence or time information; Context_t is the kernel-mode process context feature vector. Since untrusted nodes cannot recover data, secure computing power outsourcing is achieved.

[0082] Compared to the traditional single-application-layer hash time lock (HTL) architecture, the constraints in step S2 enable a more sophisticated and robust technical solution that addresses both the underlying operating system interaction and physical hardware boundaries. Specifically, this is manifested as follows: It completely eliminates the dependence of static cryptographic hashing on specific algorithms and user-space components, and evolves it into a dynamic timing state machine that relies on the kernel storage driver layer 110 of the end-side sovereign node, the physical memory management unit (MMU), and the physical clock source.

[0083] By extracting the irreversible hardware-level monotonic timestamp MonotonicTime and the real-time kernel process context state vector as cascaded confusion entropy sources, a time-related state constraint index TSC_Fingerprint is generated, which combines hard constraints of time windows with host environment-specific fingerprints. During the data consumption and computation feedback phase, it performs physical-level post-transaction linkage with a locally defined stateless virtual page buffer that has a short lifespan and supports physical erasure after a single atomic encoding.

[0084] The above constraints ensure that, in untrusted computing power outsourcing scenarios, the determination of the legality of computing paths and the causal order of execution by computing power nodes is upgraded from a single data flow integrity check to a full-dimensional sovereign control constraint on the runtime behavior trajectory, clock cycle, and hardware execution environment of computing power nodes; significantly improving the technical resistance strength and legal protection boundary of the system against complex attacks such as advanced time-series replay, memory bypass cold start, and system call hijacking.

[0085] S3, constrains untrusted nodes to perform global state causal integrity (GSCI) transition rule calculation while generating ciphertext redundancy check blocks; the kernel storage driver layer 110 generates the driver layer state identifier of the current evolution stage based on the calculation results; The status identifier is composed of the characteristics of the legal preceding state of the previous stage, the characteristics of the current ciphertext data block, the monotonic time series, and the execution context vector reflecting the characteristics of node operation as input items; The GSCI transition rule runs as the driving layer consistency determination logic for causal state machine jump updates; Figure 3 The state transition path of the multidimensional causal state machine (GSCI) and the physical layer hard circuit breaker mechanism associated with it are shown.

[0086] The core legitimate transition states of the state machine include: Verified (verified static baseline state), Active (dynamic read / write state), and Recovery (self-healing recovery state) exclusively controlled by the state-level asynchronous latch buffer 122 (SLBL). When normal verification passes or delayed causal final verification is successful, the system safely transitions between the above states.

[0087] When the system detects abnormal mutations (such as non-monotonic timing, ghost fragment injection, or forged signatures), the state machine directly jumps to Blocked (abnormal isolation state).

[0088] Specifically, when unauthorized external computing power performs unauthorized reading, bypass scanning, or micro-feature detection on encrypted fragments, it will inevitably cause perceptible physical feature disturbances and timing impedance changes in the storage medium or bus channel. The end-side hardware peripheral sovereign anchor (using the end-side device's PMU, TEE, TPM, DMA monitor, and bus anomaly detection circuit) is highly sensitive to this. Once detected, it immediately triggers a hardware-level non-maskable interrupt and a Runtime Freeze, forcing the state machine to jump to the Blocked state and physically rejecting any subsequent data overwriting or bus transmission at the hardware level.

[0089] S4, the kernel storage driver layer 110 captures the encrypted redundancy check block and its accompanying state flag, uses the state flag as one of the trigger conditions for the causal state machine jump update, performs equal collision judgment based on the expected state machine value in the driver layer, and simultaneously performs time window interval verification based on monotonic time series. Figure 4 The diagram illustrates the control flow of a differential sovereignty hierarchical scheduling based on a 400-dimensional physical performance profile of an external untrusted storage node, according to an embodiment of the present invention.

[0090] First, the dynamic performance fingerprint acquisition sensor 430, which is parasitic on each of the 400 external untrusted storage nodes, collects low-level performance indicators such as continuous availability fingerprint in the time domain, throughput bandwidth and transient latency jitter in the transport layer, and physical page write latency in the block device layer I / O layer at high frequency and without being noticed.

[0091] The redundancy level monitoring module 310 in the cloud sovereign control plane 300 periodically captures and summarizes the above indicators, jointly constructs a "multi-dimensional physical performance profile" of each external untrusted storage node 400, and evaluates the physical performance level of each node accordingly (divided into high availability level Class A and low availability level Class B).

[0092] At the same time, the edge sovereign control device 100 autonomously divides the data blocks to be stored into different popularity levels and importance levels based on the access frequency and high-dimensional semantic features of personal digital assets and other data.

[0093] Finally, the cloud-based sovereign control plane 300 establishes a cross-mapping relationship between performance levels and popularity levels, and performs differentiated physical deployment scheduling: high-popularity or high-importance data blocks and their corresponding GSCI active status identifiers are prioritized for deployment on Class A high-availability storage nodes; while low-access-frequency cold data or purely redundant check blocks are deployed on Class B low-availability backup storage nodes, achieving an optimal balance between global convergence and self-healing overhead.

[0094] It should be noted that the State-Level Asynchronous Latch Buffer 122 (SLBL), as the core control component carrying the self-healing recovery state, exclusively occupies the control state credential field and is strictly prohibited from carrying ciphertext data block entities, thus achieving strong decoupling from the data recovery layer. During offline self-healing transitions, the SLBL state gating forcibly intercepts any attempts to write real ciphertext blocks or decrypt plaintext entities, latching only the topology control flow containing GSCI transfer rules.

[0095] S5, when the judgment or verification fails and the causal state machine jumps to the abnormal branch, the block device layer performs interception and scheduling behavior in the block device request scheduling layer or I / O request queue layer to terminate the redundant write process of the current storage path, and the kernel storage driver layer 110 sends standardized control instructions to the hardware controller through the device control interface provided by the operating system kernel, cascading the underlying hardware to perform physical cache invalidation and erasure behavior. Step S5 includes strong control of the scheduling queue at the logical level (modifying the block device scheduler request queue pointer) and strong control of the bus and registers at the physical level.

[0096] Logical-level scheduling queue control: When the kernel storage driver layer 110 determines that the GSCI state machine has jumped to an abnormal branch, the system immediately starts logical control of the current untrusted node storage path.

[0097] Specifically, the kernel storage driver layer 110 directly intervenes in the Block Device Request Queue (BlockLayerScheduler) by issuing hard interception semantics to the underlying block device layer, performing access control, suspension, cancellation, or redirection operations. The interception is achieved by modifying the head and tail pointers of the current physical I / O request queue, forcibly removing, redirecting, or silently dropping all pending I / O requests pointing to the malicious or abnormal storage path from the queue. At this point, the write blocking of the upper-layer application or calling source will be directly interrupted by a kernel-forged "execution success" message or a specific blocking error code (such as -EIO), completely locking the propagation path of the abnormal data on the logical chain.

[0098] Physical-level bus and register control: Simultaneously with the logical control trigger, to prevent untrusted nodes from bypassing the software queue and continuing to physically write residual data using the underlying Direct Memory Access (DMA) controller, the kernel storage driver layer 110 coordinates with the underlying hardware controller's bus control instructions. The control kernel forcibly switches the bus interface associated with the untrusted memory path to a high-impedance (Hi-Z) state by hard-writing configuration to specific configuration space registers of the host controller interface (such as an NVMe controller or PCIe controller) or by sending a DMA disabling signal (DMA_DISABLE) to the underlying hardware controller. By cutting off the physical clock or handshake signal on the bus link, the physical transmission of a specific I / O request is forcibly suspended or terminated at the hardware electrical signal level.

[0099] Step S5, through the coordinated action of modifying the linked list of the logical layer queue pointer and the hard instructions of the physical layer bus, constructs a strong control boundary for the storage path that is exclusive and physically unavoidable between the kernel mode and the physical bus, ensuring the absolute purity of the sovereign memory base storage ledger.

[0100] Steps S2-S4 constitute an indivisible execution path closed loop consisting of kernel-driven behavior, scheduling decisions, and I / O control responses.

[0101] In some implementations, step S5 includes intercepting scheduling behavior as follows: the kernel storage driver layer 110 directly rewrites the request queue pointer of the block device scheduler according to the abnormal jump instruction of the causal state machine, forcibly discards the currently unresolved storage write request, and realizes I / O-level logical path gating interception.

[0102] In some implementations, in step S5, the standardized control instructions include: The kernel storage driver layer 110 issues page update instructions to the hardware memory management unit through the driver extension mechanism provided by the operating system kernel, and revokes the IOMMU hardware physical level mapping permission of the corresponding storage page or memory buffer. The kernel storage driver layer 110 writes a suspend register instruction to the standard bus controller, forcibly suspending the underlying physical direct memory access data bus channel, thus restricting the continued transmission of abnormal state data at the hardware level.

[0103] In some implementations, step S5, the physical cache invalidation and erasure behavior includes: the kernel storage driver layer 110 locates the stateless transient page buffer in the physical memory carrying the ciphertext data stream, continuously writes at least one round of physical overwrite signatures to the stateless transient page buffer to perform hard write overwrite, thereby erasing the residual data in the transient page buffer and performing a state reset.

[0104] Specifically, the physical overlay signature uses a clear bitstream configuration at the physical level to ensure that residual charge on the semiconductor storage medium is completely destroyed. It includes at least one of the following forms: 1) Normalized static data stream: The direct memory access (DMA) controller is controlled by kernel-level hard instructions to continuously write a static bitstream of all zeros (0x00) or all ones (0xFF) to the stateless transient page buffer, forcing the charge state of the physical memory chip to be normalized; 2) High-frequency alternating flip signature: Multiple rounds of complementary flip sequences are continuously written to the buffer (e.g., the first round writes 0x55, i.e., 01010101; the second round writes 0xAA, i.e., 10101010), eliminating the charge residual effect of the semiconductor medium through the violent flip of physical level, and blocking cold start grabbing attacks from the hardware; 3) Dynamic pseudo-random hard-coded sequence: The hardware random entropy source provided by the operating system kernel is called to generate an unpredictable random data stream with high entropy in real time and overwrite the buffer.

[0105] In this invention, the specific engineering implementation path for the allocation, streaming assembly, and state destruction of the stateless transient page buffer in physical memory is as follows: 1. Memory barriers and independent page table mapping (allocation of stateless virtual page buffers): When initializing an I / O transaction or detecting the arrival of ciphertext data, the kernel storage driver layer 110 dynamically allocates an independent contiguous or non-contiguous physical page frame in physical memory through the system kernel's memory allocator (such as alloc_pages) and configures it as a stateless transient page buffer. To prevent this buffer from being accidentally swapped to an external untrusted permanent storage medium during CPU paging scheduling, thus causing plaintext / ciphertext leakage, the kernel storage driver layer 110 forcibly attaches the VM_LOCKED attribute flag (i.e., a memory latch mechanism) to the buffer, logically depriving it of the right to be paging out. Simultaneously, the page table entries (PTEs) of this buffer are not open to user space, but are only visible to the kernel-mode driver layer and specific local DMA controllers.

[0106] 2. Ciphertext streaming assembly and blind matrix operations (logical behavior of transient assembly): During the blind computation process in steps S2 to S4, the ciphertext data blocks or ciphertext redundancy check blocks fed back by each external untrusted storage node 400 are directly written into the stateless transient page buffer via streaming DMA transfer. The kernel storage driver layer 110 reuses this stateless transient page buffer to perform matrix combination operations such as streaming assembly of the ciphertext stream, instantaneous decryption, and nonlinear similarity sorting. Since this buffer is logically "stateless," it does not maintain any long-term transaction logs internally and only serves as a "high-fluidity instantaneous relay station" for data stream transmission.

[0107] 3. Failure erasure and charge reset (erasure behavior of hard write overwrite): If the equivalence determination or time window verification in step S4 fails, or if the single ciphertext field self-healing task ends normally, the system will trigger the "physical cache invalidation erase" behavior. At this time, the kernel storage driver layer 110 no longer simply executes the conventional logic of unmapping the page table, but immediately starts hard write overwrite. Through kernel-level control instructions, the DMA controller is driven to continuously write at least one round of physical overwrite signatures consisting of all zeros, all ones, or high-frequency flip codes to all physical base addresses and page offsets corresponding to the stateless transient page buffer, forcibly resetting the residual charge at the semiconductor physical medium level, and completing the closed-loop management of the entire lifecycle of the stateless transient page buffer. Furthermore, in step S3, the execution context vector is generated by the kernel storage driver layer 110 by reading the hardware register context snapshot of the current physical execution thread. The snapshot includes at least one of the program counter features and the page table base address register features. The kernel storage driver layer 110 maps the snapshot to the input operator of the causal state machine to establish a hardware-level association between the transition decision of the causal state machine and the physical running state of the underlying hardware.

[0108] In some preferred embodiments, the method further includes establishing a multi-master version asynchronous conflict resolution and rights confirmation mechanism based on a distributed causal state machine: when an offline end device recovers to an online state, the kernel storage driver layer 110 captures the expected state flow of the locally maintained causal state machine and performs version collision with the pending self-healing transaction ledger temporarily stored in the cloud. If a state fork is detected, the kernel storage driver layer 110 is triggered to execute the pending transaction abandonment action in the driver layer, directly abandoning the pending self-healing transaction, and triggering the sovereign control instruction issuance action to reset and overwrite the storage state of the untrusted node in the cloud, so that the distributed storage topology is forcibly returned to the local root of trust.

[0109] In some preferred embodiments, when the end device is continuously offline and the number of valid ciphertext redundant blocks surviving in the network is less than a preset security threshold, the cloud scheduling module remotely schedules surviving healthy nodes to directly perform blind computation, derivation, reorganization, and redundancy completion in the ciphertext domain under blind state conditions without keys, plaintext, and node anonymity. The state characteristics carried by the generated pending self-healing results must be attached to a temporary queue and suspended until the causal state machine final review and confirmation jump is performed after the end device is restored to online.

[0110] Furthermore, the hybrid trusted input source of the causal state machine is provided collaboratively by the hardware trust anchor (HTA) and the software trust anchor (STA): the hardware trust anchor (HTA) reads the system hardware state through the physical security chip and performs initialization signature to generate the initial state seed; the software trust anchor (STA) collects dynamic operating characteristic metrics of untrusted storage nodes in real time to jointly construct the execution context vector.

[0111] In some implementations, a storage system constructed from a sequence of ciphertext data blocks containing causal state machine constraints serves as a memory privacy base or a retrieval enhancement context storage layer for the data-consuming intelligent agent during runtime. When the edge device performs high-dimensional semantic feature matrix recall and reconstruction, the block device layer reuses a stateless transient page buffer for streaming assembly, instantaneous decryption, and nonlinear similarity sorting of the ciphertext stream, and drives the buffer to perform overwrite erasure after a single computation task is completed.

[0112] As a specific application of this embodiment, the above-mentioned functions can be designed in a modular manner. Specifically, this includes a ciphertext storage module, a redundancy generation module, a causal state machine management module, a driver layer verification module, and a storage path control module. The ciphertext storage module is used to distribute and store the segmented, authenticated, encrypted ciphertext data blocks to multiple untrusted nodes. The redundancy generation module is used to schedule storage nodes to perform linear matrix combination operations on ciphertext data blocks to generate redundant check blocks under blind conditions without decrypting data or exposing the key. The causal state machine management module is used to maintain the multidimensional causal state machine by the kernel storage driver layer 110 during the redundancy generation process, and to generate state identifiers based on the GSCI transition rules. The state identifiers serve as one of the trigger conditions for the update and jump of the multidimensional causal state machine. The driver layer verification module is used to obtain the returned status flag from the driver layer 110 stored in the end-side kernel and perform equivalence judgment and time window verification, and determine the jump branch of the causal state machine based on the verification result; The storage path control module is used to make interception and scheduling decisions at the block device request scheduling layer or I / O request queue layer when the causal state machine jumps to an abnormal branch due to verification failure, terminate the redundant write behavior of the current storage path, and trigger the issuance of sovereign control instructions to cascade and drive the underlying hardware to perform physical cache invalidation and erasure behavior.

[0113] The driver layer verification module is executed by the master-sovereign domain on the edge, relying on the kernel-mode storage driver layer. The specific verification logic, verification conditions, subjects, and post-audit closed loop of the driver layer verification module are as follows: (1) Verification of subject and object: The main body of the verification is the kernel-mode storage driver layer of the end-side sovereign control terminal; the object of verification is the computational feedback load returned by the external untrusted computing power node, which contains the redundant block S_j and the associated time-varying fingerprint. (2) Verification conditions and logical expansion: The driver layer verification module extracts the computational feedback payload from the stateless virtual page buffer and performs a collision verification between the externally generated global state trusted variable State_global and the expected state fingerprint State_local, which is independently derived locally based on the physical monotonic clock source and process context. The computation path is deemed valid and data is allowed to pass only if both of the following verification conditions are met simultaneously: Condition 1: State_local == State_global; Condition 2: The timestamp carried by the feedback payload: Time_j_inValid_Window Where Valid_Window is the adaptive valid time window; (3) Output format: If the verification passes, an "Atomic Transaction Commit Signal" is output, allowing the encrypted data or redundant blocks to be mounted to the virtual block device file system; if the verification fails, the data is considered abnormal and an "Execution Path Tampering Exception Code" is output. (4) Closed-loop coordination between external interfaces and external audit interfaces: When abnormal data is detected and an exception code is output, the driver layer verification module sends an interrupt request to the operating system's kernel security governance layer or hardware security chip through the locally exposed external standard communication handle (external interface), thereby calling the external audit interface; After the external audit interface is invoked, the node identifier, process context, and base address of the affected memory page table of the currently violating node are passed in; the actions performed by the external audit interface include: a. Set the system's sovereign freeze state flag (Freeze_State_Flag); b. The kernel storage driver layer 110 immediately triggers a hard write overwrite mechanism to perform zero-physical-residue erasure on the local stateless virtual page buffer; c. Logical blocking, or through the device access control interface, IOMMU mapping management mechanism, or hardware abstraction layer provided by the operating system kernel, to perform permission convergence and access isolation on the storage access path of external untrusted computing power nodes, thereby suppressing the risk of secondary overflow of sensitive data.

[0114] In some preferred embodiments, the system further includes a stateless computing module; the stateless computing module is executed collaboratively by the kernel-mode storage driver layer of the end-side sovereign control terminal and the hardware memory management unit (MMU); Its specific stateless operation and physical destruction control logic is as follows: 1) Stateless physical memory isolation mapping: When the system triggers outsourced computing power or local ciphertext erasure coding atomic operation, the kernel storage driver layer 110 forcibly allocates a set of stateless virtual page buffers with short lifespans in the physical memory (RAM) of the host device; the stateless virtual page buffers are hidden by dynamic base address randomization through hardware MMU and do not expose physical memory pointers to the outside world. 2) Runtime seamless conversion: The streaming assembly, instant decryption, similarity retrieval or linear operation of ciphertext blocks are all limited to the stateless virtual page buffer and are performed in a plaintext non-disk form. It is prohibited to persist the intermediate calculation state to any non-volatile physical storage medium. 3) Atomic-level physical circuit breaker destruction: At the instant when a single computation transaction is completed (outputting the atomic transaction commit signal) or is intercepted by the result verification module (outputting the path tampering exception code), the kernel-mode storage driver layer forcibly triggers the hard write overwrite mechanism, using all zeros (0x00) or pseudo-random data streams to perform physical overwrite erasure on the stateless virtual page buffer, and then cancels the corresponding page table mapping and releases the physical memory space; This module, through its full lifecycle sovereign isolation state of 'absolute blinding of storage state, dynamic refining at runtime, and atomic melting after output', cuts off any attack path at the physical hardware layer that could lead to secondary data interception through non-volatile cache residency, temporary writing to system temporary files, or cold boot attack, thereby minimizing the risk of data residue in classified cognitive assets and greatly converging the overall attack surface of the system.

[0115] In some preferred embodiments, the system also includes a cloud-based scheduling center module; this module ensures that the user's distributed storage assets are always within the threshold that meets the security redundancy strength under extreme conditions where the end-side sovereign control terminal is not continuously online (such as when all devices are shut down or the network is down), as follows: 1) Live node detection and sovereign risk awareness: The cloud-based central scheduling module continuously performs liveness detection on all distributed nodes across the network through lightweight stateless heartbeat detection; when the cloud detects that due to some external nodes being silent or offline, the actual number of live nodes containing valid ciphertext redundant blocks is approaching the security red line (i.e. erasure coding recovery threshold k), and all end-side sovereign control terminals are offline at this time, the cloud-based central scheduling module forcibly activates defensive reorganization transactions; 2) Blind-state in-situ reassembly and backup security mounting: Without holding user plaintext data or accessing the decryption key, the cloud-based central scheduling module, acting as a "sovereign security guardian," directly issues controlled blind computation instructions to currently detected healthy external nodes that are alive; it guides the surviving nodes to utilize the linear computability constraint of the ciphertext field of this invention to directly reassemble and derive the missing ciphertext redundant blocks in the ciphertext state, and then put them into a brand-new backup security storage node in-situ, so that the number of available storage nodes in the entire network returns to a safe level in real time; 3) Asynchronous Sovereign State Appendage and Confirmation Activation (TSC Delayed Collision): Since the cloud cannot obtain the real-time generated local expected state fingerprint State_local when performing live node reorganization, the cloud central scheduling module will temporarily store the global state variable State_global generated by this reorganization transaction and the timestamp Time_j of the backup new node as "log pending confirmation". Once any user-side sovereign control terminal comes back online, the kernel-mode storage driver layer on the terminal side will automatically pull the "log awaiting confirmation of rights" and re-derive the expected state flow in the stateless virtual page buffer that is absolutely isolated locally. It will then perform a retrospective confirmation of rights comparison on the reorganization and completion results executed by the cloud during the terminal's offline period. Only after the comparison is passed will the local kernel formally accept and mount the virtual block device mapping of the backup new node, ultimately realizing the functional collaboration of "cloud safeguarding security level, terminal side controlling final sovereignty".

[0116] This invention establishes a two-layer topology architecture of a sovereign control center and distributed nodes. Its logical and physical topology adopts a two-layer collaborative control architecture in which "the sovereign control center performs global central scheduling, distributed computing nodes bear blind state loads, and the edge-side driver layer implements physical strong control". 1) Global Central Scheduling and Sovereign State Ledger Maintenance: The system maintains a dynamically controllable sovereign control center (central scheduling terminal). The sovereign control center does not access or store users' original plaintext data and decryption keys; it is only used for centralized maintenance of the routing index ledger, node credit ledger, and GSCI evolution state ledger for the entire network's encrypted slices. When the encrypted data blocks after segmented authentication in step S1 are distributed to the P2P network, the sovereign control center records the physical distribution topology of each slice in the routing index ledger in real time.

[0117] 2) Asynchronous Ledger Alignment for Blind Computation: During the blind matrix computation and self-healing process in steps S2 to S4, each state identifier and computation trajectory generated by the untrusted computing node must be synchronously reported to the sovereign control center. The sovereign control center performs serialization registration of the transaction in the central ledger. When the end device (user control terminal) comes online and triggers the equivalence collision determination in step S4, the kernel storage driver layer 110 of the end device performs retroactive alignment with the sovereign control center ledger to finally establish the legitimacy of the current I / O evolution stage.

[0118] 3) Centralized Penalty and Global Isolation: Once step S4 or S5 determines that an untrusted node has engaged in poisoning, fraud, or severely delayed timing behavior, the circuit breaker signal will not only trigger a hard bus block and cache erase at the end-side driver layer, but will also be simultaneously uploaded to the sovereign control center. The sovereign control center will immediately modify the global credit ledger, performing global forced isolation and path removal of the malicious node from all current and subsequent storage paths and BT scheduling queues.

[0119] In this invention, the sovereign control center (central scheduling terminal) employs a strong control mechanism based on asymmetric multi-tier ledger and blind routing when performing global scheduling and ledger recording. The specific engineering implementation path is as follows: 1) Asymmetric decoupling ledger architecture The sovereign control center establishes and maintains two core baseline ledgers: the global encrypted routing index ledger Lroute and the node credit transaction ledger Lcredit.

[0120] Lroute records the distribution topology of ciphertext data blocks ci only in the form of hash indexes: Lroute:Hash(ci)→{NodeID1,NodeID2,…} The sovereign control center does not hold, access, or decrypt the user's original plaintext data, nor does it hold the decryption key or HLA homomorphic identifier primitive, thus achieving an absolute separation of "scheduling rights and the right to know" both physically and logically.

[0121] 2) Blind Routing & Self-Healing Based on Dynamic Vector Clocks When the global central scheduling detects that a certain untrusted computing power node (such as NodeID1) is removed due to offline status, hardware failure, or credit downgrade, the sovereign control center calculates the network redundancy level of the current ciphertext set C based on the Lroute ledger.

[0122] If the water level falls below the safety threshold, the central scheduling terminal does not need to notify the user-side devices to come online. Instead, it directly sends a blind self-healing command to other untrusted nodes in the network with idle computing power. This command contains the isomorphic generation vector of the target missing block. new.

[0123] Upon receiving the instruction, the computing node, in a blind state completely unaware of the data content, invokes the finite field GF(2w) blind computation matrix to directly retrieve the remaining slices from other healthy ciphertext nodes and perform streaming dot product. This directly assembles and generates a brand-new ciphertext redundancy check block on the cloud network side and transfers it to the designated healthy redundancy node. After self-healing, the transaction is serialized and recorded in the central ledger Lroute.

[0124] Retroactive Alignment Algorithm To absolutely prevent the sovereign control center itself from being attacked by a man in the middle or maliciously tampered with, the system introduces an asynchronous traceability alignment mechanism between the end-side driver layer and the central scheduling end.

[0125] When the user-side device (such as the W1 device) performs the equivalence collision determination in step S4, its kernel storage driver layer 110 will extract the root hash value of the causal state machine that has been maintained locally for a long time and perform a collision with the evolutionary ledger flow issued by the sovereign control center using a higher-order Merkle tree.

[0126] The current I / O transaction is deemed valid only if the local expected state fingerprint (Statelocal) on the endpoint, the Stateglobal returned by the external node, and the ledger topology fingerprint of the central control center are algebraically identical. The endpoint kernel driver then sends a "sovereignty confirmation signature" to the central scheduler to formally perform final confirmation locking (Commit) on the records of this stage in the central ledger.

[0127] In some preferred embodiments, the sovereign control devices 100 (or peer nodes) on each end side of the distributed storage self-healing system are not directly exposed to the public Internet. Instead, they establish a 'logical virtual local area network (VLAN)' based on software-defined wide area network (SD-WAN) or peer-to-peer encrypted tunneling protocol (P2PEncryptedTunnelingProtocol) at the virtual network interface layer (virtual NIC layer) of the operating system.

[0128] The logical virtual local area network (VLAN) performs initial addressing and key negotiation through a self-developed private root server (Moon / Planet scheduling shadow nodes) set up within the territory. At the network communication layer, data is transmitted between nodes through a double nested encryption mechanism: the outer layer uses a transport layer physical tunnel based on stream cipher (such as ChaCha20-Poly1305 or similar symmetric encryption schemes) to forcibly penetrate and flatten the NAT firewall restrictions across operators, orchestrating globally dispersed member devices into a private storage grid with an independent internal network IP addressing system (such as 10.XXX); the inner layer carries the core ciphertext slice stream of Patent 1 and the blind computation payload of GF(2^w) finite field state machine, thereby securely performing blind self-healing within the 'private storage dome (SovereignVault)' completely isolated from the public network.

[0129] Furthermore, to ensure the high availability and disaster recovery capabilities of distributed storage in non-continuously online states of the end-side sovereign control terminal, the system also includes a cloud-based blind computing backup replacement mechanism: 1) Static monitoring of redundancy level: The control plane of the cloud-based central scheduling module maintains the online level of each external untrusted storage node 400 in real time through lightweight heartbeat monitoring; when the cloud detects that the current available redundant block level is lower than the preset safety threshold (erasure coding minimum recovery threshold k) due to node offline, and all user-side sovereign control terminals are offline at this time, the static proxy self-healing process is automatically activated. 2) Cloud-based encrypted blind computation reconstruction (core anti-leakage feature): Without holding the user's plaintext data and encryption key, the cloud-based central scheduling module directly utilizes the linear computability constraint of the encrypted field of this invention; the cloud issues blind computation instructions to guide other healthy external storage nodes that only hold encrypted blocks to directly perform linear combination operations under the encrypted field to reconstruct the lost encrypted redundant fragments; and the newly generated encrypted redundant fragments are directly distributed to the backup replacement storage nodes to achieve "blind computation completion" without plaintext being stored on the cloud; 3) Asynchronous Sovereign State Appendage and Retrospective Verification (TSC Delayed Collision): Since the cloud cannot obtain the local expected state fingerprint State_local generated by the end side in real time when performing backup replacement, the cloud will temporarily store the global state variable State_global generated by this replacement transaction and the timestamp Time_j of the new node in the pending transaction queue. When any user-side sovereign control terminal comes back online, the kernel-mode storage driver layer on the client side asynchronously pulls the pending transaction queue and re-derives the expected state flow in the local physical isolation environment. It then performs a retrospective Verify check on the backup replacement result executed by the cloud during the backup's offline period. If the check passes, the local kernel formally accepts and mounts the virtual block device mapping of the new backup node. If the check fails, it is determined that a central unauthorized tampering has occurred, and the local client immediately performs physical interception of the backup node and calls the audit countermeasure interface.

[0130] Furthermore, to eliminate potential concurrency conflicts between external cloud-based elastic reorganization and on-device local autonomous computing, and to safeguard absolute data sovereignty on the device side, the system establishes a blind-state topology ledger and a multi-master version collision cancellation mechanism: 1) Privacy-free hosting of the cloud-based blind topology ledger: The hosted ledger maintained by the cloud-based central scheduling module only contains anonymous node identifiers, the current transaction version number (Epoch), and blinded global state trusted variables (State_global), and does not contain any plaintext metadata, directory structure, or decryption keys of the original data; the cloud only uses this blind ledger to perform liveness awareness and topology integrity maintenance on external nodes; 2) Asynchronous confirmation of rights and draft to official logic (conflict elimination): When the terminal sovereign control terminal recovers from offline to online, the kernel-mode storage driver layer prioritizes version matching between the locally independently derived local expected state fingerprint State_local and the pending reorganization transactions temporarily stored in the cloud. If the collision passes (i.e., the Verify equivalence constraint is satisfied and the timing is monotonically increasing), the edge kernel directly performs atomic-level activation of the backup storage node that was hosted and reorganized in the cloud during its offline period, and mounts it to the local virtual block device file system, thereby eliminating the need for repeated download and completion calculations on the edge. 3) End-side sovereignty forced overwrite mechanism: If version collision detects that the version number of the pending transaction in the cloud is lagging behind, or that the state fingerprint is discontinuous and forked, it is determined that a concurrent conflict or unauthorized modification by the central authority has occurred. The end-side sovereignty control end directly ignores and discards the pending reorganization results in the cloud. The end-side kernel uses the latest local state stream as the absolute root of trust, forcibly calculates and issues the latest sovereignty control instructions to the external surviving nodes, resets the blind topology ledger in the cloud, and ensures that no matter what conflict scenario, the final decision control and state determination rights of the system are always anchored in the local end-side kernel.

[0131] In some preferred embodiments, the present invention also discloses exclusive isolation control of the state credential field based on state-level asynchronous latch buffer 122 (SLBL), as detailed below: To eliminate the risk of side-channel penetration caused by the mixing of control flow and data flow in the asynchronous / offline state of the distributed grid, and to clearly define the boundary with the general data temporary storage mechanism, this invention establishes a state-level asynchronous latch buffer 122 (SLBL) in the kernel storage driver layer 110 of the end-side sovereign control device 100.

[0132] Strict State-Credential Exclusivity: SLBL is configured as the exclusive operating entity for the "State-Credential Domain" in the physical memory mapping. When the heartbeat monitoring module determines that the end-side sovereign hardware has entered asynchronous communication mode with the cloud or external mesh, SLBL is unidirectionally activated. At this time, SLBL only allows and exclusively receives the driver layer state identifier, GSCI (Global State Causal Integrity) transition rule matrix, and encrypted metadata structures (such as erasure coding matrix coefficients and block device linear mapping table descriptors) fed back from external untrusted storage nodes 400.

[0133] Entity-Free Constraint: At the hardware architecture level, the SLBL does not allocate any buffers for encrypted data blocks or decrypted plaintext streams. Any operation attempting to write non-state credential characteristic data to the SLBL will be subject to I / O stream privilege revocation by the State Priority Bus Arbitration Unit 115 (SPBA) in the Kernel Privileged Execution Environment, returning a pointer out-of-bounds exception.

[0134] Through this design, the "legal status supplementary signature" generated by cloud-based blind computing reconstruction, upon entering the edge side, first undergoes a pure control-level GSCI state machine monotonicity and timing window interval equivalence verification (TSC delay collision) within the SLBL. Only after the control flow credentials in the SLBL have passed deterministic topology traversal verification does the system allocate a temporary, stateless physical read / write buffer to stream-assemble the actual encrypted data block. This physically isolates the path for "ghost fragments" to pollute the system's control state machine using the data channel, achieving perfect decoupling of rights confirmation across the patent matrix.

[0135] In some preferred embodiments, the present invention also discloses that: the cloud sovereign control plane 300 periodically captures the temporal domain continuous availability fingerprint, transport layer throughput bandwidth and transient latency jitter, and block device layer I / O physical page write latency of each external untrusted storage node 400 through lightweight heartbeat monitoring, and jointly constructs a multi-dimensional physical performance profile of each storage node; the cloud sovereign control plane 300 evaluates (classifies) the physical performance level of each untrusted storage node according to the physical performance profile; at the same time, the edge sovereign control device 100 divides the data blocks to be stored into different heat levels and importance levels according to the access frequency and high-dimensional semantic features of the data assets; the cloud sovereign control plane 300 performs differentiated physical deployment scheduling of distributed streaming storage and self-healing reconstruction according to the mapping relationship between performance level and heat level: high heat or high importance level data blocks, and corresponding GSCI active status identifiers are prioritized for deployment on high availability level storage nodes; low access frequency cold data or pure redundant check blocks are deployed on low availability level backup storage nodes.

[0136] In this embodiment, the main components and their physical interaction paths are as follows: 1. Blind-state spatial topological blocking path Once the original personal digital assets (including but not limited to audio of human interviews, historical images, and snapshots of agent cognitive parameters) enter the kernel state, this invention intercepts the write request through the unified resource entity abstraction module, and the blind state redundancy matrix collision control module performs high-dimensional linear matrix combination encoding operations under blind state conditions without decryption and without exposing the system root key.

[0137] The generated redundant ciphertext fragment matrix is ​​asynchronously distributed to the distributed peer-to-peer storage array via the spatial topology scattering scheduling module according to the PSD protocol. Since the external quantum computing cluster cannot aggregate fragments satisfying the threshold k in the spatial topology, its input exhibits a computationally unsolvable semantic vacuum, thus making it immune to brute-force reverse engineering using Shor's or Grover's algorithms.

[0138] 2. Unauthorized Access Physical Feature Disturbance Detection and Silicon-based Physical Linkage Path When unauthorized external scanning behaviors (including but not limited to shadow stack hijacking, speculative execution side-channel scanning, illegal bus sniffing, or memory bypass cold start scanning) attempt to perform unauthorized reads or bypass scans on storage nodes or stateless transient page buffers protected on the edge side of a distributed storage array: This invention utilizes the performance monitoring unit (PMU), trusted execution environment (TEE), trusted platform module (TPM), direct memory access (DMA) monitor, and bus anomaly detection circuit of the edge device to perform high-frequency sensing of the physical bus and memory status; unauthorized external read behaviors will inevitably lead to a sudden change in the system's physical timing impedance or trigger a hardware performance counter (PMU) overflow. This invention accurately captures this impedance change through a physical feature perturbation audit chain, and links the runtime execution freeze module to implement a physical bus level fuse (Runtime Freeze), forcibly jumping the corresponding distributed multidimensional causal state machine to Blocked (abnormal isolation state), physically rejecting subsequent overwriting at the hardware electrical signal level, and achieving instantaneous hardware-level blocking of unauthorized behaviors.

[0139] This invention accurately captures the impedance change through the Physical Feature Perturbation Audit Chain (HEC), and in conjunction with the runtime execution freeze module, implements a physical bus level fuse (Runtime Freeze), forcibly setting the corresponding channel and node state to Blocked (abnormal isolation state), physically rejecting subsequent overwriting, and achieving a closed-loop blocking effect equivalent to quantum wave function collapse.

[0140] 3. Causal State Atom Self-Healing Path When an external high-dimensional parameter injection process (such as malicious cognitive tampering or bootstrapping attacks) attempts to modify the Parameter Snapshot Tree (PST) component in the kernel state, the system automatically calculates its Evolutionary Deviation Index (EDI). Once the index is determined to exceed the limit, the system forcibly performs a reverse forward transformation replay within the persistent protected sector through the Write-Ahead Log (WAL) component, completing the atomic rollback of the state and forcibly pulling the system back to the legitimate Cognitive Consistency State (CCS) snapshot node, ensuring the continuity and lossless existence of the global digital avatar's sovereign assets.

[0141] Figure 5 This diagram illustrates the entire path of interaction and linkage from blind spatial topological dispersion to ciphertext streaming self-healing reconstruction in offline state after personal digital assets enter the system of this embodiment.

[0142] Once the original personal digital assets (including but not limited to audio of human interviews, historical images, and snapshots of agent cognitive parameters) enter the kernel state, the unified resource entity abstraction module in the kernel storage driver layer 110 intercepts the write request, and the blind redundancy matrix collision control module performs high-dimensional linear matrix combination encoding operations under blind conditions without decryption and without exposing the system root key.

[0143] The generated redundant ciphertext fragment matrix is ​​asynchronously distributed to a distributed peer-to-peer storage array consisting of multiple external untrusted storage nodes 400 (such as storage node A, storage node B, and storage node C) through the spatial topology distribution scheduling module, according to the Physical Spatial Dispersion (PSD) protocol.

[0144] When an untrusted node (such as storage node B) is damaged, lost, or physically offline, and the end-side sovereign control device 100 is also in an offline network blind zone, the cloud control plane activates healthy nodes (such as storage node A and verification storage node C), and uses the ciphertext streaming reconstruction module 410 to respond to the cloud water level monitoring signal. Under the blind state condition of not recalling plaintext and not decrypting data, it performs blind calculation of the linear combination of high-dimensional matrix in the Galois Field, and stream reconstructs the missing ciphertext fragments.

[0145] The entire reconstruction process is carried out by the distributed causal ledger audit module 420, which performs chain topology auditing and control flow transfer fingerprint collision. Finally, the generated unresolved self-healing results are attached to the end-side state latch buffer layer in the form of legal status supplementary signature, completely eliminating the risk of data privacy leakage and ghost fragment tampering.

[0146] External quantum computing clusters cannot gather enough fragments to satisfy the threshold k in spatial topology, and their inputs exhibit a semantic vacuum that is computationally unsolvable, thus making them immune to brute-force reverse engineering by Shor's algorithm or Grover's algorithm.

[0147] When an external micro-level bypass probe stream (including but not limited to shadow stack hijacking, speculative execution side-channel scanning) attempts to perform an unauthorized scan of node B or the protected transient page buffer on the edge of a distributed storage array: The “quantum decoherence and wave function physical collapse” described in this embodiment, in a specific silicon-based engineering embodiment, specifically refers to the “fitting of equivalent irreversible physical state change” implemented by utilizing the physical / security characteristics of the TEE (Trusted Execution Environment Enclave) or TPM / TCM chip of the end-side hardware peripheral sovereign anchor (SEPS).

[0148] Specifically, the system utilizes the physical thermal noise spin randomness of the internal hardware-level true random number generator (TRNG) of the TEE / SEPS as the underlying source of uncertainty. External unauthorized read operations will inevitably trigger an overflow of the hardware performance counter (PMU) inside the TEE / SEPS or a timing impedance glitch.

[0149] This invention accurately captures the impedance change through the Physical Feature Perturbation Audit Chain (HEC), and in conjunction with the runtime execution freeze module, implements a physical bus level fuse (Runtime Freeze), forcibly setting the corresponding channel and node state to Blocked (abnormal isolation state), physically rejecting subsequent overwriting, and achieving a closed-loop blocking effect equivalent to quantum wave function collapse.

[0150] When an external high-dimensional parameter injection process (such as malicious cognitive tampering or bootstrapping attacks) attempts to modify the Parameter Snapshot Tree (PST) component in the kernel state, the system automatically calculates its Evolutionary Deviation Index (EDI). Once the index is determined to exceed the limit, the system forcibly performs a reverse unitary transformation replay within the persistent protected sector through the Write-Ahead Log (WAL) component, completing the atomic rollback of the state and forcibly pulling the system back to a legitimate Cognitive Consistent State (CCS) snapshot node, ensuring the continuity and lossless existence of the global digital avatar's sovereign assets.

[0151] It should be noted that the above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A self-healing method for distributed storage of encrypted domains based on causal state machine control, executed in conjunction with the kernel storage driver layer, block device layer, and underlying hardware controller of the end-side sovereign control device, characterized in that... The steps include the following: S1, Distributed state initialization and channel isolation: The encrypted ciphertext data blocks after segmented authentication are distributed and stored to multiple external untrusted storage nodes. The kernel storage driver layer initializes a distributed multidimensional causal state machine and opens a state-level asynchronous latch buffer in the end-side sovereign control device. S2, Blind Redundancy Computation and Feature Mapping: External untrusted storage nodes are scheduled to perform linear matrix combination operations on the ciphertext data block to generate a ciphertext redundancy check block under blind conditions without decrypting data or exposing the key; simultaneously, the kernel storage driver layer constrains the external untrusted storage nodes to perform Global State Causal Integrity (GSCI) transition rule calculation during the generation of the ciphertext redundancy check block; the kernel storage driver layer then concatenates the calculation results to generate a dynamic state identifier stream for the current evolution stage. The dynamic state identifier stream is generated by taking the legal preceding state features of the previous stage, the current ciphertext data block features, the monotonic time series, and the execution context vector reflecting the node's running features as inputs and mapping them. S3, Asynchronous State Isolation Latch and Exclusive Voucher Field: When the end-side sovereign control device is in an asynchronous offline state that is not continuously online, a state-level asynchronous latch buffer is activated to implement exclusive control of the state credential field. The state-level asynchronous latch buffer exclusively and unidirectionally latches the dynamic state identifier stream, which contains the GSCI transfer rules, and the encrypted metadata buffer sequence calculated and returned by the external untrusted storage node, and forces the state ownership control stream and the data entity stream to be strongly decoupled and isolated at the physical layer. Among them, the state-level asynchronous latch buffer is strictly prohibited from carrying or temporarily storing any decrypted plaintext data block or encrypted data block entity, and any operation that writes non-state credential feature data to SLBL is directly intercepted by the kernel. S4, End-side heartbeat recovery and delayed causal final verification: After the end-side sovereign control device returns to online status and detects the recovery of the communication heartbeat, the kernel storage driver layer asynchronously pulls the GSCI transfer rules and encrypted metadata buffer sequence latched in a state-level asynchronous latch buffer, and performs equivalence judgment and timing window interval verification at the kernel privilege level; if the verification passes, it is determined that a legitimate control flow state transition has occurred, and the multidimensional causal state machine seamlessly updates the transition branch and releases the corresponding physical control channel, and formally incorporates the encrypted metadata buffer sequence into the main storage file system to drive the streaming self-healing reconstruction of the block device layer I / O request queue; S5, Boundary Fuse and Zero-Residual Erasure of Physical Buffer: If the dynamic state identifier stream is found to have timing non-monotonicity, step jump, or ghost fragment injection anomaly during the verification in step S4, the multidimensional causal state machine is forced to jump to the abnormal isolation state branch and triggers hardware-level bus fuse; the State Priority Bus Arbitration Unit (SPBA) performs I / O stream privilege deprivation in the Kernel Privileged Execution Environment, forcibly terminates redundant writing of the abnormal path, and coordinates with the stateless transient page buffer cleanup module to perform zero-residual overwrite erasure of the corresponding physical read and write buffer.

2. The method as described in claim 1, characterized in that, In step S3, the execution context vector is generated by the kernel memory driver layer by reading a snapshot of the hardware register context of the current physical execution thread; The snapshot includes at least one of the program counter features and the page table base address register features; The kernel storage driver layer maps the snapshot to the input operator of the causal state machine to establish a hardware-level association between the transition determination of the causal state machine and the physical running state of the underlying hardware.

3. The method as described in claim 1, characterized in that, In step S5, the interception scheduling behavior performed at the block device request scheduling layer or I / O request queue layer includes: the kernel storage driver layer reconstructs and rewrites the descriptor structure or linked list topology of the current physical I / O request queue according to the abnormal jump instruction of the causal state machine, and forcibly strips, redirects or silently drops all pending I / O requests pointing to abnormal storage paths from the queue, thereby realizing I / O-level logical path gating interception.

4. The method as described in claim 1 or 3, characterized in that, In step S5, the standardized control instructions include: The kernel storage driver layer issues page update instructions to the hardware memory management unit through the driver extension mechanism provided by the operating system kernel, and revokes the IOMMU hardware physical level mapping permission of the corresponding storage page or memory buffer. The kernel storage driver layer writes a suspend register instruction to the standard bus controller, forcibly suspending the underlying physical direct memory access data bus channel, thus restricting the continued transmission of abnormal state data at the hardware level.

5. The method as described in claim 1, characterized in that, The kernel storage driver layer performs dynamic access control on the read and write paths of asset shards based on the state transition results of the multidimensional causal state machine. When an abnormal state transition, missing state identifier, broken state chain, or failed consistency check is detected, the system blocks the data exchange between the asset shard and the external storage node, and transfers the data to be confirmed to the decoupled temporary storage layer for isolated storage.

6. The method as described in claim 1, characterized in that: The system includes a decoupled temporary storage layer independent of the external storage nodes; When the sovereign status identifier corresponding to an asset fragment is missing, unverifiable, or does not meet the preset causal transfer conditions, the system will write the corresponding data into the decoupling temporary storage layer. Once the conditions for subsequent status verification are met, status confirmation, data migration, or redundancy reconstruction operations will be performed.

7. The method as described in claim 6, characterized in that, The system uses the validity verification result of the status identifier as a prerequisite for all migration, copying, reconstruction and recovery operations of asset fragments. The corresponding data persistence operation is prohibited until the status verification is completed.

8. The method as described in claim 1, characterized in that, When the end device is continuously offline and the number of valid ciphertext redundancy blocks surviving in the network is lower than the preset security threshold, the cloud scheduling module remotely schedules surviving healthy nodes to directly perform blind computation, derivation, reorganization, and redundancy completion in the ciphertext domain under blind state conditions without keys, plaintext, and node anonymity. The state characteristics carried by the generated pending self-healing results must be attached to a temporary queue and suspended until the causal state machine final review and confirmation jump after the end device is restored to online.

9. The method as described in claim 1 or 6, characterized in that, The hybrid trusted input source of the causal state machine is provided collaboratively by the hardware trust anchor (HTA) and the software trust anchor (STA): the hardware trust anchor (HTA) reads the system hardware state through the physical security chip and performs an initialization signature to generate an initial state seed. The software trust anchor (STA) collects dynamic operational characteristic metrics of the untrusted storage nodes in real time, which are used to jointly construct the execution context vector.

10. The method as described in claim 1, characterized in that, The storage system constructed from the sequence of ciphertext data blocks containing causal state machine constraints serves as a memory privacy base or retrieval enhancement context storage layer for the data-consuming intelligent agent during runtime. When the edge device performs high-dimensional semantic feature matrix recall and reconstruction, the block device layer reuses the stateless transient page buffer for streaming assembly, instantaneous decryption, and nonlinear similarity sorting of the ciphertext stream, and drives the buffer to perform overwrite erasure after a single computation task is completed.

11. The method as described in claim 1, characterized in that, The method constructs a cloud-based sovereign control plane; The cloud-based sovereign control plane uses lightweight heartbeat monitoring to periodically capture the temporal domain continuous availability fingerprint, transport layer throughput bandwidth and transient latency jitter, and block device layer I / O physical page write latency of each external untrusted storage node, and jointly construct a multi-dimensional physical performance profile of each storage node. The cloud-based sovereign control plane assesses the physical performance level of each untrusted storage node based on the physical performance profile. Simultaneously, the edge-side sovereign control device categorizes data blocks to be stored into different popularity and importance levels based on the access frequency and high-dimensional semantic features of the data assets. The cloud-based sovereign control plane executes differentiated physical deployment scheduling for distributed streaming storage and self-healing reconstruction based on the mapping relationship between performance and popularity levels: high-popularity or high-importance data blocks, along with their corresponding GSCI active status identifiers, are prioritized for deployment on high-availability storage nodes; low-access-frequency cold data or purely redundant check blocks are deployed on low-availability backup storage nodes.

12. A distributed storage and self-healing system for encrypted domains based on sovereign kernel control, characterized in that, The kernel storage driver layer is deployed on the edge sovereign operating system and interconnected with the hardware peripheral sovereign anchor through a secure physical bus. The distributed storage and self-healing system includes a unified resource entity abstraction module, a blind redundancy matrix collision control module, and a spatial topology distribution scheduling module. The unified resource entity abstraction module is used to intercept kernel-mode file write requests and divide the original personal digital asset data stream into a sequence of unstructured data blocks with monotonic temporal identifiers. The blind redundancy matrix collision control module is used to call the stateless transient page buffer and perform high-dimensional linear matrix combination encoding operation based on Galois field under blind conditions without decrypting the data block sequence and without exposing the system root key, to generate a redundant ciphertext fragment matrix containing blind check operators. The spatial topology distribution scheduling module is used to call the kernel CR3 register and physical page frame allocator to isolate the bypass detection of the software layer and virtualization host environment; the spatial topology distribution scheduling module is based on the spatial topology neighborhood restricted neighborhood graph protocol to asynchronously distribute the redundant ciphertext fragment matrix to multiple physically isolated untrusted distributed heterogeneous storage nodes through a peer-to-peer network. The blind redundancy matrix collision control module satisfies the following constraints when performing encoding and distribution: Resistant to high-dimensional computing power for deciphering constraints; Unauthorized access physical feature disturbance detection constraints; Cause-and-effect self-healing constraints.

Images